ACHIEVING COMPLIANCE WITH NIST SP REV. 4:

ACHIEVING COMPLIANCE WITH NIST SP 800-53 REV. 4: How Thycotic Helps Implement Access Controls OVERVIEW NIST Special Publication 800-53, Revision 4 (SP 800-53, Rev. 4) reflects the U.S. federal government s guidelines and security controls for combatting a broad range of cybersecurity risks. The 460-page document delivers a comprehensive and updated approach to security preparedness that gives federal agencies a platform of guidelines to set their parameters for security controls and accountability. In many ways, NIST SP 800-53 can be used as a checklist of controls to address various security baselines that should be followed closely, implemented specifically within agencies depending on the legislation, executive 0rders, policies, directives, regulations, standards, and/ or mission/business pressures. Key areas within NIST SP 800-53 include a heavy emphasis on user activity monitoring. This emphasis is specifically designed to address detecting and preventing insider threats, and controlling access to applications by both authorized general system users and privileged system users. These security controls also address increased needs for securing mobile devices, engineering systems that provide detailed auditing, setting security rules for the buildings that house government information, ensuring information privacy, and managing organizational security with the greater use of third-party support and non-governmental services offered by cloud service providers. Each of the 18 control families within NIST SP 800-53 gives IT implementers categories of emphasis. Within each control family, granular security control guidance is provided with up to 40 control enhancements. While many of the enhancements often repeat similar activities, NIST SP 800-53 s focus is very clear that government departments, agencies, and sub-contractors need to remain vigilant in protecting information and applications from insider threats and present a comprehensive overview of how to set a security baseline. This white paper focuses on the specific security controls and target key areas where Thycotic s access and security suite can help organizations meet and document compliance with NIST requirements, as well as improve an organization s security posture and ability to detect and monitor insider threats.

BECOMING NIST COMPLIANT Security Control Identifiers and Family Names ID FAMILY ID FAMILY AC Access Control MP Media Protection AT Awareness and Training PE Physical and Environmental Protection AU Audit and Accountability PL Planning CA Security Assessment and Authorization PS Personnel Security CM Configuration Management RA Risk Assessment CP Contingency Planning SA System and Services Acquisition IA Identification and Authentication SC System and Communications Protection IR Incident Response SI System and Information Integrity MA Maintenance PM Program Management ACCESS CONTROL (AC) Guidelines for organizations to set, establish, manage, and control account access across information systems under their responsibility. Enhancements include account management, enforcement, policies and procedures, session lock/termination, unsuccessful login attempts, notifications, and permitted unauthorized uses. AC Thycotic provides privilege security protections, which include account access control for any number of systems. Secret Server privileged account management (PAM) can help organizations discover privileged accounts and control access to systems. Additionally, Secret Server s session proxy capabilities ensures all access to sensitive endpoints can be controlled and protected.

AWARENESS AND TRAINING (AT) Awareness and Training Family guides organizations to enact a security training policy for current and new workers, updated training if systems change, specialized role-based training for assigned security team members, and records for security training activities. AT-1 Security Awareness and Training Policy and Procedures AT-2 Security Awareness Training AT-3 Role-Based Security Training AT-4 Security Training Records AUDIT AND ACCOUNTABILITY (AU) Audit and Accountability Family establishes the rules, procedures, security, scope of tracing, and implementation of a reviewable audit and accountability information system. Enhancements include setting auditing policy and procedures, content, events, security, recording, storage, monitoring, report generation, and analysis. AU-1 Audit and Accountability Policy and Procedures AU-2 Audit Events AU-3 Content of Audit Records AU-4 Audit Storage Capacity AU-5 Response to Audit Processing Failures AU-6 Audit Review, Analysis, and Reporting AU-7 Audit Reduction and Report Generation AU-8 Time Stamps AU-9 Protection of Audit Information AU-10 Non-repudiation AU-11 Audit Record Retention AU-12 Audit Generation AU-13 Monitoring for Information Disclosure AU-14 Session Audit AU-15 Alternate Audit AT Thycotic provides a free online PAM e-learning course that can help employees understand the importance of password security and protecting privileged passwords. Organizations can make this course part of their on-going security awareness and training programs. Thycotic also provides a free Privileged Account Management for Dummies! ebook, which can be used to educate IT staff and agency leaders on how privileged accounts are used by hackers and malicious insiders, and steps to protect these accounts. AU Every action and activity within Secret Server is recorded and auditable. When a user accesses a privileged account, not only is the access audited, but so are the actions they take, such as copying the password to a clipboard. Each activity is tied back to a specific user for accountability. Additionally, organizations can leverage Secret Server s session monitoring to store keystroke logs and video recordings of all active sessions that are created through Secret Server.

