The "Notes to Reviewers" in the February 2012 initial public draft of Revision 4 of SP states:
|
|
- Nigel Hodge
- 5 years ago
- Views:
Transcription
1 Major Enhancements to NIST SP Revision 4 BD Pro The "Notes to Reviewers" in the February 2012 initial public draft of Revision 4 of SP states: "The proposed changes included in Revision 4 are directly linked to the current state of the threat space (i.e., capabilities, intentions, and targeting activities of adversaries) and the attack data collected and analyzed over a substantial time period. In particular, the major changes in Revision 4 include: New security controls and control enhancements; Clarification of security control requirements and specification language; New tailoring guidance including the introduction of overlays; Additional supplemental guidance for security controls and enhancements; New privacy controls and implementation guidance; Updated security control baselines; New summary tables for security controls to facilitate ease-of-use; and Revised minimum assurance requirements and designated assurance controls. Many of the changes were driven by particular cyber security issues and challenges requiring greater attention including, for example, insider threat, mobile and cloud computing, application security, firmware integrity, supply chain risk, and the advanced persistent threat (APT)." With the introduction of Revision 4, the total number of controls in SP has increased by about 22%. The earlier August 2009 SP Revision 3 set of security controls has been leveraged in various third party security guidance documents such as the following: - SANS Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines (CAG) Version 3.1, Oct 11. (The SANS 20 critical control areas (and 179 detailed security controls) are mapped to SP Rev 3 "Priority 1" security controls); - CSEC Guide to Managing Security Risks from Using Information Systems, Security Control Catalogue, ITSG-33 Annex 3, final draft, 31 Mar 11. (The ITSG-33 catalogue includes all SP Rev 3 security controls plus another 20 CSEC unique controls in the AC, CP, IA, IR, PE, SA and SC control areas. Annex 4 includes profiles and guidance for selecting these controls for Protected-A, Protected-B and Secret system implementations); - Cloud Security Alliance, Cloud Controls Matrix (CCM) Release 1.2. (The CCM controls are mapped to SP Rev 3 security controls); - US Federal Risk and Authorization Management Program (FedRAMP) Security Controls Baseline, Version 1.1. (The FedRAMP Security Controls Baseline for Cloud Computing uses controls selected from SP Rev 3); - Security Categorization and Control Selection for National Security Systems, Version 2, CNNSI No 1253, 13 March (This document provides guidance for selecting security controls from SP Rev 3 for securiing classified systems.) - Others... Until such third party guidance documents have been updated to leverage the Revision 4 set of security controls, security analysts should also consider using relevant control improvements introduced in Revision 4 to help mitigate security risks to critical assets. To assist in such security risk analysis, the following table summarizes the major changes which have been introduced in Revision 4 with respect to the SP Revision 3 security controls catalogue (and the Revision 3 based ITSG-33 security controls catalogue). AC-2 AC-2 (8) AC-2 (9) AC-2 (10) AC-2 (11) AC-2 (12) AC-2 (13) AC-2 (14) AC-2 (15) AC-3 Technical / Access Control / Account Management Technical / Access Control / Account Management / Dynamic Account Creation Technical / Access Control / Account Management / Restrictions on Use of Shared Groups - Accounts Technical / Access Control / Account Management / Group Account Requests - Appovals Technical / Access Control / Account Management / Group Account Credential Renewals Technical / Access Control / Account Management / Usage Conditions Technical / Access Control / Account Management / Account Reviews Technical / Access Control / Account Management / Account Monitoring - Atypical Usage Technical / Access Control / Account Management / Disable Accounts for High-Risk Individuals Technical / Access Control / Access Enforcement AC-2 and AU-8 incorporates r3 AC-13 AC-2(8) new in AC-2(9) new in AC-2(10) new in AC-2(11) new in AC-2(12) new in AC-2(13) new in AC-2(14) new in AC-2(15) new in AC-3 incorporates r3 AC-17(7)
2 AC-3 (7) AC-3 (8) AC-3 (9) AC-3 (10) AC-4 (18) AC-4 (19) AC-4 (20) AC-4 (21) AC-6 (7) AC-6 (8) AC-9 (4) AC-14 AC-16 (6) AC-16 (7) AC-16 (8) AC-16 (9) AC-16 (10) AC-16 (11) AC-16 (12) AC-17 AC-17 (9) AC-18 AC-19 (5) AC-19 (6) AC-19 (7) AC-19 (8) AC-19 (9) AC-20 (3) AC-20 (4) AC-21 (2) AC-23 AC-24 AC-24 (1) AC-24 (2) AC-25 AT-2 (2) AT-3 (3) Technical / Access Control / Access Enforcement / Mandatory Access Control Technical / Access Control / Access Enforcement / Role Based Access Control Technical / Access Control / Access Enforcement / Revocation of Access Authorizations Technical / Access Control / Access Enforcement / Network Access Security-Related Functions Technical / Access Control / Information Flow Enforcement / Security Attribute Bindind Technical / Access Control / Information Flow Enforcement / Protection of Metadata Technical / Access Control / Information Flow Enforcement / Classified Information Technical / Access Control / Information Flow Enforcement / Logical Separation of Information Flows Technical / Access Control / Least Privilege / Review of User Privileges Technical / Access Control / Least Privilege / Privilege Levels for Code Execution Technical / Access Control / Previous Logon (Access) Notification / Additional Logon Information Technical / Access Control / Permitted Actions without Identification or Authentication Technical / Access Control / Security Attributes / Maintenance of Attribute Association by Organization Technical / Access Control / Security Attributes / Consistent Attribute Interpretation Technical / Access Control / Security Attributes / Association Techniques - Technologies Technical / Access Control / Security Attributes / Attribute Reassignment Technical / Access Control / Security Attributes / Attribute Configuration by Authorized Individuals Technical / Access Control / Security Attributes / Permitted Attributes for Specified Information Systems Technical / Access Control / Security Attributes / Permitted Values and Ranges for Attributes Technical / Access Control / Remote Access Technical / Access Control / Remote Access / Disconnect - Disable Access Technical / Access Control / Wireless Access Technical / Access Control / Mobile Devices / Personally Owned Devices Technical / Access Control / Mobile Devices / Full Disk Encryption Technical / Access Control / Mobile Devices / Central Management of Mobile Devices Technical / Access Control / Mobile Devices / Remote Purging of Information Technical / Access Control / Mobile Devices / Tamper Detection Technical / Access Control / Use of External Information Systems / Personally Owned Information Systems - Devices Technical / Access Control / Use of External Information Systems / Network Accessible Storage Devices Technical / Access Control / Collaboration and Information Sharing / Information Search and Retrieval Technical / Access Control / Data Mining Protection Technical / Access Control / Access Control Decisions Technical / Access Control / Access Control Decisions / Transmit Access Authorization Information Technical / Access Control / Access Control Decisions / No User or Process Identity Technical / Access Control / Reference Monitor Function Operational / Awareness and Training / Security Awareness / Insider Threat Operational / Awareness and Training / Security Training / Practical Exercises Page 2 AC-3(7) new in AC-3(8) new in AC-3(9) new in AC-3(10) new in AC-4(18) new in AC-4(19) new in AC-4(20) new in AC-4(21) new in AC-6(7) new in AC-6(8) new in AC-9(4) new in AC-14 incorporates r3 AC-14(1) AC-16(6) new in AC-16(7) new in AC-16(8) new in AC-16(9) new in AC-16(10) new in AC-16(11) new in AC-16(12) new in AC-17 incorporates r3 AC-17(5) AC-17(9) new in AC-18 incorporates r3 AC-18(2) AC-19(5) new in AC-19(6) new in AC-19(7) new in AC-19(8) new in AC-19(9) new in AC-20(3) new in AC-20(4) new in AC-21(2) new in AC-23 new in AC-24 new in AC-24(1) new in AC-24(2) new in AC-25 new in AT-2(2) new in AT-3(3) new in
