attmt__18_CBP_Information_Systems_Security_Policies_and_Procedures_Handbook _HB_1400-05D.pdf

CBP INFORMATION SYSTEMS SECURITY POLICIES AND PROCEDURES HANDBOOK

HB 1400-05D

Information Systems Security Policies and Procedures Handbook

U.S. Customs and Border Protection

Office of Information and Technology

Version 3.0

February 8, 2012

DOCUMENT CHANGE HISTORY

Version Date Description

1.0 07/27/2009 Agency IT Security Policy. Reformated to follow the

DHS 4300A document structure including policy statement boxes with policy # and mapped NIST 800-53 security controls (if applicable). Also added the following DHS 4300A, Version 7.0 changes including, Section 2.0: redefining the DAA as the Authorizing Official (AO); creating Risk Executive (CBP CISO);

Section 3.9 Updated CISO Council and added Social Media Section; Section 4.0 added maintenance activities;

and Section 5.0 introducted Policy Enforcement Points (PEPs).

1.1 12/07/2009 Updated Section 5.4.7 to reflect revision in the CBP Rules of Behavior (ROB) Attachment G that specifically prohibits the use of webmail or other personal email accounts on CBP information systems and Section 5.4.8 prohibits providing personal or official DHS information solicited by e-mail; Updated handbook to reflect consistent definition of AO as authorizing official;

miscellaneous identified minors edits; and added Attachments TOC as requested by CBP ISSO and CA community.

2.0 10/01/2010 Updated to reflect recent policy changes driven by FIMP Project and recent changes in the DHS 4300A Policy and Handbook documents (versions 7.2 and 7.2.1). Changes include the following: (a) Created a new sub-section for Servers (including special servers) Section 4.8.1 and

4.8.1.1 respectively. These two-sub-sections were generated from FIMP work. Renumbered pre-existing

4.8 sub-sections and references; (b) Created new sub-section 5.4.3.3 for Domain Membership under 5.4.3 Network Connectivity. No impact on numbering or existing references. New sub-section generated from FIMP; (c) sub-section 3.16.1 Adjustment to definition of PII and the introduction of formal definition of SPII; (d) section 1.10 - DHS requirement that CBP Privacy Officer approve and sign waivers/exception requests related to CBP privacy designated system; (e) adopt new section

1.11 from DHS on Info Sharing and Communications Strategy; (f) adopt new subsection 1.12 that explains how to make policy change recommendations; (g) new policy statement (2.2.2c/15) that requires administrative privelges to be reviewed and approved; (h) adding new policy statement (2.11.a) for CBP Privacy Officer; (g) revised desktop configuration management guideline (3.7e); (h) Many additions and additional references and ii

Version Date Description policy statements within the 3.16 Privacy and Data Security Section; (i) (4.1.4b-d) new policy statements regarding administrator priveleges; (j); clarity on SMS- MMS prohibition; (k) requires maintenance personnel to be ‘cleared’ and not just ‘trusted’; (l) (5.4.3) clarifies definition of network connectivity; (m) added clairification on interconnections between DHS components and ISA requirements (5.4.3f/m/n); (l) (5.4.7.jj) common naming conventions required for DHS email systems; (m) (5.7.3.f) clearly prohibts sharing of private keys; (n) (1.10.3k) waiver/exception approval and reporting requirements; (o) (2.2.2) AO must be fed and senior manager; (p) (2.7) CO must be a fed and senior manager; (q) (3.2) added language to Capital Planning and Investment Control; (r) (3.5.2.h) CP testing coordinating with DHS components for Mod/High systems; (s) (2.3.3 and 3.17) Financial System Owners ensure key controls assessed annually; (t) (3.19) Possible new section related to HIPPA; (u) (4.1.1) contractor positions assessed for sensitivity rating annually; (v) (5.2) limit to 1 concurrent session for High systems; (w) (5.4.2) limits to network monitoring; (x) (5.7.3) DHS PKI MA responsible for Human Subscriber Forms; (y) (2.5.1) creating new sub-section for CBP ISSMs; (z) Figure 2.0

3.0 November 2011 Changed words such as accreditation, certification, ST&E, etc. ; 1.10 4th paragraph, 1.10.3; 1.10.3.1; 1.11.d;

2.2.2 Security Control assessor; 2.2.2.d/e/f; 2.5.c; 2.5.d;

page 27 (#s 41/44/45/46/47); 2.6.c; 2.7.c; 2.7.d; 2.9.d;

2.9.f; 2.9.g; 2.12.d; 2.1.4.c; 2.1.4.d; 2.1.4.e; 3.2.h; 3.5.2.c;

3.5.2.h; 3.7.h; 3.9.f; 3.9.v; 3/16.7.e/f/g; 3.19.b/c/d; Table 4.1.1; 4.1.5.b/c/d/e/g/j/k; 4.3.1.f/g/h; 4.9.j; 4.10.b; 5.2.i/g;

iii

This version of the U.S. Customs and Border Protection (CBP) Information Systems Security Policies and Procedures Handbook (HB 1400-05D, Version 2.1) was updated to reflect all current policy changes issued by DHS through the updated release of their 4300A Policy, Version 9.0 (issued October 11, 2011) and Handbook Version 7.2.1.1 (issued January 19, 2011) documents. The objective is to provide the CBP community with DHS and CBP information security policies in one location as well as to enhance CBP's ability to timely document and implement all future DHS 4300A information security policy changes. 1400-05D, Version 3.0 is in full-compliance and alignment with DHS Policies.