SECURITY ASSESSMENTS AND AUTHORIZATION (CA) The Security Assessments and Authorization Family puts the focus on an organization s compliant risk management strategy by developing, documenting, dissemination, enacting, and reviewing policy as required. Enhancement include creating annual assessments, establishing independent assessors (or internal auditing teams), authorizing information systems interconnections (internally and externally), planned remedial actions for fixing weaknesses, sets authorizing official, sets metrics and frequency of monitoring, and performing penetration testing. CA-1 Security Assessment And Authorization Policy & Procedures CA-2 Security Assessments CA-3 System Interconnections CA-4 Security Certification [Withdrawn: Incorporated Into Ca-2] CA-5 Plan Of Action And Milestones CA-6 Security Authorization CA-7 Continuous Monitoring CA-8 Penetration Testing CA-9 Internal System Connections CONFIGURATION AND MANAGEMENT (CM) The Configuration and Management Family sets the standards for a variety of information systems and components. Enhancements include establishing a baseline configuration for each device that aligns with least privilege functionality, tracking configuration-controlled changes, analyzing to determine security impacts to changes, enforcing physical and logical access restrictions, tracking and reporting on systems and components within the systems boundaries, creating and enforcing configuration, and establishing policies for user-installed software. CM-1 Configuration Management Policy And Procedures CM-2 Baseline Configuration CM-3 Configuration Change Control CM-4 Security Impact Analysis CM-5 Access Restrictions For Change CM-6 Configuration Settings CM-7 Least Functionality CM-8 Information System Component Inventory CM-9 Configuration Management Plan CM-10 Software Usage Restrictions CM-11 User-Installed Software CM Thycotic s Privilege Manager solution can help organizations implement application control on the endpoints, helping organizations operate under least privilege. Policies can be configured to allow approved software to be installed, and can control how that software is allowed to react (such as preventing it from kicking off child processes, or allowing it to bypass UAC without the user being an admin).

CONTINGENCY PLANNING (CP) The Contingency Planning Family establishes the processes and activities required if a contingency plan is enacted. Enhancements include setting recovery objectives and priorities, training workers of the process, testing contingency plans, creating a backup site and communications for when the system is unavailable, and defining safe mode for systems. CP Thycotic solutions can be deployed for high availability, scheduled backups, and geo-replication. Additionally, our solution also has a break-the-glass mode requiring dual authorization that allows organizations to quickly recover from any type of emergency. CP-1 Contingency Planning Policy and Procedures CP-2 Contingency Plan CP-3 Contingency Training CP-4 Contingency Plan Testing CP-6 Alternate Storage Site [Incorporated into CP-2] CP-7 Alternate Processing Site CP-8 Telecommunications Services CP-9 Information System Backup CP-10 Information System Recovery and Reconstitution CP-11 Alternate Communications Protocols CP-12 Safe Mode CP-13 Alternative Security Mechanisms IDENTIFICATION AND AUTHENTICATION (IA) The Identification and Authentication Family and its enhancements establish how users or devices within an information system will be given unique identifiers for local and network access, methods such as passwords to gain that access, administering the use of a cryptographic device during login, and re-authorization thresholds. IA When access to systems are proxied through Secret Server, all users are provided an individual login account (two-factor authentication available) to access those systems. Additionally, if an organization is using an Identity Management and Provisioning solution, such as SailPoint, that system can be integrated directly with Thycotic s solution.

