CWMD-NIST_Cybersecurity_RTM_20191018.pdf

SEQUENCE FAMILY NAME TITLE PRIORITY BASELINE-

IMPACT

DESCRIPTION SUPPLEMENTAL GUIDANCE RELATED DHS 4300A SSPD DHS 4300A SSH - POSSIBLE TAILORING DHS 4300A SSH - GENERAL COMMENTS |

REASON

NIST SP 800-171, Revision 1 - Basic and Derived Security Requirements

ACCESS CONTROL AC-1 ACCESS CONTROL POLICY

AND PROCEDURES

P1 LOW,MODER

ATE,HIGH

The organization: This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance.

Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

ACCESS CONTROL AC-1a. ACCESS CONTROL POLICY

AND PROCEDURES

P1 LOW,MODER

ATE,HIGH

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

ACCESS CONTROL AC-1a.1. ACCESS CONTROL POLICY

AND PROCEDURES

P1 LOW,MODER

ATE,HIGH

An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

5.2.a Components implement access control policy and procedures that provide protection from unauthorized alteration, loss, unavailability, or disclosure of information.

5.4.3.a Components ensure that appropriate identification and authentication controls, audit logging, and access controls are implemented on every network element.

ACCESS CONTROL AC-1a.2. ACCESS CONTROL POLICY

AND PROCEDURES

P1 LOW,MODER

ATE,HIGH

Procedures to facilitate the implementation of the access control policy and associated access controls;

and

ACCESS CONTROL AC-1b. ACCESS CONTROL POLICY

AND PROCEDURES

P1 LOW,MODER

ATE,HIGH

Reviews and updates the current:

ACCESS CONTROL AC-1b.1. ACCESS CONTROL POLICY

AND PROCEDURES

P1 LOW,MODER

ATE,HIGH

Access control policy [Assignment: organization-defined frequency]; and

ACCESS CONTROL AC-1b.2. ACCESS CONTROL POLICY

AND PROCEDURES

P1 LOW,MODER

ATE,HIGH

Access control procedures [Assignment: organization-defined frequency].

ACCESS CONTROL AC-2 ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

The organization: Information system account types include, for example, individual, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. Some of the account management requirements listed above can be implemented by organizational information systems. The identification of authorized users of the information system and the specification of access privileges reflects the requirements in other security controls in the security plan. Users requiring administrative privileges on information system accounts receive additional scrutiny by appropriate organizational personnel (e.g., system owner, mission/business owner, or chief information security officer) responsible for approving such accounts and privileged access. Organizations may choose to define access privileges or other attributes by account, by type of account, or a combination of both. Other attributes required for authorizing access include, for example, restrictions on time-of-day, day-of-week, and point-of-origin. In defining other account attributes, organizations consider system-related requirements (e.g., scheduled maintenance, system upgrades) and mission/business requirements, (e.g., time zone differences, customer requirements, remote access to support travel requirements). Failure to consider these factors could affect information system availability. Temporary and emergency accounts are accounts intended for short-term use. Organizations establish temporary accounts as a part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts (e.g., local logon accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include, for example: (i) when shared/group, emergency, or temporary accounts are no longer required; or (ii) when individuals are transferred or terminated. Some types of information system accounts may require specialized training.

2.1.6.d The AO is responsible for review and approval of any individual requiring administrator privileges. The AO may delegate the performance of this duty to the appropriate system owner or Program Manager.

4.1.3.a System Owners ensure that users of the information systems supporting their programs have a valid requirement to access these systems.

4.1.4.a Components divide and separate duties and responsibilities of critical information system functions among different individuals to minimize the possibility of any one individual having the necessary authority or system access to be able to engage in fraudulent or criminal activity.

4.1.4.b All individuals requiring administrator privileges are reviewed and approved by the appropriate Authorizing Official (AO). The AO may delegate this duty to the appropriate System Owner or Program Manager.

4.1.6.a Components implement procedures to ensure that system access is revoked for DHS employees, contractors, or others working on behalf of DHS who leave the Component, are reassigned to other duties, or no longer require access.

4.1.6.c Accounts for personnel on extended absences are temporarily suspended.

4.1.6.d System Owners review information system accounts supporting their programs at least annually.

5.2.d Emergency and temporary access authorization are strictly controlled and are approved by the Component Chief Information Security Officer (CISO) or Information Systems Security Manager (ISSM) or his/her designee prior to being granted.