3 AU-4 (1) AU-6 AU-7 (2) AU-8 AU-8 (2) AU-9 (5) AU-9 (6) AU-12 AU-12 (3) AU-15 AU-16 AU-16 (1) AU-16 (2) CA-2 (3) CA-3 (3) CA-7 CM-7 CM-7 (4) CM-7 (5) CM-10 CM-11 CM-11 (1) CP-2 (7) CP-2 (8) CP-7 CP-7 (6) CP-8 (5) CP-9 CP-9 (7) CP-11 CP-11 (1) Technical / Audit and Accountability / Audit Storage Capacity / Transfer to Alternate Storage Technical / Audit and Accountability / Audit Review, Analysis and Reporting Technical / Audit and Accountability / Audit Reduction and Report Generation / Automatic Sorting Technical / Audit and Accountability / Time Stamps Technical / Audit and Accountability / Time Stamps / Secondary Authoritative Time Source Technical / Audit and Accountability / Protection of Audit Information / Dual Authorization Technical / Audit and Accountability / Protection of Audit Information / Read Only Access Technical / Audit and Accountability / Audit Generation Technical / Audit and Accountability / Audit Generation / Changes by Authorized Individuals Technical / Audit and Accountability / Alternate Audit Capability Technical / Audit and Accountability / Cross-Organizational Auditing Technical / Audit and Accountability / Cross-Organizational Auditing / Identity Preservation Technical / Audit and Accountability / Cross-Organizational Auditing / Sharing of Audit Information Management / Security Assessment and Authorization / Security Assessments / External Organizations Management / Security Assessment and Authorization / Prohibit Connections to Public Networks Management / Security Assessment and Authorization / Continuous Monitoring Operational / Configuration Management / Least Functionality Operational / Configuration Management / Least Functionality / Unauthorized Software Operational / Configuration Management / Least Functionality / Authorized Software Operational / Configuration Management / Software Usage Restrictions Operational / Configuration Management / User Installed Software Operational / Configuration Management / User Installed Software / Automated Alerts for Unauthorized Installations Operational / Contingency Planning / Contingency Plan / Coordinate with External Service Providers Operational / Contingency Planning / Contingency Plan / Identify Critical Assets Operational / Contingency Planning / Alternate Processing Site Operational / Contingency Planning / Alternate Processing Site / Inability to Return to Primary Site Operational / Contingency Planning / Telecommunications Services / Alternate Telecommunication Service Testing Operational / Contingency Planning / Information System Backup Operational / Contingency Planning / Information System Backup / Two-person Rule Operational / Contingency Planning / Predictable Failure Prevention Operational / Contingency Planning / Predictable Failure Prevention / Transferring Component Responsibilities Page 3 AU-4(1) new in AU-6 incorporates r3 AU-6(7) AU-7(2) new in AC-2 and AU-8 incorporates r3 AC-13 AU-8(2) new in AU-8(5) new in AU-9(6) new in AU-12 incorporates r3 AU-2(1) and AU-2(2) AU-12(3) new in AU-15 new in AU-16 new in AU-16(1) new in AU-16(2) new in CA-2(3) new in CA-3(3) new in CA-7 incorporates r3 CM-6(4) CM-7 incorporates r3 AC-17(8) CM-7(4) new in CM-7(5) new in CM-10 new in CM-11 new in CM-11(1) new in CP-2(7) new in CP-2(8) new in CP-7 incorporates r3 CM-2(4), CM-3(5) and CP-7(5) CP-7 (6 new in CP-8(5) new in CP-9 incorporates r3 CP-9(4) CP-9 (7) new in CP-11 new in CP-11(1) new in
4 CP-11 (2) CP-11 (3) CP-11 (4) CP-12 CP-13 IA-2 (10) IA-3 IA-4 (6) IA-5 (9) IA-5 (10) IA-5 (11) IA-5 (12) IA-9 IA-9 (1) IA-9 (2) IA-10 IA-11 IA-12 IR-3 (2) IR-4 (6) IR-4 (7) IR-4 (8) IR-4 (9) IR-4 (10) IR-6 (3) IR-9 IR-9 (1) IR-9 (2) IR-9 (3) IR-9 (4) MP-3 MP-4(2) MP-6 (7) MP-7 MP-7 (1) MP-7 (1) MP-8 Operational / Contingency Planning / Predictable Failure Prevention / Time Limit on Process Execution without Supervision Operational / Contingency Planning / Predictable Failure Prevention / Manual Transfer Between Components Operational / Contingency Planning / Predictable Failure Prevention / Standby Component Installation - Notification Operational / Contingency Planning / Alternate Communications Protocols Operational / Contingency Planning / Safe Mode Technical / Identification and Authentication / Organizational Users / Single Sign-on Technical / Identification and Authentication / Device to Device Technical / Identification and Authentication / Identifier Management / Cross-organization Management Technical / Identification and Authentication / Authenticator Management / Cross-organization Management Technical / Identification and Authentication / Authenticator Management / Dynamic Authenticator Association Technical / Identification and Authentication / Authenticator Management / Hardware Token-based Authentication Technical / Identification and Authentication / Authenticator Management / Biometric Authentication Technical / Identification and Authentication / Service I&A Technical / Identification and Authentication / Service I&A / Information Exchange Technical / Identification and Authentication / Service I&A / Transmission of Decisions Technical / Identification and Authentication / Alternative Authentication Technical / Identification and Authentication / Adaptive I&A Technical / Identification and Authentication / Reauthentication Operational / Incident Response / Testing / Coordination with Related Plans Operational / Incident Response / Incident Handling / Insider Threats - Specific Capabilities Operational / Incident Response / Incident Handling / Insider Threats - Intra-organization Coordination Operational / Incident Response / Incident Handling / Correlation with External Organizations Operational / Incident Response / Incident Handling / Dynamic Response Capability Operational / Incident Response / Incident Handling / Supply Chain Coordination Operational / Incident Response / Reporting / Coordination with Supply Chain Operational / Incident Response / Information Spillage Response Operational / Incident Response / Information Spillage Response / Responsible Personnel Operational / Incident Response / Information Spillage Response / Training Operational / Incident Response / Information Spillage Response / Post-spill Operations Operational / Incident Response / Information Spillage Response / Exposure to Unauthorized Personnel Operational / Media Protection / Media Marking Operational / Media Protection / Media Storage / Off-line Storage Operational / Media Protection / Media Sanitation / Two-person Rule Operational / Media Protection / Media Use Operational / Media Protection / Media Use / Organizational Restrictions Operational / Media Protection / Media Use / Prohibition of Use without Owner Operational / Media Protection / Media Downgrading Page 4 CP-11(2) new in CP-11(3) new in CP-11(4) new in CP-12 new in CP-13 new in IA-2(10) new in IA-3 incorporates r3 IA-3(2) IA-4(6) new in IA-5(9) new in IA-5(10) new in IA-5(11) new in IA-5(12) new in IA-9 new in IA-9(1) new in IA-9(2) new in IA-10 new in IA-11 new in IA-12 new in IR-3(2) new in IR-4(6) new in IR-4(7) new in IR-4(8) new in IR-4(9) new in IR-4(10) new in IR-6(3) new in IR-9 new in IR-9(1) new in IR-9(2) new in IR-9(3) new in IR-9(4) new in MP-3 incorporates r3 AC-15 MP-4(2) new in MP-6(7) new in MP-7 incorporates r3 AC-19(1), AC-19(2) and AC-19(3) MP-7(1) new in MP-7(2) new in MP-8 new in