INCIDENT RESPONSE (IR) The Incident Response Family establishes a policy and plan to structure the roles, responsibilities, coordination, and compliance requirements during an information system security incident. Enhancements include the creation of training that includes simulated events and automated training environments, testing overall response effectiveness, handling those incidents (preparation, detection and analysis, containment, eradication, and recovery), monitoring systems, data collection, reporting correlation, and alerting security teams about leaked information during an incident. IR-1 Incident Response Policy and Procedures IR-2 Incident Response Training IR-3 Incident Response Testing IR-4 Incident Handling IR-5 Incident Monitoring IR-6 Incident Reporting IR-7 Incident Response Assistance IR-8 Incident Response Plan IR-9 Information Spillage Response IR-10 Integrated Information Security Analysis Team IR Organizations can leverage Thycotic Secret Server auditing, keystroke logging, and session monitoring to analyze privilege account access, and replay active sessions to determine exactly what happened on the endpoint during an incident response investigation. Additionally, access to these endpoints can be controlled through Secret Server to remediate endpoints.protect these accounts. MAINTENANCE (MA) The Maintenance Family establishes the rules and procedures required for the repair or maintenance of an organization s systems or components. Enhancements include scheduling, performing and documenting information system maintenance and repairs, approving those procedures (on-site or off-site), sanitizing all information from systems or media for off-site repairs, checking security controls on the devices (including maintenance tools), authorizing access for maintenance personnel, and setting timeframes for maintenance support.

MAINTENANCE (MA), CONT D MA-1 System Maintenance Policy and Procedures MA-2 Controlled Maintenance MA-3 Maintenance Tools MA-4 Nonlocal Maintenance MA-5 Maintenance Personnel MA-6 Timely Maintenance PHYSICAL AND ENVIRONMENTAL PROTECTION (PE) MA With Secret Server, organizations can control 3rd party / maintenance access to sensitive systems, granting one-time authorized access that expires once the work is completed. Additionally, access to systems can be granted in advance for a specific period of time. With session monitoring, each active remote maintenance session can be recorded and reviewed later if necessary. The Physical and Environmental Protection Family establishes protections within an organization s facilities and buildings that adhere to government security standards outside of information systems. Enhancements include a process for approving/ reviewing/revoking/monitoring authorized access for individuals at entry/exit points, changing access control cards, safeguarding the physical transmission/power lines used by information systems, controlling physical access to a system s output devices, recording all visitor access, establishing emergency process for power, shutoff and lighting, creating fire and water protection systems, regulating temperature and humidity, and removing systems or components entering or leaving a facility. PE This family is not applicable to Thycotic s solutions as we don t offer physical/ environmental protections. Yet, organizations are free to store things like Door Pin Codes within Secret Server for safe keeping, and ensuring that those who have access to the codes are the right individuals. PE-1 Physical and Environmental Protection Policy and Procedures PE-2 Physical Access Authorizations PE-3 Physical Access Control PE-4 Access Control for Transmission Medium PE-5 Access Control for Output Devices PE-6 Monitoring Physical Access PE-7 Withdrawn PE-8 Visitor Access Records PE-9 Power Equipment and Cabling PE-10 Emergency Shutoff PE-11 Emergency Power PE-12 Emergency Lighting PE-13 Fire Protection PE-14 Temperature and Humidity Controls PE-15 Water Damage Protection PE-16 Delivery and Removal PE-17 Alternate Work Site PE-18 Location Of Information System Components PE-19 Information Leakage PE-20 Asset Monitoring And Tracking