5.4.3.a Components ensure that appropriate identification and authentication controls, audit logging, and access controls are implemented on every network element.

ACCESS CONTROL AC-2a. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Identifies and selects the following types of information system accounts to support organizational missions/business functions:

[Assignment: organization-defined information system account types];

ACCESS CONTROL AC-2b. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Assigns account managers for information system accounts;

ACCESS CONTROL AC-2c. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Establishes conditions for group and role membership;

ACCESS CONTROL AC-2d. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

ACCESS CONTROL AC-2e. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

2.1.6.d The AO is responsible for review and approval of any individual requiring administrator privileges. The AO may delegate the performance of this duty to the appropriate system owner or Program Manager.

4.1.4.b All individuals requiring administrator privileges are reviewed and approved by the appropriate Authorizing Official (AO). The AO may delegate this duty to the appropriate System Owner or Program Manager.

5.2.d Emergency and temporary access authorization are strictly controlled and are approved by the Component Chief Information Security Officer (CISO) or Information Systems Security Manager (ISSM) or his/her designee prior to being granted

ACCESS CONTROL AC-2f. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

4.1.6.a Components implement procedures to ensure that system access is revoked for DHS employees, contractors, or others working on behalf of DHS who leave the Component, are reassigned to other duties, or no longer require access.

ACCESS CONTROL AC-2g. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Monitors the use of information system accounts;

ACCESS CONTROL AC-2h. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Notifies account managers:

ACCESS CONTROL AC-2h.1. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

When accounts are no longer required;

ACCESS CONTROL AC-2h.2. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

When users are terminated or transferred; and

ACCESS CONTROL AC-2h.3. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

When individual information system usage or need-to-know changes;

ACCESS CONTROL AC-2i. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Authorizes access to the information system based on:

ACCESS CONTROL AC-2i.1. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

A valid access authorization; 4.1.3.a System Owners ensure that users of the information systems supporting their programs have a valid requirement to access these systems.

ACCESS CONTROL AC-2i.2. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Intended system usage; and

ACCESS CONTROL AC-2i.3. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Other attributes as required by the organization or associated missions/business functions;

4.1.4.a Components divide and separate duties and responsibilities of critical information system functions among different individuals to minimize the possibility of any one individual having the necessary authority or system access to be able to engage in fraudulent or criminal activity.

4.1.6.c Accounts for personnel on extended absences are temporarily suspended.

ACCESS CONTROL AC-2j. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Reviews accounts for compliance with account management requirements [Assignment:

organization-defined frequency]; and

4.1.6.d System Owners review information system accounts supporting their programs at least annually.

ACCESS CONTROL AC-2k. ACCOUNT MANAGEMENT P1 LOW,MODER

ATE,HIGH

Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

ACCESS CONTROL AC-2 (1) AUTOMATED SYSTEM

ACCOUNT MANAGEMENT

MODERATE,H

IGH

The organization employs automated mechanisms to support the management of information system accounts.

The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage.

Technology - For commercial off-the-shelf (COTS) and Government off-the-shelf (GOTS) software, the automated mechanisms to support this control are those which are native to the product. For developing systems, the automated mechanisms for account management must be consistent with the requirement and have an interface that can handle the volume of users on the system and the knowledge of the typical system administrator. For legacy systems, any mechanism that allows an account administrator to automatically manage accounts (e.g., command line interface) is consistent with this control.

ACCESS CONTROL AC-2 (2) REMOVAL OF TEMPORARY

/ EMERGENCY ACCOUNTS

MODERATE,H

IGH

The information system automatically [Selection:

removes; disables] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].

This control enhancement requires the removal of both temporary and emergency accounts automatically after a predefined period of time has elapsed, rather than at the convenience of the systems administrator.

Risk - Temporary or emergency accounts are terminated after 30 days, without a written request for extension. Systems that do not have the capability to automatically terminate accounts may institute manual processes to perform this function. This manual process will be identified as a risk to the system.

ACCESS CONTROL AC-2 (3) DISABLE INACTIVE

ACCOUNTS

MODERATE,H

IGH

The information system automatically disables inactive accounts after [Assignment: organization-defined time period].