Security of information and information systems has taken on new urgency in the globally computer-enabled world of the 21st century. We must exercise vigilance to protect our information resources. Owners, operators, developers, and users of information systems each have a personal responsibility to protect these resources. Managers and supervisors are personally responsible for understanding the sensitivity and criticality of their data as well as the damage that could occur to unprotected resources. It is their responsibility to provide appropriate security controls for the resources entrusted to them. CBP security authorization authorities have the weighty responsibility to ensure that all systems presented for security authorization have adequately addressed threats and vulnerabilities to minimize security risks of operating in the production environment.

The value of this information security policy is in its execution by all CBP system owners, operators, administrators, developers, interconnecting trade partners, government agencies, and system users. The goal of executed information security policies is to reduce the risks posed to CBP information and information systems by unauthorized access or disclosure. The result of well-executed information security policies is consistent application of security countermeasures enterprise-wide that provide defense-in-depth for all CBP systems and data.

iv

1.0 INTRODUCTION

1.1 Security Objectives

1.2 IT Security Program Policy and Implementation Guidelines

1.3 Applicability

1.4 Authorities

1.5 Document References

1.6 Information Systems Security Policy Hierarchy

1.7 Policy Overview

1.8 General CBP Security Policy

1.8.1 Security of Non-CBP Sites

1.9 Penalties and Offenses

1.10 Waivers and Exceptions

1.10.1 Waivers

1.10.2 Exceptions

1.10.3 Waiver or Exception Requests

1.10.4 U.S. Citizen Exception Requests

1.11 Information Sharing and Communication Strategy

1.12 Changes to Policy

2.0 ROLES AND RESPONSIBILITIES

2.1 Commissioner/Principal Authorizing Official

2.2 Assistant Commissioner, Office of Information Technology

2.2.1 Chief Information Officer

2.2.2 Authorizing Official

2.3 Chief Financial Officer Designated Financial Systems

2.3.1 Chief Financial Officer

2.3.2 Chief Information Officer

2.3.3 Financial System Owners

2.4 Other Assistant Commissioners

2.5 Chief Information Security Officer

v

2.5.1 Information System Security Manager

2.6 Risk Executive

2.7 Security Control Assessor

2.8 Certification Agent

2.9 Information Systems Security Officer

2.9.1 Information System Security Officers supporting Privacy Sensitive Systems:

2.9.2 Information System Security Officers supporting Chief Financial Officer- Designated Financial Systems

2.10 Supervisors and Managers

2.11 Privacy Officer

2.12 Program Manager

2.13 United States Computer Emergency Readiness Team

2.14 Information System Owners and Information Owners

2.15 Users of Supplied Computing Resources

2.16 All Users

2.17 Additional Personnel

2.17.1 System Administrators - Network Administrators

2.17.2 System Control Officer

2.17.3 OneNet Steward

2.18 Security Operations Center

2.19 Common Control Provider

3.0 MANAGEMENT CONTROLS

3.1 Basic Requirements

3.2 Capital Planning and Investment Control

3.2.1 Investment Management Process

3.3 Contractors and Outsourced Operations

3.3.1 Non-Disclosure Agreements

3.4 Performance Measures and Metrics

3.5 Continuity Planning for Critical CBP Assets

3.5.1 Continuity of Operations Planning

3.5.2 IT Contingency Planning

3.6 System Life Cycle

3.6.1 Planning

vi

3.6.2 Requirements Definition

3.6.3 Design

3.6.4 Development

3.6.5 Test

3.6.6 Implementation

3.6.7 Operations and Maintenance

3.6.8 Disposition

3.7 Configuration Management

3.8 Risk Management

3.8.1 Risk Assessment

3.8.2 Risk Mitigation

3.8.3 Evaluation and Assessment

3.9 Security Authorization and Security Control Assessments

3.9.1 FIPS 199 Categorization and the NIST SP 800-53 Controls

3.9.2 Privacy Impact Assessment

3.9.3 E-Authentication

3.9.4 Risk Assessment

3.9.5 Security Plan

3.9.6 Contingency Plan

3.9.7 Security Test and Evaluation Plan

3.9.8 Contingency Plan Testing

3.9.9 Security Assessment Report

3.9.10 Authorization to Operate Letter

3.9.11 Annual Self-Assessments

3.10 IT Security Review and Assistance

3.10.1 Review and Assistance Management and Oversight

3.10.2 Information Security Assistance

3.10.3 IT Security Reviews

3.11 Security Working Groups and Forums

3.11.1 DHS Chief Information Security Officer (CISO) Council

3.11.2 DHS Information Security Training Working Group

3.12 CBP Information Technology Security Policy Review Board

3.13 CBP Information Systems Security Officer Working Group

vii

3.14 Information Security Policy Violation and Disciplinary Action

3.15 Required Reporting

3.16 Privacy and Data Security

3.16.1 Personally Identifiable Information

3.16.2 Privacy Threshold Analyses

3.16.3 Privacy Impact Assessments

3.16.4 Systems of Records Notices

3.16.5 Protecting Privacy Sensitive Systems

3.16.6 Privacy Incident Reporting

3.16.7 E-Authentication

