84101r4.pdf

UNCLASSIFIED

NI 8410.1R4 Approved: 2 February 2007 Subgroup: Information Technology

NGA Instruction for Implementation of Mobile Code

1. References.

a. Primary. NGA PD 8000R3, Policy Directive for Information Management and the Chief Information Officer, 24 November 2003.

b. Secondary. Secondary references are listed in appendix 1.

2. Purpose. Establish the policy, responsibilities, and procedures for importing, creating, and using mobile code in NGA’s information technology (IT) systems. This instruction supersedes NI 8410.1R3, same title, 8 December 2003.

3. Policy. NGA will follow Federal, DCI and DoD guidance to categorize and restrict mobile code technologies for all NGA IT systems; and continue to refine and enhance the NGA mobile code policy. The NGA Configuration Control Board (NCCB) ensures Agency efficiency in the review and evaluation of mobile code technology.

4. Applicability and Scope. This instruction applies to all NGA organizations, personnel, IT systems, and networks, and any other IT that processes NGA-owned data.

5. Definitions. Definitions are located in appendix 2.

6. Responsibilities.

a. Chief Information Officer (CIO).

(1) On a case-by-case-basis, reviews and explicitly approves in writing any waivers or exceptions to this instruction.

(2) Informs the DoD CIO and IC CIO of NGA’s use of emerging mobile code.

b. NCCB.

(1) Serves as a knowledge base for NGA mobile code technologies, applications, risks, risk mitigation strategies, security, and best management practices.

(2) Reviews proposed use of emerging mobile code.

(3) Publishes and updates a listing of risk categories for specific mobile code technologies.

NI 8410.1R4

Implementation of Mobile Code

(4) Reviews mobile code technologies and NGA, DoD, and IC mobile code policies, and makes recommendations to the Security and Installation Operations Directorate, Security Office, Computer Security Division (SISC), Certification and Accreditation Branch (SISCA) and the CIO.

(5) Disseminates technical solutions for risk mitigation of mobile code technologies.

c. Program managers.

(1) Ensure their programs comply with DoD, IC, and NGA mobile code policies, including the specific requirements in paragraph 7.

(2) Ensure that signed mobile code instituted in NGA systems is signed using an approved DoD or IC public key infrastructure (PKI) code-signing certificate once it becomes available.

(3) Ensure mobile code risk mitigation strategy detailing the measures incorporated into system development is included in the accreditation package as part of the System Security Authorization Agreement (SSAA).

(4) Ensure that all exceptions to NGA, DoD, or IC mobile code policies are approved by the CIO and are included in the SSAA.

(5) Identify mobile code requirements and ensure validation procedures are written.

(6) Obtain the approval of the NCCB and the CIO before implementing any system using incoming, unsigned category 1 or emerging mobile code.

d. Enterprise Operations Directorate (E).

(1) Manages and maintains the mobile code database as the approved listing of authorized mobile code.

(2) Blocks all mobile code that has not been authorized for use on IT systems to the maximum extent possible, including the disabling of mobile code in e-mail bodies and attachments.

(3) In coordination with SISCA, surveys, evaluates, and recommends commercial executable content security products.

e. SISCA, in conjunction with the NCCB, program managers, and E, supports the testing of mobile code and surveys, evaluates, and recommends commercial executable content security products. SISCA also reviews requests for exceptions to DoD and IC mobile code policies and makes recommendations to the CIO.

7. Procedures.

a. Downloading and executing mobile code in NGA IT systems.

(1) Unsigned mobile code is blocked by E (to the maximum extent possible) from entering classified NGA systems through the use of automated filtering devices (for example, firewalls).

(2) Mobile code digitally signed by a DoD or IC component may be allowed into NGA systems.

(3) Unsigned category 3 mobile code is allowed into unclassified NGA systems.

(4) Unsigned categories 1 and 2 and emerging mobile code may be allowed into NGA systems, if permission is given by the CIO.

(5) Whenever possible, the automatic execution of all categories of mobile code in e-mail bodies and attachments is disabled through the standard e-mail platform. Desktop software will be configured to prompt the user prior to opening e-mail attachments that may contain mobile code.

b. Exporting mobile code from NGA IT systems. All mobile code exported from NGA systems must be digitally signed.

c. Developing mobile code.

(1) Mobile code developed internally or developed by a contractor for use in an NGA system must be safeguarded to protect its integrity throughout its life cycle. Individuals developing mobile code must possess a security clearance and accesses commensurate with the level of the system.

