Attachment 2B PWS Appendix2_Security and Privacy Risk Assessment Template 2023.docx

RFP No. 15JPSS23R00000006

Transcription Services for DOJ/EOIR PWS Appendix 2

Executive Office for Immigration Review (EOIR)

Security and Privacy Risk Assessment

[DATE]

Version 1.0

UNCLASSIFIED/FOR OFFICIAL USE ONLY

Prepared for:

United States Department of Justice Executive Office for Immigration Review Office of Information Technology 5109 Leesburg Pike, Suite 900 Falls Church, VA 22041

UNCLASSIFIED/FOR OFFICIAL USE ONLY 14

This page intentionally left blank

DOCUMENT APPROVALS

This Security and Privacy Risk Assessment (SPRA) serves as an ongoing awareness tool to support the organization’s risk management decisions. The SPRA examines risks that may be introduced into the JCON/eWorld environment. It should also be noted that this is not a full Certification and Accreditation (C&A). However, the effectiveness of the security controls are examined, and configuration testing and vulnerability scanning is conducted to evaluate threats and risks that may be introduced to the environment and a baseline modification to the existing C&A will be made. By signing this document, the stakeholders acknowledge they are aware of the vulnerabilities and/or risks associated with the [Project Name].

XXXXXXXXXXXXXXXXXX

Chief Information Security Officer

Date

XXXXXXXXXXXXXXXX

Project Sponsor

Date

XXXXXXXXXXXXXXXX

Project Manager

Date

REVISION LOG

Contents

FIGURE 1 XXXXXXXX NETWORK DIAGRAM 7

Authority Federal Information Processing Standards (FIPS) are approved by the Secretary of Commerce and issued by the National Institute of Standards and Technologies (NIST) in accordance with Federal Information Security Management Act (FISMA). FIPS are compulsory and binding for federal agencies. FISMA requires that federal agencies comply with these standards, and therefore, agencies may not waive their use. Special Publications (SPs) are developed and issued by NIST as recommendations and guidance documents. For other than national security programs and systems, federal agencies must follow those NIST Special Publications mandated in a Federal Information Processing Standard. FIPS 200 mandates the use of Special Publication 800-53, as amended. In addition, Office of Management and Budget (OMB) policies (including OMB Reporting Instructions for FISMA and Agency Privacy Management), state that for other than national security programs and systems, federal agencies must follow certain specific NIST Special Publications. Other security-related publications, including interagency reports (NISTIRs) and ITL Bulletins, provide technical and other information about NIST's activities. These publications are mandatory only when specified by OMB.

In developing standards and guidelines required by FISMA, NIST consults with other federal agencies and offices as well as the private sector to improve information security, avoid unnecessary and costly duplication of effort, and ensure that NIST publications are complementary with the standards and guidelines employed for the protection of national security systems. In addition to its comprehensive public review and vetting process, NIST is collaborating with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DOD), and the Committee on National Security Systems (CNSS) to establish a common foundation for information security across the federal government. A common foundation for information security will provide the Intelligence, Defense, and Civil sectors of the federal government and their support contractors, more uniform and consistent ways to manage the risk to organizational operations and assets, individuals, other organizations, and the Nation that results from the operation and use of information systems. A common foundation for information security will also provide a strong basis for reciprocal acceptance of security authorization decisions and facilitate information sharing.

Purpose The overall purpose that the information and/or project are designed to serve and a high-level explanation of how the project achieves that purpose:

Figure 1 Network Diagram Objective The objective of this SPRA is to identify vulnerabilities, evaluate the security and privacy controls and make recommendations for risk mitigation. It is impossible to be risk free, so doing due diligence in areas of concern is the primary goal. This SPRA is to make all stakeholders aware of the risks. Vulnerability scans were conducted to identify the vulnerabilities and the risks that they present to the IT security posture. Security controls were evaluated using NIST 800-53 to measure risks based on the minimal standards set forth by this federal regulation. From this SPRA, one can prevent, minimize, mitigate, or accept risk based on the business needs of the organizations.