Technology - Inactive accounts are disabled after 30 days. Reactivation of the account requires the same approval as the initial activation of the account. Systems that do not have the capability to automatically disable inactive accounts may institute manual processes to perform this function. This manual process will be identified as a risk to the system.

ACCESS CONTROL AC-2 (4) AUTOMATED AUDIT

ACTIONS

MODERATE,H

IGH

The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment:

organization-defined personnel or roles].

AU-2,AU-12 Technology - Account management functions are performed by a privileged user. Privileged user actions must be audited. Notifications can be any mechanism that informs the administrator that an action has happened, may be an alert or an e-mail to the security administrator.

ACCESS CONTROL AC-3 ACCESS ENFORCEMENT P1 LOW,MODER

ATE,HIGH

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Access control policies (e.g., identity-based policies, role-based policies, control matrices, cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, domains) in information systems. In addition to enforcing authorized access at the information system level and recognizing that information systems can host many applications and services in support of organizational missions and business operations, access enforcement mechanisms can also be employed at the application and service level to provide increased information security.

AC-2,AC-4,AC-5,AC-

6,AC-16,AC-17,AC-

18,AC-19,AC-20,AC-

21,AC-22,AU-9,CM-

5,CM-6,CM-11,MA-

3,MA-4,MA-5,PE-3

4.5.3.a Components implement controls to ensure that only authorized individuals are able to participate in each video conference.

4.5.3.c Components implement controls to ensure that only authorized individuals are able to participate in each video conference.

4.6.2.4.g Multiple or split communication paths are not used on devices.

4.8.3.b Components limit access to system software and hardware to authorized personnel.

Scalability - Users should be given access to system information for which they have a need to know. If all users are not given access to everything on the system, then authorizations are being enforced and possibly can be fine tuned, if necessary.

Technology - Some systems are single purpose systems in which users have a need to know for all of the data on the system. This type of system would enforce the authorization on the level of general user and privileged user.

Organizational - This control is provided by the organization that manages system user accounts.

BSR 3.1.1

BSR 3.1.2

ACCESS CONTROL AC-4 INFORMATION FLOW

ENFORCEMENT

P1 MODERATE,H

IGH

The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].

Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to that information. Flow control restrictions include, for example, keeping export-controlled information from being transmitted in the clear to the Internet, blocking outside traffic that claims to be from within the organization, restricting web requests to the Internet that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between information systems representing different security domains with different security policies introduces risk that such transfers violate one or more domain security policies. In such situations, information owners/stewards provide guidance at designated policy enforcement points between interconnected systems.

Organizations consider mandating specific architectural solutions when required to enforce specific security policies. Enforcement includes, for example: (i) prohibiting information transfers between interconnected systems (i.e., allowing access only); (ii) employing hardware mechanisms to enforce one-way information flows; and (iii) implementing trustworthy regrading mechanisms to reassign security attributes and security labels. Organizations commonly employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations (e.g., networks, individuals, and devices) within information systems and between interconnected systems. Flow control is based on the characteristics of the information and/or the information path.

Enforcement occurs, for example, in boundary protection devices (e.g., gateways, routers, guards, encrypted tunnels, firewalls) that employ rule sets or establish configuration settings that restrict information system services, provide a packet-filtering capability based on header information, or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Organizations also consider the trustworthiness of filtering/inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement. Control enhancements 3 through 22 primarily address cross-domain solution needs which focus on more advanced filtering techniques, in-depth analysis, and stronger flow enforcement mechanisms implemented in cross-domain products, for example, high-assurance guards. Such capabilities are generally not available in commercial off-the-shelf information technology products.

AC-3,AC-17,AC-

19,AC-21,CM-6,CM-

7,SA-8,SC-2,SC-5,SC-

7,SC-18

4.5.2.b Components configure fax servers to ensure that incoming lines cannot be used to access the network or any data on the fax server.

4.6.2.4.d Devices use low power to minimize the range of communication.

5.4.1.b Components centrally manage all remote access and dial-in connections to their systems and ensure that remote access and approved dial-in capabilities provide strong two-factor authentication, audit capabilities, and protection for sensitive information throughout transmission. DHS has an immediate goal that remote access is only allowed with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access. Any two-factor authentication is based on Department-controlled certificates or hardware tokens issued directly to each authorized user. Remote access solutions comply with the encryption requirements of FIPS 140-2, Security Requirements for Cryptographic Modules. See Section 3.14 of this Policy Directive, “Privacy and Data Security” for additional requirements involving remote access of PII.

