COL (R) Michael F. Brown Director, Information Systems Security Cyber Security: An Educator’s...

COL (R) Michael F. Brown

Director, Information Systems Security

Cyber Security:

An Educator’s Challenge

TSD REPLAY, SEPTEMBER 11, 2001TSD REPLAY, SEPTEMBER 11, 2001

Prepared By: Prepared By:

Air Traffic Tactical OperationsAir Traffic Tactical Operations

LOWER 48 STATESLOWER 48 STATES

LOWER 48 STATES 1230Z TO 1530Z

ATCSCC Actions:1306Z ZNY GS1311Z ZBW GS1326Z GS all centers1345Z All centers to land airborne traffic ASAP

FLIGHT KEY:

MILITARY OTHER U.S. TRAFFIC

FLIGHT KEY:

39MENU

FLIGHT KEY:

PMAPMA

FISMAFISMA

Sarbains OxleySarbains Oxley

Business RequirementsBusiness Requirements

Business StrategyBusiness Strategy

National Cyber Strategy

“CALL TO ACTION”

•Federal Regulations

•Customer Requirements

•Strategy

WELCOME TO THE EXCITING WORLD OF HPVAC

HACKINGHACKINGPHREAKINGPHREAKING

VIRIVIRIANARCHYANARCHYCARDING/CARDING/CELLULARCELLULAR

HACKED WWW HOMEPAGES

CIA HOMEPAGE

DOJ HOMEPAGE

USAF HOMEPAGE

The mission of the Information Security department is to protect the information assets, the information systems, and the networks that deliver theinformation from damage resulting from failures of confidentiality, integrity, andavailability.

Security’s objective is to enhance the productivity of the business by reducingprobability of loss through the design and implementation of policy, standards,procedures, and guidelines that enhance the protection of business assets.

Defining the Role

“Departmentally” Specific ……

Business Objective ……

NationalNational

CyberCyber

SecuritySecurity

StrategyStrategyRequirements

Requirements

Strategy Determines Requirements and

Requirements Drive Resources

Strategy

StrategyStrategyStrategy

OperationalOperational

RequirementsRequirements

Mission NeedsMission Needs

The Business PlanThe Business Plan

The Flight Plan The Flight Plan GoalsGoals

ObjectivesObjectives

Sub-ObjectivesSub-Objectives

Prioritized TasksPrioritized Tasks

ybe r S

ec urit y

yber S

e cur ity

Str ate g

t rat egy

era l Info

r ma tio

e de ral In

ati on

r ity Man

e curity M

a na g

LOB Participation and Influence

ExternalInternalDrivers

Prioritizing Constrained Resources

BoundaryProtection

Vulnerability Scanning

Insider/Outsider ThreatIntrusion Detection

and Prevention

SystemCertification

Transport/Application LayerVPNs

Firewalls

Anti-viral

A Case Study

The FAA Information

Systems Security

Program

System of Systems

Internet Access Points

Messaging

Systems

Finance

and Budget

Personnel and PayrollAsset Management

Flight Procedures

Security

Inspection

Safety

Analysis

Accident / Incident Investigation

• Manage more than 30,000 commercial flights to move 2,000,000 passengers safely each day

• Support more than 35,000 general aviation flights on a daily basis

• Regulate and certify the people and aircraft that use our airspace

FAA’s Job

National Airspace System (NAS)

The Evolving Landscape of Cyber Security

•Standardized Certification

A New Look at Cyber Defense

The “Android” Approach

The “Android” Cyber Defense –Emulates the most resilient system in the world

Enterprise Architecture

Admin Equip.

