Thomas Howard Chris Pierce
35
DoD Information Technology Security Certification and Accreditation Process (DITSCAP) Phase III – Validation Thomas Howard Chris Pierce
description
DoD Information Technology Security Certification and Accreditation Process (DITSCAP) Phase III – Validation. Thomas Howard Chris Pierce. Resources. http://iase.disa.mil/ditscap/ditsdocuments.html. Phase 1 - Definition. Phase 1 Tasks. - PowerPoint PPT Presentation
Transcript of Thomas Howard Chris Pierce
DoD Information Technology Security Certification and Accreditation
Process (DITSCAP)
Phase III – Validation
Thomas HowardChris Pierce
Resources
http://iase.disa.mil/ditscap/ditsdocuments.html
Registration Negotiation
Agreement
A
Return fromPhases 2, 3, and 4
Verification
YesNo
DocumentMission Need
SSAA
Phase 2
1. Register the system – Inform DAA, CA, PM and Users.2. Determine system security requirements.3. Develop system architecture and define C&A boundary.4. Identify threat environment.5. Prepare security CONOPS.6. Identify organizations involved in the C&A activities.7. Tailor the activities and determine the level of effort.8. Develop draft SSAA.
Phase 1 Tasks
Phase 1 - DefinitionInitiates the DITSCAP process by acquiring or developing the information necessary to understand the IT and then using that information to plan the C&A tasks.
Phase 2 - Verification
SSAA
System
Development
Activity
Certification
AnalysisPass
Ready
for
Certification
CorrectReanalyze No
No
YesYes
Phase 1
Definition
A Phase 1
Definition
Phase 3
Validation
Life Cycle Activity (1 to n)
Verify the system’s compliance with the requirements agreed on in the SSAA. The goal is to obtain a fully integrated system for certification testing and accreditation.
Phase 2 Tasks - Certification
1. Review and validate security architecture.2. Software design analysis (i.e., NMCI applications). 3. Review network connection rule compliance.4. Review integration approach of products.5. Review life cycle management support requirements.6. Conduct vulnerability assessment.
Phase 3 - ValidationValidates the fully integrated system compliance with the requirements stated in the SSAA. The goal is to obtain full approval to operate the system - accreditation.
Phase 3 Tasks - Validation
1. Conduct Security Test and Evaluation.2. Conduct penetration testing.3. Validation of security requirements
compliance.4. Conduct site accreditation survey.5. Develop and exercise contingency/incident
response plan.6. Conduct risk management review.7. Identify residual risk and review with CA.8. Present ST&E results and residual risk to the
DAA.
Overview of Steps
Step 1 - Refine the SSAAStep 2 - Certification Evaluation of the Integrated ISStep 3 - Develop Recommendation and DAA Decision
1 - Refine the SSAA
Ensures requirements and agreements still applyReview runs throughout Phase IIIAll details are added to the SSAA to reflect system’s current stateChanges are submitted to DAA CA Program manager User representative
2 - Certification Evaluation of the Integrated IS
This step certifies the following:The fully integrated and operational system complies with the SSAA requirements.The IS may be operated at an acceptable level of risk
2 - Certification Evaluation of the Integrated IS
These are the certification tasks:2.1 Security Test and Evaluation2.2 Penetration Testing2.3 TEMPEST and Red-Black
verification2.4 Validation of COMSEC compliance2.5 System management analysis2.6 Site Accreditation Survey2.7 Contingency plan evaluation2.8 Risk-based management review
2.1.1 – Security Test & Evaluation
Assess implementation of design and features are in accordance with the SSAAValidates the correct implementation of identification and authentication, access controls and network connection rule compliance.Test plans and procedures will address security requirements and provide evidence of residual risk.The results of tests will validate proper installation and operation of features.
2.1.2 - Security Test & Evaluation
Multiple Locations are handled in the following ways:ST & E will occur at central integration and test facilityIf facility not applicable, possible test at intended-operating sites
System installation and security configuration should be tested at operational sites.
2.2 - Penetration Testing
Penetration TestingPenetration testing is suggested for applicable system classesTesting may include attempts based on common vulnerabilities of technology in use.
2.3 - TEMPEST & RED-BLACK Verification
Used to validate that equipment and site meet security requirements TEMPEST - Short name referring to investigation, study, and control of compromising emanations from IS equipment.RED-BLACK – refer to inspection of cables and power lines
2.4 - Validation and COMSEC compliance
COMSECCommunication SecurityEvaluates how well SSAA COMSEC requirements are integrated
Validates the following:
That the IS is COMSEC approvedThat the IS follows COMSEC management procedures
2.5.1 - System Management Analysis
System management infrastructure checked for support of maintenance of environment, mission and architecture.The roles and responsibilities of ISSO are examined for SSAA consistency.System and security management organization are examined to determine ISSO incident reporting and security changes implementation ability.