5.4.1.c Remote access of PII complies with all DHS requirements for sensitive systems, including strong authentication. Strong authentication is accomplished by means of Virtual Private Network (VPN) or equivalent encryption and two-factor authentication. The Risk Assessment and Security Plan (SP) documents any remote access of PII, and the remote access is approved by the AO prior to implementation.

5.4.4.a Components restrict physical access to firewalls and PEPs to authorized personnel.

Scalability - The flow of information between the system and any interconnected systems or networks should be controlled at the operating system, network border security device (firewall) or routing device using the access control capabilities of that product or component. The controls that are implemented should be negotiated and documented in the Interconnection Service Agreement.

DSR 3.1.3

ACCESS CONTROL AC-5 SEPARATION OF DUTIES P1 MODERATE,H

IGH

The organization: Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes, for example: (i) dividing mission functions and information system support functions among different individuals and/or roles; (ii) conducting information system support functions with different individuals (e.g., system management, programming, configuration management, quality assurance and testing, and network security); and (iii) ensuring security personnel administering access control functions do not also administer audit functions.

4.1.4.a Components divide and separate duties and responsibilities of critical information system functions among different individuals to minimize the possibility of any one individual having the necessary authority or system access to be able to engage in fraudulent or criminal activity.

5.2.b Access control follows the principles of least privilege and segregation of duties and requires users to use unique identifiers. Social Security Numbers are not be used as login IDs.

94 ACCESS CONTROL AC-5a. SEPARATION OF DUTIES P1 MODERATE,H

IGH

Separates [Assignment: organization-defined duties of individuals];

95 ACCESS CONTROL AC-5b. SEPARATION OF DUTIES P1 MODERATE,H

IGH

Documents separation of duties of individuals; and

ACCESS CONTROL AC-5c. SEPARATION OF DUTIES P1 MODERATE,H

IGH

Defines information system access authorizations to support separation of duties.

ACCESS CONTROL AC-6 LEAST PRIVILEGE P1 MODERATE,H

IGH

The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

Organizations employ least privilege for specific duties and information systems. The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational information systems.

AC-2,AC-3,AC-5,CM-

6,CM-7,PL-2

4.1.4.c Individuals requiring administrator privileges are assigned administrator accounts separate from their normal user accounts.

4.1.4.d Administrator accounts are used only for performing required administrator duties. Individuals use their regular user accounts to perform all other functions not directly tied to administrator duties (checking email, accessing the Internet).

4.6.4.b Components limit data stored on RFID tags to the greatest extent possible, recording information beyond an identifier only when required for the application mission. When data beyond an identifier is stored on a tag, the tag’s memory is protected by access control.

5.2.b Access control follows the principles of least privilege and segregation of duties and requires users to use unique identifiers. Social Security Numbers are not be used as login IDs.

Scalability - User privileges are defined with the least amount of rights/privileges that will enable them to perform the tasks that they are required to perform. This means that not all users have the same privileges, and not all administrators have the same privileges. For small systems with limited functionality, the least privilege concept may manifest itself as only allowing those performing system and security administration to have administrative privileges.

Organizational - The definition of this control is provided by the organization that manages system user accounts.

DSR 3.1.5

ACCESS CONTROL AC-6 (1) AUTHORIZE ACCESS TO

SECURITY FUNCTIONS

MODERATE,H

IGH

The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].

Security functions include, for example, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.

Security-relevant information includes, for example, filtering rules for routers/firewalls, cryptographic key management information, configuration parameters for security services, and access control lists.

Explicitly authorized personnel include, for example, security administrators, system and network administrators, system security officers, system maintenance personnel, system programmers, and other privileged users.

AC-17,AC-18,AC-19 DSR 3.1.5

ACCESS CONTROL AC-6 (2) NON-PRIVILEGED ACCESS

FOR NONSECURITY

FUNCTIONS

MODERATE,H

IGH

The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use non-privileged accounts or roles, when accessing nonsecurity functions.

This control enhancement limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies such as role-based access control and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.

PL-4 DSR 3.1.6

ACCESS CONTROL AC-6 (5) PRIVILEGED ACCOUNTS MODERATE,H

IGH

The organization restricts privileged accounts on the information system to [Assignment: organization-defined personnel or roles].

Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from having access to privileged information/functions.

Organizations may differentiate in the application of this control enhancement between allowed privileges for local accounts and for domain accounts provided organizations retain the ability to control information system configurations for key security parameters and as otherwise necessary to sufficiently mitigate risk.

CM-6 DSR 3.1.5

ACCESS CONTROL AC-6 (9) AUDITING USE OF

PRIVILEGED FUNCTIONS

MODERATE,H

IGH

The information system audits the execution of privileged functions.

Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat (APT).

AU-2 DSR 3.1.7

ACCESS CONTROL AC-6 (10) PROHIBIT NON-PRIVILEGED

USERS FROM EXECUTING

PRIVILEGED FUNCTIONS

MODERATE,H

IGH

The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Privileged functions include, for example, establishing information system accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.

DSR 3.1.7

ACCESS CONTROL AC-7 UNSUCCESSFUL LOGON

ATTEMPTS

P2 LOW,MODER

ATE,HIGH

The information system: This control applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by information systems are usually temporary and automatically release after a predetermined time period established by organizations. If a delay algorithm is selected, organizations may choose to employ different algorithms for different information system components based on the capabilities of those components. Responses to unsuccessful logon attempts may be implemented at both the operating system and the application levels.

5.2.1.a Components configure accounts to automatically lock a user’s account after three consecutive failed logon attempts.

5.2.1.b The automatic lockout period for accounts locked due to failed login attempts is be set for 20 minutes.

5.2.1.c Components establish a process for manually unlocking accounts prior to the expiration of the 20 minute period, after sufficient user identification is established.

This may be accomplished through the help desk.

UNSUCCESSFUL LOGON

ATTEMPTS

AC-7a. UNSUCCESSFUL LOGON

ATTEMPTS

P2 LOW,MODER

ATE,HIGH

Enforces a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period]; and

UNSUCCESSFUL LOGON

ATTEMPTS

AC-7b. UNSUCCESSFUL LOGON

ATTEMPTS

P2 LOW,MODER

ATE,HIGH

Automatically [Selection: locks the account/node for an [Assignment: organization-defined time period];

locks the account/node until released by an administrator; delays next logon prompt according to [Assignment: organization-defined delay algorithm]] when the maximum number of unsuccessful attempts is exceeded.

ACCESS CONTROL AC-8 SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

The information system: System use notifications can be implemented using messages or warning banners displayed before individuals log in to information systems. System use notifications are used only for access via logon interfaces with human users and are not required when such human interfaces do not exist. Organizations consider system use notification messages/banners displayed in multiple languages based on specific organizational needs and the demographics of information system users. Organizations also consult with the Office of the General Counsel for legal review and approval of warning banner content.

4.8.4.c All use of DHS information systems by anyone (including DHS personnel, contractors, and others working on behalf of DHS) is subject to monitoring or search at any time. By completing the authentication process, the user acknowledges their consent to monitoring and acknowledges that they have no expectation of privacy for their use of or for information stored in such systems.

4.8.4.d The use of Government office equipment and DHS systems/computers constitutes consent to monitoring and auditing of the equipment/systems at all times.

Monitoring includes the tracking of internal transactions and external transactions such as Internet access. It also includes auditing of stored data on local and network storage devices as well as removable media.

4.9.a All DHS personnel, contractors, or others working on behalf of DHS have no no expectation of privacy for their use of or for information stored on any DHS network, system, or application. This policy is further extended to anyone who is granted account access to any network, system, or application in use in the Department. By completing the account login process the account owner acknowledges their consent to monitoring.

5.2.3.a Systems internal to the DHS network display a warning banner specified by the DHS CISO.

5.2.3.b Systems accessible to the public provide both a security and a privacy statement at every entry point.

ACCESS CONTROL AC-8a. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

Displays to users [Assignment: organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:

ACCESS CONTROL AC-8a.1. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

Users are accessing a U.S. Government information system;

ACCESS CONTROL AC-8a.2. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

Information system usage may be monitored, recorded, and subject to audit;

ACCESS CONTROL AC-8a.3. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

Unauthorized use of the information system is prohibited and subject to criminal and civil penalties;

and

ACCESS CONTROL AC-8a.4. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

Use of the information system indicates consent to monitoring and recording;

ACCESS CONTROL AC-8b. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and

ACCESS CONTROL AC-8c. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

For publicly accessible systems:

ACCESS CONTROL AC-8c.1. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

Displays system use information [Assignment:

organization-defined conditions], before granting further access;

ACCESS CONTROL AC-8c.2. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

ACCESS CONTROL AC-8c.3. SYSTEM USE

NOTIFICATION

P1 LOW,MODER

ATE,HIGH

Includes a description of the authorized uses of the system.

