Getting Started & How to Complete a DoD Insider Threat Assessment v

Transcription

1 Getting Started & How to Complete a DoD Insider Threat Assessment v eprmhelp@alionscience.com

2 Table of Contents Page: 3. Introduction from OUSD(I) 4. Getting Started 6. Creating a New Assessment 8. Conducting an Assessment 30. Appendix A 2

3 Introduction from OUSD(I): The Department of Defense Component Insider Threat Reporting Requirements Memorandum requested quarterly principal level reporting to monitor and assess the implementation of Component insider threat programs. The reporting is focused on program establishment, initial operating capabilities and full operating capabilities, supporting our overarching initiative for assessment of the Insider Threat Enterprise. This is a standing quarterly requirement (due NLT 10 days after the end of each quarter) until your insider threat program achieves full operating capability. Should you have any questions, please contact: Mr. Lew Call lewis.r.call.civ@mail.mil lewis.r.call.civ@mail.smil.mil Ms Doris Gobin doris.v.gobin.ctr@mail.mil doris.v.gobin.ctr@mail.smil.mil

4 Getting Started: 1. To complete a DoD Insider Threat assessment, you will first receive an auto-generated with your temporary password. On SIPRNet, to login and begin your assessment, navigate to: This will be your SIPRNet address 4

5 Getting Started (continued): 2. Once you are logged in, select Change Password from the drop-down menu in the top right corner of the screen to change your password. 5

6 Creating a New Assessment: 1. To create a new assessment, click the red Create a New Assessment button. 6

7 Creating a New Assessment (continued): 2. Name your assessment. 3. Enter what organization you are assessing. 4. Select DoD InT as your assessment type. 5. Choose your organization s node. This allows for the assessment to be viewed by your organization and is essential for higher level analysis and the control of information. 6. If your unit or organization name does not appear in the hierarchy, eprmhelp@alionscience.com. NOTE: *You have privileges to nodes in Black *You do not have privileges to nodes in Red 7

8 Conducting an Assessment: 1. Click on the Profile icon to begin your assessment by entering data about yourself and your organization. The YOU ARE HERE medallion will show you which step you are currently on. You may use these administrative functions at anytime during your assessment. See Appendix A for specific instructions on how to use these functions. This is the basic assessment information, it includes: The assessment number and name. The name of the organization being assessed. The date the assessment was created and it s status. The current owner of the assessment. The dataset the assessment is using. 8

9 Conducting an Assessment (continued): 2. Click on the Assessor Information icon to begin entering information about yourself and your organization. Icons will remain locked until the previous step is completed. 9

10 Conducting an Assessment (continued): 3. This page captures contact information of the individual conducting the assessment. Be sure to enter information into all of the required fields. *Asterisk indicates a required field. 10

11 Conducting an Assessment (continued): 4. The Additional POCs page allows you to store contact information for individuals that provide answers or assist you while conducting the assessment. Click Add New Entry to add additional POCs and be sure to include all required information. Once you are finished, click Finished Adding POCs then Continue. 11

12 Conducting an Assessment (continued): 5. The About the Organization page asks questions to filter the content you will use to conduct the assessment. Answer all of the required questions then click Continue. 12

13 Conducting an Assessment (continued): 6. For the DoD Insider Threat Assessments, no additional information is needed on the Operating Environment page. Click Continue to proceed with the assessment. 13

14 Conducting an Assessment (continued): 7. After you have completed the Profile section, click Back to Assessment Menu to continue your assessment. 14

15 Conducting an Assessment (continued): 8. You are now ready to choose your critical assets. Click on the Critical Assets icon. 15

16 Conducting an Assessment (continued): 9. You may now select your critical assets. This section is where you will select which assets you want to include in your assessment and rate their criticality. To view all of the available critical assets click on the Show All Critical Asset Types. 16

17 Conducting an Assessment (continued): 10. Click Yes to include an asset in your assessment or No to exclude it. When you select Yes, a pop-up box will appear, use the rating scale to assign criticality. In EPRM, many screens display data in grids, see Appendix A for specific instructions on how to use their functionality. See Appendix A for instructions on adding a comment to an item. In EPRM, some screens have an Answer No to All Unanswered button see Appendix A for specific instructions on how this works. 17

18 Conducting an Assessment (continued): 11. After you have completed the Critical Assets section the category icons will be green. Click the Continue button to return to the assessment crossroads page. 18

19 Conducting an Assessment (continued): 12. You are now ready to choose the threats to include in your assessment. Click on the Threat Characterization icon. 19

20 Conducting an Assessment (continued): 13. You may now select the threats your organization may encounter and rate their severity. To view all of the available threats click on the Show All Threats icon or to view threats by method click on one of the icons below. 20

21 Conducting an Assessment (continued): 14. Click Yes to include a threat in your assessment, or No to exclude it. When you select Yes, a pop-up box will appear, select the threat severity. Once you have selected responses for all of the threats, click Continue. 21

22 Conducting an Assessment (continued): 15. After you have completed the Threat Characterization section the category icons will be green. Click the Continue button to return to the assessment home page. 22

23 Conducting an Assessment (continued): 16. You are now ready to select the countermeasures that you currently have in place. Click on the Countermeasures icon. 23

24 Conducting an Assessment (continued): 17. You may now select the countermeasures your organization currently has in place to determine your vulnerability. To view all of the available countermeasures click on the Show All Countermeasures icon or to view countermeasures by type click on one of the icons below. 24

25 Conducting an Assessment (continued): 18. On the Countermeasures page you will assess your vulnerability by answering countermeasures with Yes (countermeasure is in place), No (countermeasure is not in place), or N/A (countermeasure is Not Applicable). If you select N/A, you will be required to enter an explanation. Once you have answered all of the countermeasures, click Continue to proceed. For guidance while completing the Countermeasures section, double click on the countermeasure to be presented with a pop-up box containing guidance, explanations, and references. 25