MVS2000-AWP

Contracts

ACQUIRE

Finance

Retirement

Finance

DAFIS-MIR

Finance

FIRS-AWP

Finance

OPS FMS

Finance

AUTOGEN

Finance

ACE-MIR

Finance

MRPFinance

FED/MIL

Finance

RPMMSFinance

Finance

FIRS-ASW

Finance

BPCY-PCS

Finance

JF-SLH

Finance

LEASES

Finance

CHECKTRAC

Finance

PB-ICE

Finance

OIG32-9F

Finance

TRANVOUC

Finance

ORB-FIN

Finance

VFADMS

Finance

RED-MAR

Finance

FEDTRIP

Finance

RPMMS-ASW

Finance

T-SERVE

Finance

OARMIS

Finance

DAFIS-ASW

Finance

MED BILL

Finance

FMS-AHR

Finance

MM-SDG

Finance

WT-TVT

Finance

FETS-ASO

Finance

MSEXCEL-FIN

Finance

MSWORD-FIN

Finance

CFACTS-

FIGURES

Finance

CQUICKEN-FIN-

Finance

CUFF-FIN

Finance

CUPS-AWP

Finance

DAFIS-AWP

Finance

BU-SBP

Finance

QB-SAP

Finance

FETS-ASW

Finance

EBank ofAmerica

Finance

Treasury

Finance

CUPS-LOCAL

IT Services

NASPAS

IT Services

Assets

Av. Training

A/C TRAINING

Finance Services

As Is To Be

Finance Services

• Reduction in applications and interfaces• Improved connectivity• Simplified architecture• Reduced potential vulnerabilities

Element Hardening and Boundary Protection

Element Hardening

– 96% of IT systems certified and authorized

– Vulnerability scanning of public facing and internal servers on a regular basis

– Patch management to facilitate timely remediation of discovered vulnerabilities

Boundary Protection

– Security a major component of Federal Telecommunications Infrastructure, IAPs limited to 8 and hardened, e-mail post offices reduced from 850 to 12 and hardened

– Defense in-depth approach—firewalls, encryption, virtual private networks, and anti-viral software

Computer Security Incident Response Center (CSIRC)

Cyber Fusion Center

The Keystone to Making this all Work is a Trained

and Ready Workforce

Purpose of Awareness and Training

The two goals of the ISS Awareness and Training Program are:

• To make all users aware of FAA ISS responsibilities

• To provide each line of business (LOB) and staff office (SO) with the training necessary to obtain the knowledge, skills, and abilities required to maintain information systems, implement ISS policies, and offer training opportunities to named key personnel.

Awareness and Training Program

The Federal Information Security Management Act of 2002 (FISMA)

• Requires each federal agency to “provide for the

mandatory periodic training in computer security

awareness and accepted computer practices of all

employees who are involved in the management, use or operation of each federal computer system

within or under the supervision of that agency.”

• Requires training under OMB, A130, Appendix III, and in accordance with guidelines co-developed by NIST.

Awareness and Training Program

In support of FISMA, the Office of Information Systems Security (AIS) Training Program shall:

• Establish an ISS awareness and training program• Provide awareness refresher briefings• Provide training to those who design, implement, or

maintain information systems• Provide specialized training to key personnel who have

been designated by their LOB/SO

Awareness

The purpose of the FAA Awareness Program is:

- To focus attention on security

- To create sensitivity to the threats and vulnerabilities of

information systems

- To recognize the need to protect data, information and systems

Awareness Methods

- Broadcast Email Messages

- Web-based activity: Security Awareness Virtual Initiative (SAVI)

- Warning Banners

- Information Security Newsletters

- Awareness Events (briefings, conferences, expositions)

- Meetings/Lectures related to ISS topics

- Interactive Kiosk

Training

Develop relevant and needed skills that map to defined responsibilities for each role.

Methods of Training

– Instructor-led training or face-to-face communications is the most personal method of training. The type of training is the most effective in the FAA.

– Computer Based Training (CBT) is offered at the FAA. CBT is utilized by a small percentage of FAA employees.

– System Administrator Simulation Training

Training

As part of the Training Program the FAA’s 2005 IT/ISS Conference was held February 28 through March 4 in San Diego, California.

Technical Training Sessions Held:

– Patch Management– Public Key Infrastructure– FAA Telecommunications Infrastructure– Enterprise License Agreement– Web Security– Vulnerability

The training classes were video taped to be provided as a learning tool for

those key personnel who were unable to attend. The tapes will be taken to

each Region and used in conjunction with other training.

Outreach Program

Technology is accelerating and changing complexity daily

To keep up with technology FAA must:

- Seek new talent through colleges and universities

- Use the Scholarship for Students Program sponsored

by OPM

- FAA (AIS) will utilize internship programs

- FAA will leverage research and development efforts at

colleges and universities that can be adapted to FAA’s

ISS program goals and objectives

Academia Outreach

Program Roles and Responsibilities

- Ensure success of overall ISS efforts and promote the exchange of information with colleges and universities.

