04_02_A309_SP_800-128 _Security_Impact_Analysis_Template.pdf

Special Publication 800-128 Guide for Security-Focused Configuration Management of Information Systems

APPENDIX I I-1

APPENDIX I

SAMPLE SECURITY IMPACT ANALYSIS TEMPLATE

The following is a sample template for a Security Impact Analysis that can be used within a SecCM program. Organizations are encouraged to adapt it to suit their needs.

The [insert relevant parties, e.g., Change Control Board, Information system Owner (ISO), Information System Security Officer (ISSO),system administrators, security assessors] complete Tables 1-6, which will be used to review the change and determine requirements.

Table 1: Initiative/Release Background [TEMPLATE NOTE: Pre-filled information in Table 1 is for illustrative purposes only and should be replaced with information applicable to individual organizations] Initiative/Release Name Project Type [Examples only]:

-New Development: [insert description] -Enhancement: [insert description] -Maintenance: [insert description] [Insert project types and descriptions as applicable]

System Changes Provide an overview of the changes.

Baseline Changes Provide description of the new baseline.

Security Risks Provide any risks or impacts on the system.

Planned Deployment Initiation Date Planned Deployment Completion Date System(s) Impacted by change Current Security Categorization of Impacted System(s) [Insert initiative/release background info required by the organization as applicable]

Special Publication 800-128 Guide for Security-Focused Configuration Management of Information Systems

APPENDIX I I-2

Table 2: Initiative/Release Description and Potential Security Issues [TEMPLATE NOTE: Pre-filled information in Table 2 is for illustrative purposes only and should be replaced with information applicable to individual organizations] What are the business requirements driving the change?

Please provide a description of the proposed change(s), including ALL additions, deletions, and modifications.

Is the Technical Lead and/or Project Lead aware of any potential security-related issues or challenges associated with this change? If so, briefly describe them or provide and attachment describing them.

Table 3: Change Type Worksheet Please review the list of Change Types below. In the second column, mark each applicable change type with an “X”. Provide a brief explanation of why applicable change types are selected in the third column. The change types are not intended to be mutually exclusive, so multiple change types may be selected for a single initiative/release. If none of the change types are applicable, please mark “Other change” and provide a description of the change in the third column.

[TEMPLATE NOTE: Change type provided in Table 3 are for illustrative purposes only and should be replaced with changes types applicable to individual organizations]

Change Type Applicable?

(Mark X if Applicable)

Explanation (If Applicable)

New network device(s) (e.g., router, switch, firewall, VPN gateway)

New server(s) New workstation(s) (desktops or laptops)

Other new HW Decommissioning of existing HW

New virtual server New OS

Upgrade of existing OS New COTS application

Upgrade or patch of COTS application New custom application

Upgrade or bug fix for existing custom application

New DBMS (e.g., Microsoft SQL Server or Oracle)

Upgrade of existing DBMS (e.g., Oracle

Special Publication 800-128 Guide for Security-Focused Configuration Management of Information Systems

APPENDIX I I-3

Change Type Applicable?

(Mark X if Applicable)

Explanation (If Applicable)

9i to 10g) Addition of new DB instance

Modification of an existing DB instance (e.g., changes to a table)

New or upgraded Middleware application or service

Modifications to ports, protocols, and services used or provided by the system

Changes intended to address security requirements or improve/modify the security of the system (e.g., cryptographic modules, security patch, authentication, authorization, role changes)

New information type processed, stored, or transmitted on the system

Interface change (addition/removed) Change of location

Other change

Table 4: Device Impact Worksheet [TEMPLATE NOTE: Column headings in Table 4 are for illustrative purposes only and should be replaced with information relevant/applicable to individual organizations] System Name

Device Name

IP

Address

Manufacturer Model

Serial No.

Asset/ Component Property ID

OS Software Description

Table 5: Testing Worksheet [TEMPLATE NOTE: Pre-filled information in Table 5 is for illustrative purposes only and should be replaced with information applicable to individual organizations] Please describe the tests that were conducted against the change?

Please provide a description of the test results for each change (or provide reference to another document with test results).

Special Publication 800-128 Guide for Security-Focused Configuration Management of Information Systems

APPENDIX I I-4

Table 6: Analysis Worksheet [TEMPLATE NOTE: Pre-filled information in Table 6 is for illustrative purposes only and should be replaced with information applicable to individual organizations] Analysis, Recommendations, and Requirements

[Reviewed by: Name (Title)]

Signature

[Insert relevant role] [Date]

Signature

[Insert relevant role] [Date]

Signature

[Insert relevant role] [Date]

Special Publication 800-128 Guide for Security-Focused Configuration Management of Information Systems

APPENDIX I I-5

ATTACHMENT 1

SECURITY IMPACT WORKSHEET

1. AC: Will change(s) to system effect how the system limits: (i) information system access to authorized users, processes acting on behalf of authorized users or devices (including other information systems); and (ii) the types of transactions and functions that authorized users are permitted to exercise.

If so, describe.

2. AT: Will change(s) affect required system training to ensure that personnel are adequately trained to carry out their assigned information security-related duties and responsibilities?

If so, describe.

3. AU: Will change(s) affect how system audit requirements to (i) create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and (ii) ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.

If so, describe.

4. CM: Will change(s) to the system impact the (i) baseline configuration and inventory of organizational information systems; (ii) establishment and enforcement of security configuration settings; and (iii) ability to monitor and control changes to the baseline configurations and to the constituent components of the systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycle.

If so, describe.

5. IA: Will change(s) to the system impact how it (i) identifies users, processes acting on behalf of users, or devices; and (ii) authenticates (or verifies) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

If so, describe.

6. MA: Will change(s) to the system impact how (i) periodic and timely maintenance is performed; and (ii) provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct information system maintenance.

If so, describe.

7. MP: Will change(s) to the system impact how (i) information contained in the systems in printed form or on digital media is protected; (ii) access to information in printed form or on digital media removed from the systems is limited to authorized users; and (iii) how digital media is sanitized or destroyed before disposal or release for reuse.

If so, describe.

8. PE: Will change(s) to the system/system environment change how (i) physical access to information systems, equipment, and the respective operating environments is limited

Special Publication 800-128 Guide for Security-Focused Configuration Management of Information Systems

APPENDIX I I-6

to authorized individuals; (ii) the physical plant and support infrastructure for information systems is protected; (iii) supporting utilities for information systems is provided; (iv) and (v) appropriate environmental controls in facilities are provided.

If so, describe.

9. SC: Will change(s) to the system effect how: (i) communications (i.e., information transmitted or received by organizational information systems) are monitored, controlled, and protected at the external boundaries and key internal boundaries of the information systems; and (ii) architectural designs, software development techniques, and systems engineering principles that promote effective information security are implemented.

If so, describe.

10. SI: Will change(s) to the system effect how (i) system flaws are identified, reported, and corrected in a timely manner; (ii) malicious code protection is employed; (iii) system events are monitored and detected; (iv) the correct operation of security functions is verified; and (v) information is checked for accuracy, completeness, validity, and authenticity.

If so, describe.