ACCESS CONTROL AC-11 SESSION LOCK P3 MODERATE,H

IGH

The information system: Session locks are temporary actions taken when users stop work and move away from the immediate vicinity of information systems but do not want to log out because of the temporary nature of their absences. Session locks are implemented where session activities can be determined. This is typically at the operating system level, but can also be at the application level. Session locks are not an acceptable substitute for logging out of information systems, for example, if organizations require users to log out at the end of workdays

4.8.1.a Components configure workstations to either log off, or activate a password-protected lock, or password-protected screensaver after 15 minutes of user inactivity.

5.2.2.a Components configure networked applications or systems to automatically lock any user session in accordance with the appropriate configuration guide. In the absence of configuration guidance, the session locks following 20 minutes of inactivity.

5.2.2.b Locked sessions remain locked until the user re-authenticates.

ACCESS CONTROL AC-11a. SESSION LOCK P3 MODERATE,H

IGH

Prevents further access to the system by initiating a session lock after [Assignment: organization-defined time period] of inactivity or upon receiving a request from a user; and

ACCESS CONTROL AC-11b. SESSION LOCK P3 MODERATE,H

IGH

Retains the session lock until the user reestablishes access using established identification and authentication procedures.

ACCESS CONTROL AC-11 (1) PATTERN-HIDING

DISPLAYS

MODERATE,H

IGH

The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.

Publicly viewable images can include static or dynamic images, for example, patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen, with the additional caveat that none of the images convey sensitive information.

DSR 3.1.10

ACCESS CONTROL AC-12 SESSION TERMINATION P2 MODERATE,H

IGH

The information system automatically terminates a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect].

This control addresses the termination of user-initiated logical sessions in contrast to SC-10 which addresses the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions. Session termination terminates all processes associated with a user's logical session except those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated.

Conditions or trigger events requiring automatic session termination can include, for example, organization-defined periods of user inactivity, targeted responses to certain types of incidents, time-of-day restrictions on information system use.

SC-10,SC-23 DSR 3.1.11

ACCESS CONTROL AC-14 PERMITTED ACTIONS

WITHOUT IDENTIFICATION

OR AUTHENTICATION

P3 LOW,MODER

ATE,HIGH

The organization: 4.6.4.d Components identify and implement appropriate operational and technical controls to limit unauthorized tracking or targeting of RFID-tagged items when these items are expected to travel outside the Component’s physical perimeter.

ACCESS CONTROL AC-14a. PERMITTED ACTIONS

WITHOUT IDENTIFICATION

OR AUTHENTICATION

P3 LOW,MODER

ATE,HIGH

Identifies [Assignment: organization-defined user actions] that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and

ACCESS CONTROL AC-14b. PERMITTED ACTIONS

WITHOUT IDENTIFICATION

OR AUTHENTICATION

P3 LOW,MODER

ATE,HIGH

Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.

ACCESS CONTROL AC-17 REMOTE ACCESS P1 LOW,MODER

ATE,HIGH

The organization: 4.12.j Any multifunction device connected to a DHS network or other information system containing sensitive information has the inbound dial in capabilities disabled.

5.4.1.a Data communication connections via modem are limited and are tightly controlled, as such connections can be used to circumvent security controls intended to protect DHS networks. Data communication connections are only allowed when approved by the Component CISO/ISSM in writing. Approved remote access to DHS networks is only accomplished through equipment specifically approved for that purpose. Tethering with wireless devices is prohibited unless approved by the appropriate AO.

5.4.1.b Components centrally manage all remote access and dial-in connections to their systems and ensure that remote access and approved dial-in capabilities provide strong two-factor authentication, audit capabilities, and protection for sensitive information throughout transmission. DHS has an immediate goal that remote access is only allowed with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access. Any two-factor authentication is based on Department-controlled certificates or hardware tokens issued directly to each authorized user. Remote access solutions comply with the encryption requirements of FIPS 140-2, Security Requirements for Cryptographic Modules. See Section 3.14 of this Policy Directive, “Privacy and Data Security” for additional requirements involving remote access of PII.

