Appendix 3 - Baseline Security.pdf

APPENDIX III:

TTB Baseline Security Requirements Handbook

DEPARTMENT OF THE TREASURY

ALCOHOL AND TOBACCO TAX AND TRADE BUREAU (TTB)

1310 G Street, N.W.

Suite 300 Washington, D.C. 20220

Baseline Security Requirements Handbook

LIMITED OFFICIAL USE ONLY

Dated: September 30, 2004

REVISION HISTORY

VERSION: DATE: DESCRIPTION:

1.0 September 30, 2004 Initial version

ii Sept. 30, 2004

Limited Official Use Only iii Sept. 30, 2004

TABLE OF CONTENTS

1. INTRODUCTION

1.1 PURPOSE

1.2 APPLICABILITY

1.3 CATEGORIZATION OF INFORMATION AND INFORMATION SYSTEMS

1.3.1 Security Objectives

1.3.2 Potential Impact on Organizations and Individuals

2. OVERVIEW

3. REFERENCES

4 Sept. 30, 2004

1. INTRODUCTION

1.1 Purpose

The purpose of the TTB Baseline Security Requirements Handbook is to provide a guide to using the TTB Baseline Security Requirements Matrix (BLSR). The TTB BLSR provides consistent and repeatable security controls for information systems categorized in accordance with FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems and NIST Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems. The FIPS Publication 199 security categories are typically considered during the risk assessment process to help guide the initial selection of security controls for an information system. The risk assessment process provides useful information and a procedural approach to examining the important factors that ultimately determine which security controls are necessary to protect the organization’s operations and assets.

1.2 Applicability

These controls are applicable to all Federal information systems other than those designated as national security systems. A Federal information system is an information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency.

1.3 Categorization of Information and Information Systems

FIPS Publication 199 establishes security categories for both information and information systems based on the potential impact on an organization should certain events occur which jeopardize the information and information systems needed by the organization to accomplish its assigned mission, protect its assets, fulfill its legal responsibilities, maintain its day-to-day functions, and protect individuals. Security categories are to be used in conjunction with vulnerability and threat information in assessing the risk to an organization. This risk ultimately determines the applicability of the controls in the TTB BLSR.

1.3.1 Security Objectives

The Federal Information Systems Management Act defines three security objectives for information and information systems: confidentiality, integrity, and availability.

Confidentiality is defined as preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. A loss of confidentiality is the unauthorized disclosure of information.

Integrity is defined as guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. A loss of integrity is the unauthorized modification or destruction of information.

5 Sept. 30, 2004

Availability is defined as ensuring timely and reliable access to and use of information.

A loss of availability is the disruption of access to or use of information or an information system.

1.3.2 Potential Impact on Organizations and Individuals

The potential impact should there be a breach of security is low if the loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. The potential impact is moderate if the loss could be expected to have a serious adverse effect. The potential impact is high if the loss could be expected to have a severe or catastrophic adverse effect. The following matrix from FIPS Pub 199 describes the potential impact on the three security objectives.

Potential Impact Security Objective Low Moderate High Confidentiality Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

Integrity Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.

The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

Availability Ensuring timely and reliable access to and use of information.

The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

2. OVERVIEW

The security controls are organized into three classes that correspond to the major sections of a security plan: management, operational, and technical. Management

6 Sept. 30, 2004 controls typically involve those safeguards and countermeasures employed by an organization to manage the security of the information system and the associated risk to the organization’s assets and operations.

Operational controls are those safeguards and countermeasures employed by an organization to support the management and technical security controls in the information system. In contrast to technical controls that are primarily executed by the information system, operational controls are typically executed by people that support the system.

Technical controls are those safeguards and countermeasures (typically described as security mechanisms) employed within the information system’s hardware, software, or firmware to protect the system and its information from unauthorized access, use, disclosure, disruption, modification, or destruction.

These controls follow the basic control set as described in NIST SP 800-53. They serve as a starting point and can be adjusted based on the results of the risk assessment and the potential impact on the loss of confidentiality, integrity, or availability. Modifications should be documented in the security plan for the information system. All section and subsection headings in NIST SP 800-53 directly correspond to the ID column heading in the TTB BLSR. The Compliance column gives the reviewer a place to mark the system compliance with the security control. The reviewer is required to fill in the Comments column if the control is found to be N/A.

7 Sept. 30, 2004

3. REFERENCES

This handbook was prepared in accordance with TTB policies and procedures and other Federal laws, regulations, and industry best practices noted in the following:

• FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems

• House Resolution 2458, Federal Information Systems Management Act (FISMA) of 2002

• NIST SP 800-53, Recommended Security Controls for Federal Information Systems