- FAA will use academia in the area of research and development.

Program Goals for 2005

- Work with institutions of higher learning who have been designated as Academic Centers of Excellence by the National Science Foundation that are participants in the Scholarship for Services Program.

- Leverage knowledge students have gained and place them in the information security field.

Federal Efforts

The National Strategy to Secure Cyberspace

– Need to build foundations for the development of security certification programs that will be broadly accepted by the public and private sectors. DHS and other federal agencies can aid these efforts by effectively articulating the needs of the federal IT security community.

Current IT Security ProfessionalCertification Environment:

Challenge:

Need to identify highly qualified people to develop, maintain, and secure our information systems and networks

No nationally recognized certification for IT security professionals

IT Security Professional Certification

- Goal: Set up nationally recognized, privately administered certifications at appropriate levels

- Scope: Vendor-neutral certifications

- Product: Industry led IT Security Professional Certification structure/ process in place

- Outcome: National IT security professional certifications

Notional IT Security Professional Certification Process

Expected Outcomes

- Standard position categories

- Standard position levels- How many- Nomenclature (e.g., I, II, III; entry, intermediate,

advanced)

- Standard functions within categories and levels- Nomenclature (what are the functions; what are they

called)

- Skill Standards- By category and level: performance standards that

delineate what a person must know and be able to do in order to successfully perform roles related to a specific job, an occupational cluster or across an industry sector

Certification Related Issues

- Governance structure Stakeholder participation

- Common body of knowledge & standardsJob task analysis, competencies

- Training, testing & accreditationAdjudication: evaluation and feedback

- Continuing education

- Mapping current IT security certifications and transitioning current certificate holders

- Business Models

Status and Next Steps

- Working with Government and private sectors to leverage ongoing efforts

- Working with the Federal CIO Council, Workforce and Human Capital Committee to leverage existing structure

- Exploring options for setting up nationally recognized, privately administered IT security professional certifications at appropriate levels

- Others?

AN OPPORTUNITY TO DO “ISS” RIGHT

Who says trains can’t fly?

COL (R) Michael F. Brown Director, Information Systems Security Cyber Security: An Educator’s...

Documents

Transcript of COL (R) Michael F. Brown Director, Information Systems Security Cyber Security: An Educator’s...

Educator’s Guide Carrie Mae Weems

Texas Music Educator’s

An Educator’s Resource Guide - Lauritzen Gardens Educator’s Resource Guide ... Given this botanical theme ... sleeve that can be affixed to the inside cover of the Educator’s

Educator’s Guide - PBSbento.cdn.pbs.org/.../1812_EdGuide_V6_Revised.pdf · Educator’s Guide Table of Contents ... there was no single Haudenosaunee response to the ... This Educator’s

Differentiated Instruction Educator’s Package · PDF fileDifferentiated Instruction Educator’s Package ... Instruction Educator’s Package. assessment . for. learning: ... and

CECA Connecticut Educator’s Computer Association

Practice Placement Educator’s Handbook

SACE EDUCATOR’S PULSE

Educator’s Guide - RMSC

Educator’s Guide Frederic Edwin Church

educator’s guide - Aerospace

an Educator’s Guid E

Module 1 Educator’s Guide Investigation 3 - NASA3 Module 1 Educator’s Guide Investigation 3 Distribute the appropriate Representative Discus-sion Points (Educator’s Guide handout)

Educator’s Guide - Space Center

2nd Grade Educator’s Guide

Educator’s Guide EMOTIONAL EMPOWERMENT

EDUCATOR’S GUIDE TO THE FILM CREATED …...Great Bear Rainforest — Educator’s Guide • 4 5 • Great Bear Rainforest — Educator’s Guide is Douglas Neasloss, chief councillor

AN EDUCATOR’S GUIDE - The Ehlers Danlos … EDUCATOR’S GUIDE 3 AN EDUCATOR’S GUIDE Many teachers and schools have contacted The Ehlers-Danlos Society with questions about EDS,

Educator’s Guide Surface Tension

2018-2019 Educator’s Guide