NI_8420.2R8.pdf

UNCLASSIFIED

NI 8420.2R8 Approved: 30 October 2009 Subgroup: Countermeasures

NGA Instruction for Antivirus Response

1. References.

a. Primary. NGA PD 8000R3, Policy Directive for Information Management and the Chief Information Officer, 24 November 2003.

b. Secondary.

(1) NI 5210.5R5, NGA Instruction for Serious Incident Reporting, 5 January 2004.

(2) NI 8010.9R5, NGA Instruction for Information Operations Condition (INFOCON) Including Information Assurance Vulnerability Management (IAVM), 20 March 2007.

2. Purpose. Establish the Agency process for the protection of NGA information and information systems against the threat of malicious computer code attack. This instruction supersedes NI 8420.2R7, same title, 12 October 2005.

3. Policy. NGA will follow DoD and IC standards and policy to establish and maintain a program of countermeasures and processes needed to mitigate the risk of malicious computer code (malware) to the agency’s information systems, its mission critical data, and the Defense Information Infrastructure (DII); to counter known malware threats; and to respond to, and recover from, malware attacks.

4. Applicability and Scope.

a. This instruction applies to all users and administrators of NGA information systems.

The antivirus response activities affect all personnel who use NGA, DoD, or IC information systems; protect systems while supporting mission accomplishment; and coordinate the overall defensive effort through adherence to standards. Although the antivirus response activities are implemented separately from the information operations condition (INFOCON) process defined in NI 8010.9R5 (reference 1.b.(2)), a malware attack may prompt a change in INFOCON level.

b. Detection of malware may trigger a Computer Security Incident Response Team (CSIRT) response through the Security Event Management (SEM) Process based on SEM triage and analysis criteria.

5. Definitions. Definitions are located in Appendix 1.

NI 8420.2R8

Antivirus Response

6. Responsibilities.

a. Office of the Chief Information Officer (OCIO), IT Security Management Office (CS), Information Assurance Division (CSI).

(1) Conducts periodic scans of the enterprise to validate NGA configuration baselines. Configuration baseline checks include security patch status and antivirus software checks.

(2) Provides oversight, as the Security Event Management (SEM) Process Owner, to Functional Teams that support the SEM Process.

(3) Prepares and protects the enterprise by ensuring adequate measures are in place to detect computer security incidents, triage/categorize them, and to conduct appropriate response activities.

(4) Provides annual Program Manager (PM), System Administrator (SA), and Information Systems Security Representative (ISSR) training.

b. Security and Installation Operations Directorate (SI), Security Office (SIS), Computer Investigation and Awareness Division (SISC), Investigations (SISCI) and Forensics (SISCF).

(1) Provides investigative and forensic expertise during all Agency incident response and control activities.

(2) Ensures all NGA personnel are informed of guidance and procedures (including reporting procedures) through monthly computer-security awareness bulletins, mandatory computer security briefings.

c. Security and Installation Operations Directorate, Office of Counterintelligence (SIC), Counterespionage Division (SICC), Cyber Branch (SICCC) will coordinate and report to external DoD and IC agencies when any malware or computer virus infection is determined to have association with foreign nation/state sponsored group, or terrorist organization.

d. Enterprise Operations Directorate (E), Infrastructure Service Provider (ISP) Solutions Office (EN), Engineering Division (ENE).

(1) Tests the types and versions of antivirus software to be maintained on NGA networks.

(2) Documents desktop configurations and delivers software for deployment to the ISP Core Services (ES), Enterprise Management Operations Division (ESM).

(3) Performs desktop product unit tests, including coordination of integration testing on desktop antivirus products with the Acquisition Engineering Office (AE), System Integrity Division (AEI), and Test and Integration Branch (AEIT).

(4) Configures antivirus software preferences in coordination with Anti- Malware (AMaC) Team according to NGA/DoD/DNI policy.

(5) Tests and installs enterprise layer anti-virus and malware countermeasures at the Enterprise perimeter and server levels.

e. Enterprise Operations Directorate, ISP Solutions Office (EN), Enterprise Management Services Division (ENM).