3.17 DHS Chief Financial Officer – Designated Financial Systems

3.18 Social Media

3.19 Health Insurance Portability and Accountability Act

4.0 OPERATIONAL CONTROLS

4.1 Personnel

4.1.1 Citizenship, Personnel Screening, and Position Categorization

4.1.2 Rules of Behavior

4.1.3 Access to Sensitive Information

4.1.4 Separation of Duties

4.1.5 Information Security Awareness, Training, and Education

4.1.6 Separation from Duty

4.2 IT Physical Security

4.2.1 General Physical Access

4.2.2 Sensitive Facility

4.3 Media Controls

4.3.1 Media Protection

4.3.2 Media Marking

4.3.3 Media Sanitization and Disposal

4.3.4 Production, Input/Output Controls

4.4 Voice Communications Security

4.4.1 Private Branch Exchange

4.4.2 Telephone Communications

4.4.3 Voice Mail

viii

4.5 Data Communications

4.5.1 Telecommunications Protection Techniques

4.5.2 Facsimiles

4.5.3 Video Teleconferencing

4.5.4 Voice over Data Networks

4.6 Wireless Communications

4.6.1 Wireless Systems

4.6.2 Wireless Portable Electronic Devices

4.6.3 Wireless Tactical Systems

4.6.4 Radio Frequency Identification

4.7 Overseas Communications

4.8 Equipment

4.8.1 Servers

4.8.2 Workstations

4.8.3 Laptop Computers and Other Mobile Computing Devices

4.8.4 Government Furnished Portable Electronic Devices

4.8.5 Government Furnished Removable Media

4.8.6 Personally Owned Equipment and Software (Not owned by or contracted for by the Government)

4.8.7 Personally Owned Portable Electronic Devices

4.8.8 Hardware and Software

4.8.9 Personal Use of Government Office Equipment and DHS IT Systems/Computers

4.8.10 Wireless Settings for Peripheral Equipment

4.9 DHS and CBP Information Security Operations

4.9.1 DHS Security Operations Center Organization

4.9.2 Logging and Monitoring

4.9.3 Authority and Management

4.9.4 Forensics

4.9.5 Vulnerability Management

4.9.6 Security Incidents and Incident Response and Reporting

4.9.7 Law Enforcement Incident Response

4.9.8 Definitions and Incident Categories

ix

4.10 Documentation (Manuals, Network Diagrams)

4.11 Information and Data Backup

4.11.1 Backup Strategy

4.11.2 Local Area Network Backup Guidance

4.12 Converging Technologies

5.0 TECHNICAL CONTROLS

5.1 Identification and Authentication

5.1.1 Passwords

5.2 Access Control

5.2.1 Automatic Account Lockout

5.2.2 Automatic Session Termination

5.2.3 Warning Banner

5.3 Auditing

5.4 Network and Communications Security

5.4.1 Remote Access and Dial-In

5.4.2 Network Security Monitoring

5.4.3 Network Connectivity

5.4.4 Firewalls and Policy Enforcement Points

5.4.5 Router Device Management

5.4.6 Internet Security

5.4.7 Electronic Messaging and Email Security

5.4.8 Personal Email Accounts

5.4.9 Testing and Vulnerability Management

5.5 Scanning and Monitoring Policy

5.5.1 Authorized/Approved Monitoring

5.5.2 Sniffer Devices

5.6 Peer-to-Peer Technology

5.7 Cryptography

5.7.1 Encryption

5.7.2 Public Key Infrastructure

5.7.3 Public Key/Private Key

5.8 Virus Protection

5.8.1 What Is a Virus?

x

5.8.2 Other Types of Malicious Code

5.8.3 How Viruses and Other Malicious Code Affect Systems

5.8.4 Procedures When a Virus Is Detected on a System

5.9 Product Assurance

5.10 Malware Protection

xi

Figure 1.6: Security Policy Development

Figure 2.0: Security Management Roles and Responsibilities

Figure 3.2: Program Investment Review Process

Figure 3.2.1: CBP Program Funding Process

Figure 3.6: System Life Cycle Process

Figure 4.3.3: Flowchart depicting the process for selecting media sanitization method

Figure 4.9.1: DHS Security Operations Center Organization

Figure 4.9.6: Incident Reporting Process

Table 3.9.1: NIST SP 800-53 Security Controls

Table 3.18: Documentation and Testing Artifacts

Table 4.1.1: CBP Investigative Requirements

Table 4.3.4: Information Handling Policies by Classification Level

Table 4.9.4: Forensic Investigations Tiers

Table 4.9.5.1: Information Security Vulnerability Management Requirements

Table 4.9.6.1: Computer Incident Reporting Contact Information

Table 5.4.4.4: Unauthorized Firewall Protocols and Services

Table 5.4.6.1: Unauthorized Network Activities

Table 5.4.6.4: Mobile Code Risk Categories

Table 5.8.2: Types of Malicious Code xii

T A B L E O F C O N T E N T S - A T T A C H M E N T S

TABLE OF - ATTCHMENTS

xiii

HB 1400-05D, VERSION 3.0

1.0 INTRODUCTION

Customs and Border Protection (CBP) must incorporate security safeguards within its information systems to support the Department of Homeland Security (DHS) mission. This handbook serves as an aid to CBP IT users to achieve confidentiality, integrity, availability, and non-repudiation within CBP Information Technology (IT) infrastructure and operations.

The purpose of this document is to provide specific techniques and procedures for implementing the requirements of the CBP Information Security Program for Sensitive Systems. These baseline security requirements (BLSRs) are generated by the DHS IT security policies published in DHS Sensitive Systems Policy Directive 4300A. The BLSRs included in 4300A (see Attachment A, Requirements Traceability Matrix) must be addressed in the IT security documents prepared by CBP.