(2) The CIO must approve new procurement and development efforts that use category 1 and category 2 mobile code that does not meet the requirements of this instruction (paragraph 7.a.). An example is unsigned mobile code that does not execute in a constrained environment or mobile code not obtained from a trusted source over an assured channel.

(3) Commercial-off-the-shelf products containing mobile code, with explicit or implicit suitability statements from the vendor, are considered adequate for ensuring proper functionality.

(4) Mobile code categories 1 and 2 must be accompanied with digitally signed, cryptographic checksums so integrity can be verified.

(5) When category 1 or category 2 mobile code is added to an existing system, the system must be reviewed for reaccreditation.

d. Testing mobile code. Program managers and E, in conjunction with SISCA,

(1) Establish mobile code testing procedures to ensure that technical risk mitigation efforts are configured and implemented appropriately.

(2) Review mobile code test reports and include findings in accreditation recommendations.

e. Evaluating and categorizing new or emerging mobile code. Program managers provide the NCCB with sufficient information to evaluate and categorize new or emerging mobile code technology (any code not identified in the Mobile Code Technology Risk Category Assignment) at least 180 days prior to intended operational use.

f. Requesting exceptions to DoD or IC mobile code policy. Program managers submit requests for exceptions to DoD or IC mobile code policy to the CIO through SISCA and the NCCB at least 180 days prior to intended use to allow sufficient time for the review and approval process.

g. Documenting use of mobile code. Program managers must address all use of mobile code, to include CIO approved exceptions, within the SSAA.

NI 8410.1R4 Appendix 1

Appendix 1 References

1. (U//FOUO document) DCI Directive 6/3, Protecting Sensitive Compartmented Information within Information Systems, 1 May 2003.

2. DoD Memorandum, Mobile Code Technologies Risk Category Assignments and Use Restrictions, 20 January 2006.

3. DoD 8510.1-M, DoD Information Technology Security Certification and Accreditation Process (DITSCAP) Application Manual, 31 July 2000.

4. (C document) Intelligence Community (IC) Policy Memorandum for the Use of Mobile Code in the SCI Environment, 11 May 2001.

5. NI 7400.1R4, NGA Instruction for Configuration Management, 9 June 2006.

NI 8410.1R4 Appendix 2

Appendix 2 Definitions

1. Mobile code. Software obtained from remote systems outside an enclave, transferred across a network, and then downloaded and executed on a local system with or without explicit installation or execution by the recipient.

a. Category 1 mobile code exhibits a broad functionality, allowing unmediated access to workstation, host, and remote system services and resources. Category 1 mobile code may have known security vulnerabilities with few or no countermeasures once they begin executing. There are two subgroups of Category 1 mobile code technologies.

(1) Category 1A consists of those mobile code technologies that may be used when the Category 1 restrictions in the DoD policy are implemented.

Category 1A technologies can differentiate between signed and unsigned mobile code and can be configured to allow the execution of signed mobile code while simultaneously blocking the execution of unsigned mobile code. (Examples are ActiveX controls and Shockwave movies, including Xtras that execute in the Shockwave for Director Plugin.)

(2) Category 1X consists of those mobile code technologies that are prohibited form being used in DoD information systems because they cannot implement the required Category 1 policy restrictions. They cannot differentiate between signed and unsigned mobile code or cannot be configured to block the execution of unsigned mobile code while enabling the execution of signed mobile code. (Examples are mobile code scripts that execute in Windows Scripting Host, HTML Applications that download as mobile code, or Unix shell scripts.)

b. Category 2 mobile code has full functionality, allowing mediated or controlled access to workstation, host, and remote system services and resources. Category 2 mobile code may have known security vulnerabilities but also have known fine-grained, periodic, or continuous countermeasures or safeguards. (Examples: Java applets and other Java mobile code, Visual Basic for Applications (VBA), LotusScript, PerfectScript, and PostScript.)

c. Category 3 mobile code supports limited functionality, with no capability for unmediated access to workstation, host, and remote systems services and resources. Category 3 mobile code may have a history of known vulnerabilities but also have support fine-grained, periodic, or continuous security or safeguards.

(Examples: Javascript executing in the browser (including Jscript and ECMAScript variants), VBScript executing in the browser, Portable Document Format (PDF), and Shockwave/Flash.)

NI 8410.1 Appendix 2

2. Emerging mobile code. Any and all mobile code technologies and applications that have not formally undergone a risk assessment and been assigned to one of the three categories. Examples are all mobile agent systems and platforms.

NGA Instruction for Implementation of Mobile Code