5.4.1.c Remote access of PII complies with all DHS requirements for sensitive systems, including strong authentication. Strong authentication is accomplished by means of Virtual Private Network (VPN) or equivalent encryption and two-factor authentication. The Risk Assessment and Security Plan (SP) documents any remote access of PII, and the remote access is approved by the AO prior to implementation.

5.4.5.f Remote Desktop connections, such as Microsoft’s Remote Desktop Protocol (RDP), are not used to connect to or from any DHS computer without the use of an authentication method that employs secure authentication (two-factor, encrypted, key exchange).

ACCESS CONTROL AC-17a. REMOTE ACCESS P1 LOW,MODER

ATE,HIGH

Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

ACCESS CONTROL AC-17b. REMOTE ACCESS P1 LOW,MODER

ATE,HIGH

Authorizes remote access to the information system prior to allowing such connections.

ACCESS CONTROL AC-17 (1) AUTOMATED

MONITORING / CONTROL

MODERATE,H

IGH

The information system monitors and controls remote access methods.

Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote users on a variety of information system components (e.g., servers, workstations, notebook computers, smart phones, and tablets).

AU-2,AU-12 Technology - Automated measures are used to control remote access methods. This could include Intrusion Detection Systems.

DSR 3.1.12

ACCESS CONTROL AC-17 (2) PROTECTION OF

CONFIDENTIALITY /

INTEGRITY USING

ENCRYPTION

MODERATE,H

IGH

The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

The encryption strength of mechanism is selected based on the security categorization of the information. SC-8,SC-12,SC-13 Risk - A risk-based management decision is made on the need for confidentiality and integrity on information transmitted via remote access means. If it is determined that the access needs to be protected completely, then encryption measures need to be included.

DSR 3.1.13

ACCESS CONTROL AC-17 (3) MANAGED ACCESS

CONTROL POINTS

MODERATE,H

IGH

The information system routes all remote accesses through [Assignment: organization-defined number] managed network access control points.

Limiting the number of access control points for remote accesses reduces the attack surface for organizations. Organizations consider the Trusted Internet Connections (TIC) initiative requirements for external network connections.

SC-7 Technology - All remote access to a system should be controlled through some access control point that manages the access for authorized users and also manages the services or privileges that those authorized users can perform (e.g., https but not http).

DSR 3.1.14

167 ACCESS CONTROL AC-17 (4) PRIVILEGED COMMANDS /

ACCESS

MODERATE,H

IGH

The organization:

ACCESS CONTROL AC-17 (4)(a) PRIVILEGED COMMANDS /

ACCESS

MODERATE,H

IGH

Authorizes the execution of privileged commands and access to security-relevant information via remote access only for [Assignment: organization-defined needs]; and

ACCESS CONTROL AC-17 (4)(b) PRIVILEGED COMMANDS /

ACCESS

MODERATE,H

IGH

Documents the rationale for such access in the security plan for the information system.

ACCESS CONTROL AC-18 WIRELESS ACCESS P1 LOW,MODER

ATE,HIGH

The organization: Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth.

Wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication.

4.6.1.f Component CISOs review all system applications for wireless usage, maintain an inventory of systems, and provide that inventory to the DHS CISO annually.

ACCESS CONTROL AC-18a. WIRELESS ACCESS P1 LOW,MODER

ATE,HIGH

Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and

4.6.1.g Component CISOs (1) establish usage restrictions and implementation guidance for wireless technologies; and (2) authorize, monitor, and control wireless access to DHS information systems.

4.6.2.4.a Bluetooth functionality is disabled when not in use.

4.6.2.4.b Master devices (those that have unidirectional control over one or more other devices, such as a smartphone and headset combination) include link activity status indicators such as icons or LEDs.

4.6.2.4.c Pairing is performed as infrequently as possible.

4.6.2.4.e Devices are configured for manual pairing and prompt the user to authorize any incoming connection requests; auto pairing is not used.

4.6.2.4.f Devices are maintained in non-discoverable mode except during device pairing.

4.6.2.4.g Multiple or split communication paths are not used on devices.