This handbook incorporates DHS 4300A information security policies and procedures. In addition, it implements as requirements many of the guidelines contained in various National Institute of Standards and Technology (NIST) publications, Office of Management and Budget (OMB) direction and Congressional as well as Executive Branch mandates. Due to its business mission, CBP systems may require policies and procedures that are more stringent than those required by federal or DHS security policy.

The intended audience includes all elements of CBP using information systems and networks within CBP. Specific procedures supporting these policies may be found in the attachments. The scope and contents of this handbook will change over time as new capabilities are added to CBP systems, as security standards are upgraded, and as a result of user experience and comment.

This handbook is issued as implementation guidance under the authority of the Chief Information Officer (CIO) through the Office of the Chief Information Security Officer (CISO).

This handbook addresses IT security only. However, those aspects of personnel, physical, information and industrial security; investigations; emergency preparedness; and counterterrorism that relate to IT security are addressed in this handbook.

1.1 Security Objectives

Confidentiality, availability, integrity, and non-repudiation are the CBP primary security objectives. These provide a framework to develop security policies and procedures for CBP.

Risk management is another key objective, which is addressed in more detail in Section 3.8. The weighing of risks associated with each primary security objective may not be equal, nor will it be assessed in the same way for classified and Sensitive-But-Unclassified (SBU) information and information systems at CBP. Federal Information Processing Publication (FIPS) -199, Standards for Security Categorization of Federal Information and Information Systems, offers guidance to categorize information systems based on the priority of each of the security objectives. CBP follows this guidance in categorizing its SBU information and information systems.

1.2 IT Security Program Policy and Implementation Guidelines

This handbook provides procedures and techniques necessary to implement the BLSRs relating to management, operational, and technical controls that provide the foundation necessary to ensure confidentiality, integrity, availability, authenticity, and non-repudiation within the CBP IT infrastructure and operations.

This handbook addresses the procedures necessary for implementing security requirements for sensitive IT systems. A CBP system is any information system that transmits, stores, or processes data or information and is (1) owned, leased, or operated by CBP, (2) operated by a contractor on behalf of CBP, or (3) operated by another Federal, state, or local Government agency on behalf of CBP. CBP policy mandates that all CBP computing resources be individually accounted for as part of an IT system. IT systems encompass major applications and general support systems.

The CBP Information Security Program does not apply to any IT that processes, stores, or transmits foreign intelligence information pursuant to Executive Order (E.O.) 12333, to Director of Central Intelligence directives governing the protection of intelligence information, and to other applicable orders.

Policy elements are effective when issued. Any policy elements that have not been implemented within 90 days shall be considered a weakness. Either a system or program Plan of Action and Milestones (POA&M) must be generated for the identified weaknesses. After 90 days, any new policy elements that have not been implemented shall be considered a weakness. When DHS Security Compliance tools [Risk Management System (RMS) and Trusted Agent FISMA (TAF)] are required to be updated to reflect policy element changes, tool changes shall be available to CBP within 45 days of the policy changes.

1.3 Applicability

This handbook applies to all CBP personnel, contractors acting for CBP, and all authorized users who access CBP information systems. The CBP Information Systems Security Policies and Procedures Handbook applies to all CBP information systems used to process, store, transmit, or receive any CBP data.

CBP Mission Statement

Information security principles and practices in this document support the basic CBP mission stated below:

We are the guardians of our Nation’s borders. We are America’s frontline.

We safeguard the American homeland at and beyond our borders.

We protect the American public against terrorists and the instruments of terror.

We steadfastly enforce the laws of the United States while fostering our Nation’s economic security through lawful international trade and travel.

We serve the American public with vigilance, integrity, and professionalism.

1.4 Authorities

DHS established a department-wide Information Technology (IT) security program presented in DHS 4300A Sensitive Systems Handbook and DHS 4300B National Security Systems

Handbook for classified systems. This policy and authority extends to CBP, a component of

DHS.

Applicable Executive orders, public laws, and national policy for this handbook include the following:

5 Code of Federal Regulations (CFR) §2635, Office of Government Ethics, Standards of Ethical Conduct for Employees of the Executive Branch

Department of Homeland Security Acquisition Regulation (HSAR), June 2006

Department of State 12 Foreign Affairs Manual (FAM) 600, Information Security Technology, June 22, 2000

DHS Management Directives (e.g., MD 0470.1, MD 140-01, MD 1030, MD 4400.1, MD

4500.1, MD 4600.1, MD 11042.1, MD 11050.2)

Executive Order 12472, Assignment of National Security and Emergency Preparedness Telecommunications Functions, dated April 3, 1984

Executive Order 12656, Assignment of Emergency Preparedness Responsibilities, dated November 18, 1988, as amended

Federal Financial Management Improvement Act of 1996 (FFMIA), P.L. 104-208

Federal Managers’ Financial Integrity Act of 1982 (FMFIA), P.L. 97-255

Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004

National Institute of Standards and Technology (NIST) Special Publications (e.g., 800-16, 800-34, 800-37, 800-50, 800-53 Revision 1) and Federal Information Processing Standards (FIPS) (e.g., FIPS 199, 200)

NIST Federal Information Processing Standards (FIPS) 200, Minimum Security Requirements for Federal Information and Information Systems

Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources

OMB Bulletin 06-03, Audit Requirements for Federal Financial Statements August 23, 2006

OMB Circular A123, Management’s Responsibility for Internal Control, Revised, December 21, 2004

OMB Circular A-127, Financial Management Systems, Revised December 1, 2004

Privacy Act of 1974, As Amended. 5 United States Code (U.S.C.) 552a, Public Law 93-579, Washington, D.C., July 14, 1987

Public Law 104-106, Clinger-Cohen Act of 1996 [formerly, Information Technology Management Reform Act (ITMRA)], February 10, 1996

Public Law 107-296, Homeland Security Act of 2002

Public Law 107-347, E-Government Act of 2002, including Title III, Federal Information Security Management Act (FISMA)

The National Security Act of 1947, dated July 26, 1947

1.5 Document References

Applicable documents used in the preparation of this handbook are listed below

Public Law

Public Law 100-235, Computer Security Act of 1987, January 8, 1988

Public Law 101-576, Chief Financial Officers (CFO) Act of 1990

Public Law 104-106, Information Technology Management Reform Act of 1996, Section 5131

Public Law 106-398, National Defense Authorization Act of 2001

Public Law 107-347, E-Government Act of 2002 (includes FISMA, Title III)

Public Law 107-347, Federal Information Security Management Act of 2002, Title III – Information Security

Executive Orders

Executive Order 13200, President’s Information Technology Advisory Committee, Further Amendment to Executive Order 13035, as Amended, Signed: February 11, 2001

Executive Order 13215, President’s Information Technology Advisory Committee, Further Amendment to Executive Order 13035, as Amended, Signed: May 31, 2001

Executive Order 13228, Establishing the Office of Homeland Security and the Homeland Security Council, Signed:

October 8, 2001

Executive Order 13231, Critical Infrastructure Protection in the Information Age, October 16, 2001

Homeland Security Presidential Directive 7, Critical Infrastructure Identification, Prioritization, and Protection, December 17, 2003

Federal Guidance

OMB Circular A-130, Appendix III, Security of Federal Automated Information Resources

OMB Memorandum M-06-16, Protection of Sensitive Agency Information, June 23, 2006

OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, September 26, 2003

OMB Memorandum M-04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

OMB Memorandum M-07-16 Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

9/11 Act of 2007, Increased Mission Requirements for Chief Privacy Officer

OMB Circular A-123, Management’s Responsibility for Internal Control, Revised, December 21, 2004

OMB Circular A-127, Financial Management Systems, Revised December 1, 2004

OMB Bulletin 06-03, Audit Requirements for Federal Financial Statements, August 23, 2006

OMB Bulletin 01-02, Audit Requirements for Federal Financial Statements, October 19, 2000

FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, May 2006

FIPS 140-1 (January 1994) and FIPS 140-2 (May 2001), Security Requirements for Cryptographic Modules

NIST SP-800-18, Guide for Developing Security Plans for Information Technology Systems, Revision 1, February

NIST SP-800-21, Guideline for Implementing Cryptography in the Federal Government, Revision 1, December

NIST SP-800-30, Risk Management Guide for Information Technology Systems, July 2002

NIST SP-800-37, Rev. 1, DRAFT Guide for the Security Authorization of Federal Information Systems: A Security Life Cycle Approach, August 2008

NIST SP-800-47, Security Guide for Interconnecting Information Technology Systems, August 2002

NIST SP-800-48, Wireless Network Security for IEEE802.11 a/b/g and Bluetooth, August 2, 2007

NIST SP-800-53, Recommended Security Controls for Federal Information Systems, Revision 1, December 2006

NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems, 6/2008

NIST SP-800-55, Security Metrics Guide for Information Technology Systems, July 2003

NIST SP-800-55, Performance Measurement Guide for Information Security, Revision 1, July 2008

NIST SP-800-65, Integrating IT Security into the Capital Planning and Investment Control Process, January 2005

NIST SP-800-63, Electronic Authentication Guidelines, Draft, February 20, 2008

NIST SP-800-61, Computer Security Incident Handling Guide, March 2008

NIST SP-800-98, Guidelines for Securing Radio Frequency Identification (RFID) Systems, April 2007

CNSS Instruction No. 4009, National Information Assurance Glossary, Revised June 2006

CNSS Instruction No. 1001, National Instruction on Classified Information Spillage, February 2008

Code of Federal Regulations (CFR) §2635, Office of Government Ethics, Standards of Ethical Conduct for Employees of the Executive Branch

Departmental/Agency Policy

DHS, Sensitive Systems Handbook 4300A, Version 6.1.1, October 31, 2008

DHS, IT Security Procedural Guide, Developing a Contingency Plan (Appendix 1 of DHS Security Program Handbook)

CBP, System Life Cycle Handbook, CIS HB 5500-07B, Version 1.2, October 16, 2008

Department of Defense Directive 8100.2, April 14, 2004, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG)

1.6 Information Systems Security Policy Hierarchy

Federal security policy flows from the executive level and Public Law to Department and Bureau levels. Development of policy at the national level generally begins with the creation of an Executive Order (EO), a Presidential Decision Directive (PDD), or a Public Law (PL). Other organizations such as the National Security Agency (NSA), the National Institute of Standards and Technology (NIST), and the Office of Management and Budget (OMB) also provide guidance and directives for policy development. Federal agencies use these orders, directives, laws, and guidance to generate policies and practices applicable to their organizations. Figure 1.6, Security Policy Development depicts the flow of points of policy origination for CBP.