5 MP-8 (1) MP-8 (2) MP-8 (3) MP-8 (4) PE-5 (1) PE-6 (3) PE-20 PL-2 (3) PL-7 PL-8 PM-12 PM-13 PM-14 PM-15 PS-3 (3) PS-3 (4) PS-4 (1) PS-4 (2) PS-7 (1) PS-8 (1) RA-5 (10) SA-4 (8) SA-5 (6) SA-9 (2) SA-9 (3) SA-9 (4) SA-9 (5) SA-10 (3) SA-11 (4) SA-11 (5) SA-11 (6) SA-11 (7) SA-11 (8) Operational / Media Protection / Media Downgrading / Tracking - Documenting Operational / Media Protection / Media Downgrading / Equipment Testing Operational / Media Protection / Media Downgrading / Controlled Unclassified Information Operational / Media Protection / Media Downgrading / Classified Information Operational / Physical and Environmental Protection / Access Control for Output Devices / Automated Access Control - Identity Linkage Operational / Physical and Environmental Protection / Monitoring Physical Access / Video Surveillance Operational / Physical and Environmental Protection / Port and I/O Device Access Management / Planning / System Security Plan / Plan - Coordinate with other Organizational Entities Management / Planning / Security Concept of Operations Management / Planning / Security Architecture Management / Program Management / Insider Threat Program Management / Program Management / Information Security Workforce Management / Program Management / Operations Security Program Management / Program Management / Testing, Training and Monitoring Operational / Personnel Security / Personnel Screening / Additional Screening Criteria Operational / Personnel Security / Personnel Screening / Information with Special Protection Measures Operational / Personnel Security / Personnel Termination / Post-Employment Requirements Operational / Personnel Security / Personnel Termination / Automated Notification Operational / Personnel Security / Third party Personnel Security / Notifications Operational / Personnel Security / Personnel Sanctions / Notifications Management / Risk Assessment / Vulnerability Scanning / Correlate Scanning Information Technical / System and Services Acquisition / Acquisition Process / Continuous Monitoring Plan Technical / System and Services Acquisition / Information System Documentation / Functions - Ports - Protocols - Services in Use Technical / System and Services Acquisition / External Information System Services / Identification of Functions - Ports - Protocols - Services Technical / System and Services Acquisition / External Information System Services / Establish - Maintain Chain of Trust with Providers Technical / System and Services Acquisition / External Information System Services / Consistent Interests of Consumers and Providers Technical / System and Services Acquisition / External Information System Services / Processing, Storage, and Service Location Technical / System and Services Acquisition / Developer Configuration Management / Hardware Integrity Verification Technical / System and Services Acquisition / Developer Security Testing / Manual Code Reviews Technical / System and Services Acquisition / Developer Security Testing / Penetration Testing Technical / System and Services Acquisition / Developer Security Testing / Unit - Integration - Regression Testing Technical / System and Services Acquisition / Developer Security Testing / Attack Surface Reviews Technical / System and Services Acquisition / Developer Security Testing / Verify Scope of Testing Page 5 MP-8(1) new in MP-8(2) new in MP-8(3) new in MP-8(4) new in PE-5(1) new in PE-6(3) new in PE-20 new in PL-2(3) new in PL-7 new in PL-8 new in and incorporates r3 PL-2(2) PM-12 new in PM-13 new in PM-14 new in PM-15 new in PS-3(3) new in PS-3(4) new in PS-4(1) new in PS-4(2) new in PS-7(1) new in PS-8(1) new in RA-5(10) new in SA-4(8) new in SA-5(6) new in SA-9(2) new in SA-9(3) new in SA-9(4) new in SA-9(5) new in SA-10(3) new in SA-11(4) new in SA-11(5) new in SA-11(6) new in SA-11(7) new in SA-11(8) new in
6 SA-12 (8) SA-12 (9) SA-12 (10) SA-12 (11) SA-12 (12) SA-12 (13) SA-12 (14) SA-12 (15) SA-15 SA-15 (1) SA-15 (2) SA-15 (3) SA-15 (4) SA-15 (5) SA-15 (6) SA-15 (7) SA-15 (8) SA-16 SA-17 SA-17 (1) SA-17 (2) SA-17 (3) SA-18 SA-18 (1) SA-19 SC-3 (6) SC-3 (7) SC-4 SC-4 (2) SC-5 (3) Technical / System and Services Acquisition / Supply Chain Protection / Use of All-source Intelligence Technical / System and Services Acquisition / Supply Chain Protection / Operations Security Technical / System and Services Acquisition / Supply Chain Protection / Unauthorized Modifications Technical / System and Services Acquisition / Supply Chain Protection / Validate as Genuine and not Altered Technical / System and Services Acquisition / Supply Chain Protection / Penetration Testing - Analysis of Supply Chain Elements Technical / System and Services Acquisition / Supply Chain Protection / Inter-ogranizational Agreements Technical / System and Services Acquisition / Supply Chain Protection / Critical Information System Components Technical / System and Services Acquisition / Supply Chain Protection / Critical Information System Components Tools Tools / Quality Metrics Tools / Security Tracking Tools Tools / Criticality Analysis Tools / Threat Modeling - Vulnerability Analysis Tools / Attack Surface Reduction Tools / Continuous Improvement Tools / Automated Vulnerability Analysis Tools / Reuse of Threat - Vulnerability Information Technical / System and Services Acquisition / Developer-provided Training Technical / System and Services Acquisition / Developer Security Architecture and Design Technical / System and Services Acquisition / Developer Security Architecture and Design / Former Policy Model Technical / System and Services Acquisition / Developer Security Architecture and Design / Security-relevant Components Technical / System and Services Acquisition / Developer Security Architecture and Design / Formal Correspondence Technical / System and Services Acquisition / Tamper Resistance and Detection Technical / System and Services Acquisition / Tamper Resistance and Detection / Multiple Phases of SDLC Technical / System and Services Acquisition / Anti-Counterfeit Technical / System and Communications Protection / Secuirty Function Isolation / Protection Mechanisms Technical / System and Communications Protection / Secuirty Function Isolation / Module Cohesion Technical / System and Communications Protection / Information in Shared Resources Technical / System and Communications Protection / Information in Shared Resources / Classification Levels - Security Categories Technical / System and Communications Protection / Denial of Serivce Protection / Detection - Monitoring Page 6 SA-12(8) new in SA-12(9) new in SA-12(10) new in SA-12(11) new in SA-12(12) new in SA-12(13) new in SA-12(14) new in SA-12(15) new in SA-15 new in SA-15(1)new in SA-15(2) new in SA-15(3)new in SA-15(4) new in SA-15(5) new in SA-15(6) new in SA-15(7) new in SA-15(8) new in SA-16 new in SA-17 new in SA-17(1) new in SA-17(2) new in SA-17(3) new in SA-18 new in SA-18(1) new in SA-19 new in SC-3(6) new in SC-3(7) new in SC-4 incorporates r3 SC-4(1) SC-4(2) new in SC-5(3) new in