26 Conducting an Assessment (continued): 19. After you have completed the Countermeasures section the category icons will be green. Click the Continue button to return to the assessment home page. 26

27 Conducting an Assessment (continued): 20. You are now ready to finish the assessment. Click on the Finish Assessment icon. Once you have clicked the Finish Assessment icon, your participation in the test is completed. Optionally, after you have finished the assessment, you may click the Analysis icon to proceed to Risk and Vulnerability Analysis or Compliance Analysis where you will be able to see the risk/compliance sections. (available for all users but geared towards DoD Analysis of Components). 27

28 Conducting an Assessment (continued): 21. (OPTIONAL) Once you have completed your assessment you can view your assessment analysis in two different modules. Risk and Vulnerability Analysis will give you analysis tools based on the Risk Management Framework incorporating all aspects of your assessment. Compliance Analysis will allow you to view your level of countermeasure-implementation based on previously established compliance categories. 29

29 Appendix A Misc. Features Page 1. Open for Editing 2. Rename 3. Share This Assessment 5. Change Owner 7. Delete 8. File/Image Upload 10. Reports 12. Grid Functionality 13. Answer No to All Unanswered 14. Adding a Comment Appendix A

30 Open For Editing: The open for editing feature allows you to open your assessment after it has been locked and make changes or edits to any of the sections. However, in order to maintain the integrity of the original assessment as a snapshot in time any subsequent changes that the organization makes should be modeled in a new assessment. Appendix A Rename - 1

31 Rename: The Rename feature allows you the change the name of the assessment. Click Rename, enter the new name in the box provided, then click OK to save the change. Appendix A Rename - 2

32 Share This Assessment: The Share feature allows you to give other EPRM users in your Subscriber Account access to your assessment. You may allow others to Read Only or Read/Write depending on the permissions you allow. Click Share This Assessment then proceed to the next slide for additional instructions. Appendix A Share - 3

33 Share This Assessment (continued): When you share an assessment with another user you will have to select what permissions you want them to have. Read Only: Allows another user to view all of the assessment s Profile, Critical Assets, Threat Characterization, Countermeasures, Analysis and Assign and Track sections but not edit anything. Read/Write: Allows another user to view and edit all of the assessment s Profile, Critical Assets, Threat Characterization, Countermeasures, Analysis and Assign and Track sections. 1. Find the user you want to share the assessment with. 2. Assign the permissions you want the user to have on the assessment you are sharing. The Owner Level column indicates if a user already has full access to the assessment being shared by virtue of being an Assessment Manager or System Administrator above that assessment s node in the hierarchy. Appendix A Share - 4

34 Change Owner: The Change Owner feature allows you to transfer ownership of the assessment to another EPRM user. Once ownership is transferred to a new owner, the original owner no longer has any access to the assessment. Click Change Owner then proceed to the next slide for additional instructions. Appendix A Change Owner - 5

35 Change Owner (continued): Select a user to transfer ownership to from the drop down list, then click Change to complete. Once you click the Change button the new owner will be notified by and you will no longer have access to the assessment. Appendix A Change Owner - 6

36 Delete: The Delete feature allows you to permanently delete an assessment. Once the assessment has been deleted it will not be recoverable. Click Delete, then a pop-up box will appear to ensure you want to delete the assessment. If you click Yes, the assessment will be deleted and you will be returned to the EPRM home page. Appendix A Delete - 7

37 File/Image Upload: 1. The File/Image Upload feature allows you to attach supporting documents and pictures to the assessment. Click File/Image Upload then proceed to the next slide for additional instructions. Appendix A File/Image Upload - 8

38 File/Image Upload: To upload a file, click Browse (1) then select the file you wish to upload. Once you have selected the file, click Upload (2). Your file will now appear in the grid below. A message will let you know when the file has been successfully uploaded (3). All uploaded files will appear in the grid at the bottom of the page (4). The maximum upload file size is 10MB. (1) (2) (3) (4) Appendix A File/Image Upload - 9

39 Reports: The Reports feature allows you to generate reports in Excel, Word, or PowerPoint from the assessment s information. Click Reports to view all of the available reports. Appendix A Reports - 10

40 Reports (continued): The links to specific reports will be grayed out and unavailable when an assessment is started. As you progress through the assessment, reports for completed sections will turn blue as they become available. Appendix A Reports - 11

41 Grid Functionality: Throughout the assessment process data is displayed in grids. The grids provide you the ability to sort, query, export, and print the contents to make the assessment process more efficient. The text fields above each column allow you to query the contents. You may query multiple columns at one time. Click on the arrow to the right of each column name to sort the contents. Double clicking on a row will display addition information about that item. Reload GridData Export to Excel Print Preview Open (same as double clicking on row) Appendix A Grid Functionality - 12

42 Answer No to All Unanswered: The Answer No to All Unanswered button will help you save time on screens where every item or question requires an answer to proceed. Choose Yes for items or questions that apply to you, then click the Answer No to All Unanswered button to quickly answer the remaining items or questions. Appendix A Answer No to All Unanswered - 13

43 Adding a Comment: If desired, you may add a comment to a specific critical asset. You will also have the ability to add a comment to threats and countermeasures. (2) 1. To add a comment, click on the critical asset (1) to highlight the row then click the Add/View Comment button above the grid. (2) Type your comment in the text box, then click Save to continue. (3) A comment icon, will appear in the comment column. To view or edit your comment, double click on the comment icon. (4) 2. Once you have selected responses for all of the critical assets, click Continue. (1) (3) (4) Appendix A Adding a Comment - 14