RISK MANAGEMENT FRAMEWORK (RMF) V2 V2.0 Slides… · 3. How to align the NIST Cybersecurity Framework with the RMF. 4. To integrate privacy risk management processes into the RMF.
Post on 24-Apr-2020
23 Views
Preview:
Transcript
RISK MANAGEMENT FRAMEWORK (RMF)
V2.0
Derek Duchein, CISSP, CRISC
Cybersecurity Professor, DAU
derek.duchein@dau.mil
CHRONOLOGYSP 800-37 Rev. 1 published February 2010 (Updated 6/5/2014)
“Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach”
DODI 8510.01 published March 2014 (updated 7/28/2017 - DIACAP to RMF timing and Coast Guard Applicability).
SP 800-37 Rev. 2 published December 2018
“Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy”
2
WHY RMF 2.0?
3
https://www.fireeye.com/cyber-map/threat-map.html
4https://csrc.nist.gov/
5
CYBERSECURITY POSTURE
6
“The cybersecurity of our weapons and networks needs
increased attention. In support of that, the Department
needs to evolve how we monitor our cybersecurity posture.
The two-phase Cooperative Vulnerability and Penetration
Assessment (CVPA) and Adversarial Assessment (AA)
approach currently outlined in DOT&E test guidance is
necessary to help inform the cybersecurity posture of DOD
systems, but is not sufficient. This testing has greatly
improved our understanding of cyber vulnerabilities, but in
addition to dedicated assessments, DOD systems must be
built to include technologies to continuously monitor
cybersecurity, and automatically find and patch software
vulnerabilities. Periodic assessments by Red Teams alone
are not adequate, because the security of system software
can change at any time due to operator errors, or adversary
cyber-attacks.” (p. i)
7
8
NIST Special Publication (SP) 800-37 Revision 2, “Risk Management Framework for Information Systems and Organizations:
A System Life Cycle Approach for Security and Privacy”
This update to NIST SP 800-37 develops the next-generation Risk Management Framework (RMF) for information systems, organizations, and individuals, in response to:
Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. (May 11, 2017)
OMB Memorandum M-17-25, Reporting Guidance for Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. (May 19, 2017)
OMB Circular A-130, Managing Information as a Strategic Resource. (July 28, 2016)
OMB Memorandum M-19-03, Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program. (December 10, 2018)
9
RISK MANAGEMENT FRAMEWORK V2.0
10
Terminal Learning Objective: Understand and Implement our programs and
systems within a unified framework for managing security, privacy, and supply chain
risks.
Enabling Objective: To design the next-generation RMF for information systems,
organizations, and individuals consistent with seven major objectives:
1. Apply closer linkage and communication between the organizational risk
management processes and the operational levels.
2. To institutionalize critical risk management preparatory activities at all risk
management levels.
3. How to align the NIST Cybersecurity Framework with the RMF.
4. To integrate privacy risk management processes into the RMF.
5. To develop trustworthy secure software and systems by aligning life cycle-based
systems engineering processes in SP 800-160 v1&2, with relevant RMF tasks.
6. To integrate security-related, supply chain risk management (SCRM) concepts.
7. To allow for an organization-generated control selection approach to complement
the traditional baseline control selection approach and support the use of the
consolidated control catalog in NIST Special Publication 800-53, Revision 5.
OBJECTIVE #1To provide closer linkage and communication
between the risk management processes and
activities at the governance level of the organization
and the individuals, processes, and activities at the
system and operational level of the organization.
11
The Ultimate
Objective for
Security.
OBJECTIVE #2
To institutionalize critical organization-wide
risk management preparatory activities at all
risk management levels to facilitate a more
effective, efficient, and cost-effective
execution of the RMF.
12
13
ADDITION OF THE “PREPARE” STEPBy achieving the following objectives, organizations can simplify RMF execution, employ innovative approaches for managing risk, and increase the level of automation when carrying out specific tasks:
1. To facilitate effective communication between senior leaders and executives at the organization and mission/business process levels and system owners at the operational level
2. To facilitate organization-wide identification of common controls and the development of organizationally-tailored control baselines, reducing the workload on individual system owners and the cost of system development and asset protection
3. To reduce the complexity of the information technology (IT) and operations technology (OT) infrastructure using Enterprise Architecture concepts and
models to consolidate, optimize, and standardize organizational systems, applications, and services
4. To reduce the complexity of systems by eliminating unnecessary functions and security and privacy capabilities that do not address security and privacy risk
5. To identify, prioritize, and focus resources on the organization’s high value assets (HVA) that require increased levels of protection—taking measures commensurate with the risk to such assets.
14
OBJECTIVE #3To demonstrate how the NIST Cybersecurity Framework
(CSF) can be aligned with the RMF and implemented using
established NIST risk management processes. NIST SP 800-
37 Rev 2 addresses alignment of RMF with the NIST CSF by
providing specific cybersecurity framework “mappings”
within the various RMF steps and activities.
https://www.nist.gov/cyberframework/federal-resources
15
NIST CYBERSECURITY FRAMEWORK
16
Core Function Explanation
Identify Develop the organizational understanding to manage
cybersecurity risk to systems, assets, data, and capabilities.