7 SC-7 SC-7 (19) SC-7 (20) SC-8 SC-9 (3) SC-9 (4) SC-10 SC-12 SC-15 (4) SC-18 (5) SC-20 (2) SC-23 (5) SC-29 (1) SC-30 (3) SC-30 (4) SC-30 (5) SC-31 (2) SC-31 (3) SC-35 SC-36 SC-37 SC-37 (1) SC-37 (2) SC-38 SC-39 SC-39 (1) SC-40 SC-41 SC-41 (1) SC-42 Technical / System and Communications Protection / Boundary Protection Technical / System and Communications Protection / Boundary Protection / Blocking Inbound - Outbound Communications Traffic Technical / System and Communications Protection / Boundary Protection / Dynamic Isolation - Segregation Technical / System and Communications Protection / Transmission Integrity Technical / System and Communications Protection / Transmission Confidentiality / Cryptographic Protection for Message Externals Technical / System and Communications Protection / Transmission Confidentiality / Conceal - Randomize Communications Technical / System and Communications Protection / Network Disconnect Technical / System and Communications Protection / Cryptographic Key Establishment and Management Technical / System and Communications Protection / Collaborative Computing Devices / Explicitly Indicate Current Participants Technical / System and Communications Protection / Mobile Code / Allow Execution in Only Confined Environments Technical / System and Communications Protection / Secure Name-Address Resolution Serivce (Authoritive Source) / Data Origin - Integrity Technical / System and Communications Protection / Session Authenticity / Allowed Certificate Authorities Technical / System and Communications Protection / Heterogeneity / Virtualization Techniques Technical / System and Communications Protection / Concealment and Misdirection / Change Processing - Storage Locations Technical / System and Communications Protection / Concealment and Misdirection / Misleading Information Technical / System and Communications Protection / Concealment and Misdirection / Concealment and Misdirection of System Components Technical / System and Communications Protection / Covert Channel Analysis / Maximum Bandwith Technical / System and Communications Protection / Covert Channel Analysis / Measure Bandwidth in Operational Environments Technical / System and Communications Protection / Technical Surveillance Countermeasures Technical / System and Communications Protection / Honeyclients Technical / System and Communications Protection / Distributed Processing and Storage Technical / System and Communications Protection / Distributed Processing and Storage / Diversity of Implementation Technical / System and Communications Protection / Distributed Processing and Storage / Polling Techniques Technical / System and Communications Protection / Malware Analysis Technical / System and Communications Protection / Out-of-bounds Channels Technical / System and Communications Protection / Out-of-bounds Channels / Ensure Delivery - Transmission Technical / System and Communications Protection / Operations Security Technical / System and Communications Protection / Process Isolation Technical / System and Communications Protection / Process Isolation / Hardware Separation Technical / System and Communications Protection / Wireless Link Protection Page 7 SC-7 incorporates r3 SC-7(2) and SC-15(2) SC-7(19) new in SC-7(20) new in SC-8 incorporates r3 SC-33 SC-9(3) new in SC-9(4) new in SC-10 incorporates r3 AC-12 SC-12 incorporates r3 SC-12(4) and SC-12(5) SC-15(4) new in SC-18(5) new in SC-20(2) new in SC-23(5) new in SC-29(1) new in SC-30(3) new in SC-30(4) new in SC-30(5) new in SC-31(2) new in SC-31(3) new in SC-35 new in SC-36 new in SC-37 new in SC-37(1) new in SC-37(2) new in SC-37 new in SC-39 new in SC-39(1) new in SC-40 new in SC-41 new in SC-41(1) new in SC-42 new in
8 SC-42 (1) SC-42 (2) SC-42 (3) SC-42 (4) SI-3 (7) SI-3 (8) SI-4 SI-4 (18) SI-4 (19) SI-4 (20) SI-4 (21) SI-4 (22) SI-4 (23) SI-7 SI-7 (5) SI-7 (6) SI-7 (7) SI-7 (8) SI-7 (9) SI-7 (10) SI-7 (11) SI-7 (12) SI-7 (13) SI-7 (14) SI-7 (15) SI-8 (3) SI-9 (1) SI-9 (2) Technical / System and Communications Protection / Wireless Link Protection / Electromagnetic Interference Technical / System and Communications Protection / Wireless Link Protection / Reduce Detection Potential Technical / System and Communications Protection / Wireless Link Protection / Imitative or Manipulative Communications Deception Technical / System and Communications Protection / Wireless Link Protection / Signal Parameter Identification Operational / System and Information Integrity / Malicious Code Protection / Non Signature-based Detection Operational / System and Information Integrity / Malicious Code Protection / Detect Unauthorized Commands Operational / System and Information Integrity / Information System Monitoring Analyze Traffic - Covert Exfiltration Individuals Posing Greater Risk Privileged User Probationary Periods Unauthorized Network Services Host-based Devices Integrity Integrity / Automated Response to Integrity Violations Integrity / Cryptographic Protection Integrity / Hardware-based Protection Integrity / Integration of Detection and Response Integrity / Auditing Capability for Significant Events Integrity / Verify Boot Process Integrity / Protection of Boot Firmware Integrity / Confined Environments with Limited Privileges Integrity / Integrity Verification Integrity / Code Execution in Protected Environments Integrity / Binary or Machine Executable Code Operational / System and Information Integrity / Spam Protection / Continuous Learning Capability Operational / System and Information Integrity / Information Input Restrictions / Protect Remote Commands Operational / System and Information Integrity / Information Input Restrictions / Detect Unauthorized Commands Page 8 SC-42(1) new in SC-42(2) new in SC-42(3) new in SC-42(4) new in SI-3(7) new in SI-3(8) new in SI-4 incorporates r3 AU-6(2) SI-4(18) new in SI-4(19) new in SI-4(20) new in SI-4(21) new in SI-4(22) new in SI-4(23) new in SI-7 incorporates r3 CM-5(7), CM-6(3), SA-6 and SA-7 SI-7(5) new in SI-7(6) new in SI-7(7) new in SI-7(8) new in SI-7(9) new in SI-7(10) new in SI-7(11) new in SI-7(12) new in SI-7(13) new in SI-7(14) new in SI-7(15) new in SI-8(3) new in SI-9(1) new in SI-9(2) new in
9 SI-10 (1) SI-10 (2) SI-10 (3) SI-10 (4) SI-14 AP-1 AP-2 AR-2 AR-2 AR-3 AR-4 AR-5 AR-6 AR-7 AR-8 DI-1 DI-1 (1) DI-1 (12) DI-2 DM-1 DM-1 (1) DM-2 DM-2 (1) DM-3 DM-3 (1) IP-1 IP-1 (1) IP-2 IP-3 Operational / System and Information Integrity / Information Input Validation / Manual Override Capability Operational / System and Information Integrity / Information Input Validation / Review - Resolution of Errors Operational / System and Information Integrity / Information Input Validation / Predictable Behavior Operational / System and Information Integrity / Information Input Validation / Timing Interactions Operational / System and Information Integrity / Non-Persistence Privacy / Authority and Purpose / Authority to Collect Privacy / Authority and Purpose / Purpose Specification Privacy / Accountabilty, Audit and Risk Management / Governance and Privacy Program Privacy / Accountabilty, Audit and Risk Management / Privacy Impact and Risk Assessment Privacy / Accountabilty, Audit and Risk Management / Privacy Requirements for Contracts and Service Providers Privacy / Accountabilty, Audit and Risk Management / Privacy Monitoring and Auditing Privacy / Accountabilty, Audit and Risk Management / Privacy Awareness and Training Privacy / Accountabilty, Audit and Risk Management / Privacy Reporting Privacy / Accountabilty, Audit and Risk