PLANNING (PL) The Planning Family establishes the rules to create a security plan and its required content and procedures. Enhancements include the development of a security plan that assigns authorization boundaries of the system (security categorization, connected systems, rules of behavior), develops a security Concept of Operations (CONOPS) for how it will operate the system, creates an information security architecture to detail how it will protect information within the organization s environment, and calls for the implementation of a central tool to manage all security-related processes. PL Thycotic s solutions are centrally managed from a single UI, and depending on deployment models, can give administrators the eyes they need on their entire privilege security program. From access requests, credential sharing, session recordings, and automated discovery and security, IT administrators can work from a single source of information. PL-1 Security Planning Policy and Procedures PL-2 System Security Plan PL-3 System Security Plan Update [Incorporated into PL-2] PL-4 Rules of Behavior PL-5 Privacy Impact Assessment [Incorporated into AR-2] PL-6 Security-Related Activity Planning [Incorporated into PL-2] PL-7 Security Concept of Operations PL-8 Information Security Architecture PL-9 Central Management PERSONNEL SECURITY (PS) The Personnel Security Family establishes how organizations manage personnel (and designated third-party) security designations. Enhancements include a risk designation for all organizational roles and related screening criteria for personnel taking those roles, screening for those with roles that require classified or special protection access, procedures for removing access rights from terminated personnel, adjusting rights for people moving to different organizational roles, management of access agreements, establishing compliance and communications regarding third-party personnel access, and the use of sanctions against personnel.

PERSONNEL SECURITY (PS), CONT D PS-1 Personnel Security Policy And Procedures PS-2 Position Risk Designation PS-3 Personnel Screening PS-4 Personnel Termination PS-5 Personnel Transfer PS-6 Access Agreements PS-7 Third-Party Personnel Security PS-8 Personnel Sanctions RISK ASSESSMENT (RA) The Risk Assessment Family helps organizations set the policies, procedures and assessments of risk within an information system to reduce the potential for harm through content activities including exposure, alteration, disclosure or removal. Enhancements include categorizing both information and information systems, documenting security categorization results, creating a risk assessment, updating assessments when the information system is changed in a significant way, and creating a vulnerability scanning process within information systems and hosted applications. RA-1 Risk Assessment Policy and Procedures RA-2 Security Categorization RA-3 Risk Assessment RA-4 Risk Assessment Update [Incorporated into RA-3] RA-5 Vulnerability Scanning RA-6 Technical Surveillance Countermeasures Survey PS When an employee is terminated from an organization, attempting to remove their access to critical infrastructure can be a challenge. Especially if the employee has written the password down. With Secret Server, administrators have a single User Audit report where they can view every credential that was ever accessed by that employee. Additionally, with a single click, they can rotate any passwords on any endpoint where the account is managed through Secret Server. RA Thycotic s Privileged Behavior Analytics tool can help an organization s risk assessment needs. Privileged Behavior Analytics creates behavior baselines for users and accounts managed by Secret Server, and can alert security teams when anomalous behavior is detected, focusing their risk assessment on specific users and accounts. Additionally, Secret Server integrates with vulnerability scanning software to allow organizations to run authenticated/ credentialed scans. This ensures systems are scanned from both an external as well as an insider perspective. Every credential used by the vulnerability scanner is logged in the audit trail, and Secret Server can automatically change passwords used by the scanner to prevent scanners from leaving password hashes exposed.

SYSTEM AND SERVICE ACQUISITION (SA) The System and Service Acquisition Family is a broad category of enhancements that establishes the plan to implement compliant information system security. Enhancements include the allocation and procurement of resources, management of security roles, documenting security services for all components, detailing how security will be designed and used on new and legacy devices, use of external information services, and managing security during developer updates or changes. SA This section covers the acquisition and implementation of a new piece of technology. Thycotic is experienced in this area, in providing all necessary and relevant information as it pertains in the selected controls by the government entity. SA-1 System and Services Acquisition Policy and Procedures SA-2 Allocation of Resources SA-3 System Development Life Cycle SA-4 Acquisition Process SA-5 Information System Documentation SA-8 Security Engineering Principles SA-9 External Information System Services SA-10 Developer Configuration Management SA-11 Developer Security Testing and Evaluation SA-12 Supply Chain Protection SA-13 Trustworthiness SA-14 Criticality Analysis [Incorporated into SA-20] SA-15 Development Process, Standards, and Tools SA-16 Developer-Provided Training SA-17 Developer Security Architecture and Design SA-18 Tamper Resistance and Detection SA-19 Component Authenticity SA-20 Customized Development of Critical Components SA-21 Developer Screening SA-22 Unsupported System Components

