Attachment_J.7_System_Security_27Feb2020 (1).pdf

Crash Data Acquisition Network (CDAN) SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

CDAN Security Training National Center for Statistics and Analysis (NCSA)

Safety Systems Management Division (SSMD)

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

This CDAN Security Training is produced for use by both Records-Based CDAN Study and Investigation-Based CDAN Study users and account holders.

Some slides may contain information and guidance more suited for one category of Study; it is nevertheless, valuable information related to protecting and securing CDAN and its resources.

Crash Data Acquisition Network Security Training

2Some references within this content may be specific to one or more CDAN Studies

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Some slides are self-explanatory while others use a caption (yellow box) at the bottom to convey the message.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Part 1: Introduction Part 2: CDAN Rules of Behavior Part 3: Reporting

Emergency Events Part 4: CDAN Security Information Part 5: Security Refresher

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Part 1 Audience: CDAN Account Holders

Introduction

You must review the content of this presentation then read/sign the CDAN Rules of Behavior (ROB) as a mandatory requirement for being granted a CDAN account.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

FISMA

The Federal Information Security Management Act of 2002 (Public Law 107-347) and Federal Information Security Modernization Act of 2014 (Public Law 113- 283), both known as FISMA, require the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS) to issue regulations as per the cybersecurity of Federally managed information systems (computers, laptops, tablets, smart devices, etc.). DOT implements this in DOT policy.

Sample of associated terminology…

• World Wide Web

• 9/11

• Cyber War

• Homeland Security

• Continuous Monitoring

• Disaster Recovery (DR)

• 2-Factor Authentication

• Incident Response and Reporting

• Contingency Planning

• Risk Identification/Mitigation

• HIPAA (1996)

• PII/SPII

• Security Awareness

• Rules of Behavior

• Asset Protection

• Data Protection

• Encryption

• Complex Passwords

CDAN Security is only one component of a much larger federal IT Security framework.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Implementing FISMA

Department of Homeland Security

US Department of Transportation

National Highway Traffic Safety Administration

Crash Data Acquisition Network

State Security Requirements (FARS), Company Security Requirements (Contractors)

Visual representation of the multiple implementation and reporting layers regarding federal IT Security.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

• CDAN Management Staff carries out the annual SAT (Security Awareness Training) on behalf of the NHTSA Chief Information Security Officer and DOT.

• This annual training is a requirement of FISMA and the US Department of Transportation

• FARS State Employees are exempt

DOT Security Awareness Training (SAT)

Crash Data Acquisition Network Security Training

You will be directed annually, at the request of DOT Security, to complete a Security Awareness Training (SAT). The SAT is separate from annual CDAN Security Update Training.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Part 2 Audience: CDAN Account Holders

Review the Individual CDAN Rules of Behavior (ROB) Items

You must review the content of this presentation then read/sign the CDAN Rules of Behavior (ROB) as a mandatory requirement for being granted a CDAN account.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

FARS/CRSS State Employees can skip to ROB Item 8 (slide 15)

CDAN Rules of Behavior (ROB)

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

1. CDAN systems and equipment are intended for official government use only. No personal use of your Government Furnished Equipment (GFE) is authorized.

2. CDAN systems and equipment cannot be used for commercial purposes, for financial gain, for illegal activity, or in support of “for profit” non-government activities.

CDAN Rules of Behavior (ROB)

Crash Data Acquisition Network Security Training

If social media use is necessary to support the completion of your official duties then you are responsible for your discipline and use.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

3. Applies to Federal and Contract Staff: Work related to a user’s official duties for the program is to be performed using your official US DOT approved email.

a) Use of personal and company email for official program related matters is NOT authorized.

b) DO NOT send sensitive PII information to internal or external audiences using unsecure / unencrypted email.

Crash Data Acquisition Network Security Training

If monitoring reveals unauthorized activity, disciplinary action may be taken, including termination.

CDAN Rules of Behavior (ROB)

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

4. The government will monitor the activity of any machine connected to its infrastructure, which includes distributed equipment (e.g., Toughbook, camera, etc.).

5. CDAN equipment, i.e. Laptops, Tablet PC’s, and Digital Cameras shall be kept secure at all times.

Portable equipment shall not be left overnight in vehicles and must be secured (trunk, “enclosed lockable area”) if left unattended in the vehicle at anytime. Turn laptops off at the end of every day!...unless otherwise directed.

Crash Data Acquisition Network Security Training

If monitoring reveals unauthorized activity, disciplinary action may be taken, including termination.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

6. Virus prevention tools must be installed and kept current on any and all machines from which CDAN systems and network(s) are accessed.

7. Any resource not under contract to perform work on behalf of NHTSA and CDAN is prohibited from possessing Government Furnished Equipment (GFE) at anytime. This includes acting as steward of GFE when no active contract exists. All GFE must be surrendered to the federal COR/ACOR or designate on or before the expiration of the contract.