Figure 1.6: Security Policy Development

1.7 Policy Overview

Security of federal information systems is mandated by law. (See Section 1.5) Information security policy regulates how an organization protects and assigns resources to achieve its security objectives. Security safeguards and countermeasures are selected as a result of risk assessment activities. The overall CBP information technology security program encompasses the architectural framework that contains applications, networks, hardware, software, services, processes, policies, documentation, and resources that assist in accomplishment of the CBP mission. Funding of CBP is closely tied to the robustness of its security program, which must be reported annually to the Office of Management and Budget (OMB). Great importance is given to security authorization of applications and systems. Security status of a project is weighted heavily in Congressional funding considerations. (Refer to Section 3.2.1 Investment Management Process.) Section II.B of the OMB Exhibit 300 annual report requires detailed reporting on the security program.

The statement that security is everyone’s responsibility is absolutely true. System owners, operators, developers, and users of information systems each have a responsibility to protect IT data and resources. Managers and supervisors should provide appropriate security controls for any information resources entrusted to them. Managers and supervisors must be aware of the sensitivity and criticality of their data. In order to protect this data, managers should ensure that all IT users are aware of required security practices and procedures. Users of CBP systems have the responsibility to learn and follow the policies and procedures governing the use of CBP resources.

CBP IT security policies delineate the security management structure and foundation to measure progress and compliance. Policies in this document are organized under three areas:

management, operational, and technical.

Management Controls – Focus on managing both the IT security system and system risk.

These controls consist of risk mitigation techniques and concerns normally addressed by management.

Operational Controls – Focus on mechanisms primarily implemented and executed by people. These controls are designed to improve the security of a particular system, or group of systems. These controls require technical or specialized expertise and often rely on management and technical controls.

Technical Controls – Focus on security controls executed by IT systems. These controls provide automated protection from unauthorized access or misuse. They facilitate detection of security violations, and support security requirements for applications and data.

1.8 General CBP Security Policy

All information technology that generates, stores, processes, transfers, or communicates sensitive information shall be protected at a level commensurate with the threat. The following security practices, therefore, are necessary.

1. New system acquisitions, system development, and modifications to existing systems must be coordinated with the Security and Technology Policy (STP) Branch.

2. It is recommended that a label be affixed to media containing Sensitive-But- Unclassified (SBU) information, especially in environments where both sensitive information and classified information are processed. Labels stating “this medium is unclassified” are available from General Services Administration (GSA) [Standard Form (SF) 710]. Unless otherwise specified, SBU data should be labeled as “For Official Use Only” and safeguarded against unauthorized disclosure, modification, access, use, or destruction. (See Section 4.3 media controls for details.)

3. All Major Applications (MAs) and General Support Systems (GSSs) must be authorized to comply with required security controls.

4. Connections between CBP information systems and any other systems or networks not under CBP authority are unauthorized, unless documented by a formally approved Interconnection Security Agreement (ISA) signed by the Deputy Director, Enterprise Data Management and Engineering Division (EDME)/Office of Information and Technology (OIT). If the system or network not under CBP authority is owned by another DHS component, an ISA is still required. The non-CBP system representatives must have the authority to represent their organization, when defining security requirements to be included in the ISA. (See Attachment N)

5. The non-CBP signatory representative(s) must have the authority to accept the system risk incurred by the connection to CBP. One non-CBP signatory authority would belong to the organization owning the information system at the point of connection to CBP. The organization that owns the data to be transferred through the interconnection may also be a stakeholder in the interconnection. Therefore, an individual from one or more organizations participating in the interconnection (e.g., the system owner and the data owner) may be the signatory authorities representing the non-CBP side of the connection. Because non-CBP organizations are participants in the ISA and are required to sign the agreement, CBP may have to be somewhat flexible in adhering to the ISA Template. The Information Systems Security Officer (ISSO) assigned to the system should be contacted before any modifications to the template are made.

6. CBP information systems are for authorized CBP business only. “Limited Personal Use” is authorized under the conditions specified in Section 4.8.9.

7. Appropriate physical, administrative, and technical safeguards will be implemented and maintained to ensure the most cost-effective security safeguards exist. These safeguards will be consistent with the approved CBP enterprise architecture to ensure proper integration and interoperability.

8. Installation of assistive software, hardware, or other adaptive devices is subject to standard CBP security testing and change request processes before introducing these products to the production environment. Such adaptive devices and/or software must not degrade or circumvent established system security controls.

9. The requirement to protect Privacy Information is a federal law. CBP systems of record will be afforded the level of security protection commensurate with the level of safeguards required by Federal Privacy Law. For more information on Privacy Law implementation within CBP, contact the CBP Privacy Law Advocate within the Office of Regulations and Rulings (OR&R).

10. Users have no expectation of privacy when using CBP network resources, including the use of electronic messaging, Internet, and other CBP applications and systems.

Acceptance of this condition is positively validated when users log onto the network

1.8.1 Security of Non-CBP Sites

Organizations providing contracted services to CBP at other than CBP facilities must adhere to the security policies described within this document to include federal policies and regulations.

Services provided by non-CBP sites are integral parts of CBP Major Applications (MAs) or General Support Systems (GSSs) and must be considered within the system boundaries of the security authorization process of the applicable information system.

