80109r7.pdf

UNCLASSIFIED

NI 8010.9R7 Approved: 20 March 2007 Subgroup: Information Assurance

NGA Instruction for Information Operations Condition (INFOCON) Including

Information Assurance Vulnerability Management (IAVM)

1. References.

a. Primary. NGA PD 8000R3, Policy Directive for Information Management and the Chief Information Officer, 24 November 2003.

b. Secondary.

(1) DoD Directive O-8530.1, Computer Networks Defense (CND), 8 January 2001.

(2) DoD Instruction 8530.1, Support to Computer Network Defense (CND), 9 March 2001.

(3) DoD: United States Strategic Command Directive 527-1, Department of Defense (DoD) Information Operations Condition (INFOCON) System Procedures, 27 January 2006.

2. Purpose. Establish the Agency process for implementing Secretary of Defense-mandated information operations condition (INFOCON) to detect intrusions on NGA electronic systems, alert personnel responsible for protection of systems, and initiate readiness focus. This instruction supersedes NI 8010.9R6, same title, 27 November 2006.

3. Policy. Consistent with DoD and IC standards and policy, NGA will ensure the confidentiality, integrity, and availability of internal corporate information systems and the Defense Information Infrastructure (DII). NGA will implement a readiness strategy that will continuously maintain and sustain NGA’s information systems and networks.

4. Applicability and Scope. This instruction applies to all owners and operators of NGA information systems. The INFOCON system protects NGA and DoD information systems and coordinates the overall readiness effort.

5. Definitions. Definitions are located in the secondary references.

6. Responsibilities.

a. Enterprise Operations Directorate (E).

(1) Develops and implements management guidance, oversight, and review of NGA’s overall capability to ensure continuity of network

NI 8010.9R7

operations in consultation with the Security and Installation Operations Directorate, Security Office, Computer Security Division (SISC).

(2) Ensures that an INFOCON Continuity of Operations (COOP) plan is developed, maintained, and exercised for each network and facility.

b. E, Mission Assurance Office (EM), Information Security Management Division (EMM) administers the INFOCON system, integrating system-specific guidance and procedures into an Agency approach.

c. EM, Designated Accrediting Authority (DAA), EMM, and the DAA Support Division (EMD) are the points of contact for external organizations.

d. The Office of General Counsel (OGC) manages all interactions with law enforcement organizations.

e. System and network owners and operators report all system or network outages or crashes to EMM within one hour of their occurrence.

f. All users of NGA systems and networks.

(1) Report all suspicious activity to their organizations’ ISSOs. Suspicious activities include accounts locked out, unsolicited external e-mail, requests for user identification codes (userids) or passwords, loss of desktop control (remote administration), threatening e-mail, and unexplained loss of files.

(2) Maintain complete backups of critical data files.

(3) Report all virus activity to EMM.

(4) Report all inadvertent or unauthorized releases of classified information on NGA systems or networks to SISC.

7. Procedures. NGA INFOCON will remain at a level equal to or higher than the established DoD INFOCON.

a. DoD INFOCON. The Commander, Joint Task force for Global Network Operations (CJTF-GNO) recommends changes in DoD INFOCON to the Commander, United States Strategic Command (CDRUSSTRARCOM) after coordination with the DoD Components. CDRUSSTRATCOM directs all INFOCON level changes. When the DoD INFOCON changes, CJTF-GNO notifies EMM. EMM notifies system administrators (SYSADMINs), ISSOs, information system security managers (ISSMs), and senior leaders.

b. NGA INFOCON. Assimilation and evaluation of information to assess the NGA-wide CND situation is a collaborative effort focused at the Office of the NGA Command Center (ONC). EMM works with SISC to assess the situation and establish the recommended INFOCON based on evaluation of all relevant factors. EMM recommends changes in NGA INFOCON to the D/EM. D/NGA delegated declaration authority to D/EM.

c. INFOCON level. The INFOCON levels are

(1) INFOCON Level 5. Normal readiness of information systems and networks that can be sustained indefinitely; routine network operations (NetOps).

(2) INFOCON 4. Increases NetOps readiness in preparation for operations or exercises with negligible impact to users.