Vulnerabilities Identified This section identifies the vulnerabilities as a result of the vulnerability scans conducted using Nessus for scanning the operating system and database and Burp Suite for scanning the public facing web applications. The combination of the three vulnerability scans comprise the penetration testing as required by federal regulations for public facing application to undergo prior to being placed into production. Specifically, the scan results identified the following vulnerabilities, threats and risk ratings:

Example Vulnerability 1: Microsoft Patches (MS15-018, MS15-020, MS15-021, MS15-022)

Overall Risk Rating High

Example Vulnerability 2: Microsoft Patch (MS15-011)

Overall

High

Example Vulnerability 3: Permission on registry extended proc: Granted To=public

Overall

High

Example Vulnerability 4: Penetration Test Results

Overall

Medium

Security and Privacy Requirements Identified This section identifies the Security and Privacy requirements that the [Project Name] application shall satisfy to ensure that the system meets the Department’s minimum Security requirements. The [Project Name].application shall contain Personally Identifiable Information (PII), which is sensitive information about individuals and should be treated with confidentiality. The integrity of the PII must be protected in accordance with Federal Laws and Regulations.

WARNING: You are accessing a U.S. Government information system, which includes: (1) this computer, (2) this computer network, (3) all computers connected to this network, and (4) all devices and storage media attached to this network or to a computer on this network. This information system is provided for U.S. Government-authorized use only. Unauthorized or improper use of this system may result in disciplinary action, and civil and criminal penalties. By using this information system, you understand and consent to the following: -You have no reasonable expectation of privacy regarding any communications transmitted through or data stored on this information system. At any time, the government may monitor, intercept, search and/or seize data transiting or stored on this information system. -Any communications transmitted through or data stored on this information system may be disclosed or used for any U.S. Government-authorized purpose. For further information see the Department order on Use and Monitoring of Department Computers and Computer Systems.

WARNING: You are accessing a U.S. Government information system. This information system is to be used by authorized users only. Your use of this information system may be monitored, recorded, or audited. All access or use of this information system indicates consent to monitoring, recording or auditing such use. Authorized use of this system is currently limited to accessing and making permitted changes to your profile and electronically filing designated forms before the Executive Office for Immigration Review. Unauthorized or improper use of this system is prohibited and may result in criminal, civil, or administrative penalties.

AC-08

a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and

b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.

AR-02

(i) date and time of event;

(ii) the component of the information system where the event occurred (e.g., software or hardware component);

(iii) type of event;

(iv) user/subject identity;

(v) the outcome (success or failure) of the event;

(vi) session, connection, transaction, and activity duration;

(vii) source and destination addresses;

(viii) object or filename involved; and

(ix) number of bytes received and bytes sent (for client-server transactions) in the audit records for audit events identified by type, location, or subject.

AU-03

a. Identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection;

b. Limits the collection and retention of PII to the minimum elements identified for the purposes described in the notice and for which the individual has provided consent; and

c. Conducts an initial evaluation of PII holdings and establishes and follows a schedule for regularly reviewing those holdings [organization-defined frequency, at least annually] to ensure that only PII identified in the notice is collected and retained, and that the PII continues to be necessary to accomplish the legally authorized purpose..

DM-01

- Upper-case

- Lower-case

- Numeric

- Special characters (e.g. ~ ! @ # $ % ^ & * ( ) _ + = - ‘ [] / ? > <) for user accounts and in accordance with the DOJ Strong Authentication Plan.

IA-05(1)

a. Protect and control types of system media (i.e. flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state and magnetic), compact discs, and digital versatile discs, microfilm and paper) during transport outside of controlled areas using physical and/or procedural controls (i.e. cryptography and locked containers);

b. Maintain accountability for system media during transport outside of controlled areas;

c. Document activities associated with the transport of system media; and

d. Restrict the activities associated with the transport of system media to authorized personnel.

MP-05

a. Sanitize system media prior to disposal, release out of organizational control, or release for reuse using sanitization techniques and procedures as defined in the DOJ Security Program Operating Manual (SPOM); and

b. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

MP-06

a. Restrict the use of unauthorized system media (i.e. restricting or prohibiting the use of flash drives or external hard disk drives) on system components using physical cages on workstations to prohibit access to certain external ports or disabling or removing the ability to insert, read, or write to such devices; and.

b. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

MP-07

a. Enforce physical access authorizations at entry and exit points to the facility where the system resides by:

1. Verifying individual access authorizations before granting access to the facility; and

2. Controlling ingress and egress to the facility using physical access control systems or devices, and/or guards;

b. Maintain physical access audit logs for 1 (one) year;

c. Control access to areas within the facility designated as publicly accessible by implementing the following controls: physical access controls;

d. Escort visitors and control visitor activity circumstances requiring visitor escorts and control of visitor activity;

e. Secure keys, combinations, and other physical access devices;

f. Inventory physical access devices every annually; and

g. Change combinations and keys quarterly and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

PE-03

a. Provides effective notice to the public and to individuals regarding:

1. Its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII);

2. Authority for collecting PII;

3. The choices, if any, individuals may have regarding how the organization uses PII and the consequences of exercising or not exercising those choices; and

4. The ability to access and have PII amended or corrected if necessary;

b. Describes:

1. The PII the organization collects and the purpose (s) for which it collects that information;

2. How the organization uses PII internally;

3. Whether the organization shares PII with external entities, the categories of those entities, and the purposes for such sharing;

4. Whether individuals have the ability to consent to specific uses or sharing of PII and how to exercise any such consent;

5. How individuals may obtain access to PII; and

6. How the PII will be protected; and

c. Revises its public notices to reflect changes in practice or policy that affect PII or changes in its activities that impact privacy, before or as soon as practicable after the change.

TR-01

a. Publishes System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII);

b. Keeps SORNs current; and

c. Includes Privacy Act Statements on its forms that collect PII, or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected

TR-02

Evaluation of Security and Privacy Controls

The methodology used to evaluate the effectiveness of the security controls in the below table are based on NIST 800-53 Rev4 and are as follows: the security control family identifier and control number are listed under the Control column; the Test Description column provides instructions on how the assessor will test the control, the Expected Results column provides the recommended results based on federal regulations and the Actual Results column is used for the assessor to provide the status of the control whether it was or was not applied and if the control is not applicable (N/A). If a control was not applied and is applicable it will be identified as vulnerability with a risk rating and a recommendation for resolution will be made.

[Project Name] Security and Privacy Risk Assessment

a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and

b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures..

PRIVACY IMPACT AND RISK ASSESSMENT

Control: The organization:

a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII);

(i) date and time of event; (ii) the component of the information system where the event occurred (e.g., software or hardware component); (iii) type of event; (iv) user/subject identity; and (v) the outcome (success or failure) of the event; (vi) session, connection, transaction, and activity duration; (vii) source and destination addresses; (viii) object or filename involved; and (ix) number of bytes received and bytes sent (for client-server transactions) in the audit records for audit events identified by type, location, or subject.

The information system generates audit records containing the following additional information: (i) date and time of event (ii) the component of the information system where the event occurred; (iii) type of event; (IV) user/subject identity; (v) outcome; (vi) session, connections, transaction, and activity duration; (vii) source and destination address; (viii) object or filename; (ix) number of bytes received and bytes sent.

a. Develops a security assessment plan that describes the scope of the assessment including:

1. Security controls and control enhancements under assessment;

2. Assessment procedures to be used to determine security control effectiveness; and

3. Assessment environment, assessment team, and assessment roles and responsibilities;

b. Assesses the security controls in the information system and its environment of operation at least annually to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

c. Produces a security assessment report that documents the results of the assessment; and

d. Provides the results of the security control assessment to the Authorizing Official or designee.

a. Develops a contingency plan for the information system that:

1. Identifies essential missions and business functions and associated contingency requirements;

2. Provides recovery objectives, restoration priorities, and metrics;

3. Addresses contingency roles, responsibilities, assigned individuals with contact information;

4. Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;

5. Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and

6. Is reviewed and approved by organization-defined personnel or roles;

b. Distributes copies of the contingency plan to organization-defined key contingency personnel (identified by name and/or by role) and organizational elements (b);

c. Coordinates contingency planning activities with incident handling activities;

d. Reviews the contingency plan for the information system;

e. Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;

f. Communicates contingency plan changes to organization-defined key contingency personnel (identified by name and/or by role) and organizational elements (f); and

g. Protects the contingency plan from unauthorized disclosure and modification.

a. Establishes an alternate processing and storage site including necessary agreements to permit the storage and retrieval of information system backup information; and

b. Ensures that the alternate processing and storage site provides information security safeguards equivalent to that of the primary site.

a. Conducts backups of user-level information contained in the information system at a Component defined frequency consistent with recovery time and recovery point objectives;

b. Conducts backups of system-level information contained in the information system at a Component defined frequency consistent with recovery time and recovery point objectives;

c. Conducts backups of information system documentation including security-related documentation at a Component defined frequency consistent with recovery time and recovery point objectives; and

d. Protects the confidentiality, integrity, and availability of backup information at storage locations.

a. Identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection;

b. Limits the collection and retention of PII to the minimum elements identified for the purposes described in the notice and for which the individual has provided consent; and

c. Conducts an initial evaluation of PII holdings and establishes and follows a schedule for regularly reviewing those holdings [organization-defined frequency, at least annually] to ensure that only PII identified in the notice is collected and retained, and that the PII continues to be necessary to accomplish the legally authorized purpose.