2.5.2 - System Management Analysis
Benefits of System Management Analysis:Insight of level of secure operation of the environmentIndication of the effectiveness of security personnelInsight into potential security problem areas
2.5.3 - System Management Analysis
Configuration management program is mandatory for maintenance of a secure postureEvaluates change control and configuration management practices on integrity of software and hardwarePeriodic re-verification on configuration for unauthorized changes
2.6 - Site Accreditation Survey
Ensures that site operation is accomplished in accordance with SSAAValidates that operational procedures pose no unacceptable riskWhen system not confined to fixed site, system will be evaluated in a representative site or environment
2.7 - Contingency Plan Evaluation
Evaluates that contingency, back-up and continuity service plans meet SSAA requirementsDoD Directive 5200.28 requires periodic test for critical systems
2.8 - Risk Management Review
Evaluates operation of system to see if CIA is being maintainedEvaluates system vulnerabilities Evaluates operational procedures and safeguards in offsetting a risk
3 – Develop Recommendation and DAA Decision
Begins after completion of all certification tasksEnds with DAA Accreditation decisionPurpose Consolidate findings Submit CA’s report Produce DAA decision
3.1 – CA’s Recommendation
CA issues system certification if technical requirements are satisfiedSupplemental recommendations might be made to improve security postureShould provide input to future enhancement and change management decisions
3.1.1 - Deficiencies
CA may uncover security deficiencies, but believe risk level is acceptableCA may make recommendation as long as there will be timely correction of deficienciesSSAA will reflect deficienciesAgreement obtained outlining acceptable operating conditions
3.1.2 – Don’t Accredit
If CA determines the system Does not satisfy the SSAA, and Short-term risks are unacceptable
CA will recommend the system not be accredited
3.2 – DAA Accreditation Decision
Accreditation package consists of: CA’s recommendation DAA authorization to operate Supporting documentation SSAA
Supporting documentation may vary, but should include at least: Security findings and deficiencies Risks of operation
3.2.1 - DAA Accreditation Decision
If decision is to accredit it will include security parameters of acceptable operating conditionsIf decision does not meet SSAA requirements a temporary approval may be issued if system need be operational This requires a return to Phase I to
negotiate accepted solutions, schedule, and security actions
3.2.2 - DAA Accreditation Decision
When accreditation has been issued the responsibility for the SSAA moves to the system operatorPhase IV begins if decision is to accreditIf accreditation is withheld Reasons for denial are stated Suggested solutions are provided DITSCAP reverts to Phase I to resolve the
issues
Mobile systems are difficult to accredit at all possible locationsGeneric accreditation may be issued for a typical operating environmentIt is the official authorization to employ identical copies in a specified environment
3.2.3 - Generic Accreditation
3.2.3 - Generic Accreditation
SSAA will identify Specific uses of the system Operational constraints and procedures
DAA would include disclaimer stating that operators are responsible for monitoring the environment for compliance
Roles and Responsibilities
Describes the functional relationships and integration of these roles of each of the In some cases the roles may be performed by three separate organizationsIn other cases some roles may be combined
Phase 1 – Role and Responsibility
Program Manager DAA and CA User Representative
Initiate security dialogue with DAA, the CA, and the user representative.
Define system schedule and budget.
Define and/or validate system performance, availability, and functionality requirements.
Support DITSCAP tailoring and level of effort determination.
Draft or support drafting of the SSAA.
Reach agreement on the SSAA.
Approve the SSAA.
Define ITSEC accreditation requirements.
Obtain threat assessment.
Begin vulnerability and risk assessments.
Assign the CA.
Support DITSCAP tailoring and determine the level of effort.
Draft or support drafting of the SSAA.
Reach agreement on the SSAA.
Approve the SSAA.
Validate and/or define system performance, availability and functionality requirements.
Support DITSCAP tailoring and level of effort determination.
Reach agreement on the SSAA.
Approve the SSAA.
Phase 2 – Role and Responsibility
Program Manager DAA and CA User Representative
Review the SSAA.
Develop system or system modifications.
Support certification actions.
Review certification results.
Revise system as applicable.
Review the SSAA.
Evaluate developing system.
CA performs certification actions.
CA assesses vulnerabilities
CA reports results to the program manager, the DAA, and the user representative.
Maintain the SSAA.
Review the SSAA.
Support certification actions.
Phase 3 – Role and Responsibility
Program Manager DAA and CA User Representative
Review the SSAA.
Test integrated system.
Support certification actions.
Review certification results.
Revise system as applicable.
Support SSAA revisions.
Review the SSAA.
Evaluate developing system.
CA performs certification actions.
Assess vulnerabilities and residual risk
CA reports results to the program manager, the DAA, and the user representative.
CA develops recommendation to the DAA.
CA prepares accreditation package.
Review the SSAA.
Issue decision.
Review the SSAA.
Support certification actions.
Review certification results.
Support SSAA revisions.
Conclusion
Validate that Phase I & II has produced an IS that operates in a specified computing environment with acceptable riskThe goal is to obtain full approval to operate – Accreditation
Questions?