Management / Privacy-enhanced System Design and Development Privacy / Accountabilty, Audit and Risk Management / Accounting of Disclosures Privacy / Data Quality and Integrity / Data Quality Privacy / Data Quality and Integrity / Data Quality / Validate PII Privacy / Data Quality and Integrity / Data Quality / Re-Validate PII Privacy / Data Quality and Integrity / Data Integrity and Data Integrity Board Privacy / Data Minimization and Retention / Minimization of Personally Identifiable Information Privacy / Data Minimization and Retention / Minimization of Personally Identifiable Information / Locate - Remove - Redact - Anonymize PII Privacy / Data Minimization and Retention / Data Retention and Disposal Privacy / Data Minimization and Retention / Data Retention and Disposal / System Configuration Privacy / Data Minimization and Retention / Minimization of PII Used in Testing, Training, and Research Privacy / Data Minimization and Retention / Minimization of PII Used in Testing, Training, and Research / Risk Minimization Techniques Privacy / Individual Participation and Redress / Consent Privacy / Individual Participation and Redress / Consent / Mechanisms Supporting Itemized or Tiered Consent Privacy / Individual Participation and Redress / Individual Access Privacy / Individual Participation and Redress / Redress Page 9 SI-10(1) new in SI-10(2) new in SI-10(3) new in SI-10(4)new in SI-14 new in Privacy AP-1 new in Privacy AP-2 new in Privacy AR-1 new in Privacy AR-2 new in Privacy AR-3 new in Privacy AR-4 new in Privacy AR-5 new in Privacy AR-6 new in Privacy AR-7 new in Privacy AR-8 new in Privacy DI-1 new in Privacy DI-1(1) new in Privacy DI-1(2) new in Privacy DI-2 new in Privacy DM-1 new in Privacy DM-1(1) new in Privacy DM-2 new in Privacy DM-2(1) new in Privacy DM-3 new in Privacy DM-3(1) new in Privacy IP-1 new in Privacy IP-1(1) new in Privacy IP-2 new in Privacy IP-3 new in
10 IP-4 IP-4 (1) SE-1 SE-2 TR-1 TR-1 (1) TR-2 TR-2 (1) TR-3 UL-1 UL-2 Privacy / Individual Participation and Redress / Complaint Management Privacy / Individual Participation and Redress / Complaint Management / Response Times Privacy / Security / Inventory of Personally Identifiable Information Privacy / Security / Privacy Incident Response Privacy / Transparency / Privacy Notice Privacy / Transparency / Privacy Notice / Real-time or Layered Notice Privacy / Transparency / System of Records Notices and Privary Act Statements Privacy / Transparency / System of Records Notices and Privary Act Statements / Public Web Site Publication Privacy / Transparency / Dissemination of Privacy Program Information Privacy / Use Limitation / Internal Use Privacy / Use Limitation / Information Sharing with Third Parties Page 10 Privacy IP-4 new in Privacy IP-4(1) new in Privacy SE-1 new in Privacy SE-2 new in Privacy TR-1 new in Privacy TR-1(1) new in Privacy TR-2 new in Privacy TR-2(1) new in Privacy TR-3 new in Privacy UL-1 new in Privacy UL-2 new in
MINIMUM SECURITY CONTROLS SUMMARY
APPENDIX D MINIMUM SECURITY CONTROLS SUMMARY LOW-IMPACT, MODERATE-IMPACT, AND HIGH-IMPACT INFORMATION SYSTEMS The following table lists the minimum security controls, or security control baselines, for
Mapping of FedRAMP Tailored LI SaaS Baseline to ISO Security Controls
Mapping of FedRAMP Tailored LI SaaS Baseline to ISO 27001 Security Controls This document provides a list of all controls that require the Cloud Service Provider, Esri, to provide detailed descriptions
ACHIEVING COMPLIANCE WITH NIST SP REV. 4:
ACHIEVING COMPLIANCE WITH NIST SP 800-53 REV. 4: How Thycotic Helps Implement Access Controls OVERVIEW NIST Special Publication 800-53, Revision 4 (SP 800-53, Rev. 4) reflects the U.S. federal government
INTERNATIONAL CIVIL AVIATION ORGANIZATION ASIA and PACIFIC OFFICE ASIA/PAC RECOMMENDED SECURITY CHECKLIST
INTERNATIONAL CIVIL AVIATION ORGANIZATION ASIA and PACIFIC OFFICE Aeronautical Telecommunication Network Implementation Coordination Group (ATNICG) ASIA/PAC RECOMMENDED SECURITY CHECKLIST September 2009
DoD Guidance for Reviewing System Security Plans and the NIST SP Security Requirements Not Yet Implemented This guidance was developed to
DoD Guidance for Reviewing System Security Plans and the s Not Yet Implemented This guidance was developed to facilitate the consistent review and understanding of System Security Plans and Plans of Action,
Evolving Cybersecurity Strategies
Evolving Cybersecurity Strategies NIST Special Publication 800-53, Revision 4 ISSA National Capital Chapter April 17, 2012 Dr. Ron Ross Computer Security Division Information Technology Laboratory NATIONAL
New Guidance on Privacy Controls for the Federal Government
New Guidance on Privacy Controls for the Federal Government IAPP Global Privacy Summit 2012 March 9, 2012 Dr. Ron Ross Computer Security Division, NIST Martha Landesberg, J.D., CIPP/US The Privacy Office,
Security Control Mapping of CJIS Security Policy Version 5.3 Requirements to NIST Special Publication Revision 4 4/1/2015
U. S. Department of Justice Federal Bureau of Investigation Criminal Justice Information Services Division Security Control Mapping of CJIS Security Policy Version 5.3 s to NIST Special Publication 800-53
Ransomware. How to protect yourself?
Ransomware How to protect yourself? ED DUGUID, CISSP, VCP CONSULTANT, WEST CHESTER CONSULTANTS Ransomware Ransomware is a type of malware that restricts access to the infected computer system in some way,
CloudCheckr NIST Audit and Accountability
CloudCheckr NIST 800-53 Audit and Accountability FISMA NIST 800-53 (Rev 4) Audit and Accountability: Shared Public Cloud Infrastructure Standards Standard Requirement per NIST 800-53 (Rev. 4) CloudCheckr
WRITTEN INFORMATION SECURITY PROGRAM (WISP) ACME Business Consulting, Inc.
WRITTEN INFORMATION SECURITY PROGRAM (WISP) ACME Business Consulting, Inc. TABLE OF CONTENTS WRITTEN INFORMATION SECURITY PROGRAM (WISP) OVERVIEW 9 INTRODUCTION 9 PURPOSE 9 SCOPE & APPLICABILITY 10 POLICY
existing customer base (commercial and guidance and directives and all Federal regulations as federal)
ATTACHMENT 7 BSS RISK MANAGEMENT FRAMEWORK PLAN [L.30.2.7, M.2.2.(7), G.5.6; F.2.1(41) THROUGH (76)] A7.1 BSS SECURITY REQUIREMENTS Our Business Support Systems (BSS) Risk MetTel ensures the security of
WHITE PAPER CONTINUOUS MONITORING INTRODUCTION & CONSIDERATIONS PART 2 OF 3
WHITE PAPER CONTINUOUS MONITORING INTRODUCTION & CONSIDERATIONS PART 2 OF 3 ABSTRACT This white paper is Part 2 in a three-part series of white papers on the sometimes daunting subject of continuous monitoring
SAC PA Security Frameworks - FISMA and NIST
SAC PA Security Frameworks - FISMA and NIST 800-171 June 23, 2017 SECURITY FRAMEWORKS Chris Seiders, CISSP Scott Weinman, CISSP, CISA Agenda Compliance standards FISMA NIST SP 800-171 Importance of Compliance
EXCERPT. NIST Special Publication R1. Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
EXCERPT NIST Special Publication 800-171 R1 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations An Excerpt Listing All: Security Requirement Families & Controls Security
NIST Compliance Controls
NIST 800-53 Compliance s The following control families represent a portion of special publication NIST 800-53 revision 4. This guide is intended to aid McAfee, its partners, and its customers, in aligning
Using Metrics to Gain Management Support for Cyber Security Initiatives
Using Metrics to Gain Management Support for Cyber Security Initiatives Craig Schumacher Chief Information Security Officer Idaho Transportation Dept. January 2016 Why Metrics Based on NIST Framework?