SYSTEM AND COMMUNICATIONS PROTECTION (SC) SC-1 System and Communications Protection Policy and Procedures SC-2 Application Partitioning SC-3 Security Function Isolation SC-4 Information in Shared Resources SC-5 Denial of Service Protection SC-6 Resource Availability SC-7 Boundary Protection SC-8 Transmission Confidentiality and Integrity SC-9 Transmission Confidentiality [Incorporated into SC-8] SC-10 Network Disconnect SC-11 Trusted Path SC-12 Cryptographic Key Establishment and Management SC-13 Cryptographic Protection SC-14 Public Access Protections Capability [provided by AC-2, AC-3, AC-5, SI-3, SI-4, SI-5, SI-7, SI-10] SC-15 Collaborative Computing Devices SC-16 Transmission of Security Attributes SC-17 Public Key Infrastructure Certificates SC-18 Mobile Code SC-19 Voice Over Internet Protocol SC-20 Secure Name /Address Resolution Service (Authoritative Source) SC-21 Secure Name /Address Resolution Service (Recursive or Caching Resolver) SC-22 Architecture and Provisioning for Name/Address Resolution Service SC-23 Session Authenticity SC-24 Fail in Known State SC-25 Thin Nodes SC Our solutions implement Role Based Access Control (RBAC) to ensure that users and admins can only view the parts of the tool that are relevant to them. This helps satisfy several isolation requirements. Due to the ability for our solution to serve as the launching platform for access to remote systems, if those remote systems only accept connections from Secret Server, then that access can always be isolated and controlled. SC-26 Honeypots SC-27 Platform-Independent Applications SC-28 Protection of Information at Rest SC-29 Heterogeneity SC-30 Concealment and Misdirection SC-31 Covert Channel Analysis SC-32 Information System Partitioning SC-33 Transmission Preparation Integrity Incorporated into SC-8 SC-34 Non-Modifiable Executable Programs SC-35 Honeyclients SC-36 Distributed Processing and Storage SC-39 Process Isolation SC-40 Wireless Link Protection SC-41 Port and I/O Device Access SC-42 Sensor Capability and Data SC-43 Usage Restrictions SC-44 Detonation Chambers

SYSTEMS AND COMMUNICATIONS PROTECTION (SI) SI Our system, on managed endpoints, SI-1 System and Information Integrity Policy and Procedures can help prevent malicious code from SI-2 Flaw Remediation running when that code is not on SI-3 Malicious Code Protection the approved application list. This SI-4 Information System Monitoring would be increased security deployed SI-5 Security Alerts, Advisories, and Directives along another anti-virus/anti-malware SI-6 Security Function Verification solution. In addition, our Privileged SI-7 Software, Firmware, and Information Integrity Behavior Analytics can help with SI-8 Spam Protection some requirements for monitoring and SI-9 Information Input Restrictions alerting on unusual activity. [Incorporated into AC-2, AC-3, AC-5, AC-6] SI-10 Information Input Validation SI-11 Error Handling SI-12 Information Handling and Retention SI-13 Predictable Failure Prevention SI-14 Non-Persistence SI-15 Information Output Filtering Memory Protection Fail-Safe Procedures 1101 17th Street NW Suite 1102 Washington DC 20036 DC LONDON SYDNEY p: +1 202-802-9399 t: @thycotic www.thycotic.com