The organization:

a. Identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection

- Upper-case

- Lower-case

- Numeric

- Special characters (e.g. ~ ! @ # $ % ^ & * ( ) _ + = - ‘ [] / ? > <) for user accounts and in accordance with the DOJ Strong Authentication Plan.

The application for external shall enforce minimum password complexity of at least 12 characters composed of representatives of at least two of the following character sets:

- Upper-case

- Lower-case

- Numeric

- Special characters (e.g. ~ ! @ # $ % ^ & * ( ) _ + = - ‘ [] / ? > <) for user accounts and in accordance with the DOJ Strong Authentication Plan.

a. Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;

b. Coordinates incident handling activities with contingency planning activities; and

c. Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.

a. Develops a security plan for the information system that:

1. Is consistent with the organization’s enterprise architecture;

2. Explicitly defines the authorization boundary for the system;

3. Describes the operational context of the information system in terms of missions and business processes;

4. Provides the security categorization of the information system including supporting rationale;

5. Describes the operational environment for the information system and relationships with or connections to other information systems;

6. Provides an overview of the security requirements for the system;

7. Identifies any relevant overlays, if applicable;

8. Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and

9. Is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

b. Distributes copies of the security plan and communicates subsequent changes to the plan to all personnel with

c. Reviews the security plan for the information system at least annually;

d. Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and

e. Protects the security plan from unauthorized disclosure and modification.

a. Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;

b. Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;

c. Reviews and updates the rules of behavior [organization-defined frequency]; and

d. Requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.

a. Scans for vulnerabilities in the information system and hosted applications in accordance with the DOJ Vulnerability Management Plan and when new vulnerabilities potentially affecting the system/applications are identified and reported;

b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:

1. Enumerating platforms, software flaws, and improper configurations;

2. Formatting checklists and test procedures; and

3. Measuring vulnerability impact;

c. Analyzes vulnerability scan reports and results from security control assessments;

d. Remediates legitimate vulnerabilities within the response times defined in the DOJ Vulnerability Management Plan in accordance with an organizational assessment of risk; and

e. Shares information obtained from the vulnerability scanning process and security control assessments with Component defined personnel or roles to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

a. Replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and

b. Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.

a. Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code;

b. Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures;

c. Configures malicious code protection mechanisms to:

1. Perform periodic scans of the information system and real-time scans of files from external sources at endpoint; network entry/exit points as the files are downloaded, opened, or executed in accordance with organizational security policy; and

2. block malicious code; quarantine malicious code; send alert to administrator; in response to malicious code detection; and

d. Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.

a. Provides effective notice to the public and to individuals regarding:

1. Its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII);

2. Authority for collecting PII;

3. The choices, if any, individuals may have regarding how the organization uses PII and the consequences of exercising or not exercising those choices; and

4. The ability to access and have PII amended or corrected if necessary;

b. Describes:

1. The PII the organization collects and the purpose (s) for which it collects that information;

2. How the organization uses PII internally;

3. Whether the organization shares PII with external entities, the categories of those entities, and the purposes for such sharing;

4. Whether individuals have the ability to consent to specific uses or sharing of PII and how to exercise any such consent;

5. How individuals may obtain access to PII; and

6. How the PII will be protected; and

c. Revises its public notices to reflect changes in practice or policy that affect PII or changes in its activities that impact privacy, before or as soon as practicable after the change.

The organization:

a. Provides effective notice to the public and to individuals regarding: (i) its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII);(ii) authority for collecting PII;(iii) the choices, if any, individuals may have regarding how the organization uses PII and the consequences of exercising or not exercising those choices; and (iv) the ability to access and have PII amended or corrected if necessary;

a. Publishes System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII);

b. Keeps SORNs current; and

c. Includes Privacy Act Statements on its forms that collect PII, or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected.

The organization:

a. Publishes System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII);

Recommendations

To be completed prior to final SPRA being submitted:

The following Sample Recommendations need to be addressed, remediated and/or mitigated as of this SRA:

Vulnerability 1: Microsoft Patches (MS15-018, MS15-020, MS15-021, MS15-022, MS15-028)

Recommendation: Once these patches have been tested and approved by EOIR’s CCB; they should be immediately applied to all applicable workstations, laptops, and servers.

Vulnerability 2: Microsoft Patch (MS15-011)

Recommendation: This patch is an enterprise-wide solution to group policy vulnerability. Once this patch have been tested and approved by EOIR’s CCB; it should be immediately applied to all applicable workstations, laptops, and servers.

Vulnerability 3: Permission on registry extended proc:…