Four Deadly Traps of Using Frameworks NIST Examples
Four Deadly Traps of Using Frameworks NIST 800-53 Examples ISACA Feb. 2015 Meeting Doug Landoll dlandoll@lantego.com (512) 633-8405 Session Agenda Framework Definition & Uses NIST 800-53 Framework Intro
Recommended Security Controls for Federal Information Systems and Organizations
NIST Special Publication 800-53 Revision 3 Excerpt Recommended Security Controls for Federal Information Systems and Organizations JOINT TASK FORCE TRANSFORMATION INITIATIVE HIGH-IMPACT BASELINE I N F
NIST SP , Revision 1 CNSS Instruction 1253
NIST SP 800-53, Revision 1 CNSS Instruction 1253 Annual Computer Security Applications Conference December 10, 2009 Dr. Ron Ross Computer Security Division Information Technology Laboratory Introduction
EXABEAM HELPS PROTECT INFORMATION SYSTEMS
WHITE PAPER EXABEAM HELPS PROTECT INFORMATION SYSTEMS Meeting the Latest NIST SP 800-53 Revision 4 Guidelines SECURITY GUIDELINE COMPLIANCE There has been a rapid increase in malicious insider threats,
The Common Controls Framework BY ADOBE
The Controls Framework BY ADOBE The following table contains the baseline security subset of control activities (derived from the Controls Framework by Adobe) that apply to Adobe s enterprise offerings.
Altius IT Policy Collection Compliance and Standards Matrix
Governance Context and Alignment Policy 4.1 4.4 800-26 164.308 12.4 EDM01 IT Governance Policy 5.1 800-30 12.5 EDM02 Leadership Mergers and Acquisitions Policy A.6.1.1 800-33 EDM03 Context Terms and Definitions
Because Security Gives Us Freedom
Because Security Gives Us Freedom PANOPTIC CYBERDEFENSE CYBERSECURITY LEADERSHIP Panoptic Cyberdefense is a monitoring and detection service in three levels: Security Management and Reporting Managed Detection
Altius IT Policy Collection Compliance and Standards Matrix
Governance Context and Alignment Policy 4.1 4.4 800-26 164.308 12.4 EDM01 IT Governance Policy 5.1 800-30 12.5 EDM02 Leadership Mergers and Acquisitions Policy A.6.1.1 800-33 EDM03 Context Terms and Definitions
Security Standards Compliance NIST SP Release 4 Trend Micro Products (Deep Security and SecureCloud) - Version 1.1
Security Standards Compliance NIST SP 800-53 Release 4 Trend Micro Products (Deep Security and SecureCloud) - Version 1.1 Document TMIC-003-N Version 1.1, 24 August 2012 1 Security and Privacy Controls
NIST Special Publication
DATASHEET NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations Mapping for Carbon Black BACKGROUND The National Institute of Standards and Technology
Building Secure Systems
Building Secure Systems Antony Selim, CISSP, P.E. Cyber Security and Enterprise Security Architecture 13 November 2015 Copyright 2015 Raytheon Company. All rights reserved. Customer Success Is Our Mission
Attachment 1 to Appendix 2 Risk Assessment Security Report for the Networx Security Plan
Attachment 1 to Appendix 2 Risk Assessment Security Report for the Networx Security Plan DRAFT December 13, 2006 Revision XX Qwest Government Services, Inc. 4250 North Fairfax Drive Arlington, VA 22203
Top 10 ICS Cybersecurity Problems Observed in Critical Infrastructure
SESSION ID: SBX1-R07 Top 10 ICS Cybersecurity Problems Observed in Critical Infrastructure Bryan Hatton Cyber Security Researcher Idaho National Laboratory In support of DHS ICS-CERT @phaktor 16 Critical
Mapping of ITSG-33 Security Controls to SP Revision 4 Security Controls
1 April 2013 BD Pro Mapping of ITSG-33 Security Controls to SP 800-53 Revision 4 Security Controls NIST SP 800-53 Revision 4 is replacing the August 2009 Revision 3 version of the security controls catalogue.
FISMA Compliance. with O365 Manager Plus.
FISMA Compliance with O365 Manager Plus www.o365managerplus.com About FISMA The Federal Information Security Management Act (FISMA) is a United States federal law passed in 2002 that made it a requirement
Information Technology Security Plan Policies, Controls, and Procedures Protect: Identity Management and Access Control PR.AC
Information Technology Security Plan Policies, Controls, and Procedures Protect: Identity Management and Access Control PR.AC Location: https://www.pdsimplified.com/ndcbf_pdframework/nist_csf_prc/documents/protect/ndcbf_
MIS Week 9 Host Hardening
MIS 5214 Week 9 Host Hardening Agenda NIST Risk Management Framework A quick review Implementing controls Host hardening Security configuration checklist (w/disa STIG Viewer) NIST 800-53Ar4 How Controls
SYSTEMS ASSET MANAGEMENT POLICY
SYSTEMS ASSET MANAGEMENT POLICY Policy: Asset Management Policy Owner: CIO Change Management Original Implementation Date: 7/1/2017 Effective Date: 7/1/2017 Revision Date: Approved By: NIST Cyber Security
1. Post for 45-day comment period and pre-ballot review. 7/26/ Conduct initial ballot. 8/30/2010
Standard CIP 011 1 Cyber Security Protection Standard Development Roadmap This section is maintained by the drafting team during the development of the standard and will be removed when the standard becomes
Annex 1 to NIST Special Publication Recommended Security Controls for Federal Information Systems
Annex 1 to NIST Special Publication 800-53 Recommended Security Controls for Federal Information Systems Minimum Security Controls Low Baseline AC-1 ACCESS CONTROL POLICY AND PROCEDURES The organization
Safeguarding of Unclassified Controlled Technical Information. SAFEGUARDING OF UNCLASSIFIED CONTROLLED TECHNICAL INFORMATION (NOV 2013)
Page 1 of 7 Section O Attach 2: SAFEGUARDING OF UNCLASSIFIED CONTROLLED TECHNICAL INFORMATION (NOV 2013) 252.204-7012 Safeguarding of Unclassified Controlled Technical Information. As prescribed in 204.7303,
IT Security Risk Management: A Lifecycle Approach
Information Technology Security Guidance IT Security Risk Management: A Lifecycle Approach Security Control Catalogue ITSG-33 Annex 3A December 2014 Foreword Annex 3A (Security Control Catalogue) to IT
READ ME for the Agency ATO Review Template
READ ME for the Agency ATO Review Template Below is the template that the FedRAMP Program Management Office (PMO) uses when reviewing an Agency ATO package. Agencies and CSPs should be cautious to not
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Signature Repository A Signature Repository provides a group of signatures for use by network security tools such
Information Security Policy
April 2016 Table of Contents PURPOSE AND SCOPE 5 I. CONFIDENTIAL INFORMATION 5 II. SCOPE 6 ORGANIZATION OF INFORMATION SECURITY 6 I. RESPONSIBILITY FOR INFORMATION SECURITY 6 II. COMMUNICATIONS REGARDING
Protecting Controlled Unclassified Information(CUI) in Nonfederal Information Systems and Organizations
Protecting Controlled Unclassified Information(CUI) in Nonfederal Information Systems and Organizations January 9 th, 2018 SPEAKER Chris Seiders, CISSP Security Analyst Computing Services and Systems Development
Checklist: Credit Union Information Security and Privacy Policies
Checklist: Credit Union Information Security and Privacy Policies Acceptable Use Access Control and Password Management Background Check Backup and Recovery Bank Secrecy Act/Anti-Money Laundering/OFAC
Catalog of Control Systems Security: Recommendations for Standards Developers. September 2009
Catalog of Control Systems Security: Recommendations for Standards Developers September 2009 2.7.11.2 Supplemental Guidance Electronic signatures are acceptable for use in acknowledging rules of behavior
ENTS 650 Network Security. Dr. Edward Schneider
