7-Appendix C.pdf

Appendix C - Enterprise Security Framework and Standards

To enable a common understanding of the security needs of the City, an enterprise security framework was constructed. The framework relies upon readily recognizable operational security principles to facilitate communication.

Security Principles

The security principles upon which the Enterprise Security Framework organize basic cybersecurity activities at their highest level. The principles are Identify, Protect, Detect, Respond, and Recover.

These principles were selected to aid an organization in expressing its management of cybersecurity risk by organizing information, enabling risk management decisions, and addressing threats.

To assist in communication, these principles have been defined as follows:

• Identify – Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities

• Protect – Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services

• Detect – Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event

• Respond – Develop and implement the appropriate activities to take action regarding a detected cybersecurity event

• Recover – Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event

1. Enterprise Security Framework The Enterprise Security Framework relies upon a generalized layered approach to focus attention to areas of concern to the City. The four domains of the Security Framework are illustrated as follows:

Figure 1 City Security Principles

IDENTIFY

PROTECT

DETECT

RESPOND

RECOVER

City of Dallas Enterprise Reference Architecture Security Framework | High Level Reference Diagram – V01 00

Security Management Services

DATA MANAGEMENT SERVICES

Data Governance

Data Standards

Structured Data

Master Data Management Data Quality

Data Security

Unstructured Data

Business Intelligence

Data Analytics

Data Visualization

Data Distribution

Data Storage

Business Intelligence

Data Analytics

Data Visualization

Data Distribution

Data Storage

IDENTIFY

Business Env ironment Governance

Risk Mgmt Strategy Risk Assessment

Asset Management

PROTECT

Access Control

Awareness Training

Information Protection Process and Procedures Maintenance

Data Security

DETECT

Anomalies and Events

Security Monitoring

Detection Processes

RESPOND

Response Planning Communications

Analysis Mitigation

Improvements

RECOVER

Recovery Planning Communications

Improvements

BUSINESS APPLICATION SERVICES

Presentation Services Presentation Platforms

Application Services Application Lifecycle Integration Middleware

Customer Service Platform

Collaboration

Email

Search

End Points

Mobile Devices

Portable Devices

Fixed Devices

Enterprise Service Platform

Business to Business

Peer to Peer

Business to Mobile

Desktops

Interfaces

Smart Applications

INFRASTRUCTURE SERVICES

On-Prem/Colocation Infrastructure

Storage Virtualization

Block Based Virtualization

File-Based Virtualization

Server Virtualization

Virtual Machine (Host based)

O S Virtuali zation

TPM

Virtuali zation

Sessi on Ba sed

Application Virtualization Client Application

Streaming

Server Application Streaming

Cloud InfrastructureNetwork Services

Server Virtualization

Virtual Machine (Host based)

O S Virtuali zation

TPM

Virtuali zation

Sessi on Ba sed

Network Availability

Network Segmentation

Network Build

LAN

WAN

Cloud Service

Cloud Deployment

Model

Portability and Interoperability

Cloud Provider

DataCenter Architecture

& Design

Cloud Business Continuity and

Disaster Recovery

Storage Virtualization

Block Based Virtualization

File-Based Virtualization

Network Virtualization

Network Space Virtualization

Network Virtualization

Network Space Virtualization

Desktop Virtualization

Local Remote

• Data Management Services is dedicated to focusing on and protecting organizational data.

All proposed technology solutions must map their data-centric security mechanisms to this layer as appropriate.

Structured Data Unstructured Data Data Governance

• Business Application Services is focused upon the secure and authorized delivery of data and information to achieve desired business outcomes. All proposed technology solutions that address infrastructure elements must map their security mechanisms to this layer as appropriate.

Presentation Services Presentation Platforms Application Services

• Infrastructure Services is dedicated to the protection of infrastructure elements supporting business applications. All proposed technology solutions that address infrastructure elements must map their security mechanisms to this layer as appropriate.

Network Services OnPrem/Colocation Infrastructure Cloud Infrastructure

• Security Services is focused upon the governance, management, and operation of security mechanisms within the City Standards and Compliance Services performs those activities such as risk assessment and risk management, threat and vulnerability management, infrastructure protection and security monitoring. All proposed technology solutions directly impacting or complementing security activities must map their security mechanisms to this layer as appropriate.

Identify Protect Detect Respond Recover

All four domains of the Enterprise Security Framework are directed to the one goal of the protection of data and information. As with most security frameworks, the primary information security goals of the framework are Confidentiality, Integrity, and Availability.

These terms are defined as:

• Confidentiality – preserving authorized restrictions on access and disclosure, including means for protecting privacy and proprietary information.

• Integrity – guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity.

• Availability – ensuring timely and reliable access to – and use of – information.

When mapping security mechanisms to a domain, Proposers are encouraged to provide responses within the context of the previously identified security principles which underpin the City’s Enterprise Security Framework.

2. Enterprise Security and Privacy Standards

Enterprise Security and Privacy Standards have been identified as necessary elements of any Security and Privacy Program for the City and as such are designated as appropriate standards for use at the City.

The following enterprise security standards are categorized by major frameworks or groupings for the convenience of Proposers that provide solutions and services within known frameworks or groupings of standards. All standards noted are applicable to all solution and services deployed and operated for the benefit of the City.

FedRAMP NIST Standards

• SP 500-292: NIST Cloud Computing Reference Architecture

• SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems

• SP 800-37 Revision 2: Guide for Applying the Risk Management Framework to Federal

Information Systems: Security Life Cycle Approach

• SP 800-39: Managing Information Security Risk: Organization, Mission, and

Information System View

• SP 800-53 Revision 5: Security and Privacy Controls for Federal Information Systems and Organizations

• SP 800-53a Revision 5: Guide for Assessing the Security Controls in Federal

Information Systems and Organizations, Building Effective Security Assessment Plans

• SP 800-60 Revision 1, Volume 1: Guide for Mapping Types of Information and Information Systems to Security Categories

• SP 800-60 Revision 1, Volume 2: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories

• SP 800-61 Revision 2: Computer Security Incident Handling Guide

• SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

• SP 800-92: Guide to Computer Security Log Management

• SP 800-94: Guide to Intrusion Detection and Prevention Systems (IDPS)

• SP 800-115: Technical Guide to Information Security Testing and Assessment

• SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable

Information (PII)

• SP 800-128: Guide for Security-Focused Configuration Management of Information

Systems

• Federal Information Processing Standards (FIPS) 140-2: Security Requirements for

Cryptographic Modules

• FIPS 199: Standards for Security Categorization of Federal Information and Information

Systems

• FIPS 200: Minimum Security Requirements for Federal Information and Information

Systems

• FIPS 201: Personal Identity Verification (PIV) of Federal Information and Information

Systems

• Office of Management and Budget Circular A-130.

City Extensions to FedRAMP

• SP 800-30, Revision 1: Risk Management Guide for Information Technology Systems

• SP 800-31: Intrusion Detection Systems

• SP 800-35: Guide to Information Technology Security Services

• SP 800-50: Building an Information Technology Security Awareness and Training

Program

• SP 800-55, Revision 1: Performance Measurement Guide for Information Security

• SP 800-64: Security Considerations in the Information System Development Life Cycle

• SP 800-82: Guide to Industrial Control Systems (ICS) Security

• SP 800-83: Guide to Malware Incident Prevention and Handling for Desktops and

Laptops

• National Institute of Standards and Technology Internal Report (NISTIR) 8062: Privacy

Risk Management for Federal Information Systems.

Appendix C - Enterprise Security Framework and Standards