Security Package Documents Flashcards
(31 cards)
What is the SSP? Define it and it’s objective.
- The System Security Plan
- Living document that is meant to improve the Protection is system resources.
List the 15 major content/sections of the SSP
1- system name and unique identifier
2- system categorization
3- system owner
4- authorizing official
5- other designated contacts
6- assignment of responsibilities
7- system operational status
8- information system type (gas? Major app?)
9- general description/ purpose of system
10- system environment ( Small Office? Agency?)
11- system interconnection/ information sharing
12- laws, regulations & policies affecting the system
13- security controls selection
- Control title, status, scoping guide, etc.
14- completion and approval dates
15- ongoing system security plan maintenance
At which RMF step is the SSP initiated?
Categorization
At which RMF step is the SSP approved?
Selection
NIST publication for developing the SSP?
SP 800-18 rev 1
How many components make up the SSP?
About 12-15
Who approves the SSP?
Authorizing Official (AO)
How many pages is your SSP doc?
~150
The template for the FedRAMP SSP is 352 pages long.
Define and Explain the POA&M
The plan of action and Milestones.
This document contains all the vulnerabilities and findings that were found during the assessment.
This tool is used to track the progress of material weaknesses that were tracked during/after assessment or during continuous monitoring.
What are the contents of a POA&M?
- weakness number /ID
- creation date
- description of weakness
- status (open or closed)
- criticality (priority) level
- point of contact (POC)
- Risk category (low, mod, high)
- resources required ( estimated dollar amount)
- severity
- type (System specific or inherited?)
- material weakness indication
- scheduled completion date
- estimated completion date
- actual completion date
- link to related control title, name or numbers
- source of weakness
- milestone changes
- milestone with completion date
What tools can be used to create a POA&M?
One can use an excel spreadsheet
Some automated tools or application such as
- TAF (Trusted Agent Fisma) (used by DOD & DHS)
- Xacta IA Manager or 360 (DHS)
- CFACTS (CMS Fisma Controls Tracking System) (CMS- center for Medicaid/Medicare services)
- CSAM (DOJ)(most fed agencies)
- Risk Vision ( veterans affairs and NIH)
Automation tools that fully implement the six (seven) steps of the RMF?
- TAF (Trusted Agent Fisma) (used by DOD & DHS)
- Xacta IA Manager or 360 (DHS)
- CFACTS (CMS Fisma Controls Tracking System) (CMS- center for Medicaid/Medicare services)
- CSAM (DOJ)(most fed agencies)
- Risk Vision ( veterans affairs and NIH)
*these tools manage, monitor and track ATOs, POA&Ms, control assessments and ongoing authorizations for all FISMA systems/ major applications of the org. which sometimes range from 50-100.
At which RMF step is the POA&M initiated?
- Assessment
- Continuous Monitoring
What is the SAR?
The Security Assessment Report: contains the findings that were uncovered during the assessment. Notes their criticality - low, mod or high.
What is the PTA?
Privacy Threshold Analysis: an artifact that is used in the categorization step of the RMF. This is done if a system tests positive for PII and is a threshold for creating a PIA.
What are the specific PTA questions?
- description of program/project purpose
- program/project status
- from whom does the prog. collect, maintain, use or disseminate information?
- what specific information about individuals could be collected, generated or retained? Does the prog use SSN?
- checklist of technologies - does the system use them? CCTV, social media? Etc.
- does the program connect, receive or share PII with other programs or systems?
- does the program connect, receive or share PII with any external programs or systems?
What is the PIA?
Privacy Impact Analysis; discusses the risk of storing, using or transmitting PII on a system.
What is a SORN? And what is it’s purpose?
System of Records Notice
As required by the Privacy Act, whenever a federal agency maintains I formation about an individual in a system of records and retrieves the information by a personal identifier, it must publish a SORN in the Federal Register.
SORN describes what, why and how the records in the relevant system are collected, maintained, and used. SORN is published on new systems and updated and republished if and when system changes are made that affect the factors earlier reported.
What is the MOU? Purpose and content?
Memorandum of Understanding
A formal agreement that discusses the terms of two or more organizations as they establish an official partnership. Although not legally binding, they do carry a degree of seriousness.
Names the parties, describes the project on which they are agreeing, details each party’s roles and responsibilities.
What is an SLA? Purpose?
Service Level Agreement
Dictates the minimum level of services that would be required as part of the agreement. Uptime, response time agreement, etc.
What is BPA? Purpose?
Business Partners Agreement
Commonly seen between organisations that have longer term and broader relationships. Eg between a Manufacturer and a Reseller.
What is ISA? Purpose?
Interconnection Security Agreement
Required as part of the US Federal Government to define security controls when different depts are connecting to each other.
Legally binding. Defines the physical and logical boundaries between the organizations. Lays rules for the expectations of establishing a secured connection between both organizations. The state of utilities that would be in use, etc etc.
What is E-Authentication? Levels? Examples.
Authentication that can be established when accessing a system from a remote location. There are two levels:
1- single factor authentication
2- multi factor authentication
Type of authentication :
1- something you know: password, pin, combinations, code words, secret handshakes etc
2- something you have: piv card, keys, smart phones, token devices, etc
3- something you are: biometrics; voice verification, retina and Palm screening, finger print, face scan, etc.
What is the contingency plan (CP)?
Both an artifact and a control, the contingency plan is one of the most critical components of an organization’s policy agenda.
A plan that discusses the controls and procedures in place to ensure that there is business continuity and resilience in case of any disruption of services.