(1) Manages configuration of desktop products consistent with the NGA Configuration Management Plan (NCMP).

f. Enterprise Operations Directorate, ISP Core Services (ES), Incident Management Operations Division (ESI), Anti-Malicious Code (AMaC) Team.

(1) Provides guidance regarding antivirus software, software configuration, malware threats, remediation options, and spam.

(2) Obtains and distributes current antivirus signature files.

(a) Manages automated signature file distributions to all major Agency networks.

(b) Makes available updated signature files to system administrators and laptop users via shared folders and linked websites.

(3) Performs triage support for all malware detections in coordination with the SISC and OCIO/CSI offices as part of the SEM Process.

(4) Operates and maintains an anti-spam function to detect and filter out spam from SBU message traffic.

(5) Remediates network information systems discovered to not conform with the antivirus software baseline or to have antivirus signature files two weeks or more out-of-date.

g. All users of NGA networks and corporate information systems must:

(1) Ensure that virus definitions are up-to-date on their systems and that the antivirus software appears to be operating properly.

(2) Report to their Information Assurance Officer (IAO) (check the OCIO/CS website for the current list) or to the Enterprise Service Center

(ESC):

(a) Out-of-date virus definitions dated older than one week.

(b) Disabled antivirus software or pop-up alerts that indicate problems with system software.

(c) Operational problems that may indicate the execution of malware such as unexpected or excessive pop-up windows, redirection to malicious websites, very slow system operations or crashes, blue screens, or any other system abnormalities.

(3) Back up important data on a regular basis to help minimize loss or damage due to virus or malware activity.

(4) Install and update antivirus software on their home computers. Users (government and military personnel only) can take advantage of the Agency Anti-Virus Home Use Program.

h. Laptop users. In addition to the responsibilities in section 6.g above:

(1) Ensure that operating system and application software has the latest security patches installed by bringing the laptop to laptop support personnel on at least a bimonthly basis. Users will need to contact the ESC to open a Remedy ticket.

(2) Protect the laptop from theft or damage. Immediately report lost or stolen laptop to the local NGA site security office.

7. Procedures.

a. Prevention

(1) Cyber Security Elements (Perimeter Defense, AMaC Team, Intrusion Detection, Cyber Security Operations (ESIS))

(a) Shall become aware of malware threats and exploit risks through government and commercial computer security websites and alert emails.

(b) Shall take preventive measures to counteract the threats and remediate the risks in coordination with the TSO and OCIO.

(2) Users of NGA networks and corporate information systems:

(a) Shall use only authorized media on Agency information systems. If authorized, the media must be scanned for malware (on a standalone workstation where available) by an authorized IAO or properly trained Data Transfer Agent.

(b) Shall use only authorized software on Agency information systems.

(c) Shall exercise common sense and good judgment when opening emails, especially those containing hyperlinks or attachments.

(d) Shall be aware of the concepts of social engineering and spear phishing and take the mandatory Department of Defense (DOD) Spear-Phishing Awareness Training.

(2) General Policy:

(a) Using personally owned media (e.g., music CDs or software CDs, commercially produced or user-created, DVDs, or thumb/flash drives) on Agency information systems is prohibited.

(b) Downloading software, scripts, macros, or other executable content from the internet is prohibited. System administrators and privileged users as defined in NI 8010.2R7 must have prior authorization from the OCIO and the Designated Accrediting Authority (DAA) in order to perform such actions.

b. Detection and notification.

(1) Users of NGA networks and corporate information systems:

http://college.nga.ic.gov/library/pp/SpearPhishing.pps http://college.nga.ic.gov/library/pp/SpearPhishing.pps

(a) Shall report immediately, to any IAO or the ESC, any detection of malware on their information system as revealed by the antivirus software or by symptoms such as strange pop-up windows, strange cursor behavior, strange messages, unexpected and extensive hard drive activity, data file corruption or the presence of strange files in the home directory.

(b) Shall report any changes to the antivirus software configuration or operation or the presence of out-of-date antivirus signatures to their IAO or to the ESC for corrective action.

(2) Upon notification of potential a virus or malware incident, the ESC will alert the Enterprise Management Officer (EMO). The EMO will alert SISCI, SISCF, and the Technical Services Office (TSO) (as appropriate based on impact).

c. Investigation and Escalation.

