DSCSA mnit_slm_workbook_template.xlsx

CoverPage Security Lifecycle Management Minnesota IT Services | partners in security C O N F I D E N T I A L This document contains sensitive information about Information Systems and security that is privileged and confidential, and not customarily released publicly, and which is, therefore, exempt from the public access provisions of the Freedom of Information Act, 5 U.S.C. 552.

System Security Plan The following named project or system has completed the Security Lifecycle Management process and been accredited by the CISO. This document certificies that application listed below has a completed System Security Plan (SSP).

[ADD SYSTEM OR APPLICATION NAME HERE]

Instructions - to be completed by security engineer

1. Use the template below to create the assessment summary with closing comments.

2. Once complete, place the summary in the table above.

3. Share the completed workbook and project files with agency CISO for approval

4. Delete these instructions then export workbook to PDF, excluding the securtity controls tab and any unused tabs from the pdf version

5. Share the PDF with the project manager, business owner, and technical owners as appropriate.

5. Verify the SSP completion date is added to agencies Application Inventory.

Summary Template

A [Full, Custom, Annual] security assessment was done on [XYZ] application. This application is currently in [production, Test]. [WebInspect, Veracode, Burp Suite, Acunetix] scan was done on the [test, stage, Prod] environment and [x, no] vulnerabilities were found. [All the application security/ critical application security] flaws have been fixed or no major security risk at this point]. [If there were fixes]These fixes includes X, Y AND Z]. [If flaws need to be fixed by the vendor] The other flaws were sent to the vendor for fix. Some of the fixes are [scheduled for the next release, were marked as false positive]. Detailed vendor report is attached in the project file.

Operating System scan is being done on a [weekly, bi-weekly, monthly] basis. There were vulnerabilities that need to be fixed on [Prod, Test and Dev] servers. All/critical Application security patches and fixes have been applied to the [Prod, Test and Dev] servers. Detailed Tenable OS scan of these servers is found in the project file.

The Security Lifecycle Management (SLM) workbook has been completed. It was determined that [X, Y and Z] control did not meet the security control requirement. An exception [X, Y AND Z] was submitted in Archer and approved by business. Information Risk assessment was [done/not done and finding XXX was submitted].

The Disaster recovery (DR) plan was completed by the technical owner and the report has been added to Application Inventory System (AIS). Security has updated the AIS entry for [security, technical] tab. [Production server is sending logs to [ArcSight/qradar].

&"+,Regular"&10 Updated: 06/2020

Checklist Security Lifecycle Management 4.0 Minnesota IT Services | partners in security INSTRUCTIONS: Review requirements below with primary project contact and security analyst or engineer.

For questions contact your security liaison or email SLM@state.mn.us

The SLM workbook is used to assess all applications listed in the agencies application inventory. Use of this template satisfies requirements to create a System Security Plan (SSP) for all HIGH data systems.

When is the SLM process used?

The SLM process should be used to assess (1) all projects and activities that incorporate the use of Protected Information, and (2) all system and application development and major enhancement activities, whether conducted or hosted at agency or with a third party, regardless of the classification of data used.

Benefits of Security Lifecycle Management s To protect citizen data by ensuring proper security controls are included in the design of projects and activities.

s To assure security concerns do not delay implementation.

s To reduce the amount of possible rework for the business and development due to security concerns.

s To ensure projects and activities comply with state and federal requirements.

&"-,Bold Italic"C O N F I D E N T I A L&"-,Italic" &10This document contains sensitive security information that is exempt from public access provisions of the Freedom of Information Act, 5 U.S.C. 552.

https://app.securitystudio.com/file:///C:/Users/ndoll/Downloads/SLM%20-%20Secure%20Engineering%20Processfile:///C:/Users/ndoll/Downloads/SLM%20-%20Secure%20Engineering%20Processfile:///C:/Users/ndoll/Downloads/SLM%20-%20Secure%20Engineering%20Processfile:///C:/MNIT-EA/SitePages/Secure%20Systems%20by%20Design.aspxfile:///C:/Users/ndoll/Downloads/Forms/AllItems.aspx%3fsortField=Modified&isAscending=false&viewid=865917f4-45ed-4bb7-8ded-937b8de99a6a&id=/sites/MNIT-ESO/ISC/Shared%20Documents/SLM%20-%20Secure%20Engineering%20Process #1 Security Lifecycle Management 4.0 Risk Assessment & System Security Planning Minnesota IT Services | partners in security