ENTS 650 Network Security Dr. Edward Schneider http://www.ece.umd.edu/class/ents650/ Schneide@umd.edu Stallings. Cryptography and Network Security, 4e. Prentice-Hall. 2006. NIST Special Pubs: csrc.nist.gov/publications/pubssps.html
Rev.1 Solution Brief
FISMA-NIST SP 800-171 Rev.1 Solution Brief New York FISMA Cybersecurity NIST SP 800-171 EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker delivers business critical
Executive Order 13556
Briefing Outline Executive Order 13556 CUI Registry 32 CFR, Part 2002 Understanding the CUI Program Phased Implementation Approach to Contractor Environment 2 Executive Order 13556 Established CUI Program
Annex 3 to NIST Special Publication Recommended Security Controls for Federal Information Systems
Annex 3 to NIST Special Publication 800-53 Recommended Security Controls for Federal Information Systems Minimum Security Controls High Baseline Includes updates through 04-22-2005 AC-1 ACCESS CONTROL
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud
Criminal Justice Information Security (CJIS) Guide for ShareBase in the Hyland Cloud Introduction The Criminal Justice Information Security (CJIS) Policy is a publically accessible document that contains
Information Technology Security Plan Policies, Controls, and Procedures Identify Governance ID.GV
Information Technology Security Plan Policies, Controls, and Procedures Identify Governance ID.GV Location: https://www.pdsimplified.com/ndcbf_pdframework/nist_csf_prc/documents/identify/ndcbf _ITSecPlan_IDGV2017.pdf
IASM Support for FISMA
Introduction Most U.S. civilian government agencies, and commercial enterprises processing electronic data on behalf of those agencies, are concerned about whether and how Information Assurance products
HIPAA Security and Privacy Policies & Procedures
Component of HIPAA Security Policy and Procedures Templates (Updated for HITECH) Total Cost: $495 Our HIPAA Security policy and procedures template suite have 71 policies and will save you at least 400
FISMA-NIST SP Rev.4 Solution Brief. EventTracker 8815 Centre Park Drive, Columbia MD FISMA NIST SP
FISMA-NIST SP 800-53 Rev.4 Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical solutions that transform high-volume cryptic log data into actionable, prioritized intelligence
ISO based Written Information Security Program (WISP) (a)(1)(i) & (a)(3)(i) & (ii) & (A) (A)(5)(ii) & (ii)(a)
1 Information Security Program Policy 1.2 Management Direction for Information Security 5.1 1.2.8 1.2.1.1 Publishing An Information Security Policy 5.1.1 500.03 1.1.0 2.1.0-2.2.3 3.1.0-3.1.2 4.1.0-4.2.4
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Risk Monitoring Risk Monitoring assesses the effectiveness of the risk decisions that are made by the Enterprise.
PT-BSC. PT-BSC version 0.3. Primechain Technologies Blockchain Security Controls. Version 0.4 dated 21 st October, 2017
PT-BSC Primechain Technologies Blockchain Security Controls Version 0.4 dated 21 st October, 2017 PT-BSC version 0.3 PT-BSC (version 0.4 dated 21 st October, 2017) 1 Blockchain technology has earned the
TOP 10 IT SECURITY ACTIONS TO PROTECT INTERNET-CONNECTED NETWORKS AND INFORMATION
INFORMATION TECHNOLOGY SECURITY GUIDANCE TOP 10 IT SECURITY ACTIONS TO PROTECT INTERNET-CONNECTED NETWORKS AND INFORMATION ITSM.10.189 October 2017 INTRODUCTION The Top 10 Information Technology (IT) Security
SECURITY & PRIVACY DOCUMENTATION
Okta s Commitment to Security & Privacy SECURITY & PRIVACY DOCUMENTATION (last updated September 15, 2017) Okta is committed to achieving and preserving the trust of our customers, by providing a comprehensive
The New Security Heroes. Alan Paller
The New Security Heroes Alan Paller apaller@sans.org How they attack Spam with infected attachments Web sites that have infected content The most dangerous: targeted attacks Fooling the victim into Installing
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Host Intrusion The Host Intrusion employs a response to a perceived incident of interference on a host-based system
Continuous Monitoring Strategy & Guide
Version 1.0 June 27, 2012 Executive Summary The OMB memorandum M-10-15, issued on April 21, 2010, changed from static point in time security authorization processes to Ongoing Assessment and Authorization
TARGET2-SECURITIES INFORMATION SECURITY REQUIREMENTS
Target2-Securities Project Team TARGET2-SECURITIES INFORMATION SECURITY REQUIREMENTS Reference: T2S-07-0270 Date: 09 October 2007 Version: 0.1 Status: Draft Target2-Securities - User s TABLE OF CONTENTS
NIST Risk Management Framework (RMF)
NIST Risk Management Framework (RMF) Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical solutions that transform high-volume cryptic log data into actionable, prioritized
DFARS Safeguarding Covered Defense Information The Interim Rule: Cause for Confusion and Request for Questions
DFARS 252.204.7012 Safeguarding Covered Defense Information The Interim Rule: Cause for Confusion and Request for Questions By Jonathan Hard, CEO And Carol Claflin, Director of Business Development H2L
IMPLEMENTING MICROSOFT CREDENTIAL GUARD FOR ISO 27001, PCI, AND FEDRAMP
IMPLEMENTING MICROSOFT CREDENTIAL GUARD FOR ISO 27001, PCI, AND FEDRAMP North America Latin America Europe 877.224.8077 info@coalfire.com coalfire.com Coalfire sm and CoalfireOne sm are registered service
NIST Cybersecurity Framework Based Written Information Security Program (WISP)
Cybersecurity Governance (GOV) Title 52.20 21 66A.622 GOV 1 Publishing Cybersecurity Policies & s ID.GV 1 500.02 500.03 66A.622(2)(d) GOV 2 Periodic Review & Update of Cybersecurity Documentation ID.GV
The Cybersecurity Risk Management Framework Applied to Enterprise Risk Management
The Cybersecurity Risk Management Framework Applied to Enterprise Risk Management Session 43, March 6, 2018 Barry S. Herrin, JD, FAHIMA, FACHE Founder, Herrin Health Law, PC 1 Conflict of Interest Barry
CSAM Support for C&A Transformation
CSAM Support for C&A Transformation Cyber Security Assessment and Management (CSAM) 1 2 3 4 5 Five Services, One Complete C&A Solution Mission/Risk-Based Policy & Implementation/Test Guidance Program Management
Data Inventory and Classification, Physical Devices and Systems ID.AM-1, Software Platforms and Applications ID.AM-2 Inventory
Audience: NDCBF IT Security Team Last Reviewed/Updated: March 2018 Contact: Henry Draughon hdraughon@processdeliveysystems.com Overview... 2 Sensitive Data Inventory and Classification... 3 Applicable
Courses. X E - Verify that system acquisitions policies and procedures include assessment of risk management policies X X
4016 Points * = Can include a summary justification for that section. FUNCTION 1 - INFORMATION SYSTEM LIFE CYCLE ACTIVITIES Life Cycle Duties No Subsection 2. System Disposition/Reutilization *E - Discuss
NERC CIP VERSION 6 BACKGROUND COMPLIANCE HIGHLIGHTS
NERC CIP VERSION 6 COMPLIANCE BACKGROUND The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards define a comprehensive set of requirements
Managed Trusted Internet Protocol Service (MTIPS) Enterprise Infrastructure Solutions (EIS) Risk Management Framework Plan (RMFP)
Enterprise Infrastructure Solutions Volume 1 Technical Volume EIS MTIPS Risk Management Framework Plan Managed Trusted Internet Protocol Service (MTIPS) Enterprise Infrastructure Solutions (EIS) Risk Management
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE Digital Policy Management consists of a set of computer programs used to generate, convert, deconflict, validate, assess
FRAMEWORK MAPPING HITRUST CSF V9 TO ISO 27001/27002:2013. Visit us online at Flank.org to learn more.