4.6.2.4.h Pairings are made only between approved devices. Devices may be paired to receivers in personally owned vehicles for voice communication as approved by the AO.

4.6.2.4.i Profiles are deleted for devices no longer in service.

ACCESS CONTROL AC-18b. WIRELESS ACCESS P1 LOW,MODER

ATE,HIGH

Authorizes wireless access to the information system prior to allowing such connections.

4.6.a Components do not introduce new wireless network communications technologies into the enterprise unless the appropriate AO specifically approves a technology and application.

4.6.2.b Wireless mobile devices are not tethered or otherwise physically or wirelessly connected to the DHS-wired core network without the prior written consent of the AO

ACCESS CONTROL AC-18 (1) AUTHENTICATION AND

ENCRYPTION

MODERATE,H

IGH

The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.

SC-8,SC-13 Risk - A risk-based management decision is made on whether authentication and encryption are necessary for the intended use of the access.

Authentication on the wireless access that is performed without encryption should use strong authentication mechanisms (e.g., more than just a user ID and password).

DSR 3.1.17

ACCESS CONTROL AC-19 ACCESS CONTROL FOR

MOBILE DEVICES

P1 LOW,MODER

ATE,HIGH

The organization: 4.6.1.c Components identify countermeasures to denial-of-service attacks and complete a risk based evaluation prior to approving the use of any non-GFE wireless device.

4.6.2.b Wireless mobile devices are not tethered or otherwise physically or wirelessly connected to the DHS-wired core network without the prior written consent of the AO.

4.6.2.c Wireless mobile devices that store, process, or transmit sensitive information implement full-disk encryption using NIST FIPS 140-2 Validated encryption modules3 and strong complex passwords prior to receiving sensitive information. A strong complex password is required to decrypt after any power cycling or restart.

4.6.2.d The AO approves the use of wireless mobile devices or software applications used to process, store, or transmit sensitive information from the NSA Commercial Solutions for Classified (CSFC) Program components list4; FIPS 201 Approved Products List (APL)5; or the National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme (CCEVS) product list6. Mobile devices approved by the AO are posted in the DHS Enterprise Architecture (EA) Approved Products List (APL) of the Technical Reference Model (TRM).

4.6.2.m The use of add-on devices, such as cameras and video/voice recorders, is not authorized unless approved by the AO. Functions that can record or transmit sensitive information via audio, video, Infrared (IR), or Radio Frequency (RF) are disabled or powered off in areas where sensitive information is discussed.

4.6.2.n When Biometric fingerprint technology is used as a subsequent unlock method on a mobile device; it is configured to allow no more than five (5) consecutive failed fingerprint attempts and upon failure of these attempts require entering the complex password.

4.6.2.s Information stored on any laptop computer or other mobile computing device that may be used in a residence or on travel use encryption in accordance with Section 5.5.1, Encryption, for data at rest and in motion. Passwords, tokens and Smart Cards are not stored on or with the laptop or other mobile computing device.

4.6.2.t Laptop computers are powered down when not in use (due to volatile memory vulnerabilities).

4.6.2.u "When unattended, laptop computers and other mobile computing devices are secured using one of the following methods:

• a locked office

• a locking cable

• a locked cabinet

• a locked desk" 4.6.2.v Users obtain the written approval of the office director before taking a laptop computer or other mobile computing device outside of the United States or its territories.

4.6.2.3.a Functions that cannot be encrypted using approved cryptographic modules are not used to process, store, or transmit sensitive information.

4.6.2.3.b Functions that transmit or receive video, IR, or RF signals are disabled in areas where sensitive information is discussed.

4.6.2.4.h Pairings are made only between approved devices. Devices may be paired to receivers in personally owned vehicles for voice communication as approved by the AO.

ACCESS CONTROL AC-19a. ACCESS CONTROL FOR

MOBILE DEVICES

P1 LOW,MODER

ATE,HIGH

Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

ACCESS CONTROL AC-19b. ACCESS CONTROL FOR

MOBILE DEVICES

P1 LOW,MODER

ATE,HIGH

Authorizes the connection of mobile devices to organizational information systems.

Technology - The limit of consecutive invalid access attempts is three (3) consecutive attempts during a twenty-four (24) hour period.

On the fourth (4th) invalid attempt, the user's account will be locked out for twenty (20) minutes. This is a function that needs to be a capability in the operating system or other authentication…