Industry Day Pool C.pptx

Pool C: CISO Cybersecurity Services CloudFirst Enterprise Systems Support Services (CFESSS)

Development Finance Corporation (DFC) Office of Information Technology (OIT)

Industry Day

September 7, 2022

Pool Breakout Agenda

10:35 – 11:00 am DFC Presentation

11:00 – 11:45 am Q & A

11:50 – 12:20 pm Back to general session for close

Time

Presenter

Industry conversation

DFC OA

Michael Goulding dfc.gov |

Please ask questions!

Please put your questions in the chat The federal team may request the question be clarified and unmute you The federal team will do their best to answer each question in the order it is received

Session Rules

CISO Division

Who We are:

Current Federal Staffing: 3 Federal employees, 1 Federal vacancy Current Environment:

4 - FISMA Reportable Systems (3 Moderate and 1 Low) 17 - Major Applications that fall under the General Support System (GSS) authorization boundary Total Open POA&M items: 17 Open POA&M items relating to FISMA OIG audit recommendations: 11

Mission: Deliver high-quality, innovative cybersecurity services and solutions that enable business and reduce cybersecurity risk across the agency in accordance with federal laws and regulations while also fostering open communication across organizational business units, team members and agency customers in order to align a security-conscious mindset with the agency’s mission and business goals.

DFC Cybersecurity Program We must understand the current Cybersecurity posture of the agency. To do this, the CISO team will deploy and manage the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) aligned with the NIST Cybersecurity Framework (CSF) Functions.

The foundation of the DFC Cybersecurity program is built on implementing and monitoring the appropriate NIST controls based on the Office of Management and Budget (OMB) guidance along with industry standards and best practices.

The maturity of the DFC Cybersecurity program is assessed annually by the Office of the Inspector General (OIG) in accordance with the FY OIG Federal Information Security Management Act (FISMA) Reporting Metrics.

FY OIG FISMA Reporting Metrics/ Evaluation Maturity Levels AD Hoc Policies, procedures, and strategies are not formalized; activities are performed in an ad-hoc, reactive manner.

Defined Policies, procedures, and strategies are formalized and documented but not consistently implemented.

Consistently Implemented Policies, procedures, and strategies are consistently implemented, but quantitative and qualitative effectiveness measures are lacking.

Managed and Measurable Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategies are collected across the organization and used to assess them and make necessary changes.

Optimized Policies, procedures, and strategies are fully institutionalized, repeatable, self-generating, consistently implemented, and regularly updated based on a changing threat and technology landscape and business/mission needs.

Cybersecurity Framework (CSF)

IDENTIFY

What processes and assets need protection?

PROTECT

What safeguards are available?

DETECT

What techniques can identify incidents?

RESPOND

What techniques can contain impacts of incidents?

RECOVER

What techniques can restore capabilities?

Target Assessment: Managed and Measurable

DFC Cybersecurity Program Functions

* These functions also address any current and future directives issued in response to or aligned with the Executive Order 14028.

Governance, Risk Management and Compliance This function addresses the OMB, NIST and FedRAMP requirements to manage federal information systems including system authorization, continuous monitoring and supporting the annual FISMA OIG audits.

Cybersecurity Monitoring This function addresses the daily monitoring of the cybersecurity tools providing visibility into the DFC environment including the Incident Response (IR) process from event notification and escalation to incident investigation, reporting and remediation and recovery. Also included in this function is responding to various data calls (EEO, HR, FOIA, Legal, Records Management, etc.) by performing eDiscovery searches on both cloud or on-premise environments.

Standards and Design This function addresses the cybersecurity responsibilities in participation in the Change Control Process: Technical Review Board (TRB)/Change Approval Board (CAB), conducting vulnerability/compliance scanning and reporting and assessing asset and access hardening controls.

Security Architecture This function addresses the development of the security architecture and the continuous review of the cybersecurity tools used to monitor the DFC cloud and on-premise computing environment including DLP and maintenance and daily operations.

Federal Guidance

OMB

M-22-16 Administration Cybersecurity Priorities for the FY 2024 Budget M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles M-22-01 Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response M-21-30 Protecting Critical Software Through Enhanced Security Measures M-21-31 Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents M-21-07 IPv6 and Zero Trust

DHS/CISA

Emergency Directives (ED) Binding Operational Directives (BOD) 22-01 Reducing the Significant Risk of Known Exploited Vulnerabilities 20-01 Develop and Publish a Vulnerability Disclosure Policy 19-02 Vulnerability Remediation Requirements for Internet-Accessible Systems Cyber Coordination and Action Response (C-CAR) Cyberscope Reporting Executive Order 14028 Improving the Nation’s Cybersecurity

Network Security Monitoring – Intrusion Detection System (IDS) Security Onion monitoring multiple 10 gb SPANs. SNORT rulesets.

Endpoint Detection and Response (EDR) – Microsoft Defender for Endpoint (M365) Vulnerability and Compliance Scanning – Tenable Security Center Compliance Baseline – Center for Internet Security (CIS) Benchmark Asset Monitoring – Absolute Data and Device Security Security Information and Event Management (SIEM) Tool – Splunk Cloud Patch Management – BigFix Network Access Controller (NAC) – Aruba ClearPass IT Infrastructure Monitoring Tool – ManageEngine OpManager CISA CDM – Qualys Managed Trusted Internet Protocol Services (MTIPS) – AT&T (working on TIC 3.0 through Zscaler) Einstein E3A – Verizon Mobile Device Manager (MDM) – M365 Intune

DFC Cybersecurity Systems and Tools

Q & A What’s the vendor’s ability to surge in the event of:

New Federal guidance (Executive Order 14028) Security incident (SolarWinds eradication) Deploying and documenting new tools and services New Microsoft 365 G5 services Vendor having reach back within the company for support if current personnel need assistance or don’t have the requisite skillset Vendor’s responsibility to stay abreast of changes in Federal guidance, industry standards and best practices Vendor’s ability to support transitioning cybersecurity services to cloud environment without gaps or interruptions in visibility image6.png image7.png image1.png image8.png image9.png image10.svg

.MsftOfcThm_Background1_Fill_v2 { fill:#FFFFFF;

image11.png image12.svg

.MsftOfcThm_Background1_Fill_v2 { image13.png image14.png image15.png image16.png image17.svg

.MsftOfcThm_Background1_Fill_v2 { image18.png image19.svg

.MsftOfcThm_Background1_Fill_v2 { image20.png