Protect Develop and implement the appropriate safeguards to ensure
delivery of critical infrastructure services.
Detect Develop and implement the appropriate activities to identify
the occurrence of a cybersecurity event.
Respond Develop and implement the appropriate activities to take
action regarding a detected cybersecurity event.
Recover Develop and implement the appropriate activities to maintain
plans for resilience and to restore any capabilities or services
that were impaired due to a cybersecurity event.
Framework for Improving Critical Infrastructure Cybersecurity, v 1.0, NIST, February 2014
RISK DIAGRAM
17
“The five Functions also balance prevention and reaction, including preparatory
activities to enable the best possible outcome from that reaction. This balance
allows Functions to act as a high level expression of risk management strategy
and structure for risk assessment.” (p. 28)
OBJECTIVE #4
To integrate privacy risk management concepts, principals, and processes into the RMF to better support the privacy protection needs for which privacy programs are responsible. NIST SP 800-37 Rev 2 now integrates privacy risk management concepts into the RMF life cycle and also encourages use of the consolidated cybersecurity and privacy controls catalog in NIST SP 800-53 Rev 5 (Chapter 3).
18
NIST SP 800-53 R5
NIST Special Publication 800-53, Revision 5
Security and Privacy Controls
Final Public Draft: Spring 2019
Final Publication: Summer 2019
NIST Special Publication 800-53A, Revision 5
Assessment Procedures for Security and Privacy Controls
Initial Public Draft: Fall 2019
Final Public Draft: TBD
Final Publication: Spring 2020
19
On the Horizon…
SECURITY CONTROL FAMILY CHANGES *
20
SP 800-53 r4
SP 800-53 r5 *SCRM = 22 Controls
OBJECTIVE #5
To promote the development of trustworthy
secure software and systems by aligning life
cycle-based systems engineering processes in
NIST SP 800-160, Volume 1, with the relevant
tasks in the RMF. NIST SP 800-37 Rev 2 also
provides an alignment of RMF with the systems
engineering process as documented in NIST SP
800-160.
21
SSE – NIST SP 800-160 VOL 1 & 2
22
SP 800-160 Vol. 1 (Final), “Systems Security Engineering:
Considerations for a Multidisciplinary Approach in the Engineering of
Trustworthy Secure Systems” (November 2016)It addresses the engineering-driven perspective and actions necessary to develop
more defensible and survivable systems, inclusive of the machine, physical, and
human components that compose the systems and the capabilities and services
delivered by those systems
SP 800-160 Vol. 2 (Draft), “Systems Security Engineering: Cyber
Resiliency Considerations for the Engineering of Trustworthy Secure
Systems” (March 2018)
It provides a flexible systems engineering-based framework to help
organizations address the Advanced Persistent Threat (APT),
addressing cyber resiliency considerations for two important, yet
distinct communities of interest:
- Organizations conducting new development of IT component products,
systems, and services
- Organizations with legacy systems (installed base) currently carrying out day-to-
day missions and business functions.
OBJECTIVE #6
To integrate security-related, supply chain risk management (SCRM) concepts into the RMF to address untrustworthy suppliers, insertion of counterfeits, tampering, unauthorized production, theft, insertion of malicious code, and poor manufacturing and development practices throughout the SDLC. NIST SP 800-37 Rev 2 pays increased attention to SCRM considerations.
*NIST SP 800-53 Rev 5 adds an additional 23 SCRM security controls to consider.
23
OBJECTIVE #7To allow for an organization-generated control selection approach to complement the traditional baseline control selection approach and support the use of the consolidated control catalog in NIST SP 800-53, Revision 5.
800-53 r5 (page ii): The consolidated catalog of controls (found in Chapter 3) addresses security and privacy from a functionality perspective (i.e., the strength of functions and mechanisms) and an assurance perspective (i.e., the measure of confidence in the security or privacy capability). Addressing both functionality and assurance ensures that information technology products and the information systems that rely on those products are sufficiently trustworthy.