All CBP information systems must be properly authorized. The Assistant Commissioner, OIT must authorize information systems that are functionally owned and managed by CBP. Any CBP information system operating without the approval of the Assistant Commissioner, OIT is not considered accredited, regardless of any other security authorization, unless there is an explicit written Memorandum of Understanding that provides different policy.

Non-CBP sites are subject to the same security review as government owned or controlled sites.

The reviews are conducted in accordance with the Federal Information Security Management Act (FISMA) of 2002, which states in the relevant section:

“The head of each agency shall be responsible for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of the agency.” (H.R.

2458—51, section 3544).

The goal of the information system security review effort is to ensure that sensitive CBP information being processed at non-CBP facilities is appropriately protected commensurate with federal law, CBP policies, DHS regulations, and security best practices. The objectives of the security reviews are to assess the effectiveness of security controls in place at all facilities, identify areas of strength and weakness, assist in corrective measures, and issue resolution where necessary.

Guidance for a self-evaluation of the security controls implemented to protect CBP information systems (i.e., Major Applications [MAs] and General Support Systems [GSSs] as listed in the CBP system inventory) compliance with CBP security policy. The self-assessment used by CBP is found in the NIST SP 800-53, which provides a detailed checklist for 17 security areas. STP staff, namely the Information Systems Security Officers (ISSOs) will complete the self-assessment templates generated by the DHS Risk Management System (RMS) tool. Based on DHS requirements, artifacts produced by security reviews of government or contractor/consultant facilities will be completed for each MA or GSS system, but not necessarily for each individual site. Independent audit agencies may validate the results of the completed self-assessments of CBP information systems.

1.9 Penalties and Offenses

All users authorized to access CBP systems are responsible for reading and complying with the policies in this handbook, as well as other CBP policies that govern standards of behavior within CBP. Failure to comply with these policies subjects a violator to the published penalties. These are available on the CBPnet using the following link:

http://www.cbp.gov/xp/cgov/careers/neo_kit/additional_info/standards_of_conduct/

Supervisors and managers are responsible for determining appropriate disciplinary action and applicable penalties for violations. Although some infractions may incur progressive disciplinary actions, others may be serious enough to warrant removal.

1.10 Waivers and Exceptions

Waivers from or exceptions to CBP or DHS policy may be requested from DHS or CBP policy requirements.

All waivers and exception requests for a specific system shall include the system name and system Trusted Agent FISMA (TAF) Inventory ID.

Any waiver or exception request should be handled at the same classification level as the system, either unclassified or classified. For an unclassified waiver or exception, which includes the identification of system vulnerabilities, the request should be marked “For Official Use Only.”

Any waiver or exception request from DHS policy shall be made to the Certifying Agent (CA) through the Information Systems Security Officer (ISSO) with the concurrence of the business owner and system owner. The request is then vetted through the appropriate Security and Technology Policy (STP) Team. The formal request is submitted through the Chief Information Security Officer (CISO) to the DHS CISO. All submitted policy waiver or exception requests shall be coordinated with the Authorizing Official (AO) prior to submission to DHS.

Any waiver or exception request from CBP policy shall be submitted to the Certifying Agent (CA) through the Information Systems Security Officer (ISSO) with the concurrence of the http://www.cbp.gov/xp/cgov/careers/neo_kit/additional_info/standards_of_conduct/ business owner and system owner. The request is then vetted through the appropriate STP Team.

The formal request is submitted through the CISO to the AO for final approval.

1.10.1 Waivers

A request for a waiver to any portion of DHS or CBP policy may be made, for up to 6 (six) months, any time DHS or CBP policy requirements cannot be achieved. Waiver requests shall include the operational justification, risk acceptance, risk mitigation measures, and a plan for bringing the system into compliance.

If a Material Weakness is reported in an Audit Report, and the control weakness is not scheduled to be remediated within twelve months, a waiver request must be submitted as described above.

If the Material Weakness is against a financial system, the CFO must also approve the waiver request before sending it to the CISO or through the CISO to the DHS CISO.

The Commissioner shall approve any waiver request that results in a total waiver time exceeding 12 months before sending it to the DHS CISO and the waiver must be reported as a material weakness in the Federal Information Systems Management Act (FISMA) report.

All waiver requests must identify the POA&M for bringing the system procedures or control weakness into compliance. In all cases waivers should be requested for an appropriate period based on a reasonable remediation strategy.

1.10.2 Exceptions

Exceptions may be requested whenever an office is unable to bring a system control weakness into compliance or requires a permanent exception to DHS or CBP policy. Exceptions are generally limited to systems that are unable to comply due to detrimental impact to mission, excessive costs, and/or clearly documented end of platform life for non-essential systems within 18 months, commercial-off-the-shelf (COTS) products that cannot be configured to support the control requirement, etc.

This request shall include the operational justification, risk acceptance, and risk mitigation measures.

The resulting risk also must be approved and accepted by the Authorizing Official (AO) and by the CFO if the system is a financial or mixed financial system.

1.10.3 Waiver or Exception Requests

For waivers to or exceptions from DHS policy, the Waiver or Exception Request Form, located in Attachment B of the DHS 4300A Sensitive Systems Handbook shall be used. For waivers to or exceptions from CBP policy, a memorandum, which is located as an asset in the OIT PAL shall be used. A Privacy Threshold Assessment (PTA) may be required as part of this process as well. ISSOs, audit liaisons, and others may develop the waiver or exception request, but the CA must submit the request through the CISO and coordinate with the AO prior to submission to the

DHS CISO.