Crash Data Acquisition Network Security Training

6. Virus tools will be managed by CDAN/NHTSA/DOT but please be aware.

7. In other words, don’t get creative in handling GFE, follow federal guidance.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

8. CDAN systems are the property of the federal government. NHTSA owns the data stored on these systems, including all email messages and information, even those deemed personal.

9. Information that was obtained via the CDAN systems will not be divulged outside of government channels without the express permission of the data owner.

Crash Data Acquisition Network Security Training

If monitoring reveals unauthorized activity, disciplinary action may be taken, including termination.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

10. Any activity that would discredit NHTSA or the U.S. Department of Transportation, including seeking, transmitting, collecting, or storing defamatory, discriminatory, obscene, harassing, or intimidating messages or material is not permitted.

11. Any activity that violates Federal laws for information protection (e.g., hacking, spamming, etc.) is not permitted.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

12. CDAN system accounts are provided solely for the use of the individual for whom they were created to perform authorized government work.

13. Passwords or any other authentication mechanism should never be shared or stored in any place easily accessible. If stored, a password must not be stored in a clear-text or readable format.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

14. Each CDAN system has password format requirements and a password expiration policy.

Although there are variations between systems, passwords which are at least 12 alphanumeric characters in length, and contain at least two letters and three numbers or special characters (@, $, #, etc.) will normally meet the requirement. Typically, passwords must be changed every 90 days (30 days for Administrator accounts).

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

15.It is mandatory that all forms of Personally Identifiable Information (PII) stored on all systems (including mobile devices) be protected and never disclosed to unauthorized third parties.

16.Any security problems, password compromises, and unauthorized information disclosures must be reported immediately to the Network Administrator by contacting the CDAN HelpDesk at 888-399-3277 or by e-mail to CDAN.HelpDesk@dot.gov .

Crash Data Acquisition Network Security Training mailto:CDAN.HelpDesk@dot.gov

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

17. CDAN Users should use extreme caution when printing CDAN material, specifically CDAN content that contains sensitive information. Printed material containing sensitive information must be secured in transit and in storage. See Emergency Events for reporting document loss.

18. The distribution of third party software and proprietary manuals outside of CDAN is strictly prohibited.

19. Collection, transportation and transfer of CDAN data, specifically sensitive data, is strictly prohibited unless done so using an approved and authorized mobile device such as Secure USB.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

20. When using government provided or employee provided, approved, mobile devices (iPhone, iPad, smart phone) to support data acquisition; any information captured and/or transmitted must contain ONLY non-sensitive, unclassified, publicly releasable information. All CDAN sanitization rules apply.

Crash Data Acquisition Network Security Training

CDAN Rules of Behavior (ROB)

Question: What if private citizens send us image(s) of the crash?

Whether it be via email or text message, upload the image(s) based on image handling procedures and delete the source email/text.

Question: What if we have Lat/Long values on our phones relative to a crash location?

Upload or enter the data into CISS Web if it supports the case data. If you recorded the information on your phone to reference later for upload, delete the note, etc.

once the information is in CISS Web.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Part 3 Audience: CDAN Account Holders

Reporting CDAN Rules of Behavior (ROB) Emergency Events

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

The DOT Cyber Security Management Center (CSMC) must be notified within 1 HOUR of an incident taking place!

The guidance from CSMC is that the incident is to be reported by the person involved directly in the incident.*

*The CDAN Information Systems Security Officer (ISSO) Team will allow, at the discretion of CDAN CORs, the appointment of a POC (Point of Contact) to be the primary resource for reporting to the

CSMC.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Whether it is the person directly involved or appointed POC, the directions on the following slides must be followed.

If you cannot initiate the reporting of the incident, for whatever reason, you must contact your Team Leader, Management Center POC or Immediate Supervisor to have them begin the process!!

Step 1: Call the CSMC @ 1-866-580-1852

Identify who you are and your affiliation to NHTSA/DOT You will provide your contact information

You may be asked a few questions.

Be ready to respond with a concise description such as:

• Police Accident Report (PAR) with personal information

• Laptop/Tablet with unredacted case data

• Camera with unsanitized images on SD card If you don’t know just tell them that.

They should issue you an Incident Number.

They will email you a link to the proper reporting form.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Crash Data Acquisition Network Security Training

Email, Phone where you can be reached!

In life threatening situations: Step 2 then Step 1

Step 2: Notify Law Enforcement*

*In cases of Loss/Theft, Site Compromise: Break In

Police Report will be needed for NHTSA, DOT, CSMC follow-up and/or investigation

At minimum, try to obtain the Police Report Number even if the report has not been completed

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Crash Data Acquisition Network Security Training

In life threatening situations: Step 2 then Step 1

Notify law enforcement IF the situation warrants. Not all reportable events require law enforcement notification.