(1) SISCI and SISCF will investigate and analyze reports and indications of system compromise based on a virus or other malware with the assistance of other functional teams in the SEM Process as required. They will also provide detailed reports of their findings, and identify, through proper reporting channels, the extent of the damage incurred.

(2) SISCI and SISCF will coordinate with the TSO, determine the level of the event for possible escalation, and relay the notification requirements to management.

(3) The TSO will coordinate the Agency's response activities and lead the Computer Security Incident Response Team (CSIRT) if a CSIRT is deemed appropriate. The TSO will provide information to management and external agencies as required. Refer to the SEM Process and CSIRT Standard Operating Procedures (SOP) (located on the OCIO/CSI SEM website) for further information.

d. Corrective action.

(1) Upon notification, the AMaC Team will obtain the latest antivirus signature files and initiate automated network distributions of these files to all managed information systems. The AMaC Team will then initiate full network scans for any detectable malware using these updated signature files. The TSO will be notified of the results of the scans when they are completed.

(2) The AMaC Team will provide technical assistance to the TSO and other elements of the SEM Process, as required, during a malware event.

(3) The AMaC Team will coordinate with the TSO concerning any IP address or domain blocking configuration changes on AMaC Team-managed network devices which scan and/or filter network traffic.

(4) The ES desktop support team will provide technical assistance in the recovery of data on information systems that have been damaged by malware. They will also repair or reimage affected information systems as deemed appropriate by the TSO.

(5) The ES server support team will ensure that all servers are updated with the latest antivirus signature files and that the antivirus software on these servers is configured and operating properly.

e. INFOCON reporting.

(1) CSI reports changes in NGA INFOCON status to the Commander U.S.

Strategic Command and Joint Task Force - Global Network Operations (JTF-GNO) through the Joint CERT Database.

Appendix 1 Definitions

1. Antivirus Response. A robust antivirus program that includes: prevention (e.g., mitigating the risk of infection from known malware through the installation and timely update of antivirus software on all agency assets capable of hosting such software);

detection (includes the detection of known malware by the antivirus client and the reporting of the detection to a central management server for analysis); reaction (triage and analysis through the Security Event Management (SEM) Process); user education (e.g., annual briefings, on-line computer-based training, splash page announcements, security blogs).

2. Malware. Malicious software ("malware") which can be detected by the latest version of antivirus software with the latest released signature files (definitions/DAT files).

Includes malware that is detectable through heuristics/behavioral analysis by the antivirus program even though there is no specific signature file written for it. Categories of malware include, but are not limited to, viruses, Trojan horses, worms, spyware/adware, key loggers, and time bombs.

3. Information System. Any workstation, server, appliance, laptop computer, tablet computer, or portable digital appliance capable of hosting malware and for which there is an antivirus solution available.

4. Computer Security Incident. An adverse event wherein some aspect of a computer system is threatened (e.g., loss of data confidentiality, compromise of data or system integrity, and disruption or denial of availability).

5. Current Antivirus Signatures. Antivirus signature files are considered current if they are within the window specified by the JTF-GNO or the DAA (currently within seven (7) days of release or better from the antivirus vendor) unless mandated by the JTF-GNO to be the latest signature files released (e.g., in response to an increase in INFOCON level, from a FRAGO or CTO, etc.). Antivirus signature files are also known as antivirus definitions files or antivirus DAT files depending on the vendor.

6. Authorized Software. Software that has been approved by NGA Infrastructure Engineering Division (ENE) and installed by either an authorized system administrator or privileged user.

7. Privileged User. A user or system administrator (SA) who has access to system control, monitoring, or administration functions.

8. Security Event Management (SEM) Process. The Security Event Management (SEM) Process provides NGA with the capability to protect, defend and sustain the Information Technology (IT) Infrastructure and respond to Computer Security Incidents by conducting appropriate response activities.

9. Computer Security Incident Response Team (CSIRT). Stands up as needed to coordinate and affect the appropriate response activities to computer security incidents.

NGA Instruction forAntivirus Response