24
CYBERSECURITY RISK MANAGEMENT
DoDI 8510.01 – Risk Management Framework (RMF) for DoD IT
DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk
Management Framework (RMF) into the System Acquisition Lifecycle 25
26
800-37 r1
800-37 r2
NIST/DOD RMF RESOURCES
NIST Computer Security Resource Center (CSRC)
- https://csrc.nist.gov/
- https://csrc.nist.gov/publications/sp
OSD: Knowledge Service Website
- https://rmfks.osd.mil
DAU: Cyber Support and Education - https://www.dau.mil/
ISA 220 “RMF for the Practitioner”
- https://www.dau.mil/training/p/apply-for-a-course
• DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle
- https://www.dau.mil (use the search feature)
27
Office of the Secretary of Defense (OSD) Knowledge Service Website (the authoritative source of all DOD RMF documentation and information)
(https://rmfks.osd.mil)
28
29
DAU CYBER WORKSHOP TRAINING MATRIX
Cybersecurity
Awareness
“Technical Oversight” “Technical Execution”
CDI Security
Reqts Assessment
Threat-Based
Engineering
Active
Cyber DefenseCloud Security -
Assessment
System Security
Engineering
Cloud Security -
Principles
DFARS CDI
Overview
Audit
Principles
DCMA Audit
Reqts Assessment
Compliance
Mission Assurance
Test
Level 1 – Learn It
Level 2 – Love It
Level 3 –
Behaviors
Level 4 –
External ValidationAdvanced
TestingAdvanced
RMF 2.0
Learning Objective: Deliver Secure and
Resilient Systems
Cloud Security -
Threat-Based
30
TYPES OF WORKSHOP CUSTOMERS
Executive
LeadershipProgram Office
Cybersecurity
Workforce
Emphasis:
- Agency/Mission
Objectives
- Cybersecurity
Resourcing
- Strategic Level
of Cybersecurity
Emphasis:
- Acquisition Risk
Management
- Trade Space
decisions
- Operational Level
of Cybersecurity
Emphasis:
- Technical Process Execution
- Adequate Security
- Tactical Level of Cybersecurity
31
32
33
34
35
36
Questions
FEDERAL RMF RESOURCES
37
The Risk Management Framework
(RMF) provides a structured, yet
flexible approach for managing the
portion of risk resulting from the
incorporation of systems into the
mission and business processes of
the organization.
This figure represents the links to
other relevant Federal resources
(FIPS and NIST SPs) for
implementing the RMF steps
CYBERSECURITY
MOONSHOT
past efforts and current strategies to seize the opportunity to strategically
reorient from a largely reactive, incremental cybersecurity posture to a proactive
approach that boldly assures digital trust, safety, and resilience for all
Americans.” (p. ES-1) 38
“Make the Internet safe and secure for the functioning
of Government and critical services for the American
people by 2028.”
“The United States is at an inflection point:
simultaneously faced with a progressively
worsening cybersecurity threat environment and
an ever-increasing dependence on Internet
technologies fundamental to public safety,
economic prosperity, and overall way of life. Our
national security is now inexorably linked to
cybersecurity. Therefore, the Nation must build on
OMB A-130: MANAGING INFORMATION AS A
STRATEGIC RESOURCE - UPDATED 28 JULY 2016
• Real Time Knowledge of the Environment
• Proactive Risk Management
39
For Cybersecurity
• Introduces “adequate security”
• Requires System Security Engineering
• Requires Supply Chain Risk Management
CYBERSECURITY IN ACQUISITION
• Understand
implications of
cybersecurity
requirements
• Develop
Cybersecurity
Strategy
• Develop Evaluation
Methodology
inclusive of
Cybersecurity
• Examine system
architecture to identify
potential attack vectors
• Update Cybersecurity
Strategy
• Incorporate Cyber Attack
Surface elements into test
plans
• Define resources for
cybersecurity DT&E
• In cooperation with
SE develop
understanding of
potential system
vulnerabilities
• Assess system
against potential
vulnerabilities
• Provide feedback to
SE
• Execute
adversarial
cybersecurity
DT&E event within
realistic mission
environment.
• Use of Cyber
ranges
• Overt and cooperative
review of the system to
characterize operational
cybersecurity status
• Determine residual risk
as well as readiness for
the Adversarial
Assessment.
• Discovery of all
significant remaining
vulnerabilities and
exploits
Understand
Cybersecurity
Requirements
Characterize
Cyber Attack
Surface
Cooperative
Vulnerability
Identification
Adversarial
Cybersecurity
DT&E
Full RateProduction
Decision Review
Technology Maturation &
Risk Reduction
Engineering & Manufacturing Development
Production and Deployment
O&S
SRR SFR CDR TRR SVRASR
MaterielSolutionAnalysis
MDD
DRAFT
CDDAOA CDD CPD
IATT
Cooperative
Vulnerability and
Penetration
Assessment
IOT&E
Phases
OTRR
DT&E
Event
Adversarial
Assessment
CDD Validation
Dev RFP Release Decision
DT&E Assessment
DT&E Assessment
PDR
ATOA B C
• Full operational test
and evaluation of the
system’s defensive
cyberspace
performance in the
operational
environment.
• Characterization of
the mission impact of
remaining
vulnerabilities and
exploits
40
BEYOND COMPLIANCE
“Cyber security has long been a
compliance dominated process, focused
on doing specific actions on a checklist.
Examining the attack data to determine
what is working well, what is not, where
changes need to be made, and where
investment is required to better defend
against troublesome or emerging threats
would move the Department beyond a
compliance approach towards a more
dynamic performance evaluation.” (p. 11)
41
top related