(3) INFOCON 3. Further increases NetOps readiness by increasing the frequency of validation of the information network and its corresponding configuration. Impact to end-users is minor.

(4) INFOCON 2. Readiness condition requiring a further increase in frequency of validation of the information network and its corresponding configuration. Impact to end-users could be significant for short periods.

(5) INFOCON 1. The highest readiness condition which addresses intrusion techniques that cannot be identified or defeated at lower readiness levels. The impact on SYSADMINs is significant and impact to end-users could be significant for short periods.

Regardless of the INFOCON level, SYSADMINs must report all unauthorized accesses to EMD within one hour of their occurrence.

d. Reporting. SISCI reports violations of the law (such as unauthorized access to DII computer networks and systems) through OGC to servicing military counterintelligence organizations complying with DoD Instruction 5240.6 (reference 1.b.(3)). Potential and actual impact to operations must be reported through operational channels.

e. Report timing. EMM reports INFOCON changes to ONC no later than four hours after the INFOCON has changed, providing whatever information is available at the time and indicating critical information that is unknown or unavailable. When missing information becomes available, it must be provided in a followup report.

f. D/NGA may authorize release of unclassified NGA INFOCON procedures to allied countries as necessary to ensure effective protection of interconnected information systems.

g. Changes in INFOCON are operational security (OPSEC) indicators and must be protected accordingly. The criteria and response countermeasures are of value to foreign intelligence services in assessing the effectiveness of a CNA and in analyzing NGA’s response. NGA INFOCON procedures must not be posted on publicly accessible networks such as the worldwide web.

h. Assessment.

(1) Exercises. INFOCON procedures should be practiced on all corporate information systems every 120 days.

(2) EMM submits feedback on the effectiveness of the INFOCON system based on IW attack and exercise data. EMM reviews the NGA system periodically to ensure it satisfies operational requirements.

NI 8010.9R7 Appendix 1

Appendix 1 Background, Description, and Fundamentals

1. Background. Since the INFOCON system was initiated in 1999 many real world events highlighted needed changes in system concepts and procedures. One priority is the need to standardize the DoD INFOCON process. While CDRUSSTRATCOM will continue to direct changes in the global INFOCON status, changes in local or regional INFOCON status can now be actively managed by Components using a standardized measures framework.

2. Description. The INFOCON system is now a readiness –based strategy with a proactive approach replacing the prior threat-based reactive system. This shift represents a significant change in how organizations at all levels ensure the security and operational readiness of information networks. A determined intruder will always compromise a networked system. The system provides a framework of prescribed actions and cycles necessary to reestablish the confidence level and security of the information systems.

3. Fundamentals. Understanding these critical fundamentals is essential to effectively implement this system.

a. Implementation burden. The burden of meeting INFOCON requirements is placed on networks and system administrators rather than on the network’s users.

INFOCON measures should, to the extent possible, be transparent to the users.

b. Insider threat. The threat is not only from insider personnel but also from outsiders who, because of network trust relationships, are effectively insiders to multiple networks based on compromise of a single network.

c. Operational rhythm. Most information system management activities have a cycle of repetition. Increased INFOCON level may require increased workload.

d. Self-imposed denial of service. INFOCON measures should not result in a self-imposed denial of service, either to specific users or to entire networks. Responses to specific threats may be required in response to network activity or threats but are not implemented as a part of the INFOCON system. When these measures become necessary they will be carefully tailored to focus on the specific situation.

e. Shared risk. In today’s networked environment, risk to one system is risk shared by all systems. A successful network intrusion in one domain may facilitate access to other domains. Shared risk is mitigated by the synchronized accomplishment of the systemic measures within a directed readiness level. These actions must be carried out concurrently in all network domains for an effective defense.

NI 8010.9R7 Appendix 2

Appendix 2 General Security Practices

Measures that can significantly reduce the risk of successful attack against an NGA information system are listed below. These activities are the foundation of a sound, prevention-based information assurance and security program.