DO NOT MODIFY

C O N F I D E N T I A L This document contains sensitive security information that is exempt from public access provisions of the Freedom of Information Act, 5 U.S.C. 552.

file:///C:/:w:/r/sites/MNIT-ESO/ISC/Shared%20Documents/SLM%20-%20Secure%20Engineering%20Process/Business%20Impact%20Analysis%20Definitions%202019.docx%3fd=w414963b3b15f44c2b99a1594930c249c&csf=1&web=1&e=BiyqZG Risk Assessment Risk Assessment Questionnaire Minnesota IT Services | partners in security

2 Describe the Authentication method that will be used to identify and authorize users access to the system and data. Specify if solution is Active Directory, Oracle, MySQL, or other. Provide as much detail as possible about the solution. Include any multi-factor authentication or biometric options. Not scored

0% of max score

Add any additional questions / answers that may be relevant to this project.

22 Date completed

C O N F I D E N T I A L This document contains sensitive security information that is exempt from public access provisions of the Freedom of Information Act, 5 U.S.C. 552.

RA (old) Risk Assessment Questionnaire Minnesota IT Services | partners in security A. Group Assessment Security Engineer Instructions Chere linked location below for an existing Risk Assessment that may have been completed already.

1 Describe physical system architecture as currently known or understood.

*Include: servers, network equipment, all hardware/devices/virtual devices including peripherals and non-state owned, vendor managed equipment and locations.

3 Describe vendor support notifications and communications plan. How will state staff be notified of software updates, maintenance windows, vulnerabilities, security patches, or other important notices in a timely manner? List one or more state email addresses that are subscribed to vendor alerts and updates.

4 List any system concerns or weaknesses. Describe any threats or vulnerabilities that could result in adverse impact to the system.

Are all servers, network devices, databases, and applications that support the system/application known and documented in a formal asset inventory?

2 Inventory of Authorized and Unauthorized Software Is installed software supporting this system/application limited to only software that has been approved and documented by MN IT Services?

3 Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers Are all laptops, workstations, and servers supporting this system/application configured according to the secure configuration baselines established by the MN IT Services?

4 Continuous Vulnerability Assessment and Remediation Are all servers and network devices supporting this system/application scanned at least monthly by network vulnerability scanning tools?

5 Controlled Use of Administrative Privileges Does administrative access to the system/application and supporting servers require multi-factor authentication?

6 Maintenance, Monitoring, and Analysis of Audit Logs Does the system/application as well as supporting servers, generate standardized logs and send those logs to a centralized log server?

7 Supported Technologies Available and in Use Is the system/application using modern and fully supported technologies including hardware, operating systems, databases, and development languages?

8 Malware Defenses Is anti-malware software installed and running on all servers supporting this system/application? Are the anti-malware software and signatures updated on a daily basis?

9 Limitation and Control of Network Ports, Protocols, and Services Are firewall and router rules in place to restrict access to the system/application and are all supporting servers accessible only to those necessary? Is remote access restricted to only legitimate users and services? Are settings configured to block traffic that is not explicitly allowed?

10 Data Recovery Capability Is data backed up on a regular basis? Are backups automated and do they include all information required to fully restore the data?

11 Secure Configurations for Network Devices such as Firewalls, Routers, and Switches Are all network devices supporting the system/application configured according to secure configuration baselines established by MN IT Services? Are deviations from the standard configurations documented and approved?

12 Boundary Defense Is the application and supporting systems located in the appropriate network locations in accordance with the State of Minnesota Zones of Control architecture? Are multilayered boundary defenses enforced and documented for the system/application?

13 Data Protection Is all data with a data categorization of High encrypted when at rest? Is data with a categorization of High encrypted at all times during transit? Is data with a Moderate categorization encrypted over external networks? *reference completed vendor security questionnaire if applicable

14 Controlled Access Based on the Need to Know Is access to the system/application and supporting servers restricted to the least access necessary for the individuals’ roles?

15 Vendor Review and Assessments Have all vendors that are involved in the development, support, and/or maintenance of the system/application undergone a security review and assessment? Is there a Vendor Security Questionnaire (VSQ) on file for the system and is it current?

16 Account Monitoring and Control Are user and administrator access removed upon an individual’s role change or termination? Is there a documented process for doing this? Are all accounts reviewed upon changes in user role and at least annually?