FRAMEWORK MAPPING HITRUST CSF V9 TO ISO 27001/27002:2013 Visit us online at Flank.org to learn more. HITRUST CSF v9 Framework ISO 27001/27002:2013 Framework FLANK ISO 27001/27002:2013 Documentation from
NIST SP Controls
NIST SP 800-53 Controls and Netwrix Auditor Mapping www.netwrix.com Toll-free: 888-638-9749 About FISMA / NIST The Federal Information Security Management Act of 2002 (commonly abbreviated to FISMA) is
Page 1 of 15. Applicability. Compatibility EACMS PACS. Version 5. Version 3 PCA EAP. ERC NO ERC Low Impact BES. ERC Medium Impact BES
002 5 R1. Each Responsible Entity shall implement a process that considers each of the following assets for purposes of parts 1.1 through 1.3: i. Control Centers and backup Control Centers; ii. Transmission
Information Technology Security Plan Policy, Control, and Procedures Manual Detect: Anomalies and Events
Information Technology Security Plan Policy, Control, and Procedures Manual Detect: Anomalies and Events Location: Need the right URL for this document https://www.pdsimplified.com/ndcbf_pdframework/nist_csf_prc/documents/detect/ndcbf_i
A Supply Chain Attack Framework to Support Department of Defense Supply Chain Security Risk Management
A Supply Chain Attack Framework to Support Department of Defense Supply Chain Security Risk Management D r. J o h n F. M i l l e r T h e M I T R E C o r p o r a t i o n P e t e r D. K e r t z n e r T h
AWS alignment with Motion Picture of America Association (MPAA) Content Security Best Practices Application in the Cloud
AWS alignment with Motion Picture of America Association (MPAA) Content Security Best Practices Application in the Cloud The Motion Picture of America Association (MPAA) has established a set of best practices
Approved 10/15/2015. IDEF Baseline Functional Requirements v1.0
Approved 10/15/2015 IDEF Baseline Functional Requirements v1.0 IDESG.org IDENTITY ECOSYSTEM STEERING GROUP IDEF Baseline Functional Requirements v1.0 NOTES: (A) The Requirements language is presented in
TEL2813/IS2820 Security Management
TEL2813/IS2820 Security Management Security Management Models And Practices Lecture 6 Jan 27, 2005 Introduction To create or maintain a secure environment 1. Design working security plan 2. Implement management
Security+ SY0-501 Study Guide Table of Contents
Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators
Technical Reference [Draft] DRAFT CIP Cyber Security - Supply Chain Management November 2, 2016
For Discussion Purposes Only Technical Reference [Draft] DRAFT CIP-013-1 Cyber Security - Supply Chain Management November 2, 2016 Background On July 21, 2016, the Federal Energy Regulatory Commission
Risk-Based Cyber Security for the 21 st Century
Risk-Based Cyber Security for the 21 st Century 7 th Securing the E-Campus Dartmouth College July 16, 2013 Dr. Ron Ross Computer Security Division Information Technology Laboratory NATIONAL INSTITUTE OF
New York Cybersecurity. New York Cybersecurity. Requirements for Financial Services Companies (23NYCRR 500) Solution Brief
Publication Date: March 10, 2017 Requirements for Financial Services Companies (23NYCRR 500) Solution Brief EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker s advanced
CIP Cyber Security Configuration Change Management and Vulnerability Assessments
CIP-010-2 3 Cyber Security Configuration Change Management and Vulnerability Assessments A. Introduction 1. Title: Cyber Security Configuration Change Management and Vulnerability Assessments 2. Number:
The Future of Cyber Security NIST Special Publication , Revision 4
The Future of Cyber Security NIST Special Publication 800-53, Revision 4 Information System Security Association NOVA June 20, 2013 Dr. Ron Ross Computer Security Division Information Technology Laboratory
The HITRUST CSF. A Revolutionary Way to Protect Electronic Health Information
The HITRUST CSF A Revolutionary Way to Protect Electronic Health Information June 2015 The HITRUST CSF 2 Organizations in the healthcare industry are under immense pressure to improve quality, reduce complexity,
Interagency Advisory Board Meeting Agenda, December 7, 2009
Interagency Advisory Board Meeting Agenda, December 7, 2009 1. Opening Remarks 2. FICAM Segment Architecture & PIV Issuance (Carol Bales, OMB) 3. ABA Working Group on Identity (Tom Smedinghoff) 4. F/ERO
NW NATURAL CYBER SECURITY 2016.JUNE.16
NW NATURAL CYBER SECURITY 2016.JUNE.16 ADOPTED CYBER SECURITY FRAMEWORKS CYBER SECURITY TESTING SCADA TRANSPORT SECURITY AID AGREEMENTS CONCLUSION QUESTIONS ADOPTED CYBER SECURITY FRAMEWORKS THE FOLLOWING
Improving Critical Infrastructure Cybersecurity Executive Order Preliminary Cybersecurity Framework
1 Improving Critical Infrastructure Cybersecurity Executive Order 13636 Preliminary Cybersecurity Framework 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
Security analysis and assessment of threats in European signalling systems?
Security analysis and assessment of threats in European signalling systems? New Challenges in Railway Operations Dr. Thomas Störtkuhl, Dr. Kai Wollenweber TÜV SÜD Rail Copenhagen, 20 November 2014 Slide
Checklist for Applying ISO 27000, PCI DSS v2 & NIST to Address HIPAA & HITECH Mandates. Ali Pabrai, MSEE, CISSP (ISSAP, ISSMP)
Checklist for Applying ISO 27000, PCI DSS v2 & NIST to Address HIPAA & HITECH Mandates Ali Pabrai, MSEE, CISSP (ISSAP, ISSMP) ecfirst, chief executive Member, InfraGard Compliance Mandates Key Regulations
ISACA Arizona May 2016 Chapter Meeting
ISACA Arizona May 2016 Chapter Meeting Suzanne Farr / Carlos A. Villalba Agenda Introduction Preliminary questions CCM Preliminaries Definition Benefits Challenges Beyond Templates Questions 1 Background
Objectives of the Security Policy Project for the University of Cyprus
Objectives of the Security Policy Project for the University of Cyprus 1. Introduction 1.1. Objective The University of Cyprus intends to upgrade its Internet/Intranet security architecture. The University
New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines
New York Department of Financial Services Cybersecurity Regulation Compliance and Certification Deadlines New York Department of Financial Services ( DFS ) Regulation 23 NYCRR 500 requires that entities
ISO COMPLIANCE GUIDE. How Rapid7 Can Help You Achieve Compliance with ISO 27002
ISO 27002 COMPLIANCE GUIDE How Rapid7 Can Help You Achieve Compliance with ISO 27002 A CONTENTS Introduction 2 Detailed Controls Mapping 3 About Rapid7 8 rapid7.com ISO 27002 Compliance Guide 1 INTRODUCTION
Advent IM Ltd ISO/IEC 27001:2013 vs
Advent IM Ltd ISO/IEC 27001:2013 vs 2005 www.advent-im.co.uk 0121 559 6699 bestpractice@advent-im.co.uk Key Findings ISO/IEC 27001:2013 vs. 2005 Controls 1) PDCA as a main driver is now gone with greater
Big Brother is Watching Your Big Data: z/os Actions Buried in the FISMA Security Regulation
Big Brother is Watching Your Big Data: z/os Actions Buried in the FISMA Security Regulation Bill Valyo CA Technologies February 7, 2013 Session #12765 Quick Abstract: About this Presentation This presentation