1. System security administration. All NGA system and network owners and operators must ensure technically qualified, experienced personnel administer their systems. Those personnel are provided periodic professional training in system administration and security, as well as the necessary tools to assist in effective baseline management, auditing, and network intrusion detection. Configuration management, proper staffing, and strong systems policies are critical to reliable and secure operations.

2. Auditing and log review. All SYSADMINs review audit logs for suspicious activity on a weekly basis. Audit and review requirements may change as INFOCON is raised, including more frequent reviews, focused string searches, analysis of activity below normal trigger thresholds, and submission of logs to SISCI and EMM for specialized review. Audit logs must be submitted to EMM ISSOs for weekly audit independent reviews.

3. Critical-file backup procedures. SYSADMINs must conduct weekly backups of files critical to NGA’s mission accomplishment. Storage of back-up files should be isolated from any network and physically separated from the originating facility. Change in INFOCON may warrant change in the backup frequency such as weekly to daily.

4. Internal security reviews. SYSADMINs must establish procedures and for internal security reviews and submit the procedures for approval by SISC and EMD.

5. External vulnerability assessments. EMM coordinates with external Agencies to conduct vulnerability assessments and analyses of NGA information systems. These assessments may include network scans, OPSEC surveys, communications security reviews, and red team operations.

NI 8010.9R7 Appendix 3

Appendix 3 Information Assurance Vulnerability Management (IAVM)

1. IAVM is the alert notification process which incorporates corresponding actions to protect systems against known or identified vulnerabilities. The process requires receipt acknowledgement within 72 hours and provides specific time parameters for implementing countermeasures depending on the criticality of the vulnerability. The Defense Information Systems Agency (DISA) manages the DoD IAVA process.

2. The Joint Task Force – Global Network Operations (JTF-GNO). JTF-GNO monitors relevant sources of information to discover security conditions that may require vulnerability notifications and direct actions to bring DoD assets into compliance and mitigate the risks associated with vulnerabilities. Vulnerability notices and warning orders apply to all NGA systems, classified or unclassified. The following are details of each type of IAVM notice and the reporting guidelines:

a. Alert (IAVA). Vulnerability is severe. The DoD Computer Emergency Response Team assigns an IAVA alert number, release date, acknowledgement suspense, and compliance suspense. Patching beyond the compliance suspense requires a DAA-granted waiver.

b. Bulletin (IAVB). Vulnerability is moderate. Proxy is given to the NGA DAA to determine applicability and risk level. A bulletin may or may not have a compliance suspense date assigned to it.

c. Technical advisory (IAVT). Vulnerability is minimal and NGA must determine if it is applicable. If applicable, EMMV assigns compliance suspense to patch.

d. All notices and warning orders must be acknowledged by the system administrators within 72 hours of receipt of the notice or warning order.

e. A first compliance report is required to be submitted to JFT-GNO within 10 calendar days from release of the notice or warning order. Compliance reports must be submitted to EMMV 24 hours prior to release to JTF-GNO for DAA concurrence.

f. All IAVAs, IAVBs, and IAVTs must be implemented on the systems within these timeframes. Some releases may be severe which requires reduced compliance timelines according to the vulnerability identified.

3. Disseminate reports or alert messages.

a. The Director of National Intelligence (DNI) will issue vulnerability notifications from the JTF-GNO to the NGA IAVM primary coordinators

NI 8010.9R7 Appendix 3

(EMMV). The coordinators distribute IAVM notices to the program managers for action.

b. Program managers notify the SYSADMINs of newly released IAVM notices.

c. SYSADMINs evaluate the applicability to their particular system and notify the program manager of potential impact. The SYSADMINs will apply IAVM notice patches to their systems and report compliance to the PM and IAVM coordinator.

NOTE: SYSADMINs and Information System Security Representatives (ISSRs) must use the DISA Windows Gold Disk and UNIX Security Readiness Review (SRR) tools as part of the certification and accreditation test process. All Gold Disk Category 1 findings indicate vulnerabilities and must be patched or justified in writing and approved by the DAA. For further guidance contact EMMV.

d. The program manager provides confirmation of systems patch implementation to the IAVM coordinator

e. The IAVM coordinator reports compliance status to NGA leadership, JTF- GNO, and the DNI.