17 Security Skills Assessment and Appropriate Training to Fill Gaps Are all users and administrators appropriately trained with the security knowledge and skills necessary to do their jobs?

18 Application Software Security Is all application code tested for security flaws prior to being released to production? Are both internally developed and third-party application software tested for security flaws, including coding errors and malware? *reference completed vendor security questionnaire if applicable

19 Disaster Response and Management Are there disaster response plans and procedures in place to recover the system/application within the documented time objectives? Have these plans and procedures been reviewed and tested within the last 12 months?

20 Penetration Tests Has the system/application undergone a penetration test within the past 24 months? Have both internal and external penetration tests that mimic an attack been conducted to identify vulnerabilities and gauge the potential damage?

21 Add any additional questions / answers that may be relevant to this project.

C O N F I D E N T I A L This document contains sensitive security information that is exempt from public access provisions of the Freedom of Information Act file:///C:/DHS_Teams_OIS/Shared%20Documents/Forms/AllItems.aspx%3f Scoring Risk Assessment Score Minnesota IT Services | partners in security INSTRUCTIONS: When tab #1 and Risk Assessment are complete, send a copy of the entire workbook to GRC@state.mn.us. GRC staff will verify calculations, scoring, and add risk data to Archer.

Do not modify data or calculations on this page.

Data Categorization SLM Data Categorization Minnesota IT Services | partners in security

This document contains sensitive security information that is exempt from public access provisions of the Freedom of Information Act https://mn.gov/mnit/assets/enterprise-data-protection-categorization-standard_tcm38-323779.pdf Environments Environments Inventory Minnesota IT Services | partners in security

C O N F I D E N T I A L

Inventory Application Hardware & Software Inventory Minnesota IT Services | partners in security

INSTRUCTIONS

1. List below ALL system resources: Virtual IP addresses (VIPs), Presentation layer server names and IP addresses, Application server names and IP addresses, database names and IP addresses.

2. Add or update the agency Application Inventory System (AIS) and Enterprise Application Inventory System.

C O N F I D E N T I A L

Diagrams System Architecture and Diagrams Minnesota IT Services | partners in security

*If documentation does no exist, provide remediation or justification information here.

*If documentation does no exist, provide remediation or justification information here.

C O N F I D E N T I A L

Scanning & Testing Vulnerability Testing Minnesota IT Services | partners in security

List all URLs here

Controls

Filter controls using columns below Default Filter = High Data Application

IMPORTANT INSTRUCTIONS

1. Before entering control responses, complete the "Data Categorization" tab.

2. Filter Scope 1 and Scope 2 according to instructions.

3. Enter data in Columns (E, F, G). Where control is not compliant, include remediation plan and SME in columns H & I.

*For the purpose of this assessment, some control details below have been modified from the original format into a simplified plain language. For detailed Policies and Standards in their published format, access the Enterprise Policies and Standards library. https://mn.gov/mnit/government/policies/security/ Edit filter for Moderate or Low data assessments. Check all that apply AppSLM=Application DataSLM=Data Set Uncheck (Blanks)

• Systems must be categorized based on the highest categorized data the system stores, processes, or transmits.

• Handling and retaining information within systems and information output from systems in accordance with applicable federal and state laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.

• Limiting data storage amount and retention time to that which is required for legal, regulatory, and/or business requirements.

• Specific retention requirements for cardholder data and other regulated data.

• Processes for secure deletion of data when no longer needed.

• Designating individuals that are authorized to post information onto publicly accessible systems.

• Training authorized individuals to ensure that publicly accessible information does not contain nonpublic information.

• Reviewing the proposed content of information prior to posting onto publicly accessible systems to ensure that nonpublic information is not included.

IT DR plan testing must be coordinated with state agency partners responsible for related plans.

The alternate storage site must:

Ensure that equipment and supplies required to resume operations are available at the alternate site, or contracts are in place to support delivery to the site in time to support the resumption.

Ensure the alternate processing site is separated from the primary processing site to reduce susceptibility to the same threats as identified in a risk assessment.

Provides information security safeguards equivalent to that of the primary site.

Critical systems must have three generations of backups (full as well as all related incremental or differential backups) stored off site.

• Systems and data that each user needs to access for their job function.

• Level of privilege required (for example, user, administrator, etc.) for accessing resources.