Step 3 Complete CSMC SPII/PII and or Lost/Stolen Device Report Access the reporting form via the link provided by the CSMC

Since this reporting form can be updated with no prior notification just be aware and prepared to provide any of the following:

• Incident Number provided during phone call

• Information Classification: Use PII (follow up will confirm classification)

• Reported By should be person directly involved or POC

• Equipment/Data Owners Name, Phone Number, Email should be person directly involved

• Owner Supervisor information should be who the person immediately reports to

• Type of Device: Laptop, tablet, camera, SD card, USB, PAR, Medical Record, etc.

• Description: Explain briefly the incident that resulted in the loss

• Has the device been properly secured and/or wiped?: Yes/No

• Was the data protected?: Data encrypted using Symantec Endpoint Protection

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Crash Data Acquisition Network Security Training

Email, Phone where you can be reached!

Step 4 Save the form

Email the form to 9-AWA-CSMC@faa.gov

Forward the CSMC Email to:

• NHTSA_CyberSecurity@dot.gov

• Lavanya.Yanduru.CTR@dot.gov

• Timothy.Fahey@dot.gov

• Your Contract Lead

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Crash Data Acquisition Network Security Training mailto:9-AWA-CSMC@faa.gov mailto:Michele.Thomas@dot.gov mailto:CDAN.HelpDesk@dot.gov mailto:Timothy.Fahey@dot.gov

Step 5 Identify and gather any other information or evidence such as a police report, etc. that NHTSA/DOT Security may request.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Crash Data Acquisition Network Security Training

Step 6 Create a CDAN HelpDesk ticket using the “Emergency” ticket priority and attach the completed form to the ticket.

https://helpdesk.cdan.dot.gov/

Step 7 NHTSA Security may schedule a teleconference to ask some questions regarding the incident.

https://helpdesk.cdan.dot.gov/

CDAN Rules of Behavior and Reporting Emergency Events can be found on the CDAN Main Menu under CDAN Resources

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Part 4 Audience: CDAN Account Holders

CDAN Security Information

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Applies to your work environment as well!

It doesn’t always require a form or formal reporting…If something doesn’t seem right notify team members, management center, NHTSA!

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

• All team members need to be aware of the routines and schedules of coworkers

• Don’t let unexpected absences or unknown status of coworkers be “not my problem!”

• Communicate with coworkers or notify the Management Center if you have concern

• Management Center must monitor single person sites for such potential events

• All site members must be ready to report on the status of the office, coworkers, equipment and records containing data anytime a potential “reportable event” is identified

• A reported event which turns out to be a Non Qualifying Event (Non-Emergency) is perfectly okay

If someone says “my work schedule is none of your business” notify your Management Center.

Personal Email, Facebook (Limited)

Online Shopping Adult Content Websites Streaming TV, Sports, Movies… Online Gaming/Gambling Hosting a Blog, Running a Business Twitter

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Crash Data Acquisition Network Security Training

, “Social Media”

Using your Government provided/CDAN provided personal computer.

Case Research ONLY! Refer to

ROB Item 3.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Crash Data Acquisition Network Security Training

If you are at a remote site location you and any other team members are responsible for preparing and protecting government assets in the event of environmental threats and/or events which could leave government assets vulnerable to loss. Report any loss or suspected loss as soon as possible once it is safe to do so.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Open Doors/Windows, Open Cabinets, Unattended Files are opportunities for compromise!

Crash Data Acquisition Network Security Training

What seems like a safe condition to you may mean an opportunity for someone to compromise the security of your location and information. Even that folder organizer so many people use is a vulnerability.

Do you leave folders in them when your workday is over? Are you unintentionally risking PII exposure by doing this?

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Crash Data Acquisition Network Security Training

You are expected to practice professionalism and integrity when working at home and keep ALL case information confidential!

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

We can’t always control how we receive data, but we can control what happens to it after we receive it.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

So easy to forget and leave something on the printer that may contain sensitive data.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Part 5 Audience: Investigation-Based Users

CDAN Field Security Refresher

42CRSS and FARS staff can skip this section if they want to and go to Read/Sign CDAN ROB.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Crash Data Acquisition Network Security Training

Equipment containing sensitive data is NEVER left in your vehicle overnight. The Nikon Total Station is included in this guidance because of the value of the piece of equipment.

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Almost Done!

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Don’t Be This Person!

I was in a hurry!

It’s not my responsibility…

I didn’t think!

This is your job so take your Security responsibilities seriously!

SYSTEM SECURITY / RISK MANAGEMENT / RULES OF BEHAVIOR / INCIDENT RESPONSE / ASSET PROTECTION / DATA PROTECTION

Please Read and Sign the CDAN Rules of Behavior and return it to your Team Leader or immediate Supervisor.