Justification for the waiver request should document mission impact by the operational system, as well as efforts to mitigate the risk based on descriptions of counter measures or compensating controls currently in place.

Any waiver or exception requests for Chief Financial Officer (CFO) designated systems must additionally be submitted to and approved by the CFO.

Any waiver or exception requests for Privacy Sensitive Systems must additionally be submitted to, and approved by, the Privacy Officer in writing. Justification for the exception requests should include cost trade off justification and/or system lifecycle considerations.

All approved waiver and exception requests must be directed to the CISO to coordinate with the AO. If the waiver and exception request is from DHS policy, the approved waiver and/or exception request will still be directed to the CISO who will coordinate with the AO prior to submitting to the DHS CISO.

Policy

ID

CBP Policy Statements Relevant Controls

1.10.3.a

This policy applies to all CBP employees, contractors, detailees, others working on behalf of CBP, and users of CBP information systems that collect, generate, process, store, display, transmit, or receive CBP data. This includes prototypes, telecommunications systems, and all systems in all phases of the Systems Engineering Life Cycle (SELC).

1.10.3.b Systems without an ATO when this policy is issued shall comply with all of its policy statements or obtain appropriate waivers and/or exceptions.

PL-1

1.10.3.c Systems with an ATO when this policy is issued shall comply with all of its policy statements within ninety (90) days or obtain appropriate waivers and/or exceptions. (A new ATO is only required for significant changes.)

PL-1

1.10.3.d Each waiver or exception request shall include the system name, and system Trusted Agent FISMA (TAF) Inventory ID, operational justification, and risk mitigation.

CM-3

1.10.3.e System Owners shall request a waiver whenever they are temporarily unable to comply fully with any portion of this policy.

CA-4

1.10.3.f All waiver requests shall identify the POA&M for bringing the system or program into compliance.

CA-5

1.10.3.g CISO shall approve all waiver requests prior to submitting them to the DHS

CISO.

CA-6

1.10.3.h Requests submitted without sufficient information will be returned for clarification prior to making a decision.

CA-6

1.10.3.i A waiver shall be issued for six (6) months or less. The DHS CISO reserves the right to issue waivers for longer than six (6) months in exceptional

CA-4

Policy Relevant CBP Policy Statements

ID Controls situations. Waivers may be renewed by following the same process as in the initial request.

1.10.3.j

The Assistant Commissioner must approve any waiver request that results in a total waiver time exceeding twelve (12) months before sending it to the DHS CISO. The waiver must also be reported as a material weakness in the Component’s FISMA report.

1.10.3.k CBP shall request an exception whenever they are permanently unable to comply fully with any portion of this policy.

CA-4

1.10.3.l All such waivers shall be reported in the Component’s FISMA report. CA-6

1.10.3.m The DHS CFO must approve all requests for waivers and exceptions for financial systems prior to their submission to the DHS CISO.

CA-6

1.10.3.n

The DHS Chief Privacy Officer must approve all requests for waivers and exceptions for designated privacy systems prior to their submission to the

DHS CISO.

CA-6

1.10.4 U.S. Citizen Exception Requests

Special procedures apply for exception to the requirement that persons accessing DHS systems be U.S. Citizens (see Section 4.1.1). Under normal conditions, only U.S. Citizens are allowed access to DHS systems and networks, however, at times there is a need to grant access to foreign nationals. Access for foreign nationals is normally a long-term commitment, and exceptions to appropriate policies are treated separately from standard exceptions and waivers. The approval chain for an exception to the United States (U.S.) Citizenship requirement flows through the CISO to the DHS CISO. Attachment J to the DHS 4300A Sensitive Systems Handbook provides an electronic form for requesting exceptions to the U.S. Citizenship requirement.

CBP Policy Statements Relevant Controls

1.10.4.a Persons of dual citizenship, where one of the citizenships includes U.S.

Citizenship, shall be treated as U.S. Citizens for the purposes of this directive.

1.10.4.b The System Owner shall submit each request for exception to the United States Citizenship policy to the CISO. The CISO shall obtain concurrence from the

DHS CISO.

PS-3

1.10.4.c Additional compensating controls shall be maintained for foreign nationals, based on nations lists maintained by the DHS CISO.

1.11 Information Sharing and Communication Strategy

The DHS Enterprise Operations Center (EOC) exchanges information with CBP and other Component SOCs and Network Operations Centers (NOCs), the Homeland Secure Data Network (HSDN) SOC, the Intelligence Community, and with external organizations in order to facilitate the security and operation of the DHS network. This exchange enhances situational awareness and provides a common operating picture to network managers. The operating picture is developed from information obtained from “raw” fault, configuration management, accounting, performance, and security data. This data is monitored, collected, analyzed, processed, and reported by the NOCs and SOCs.

The DHS EOC is responsible for communicating other information such as incident reports, notifications, vulnerability alerts and operational statuses to the Component SOCs, Component CISOs/ISSMs or other identified Component points of contact.

The DHS EOC portal implements role-based user profiles that allow Components to use the website’s incident database capabilities. Users assigned to Component groups shall be able to perform actions such as:

Entering incident information into the DHS EOC incident database

Generating preformatted incident reports

Initiating queries of the incident database

Viewing FISMA incident reporting numbers

Automating portions of the Information Security Vulnerability Management (ISVM) program

Automating portions of the vulnerability assessment program

CBP Policy Statements Relevant Controls

1.11.a For DHS purposes, electronic signatures are preferred to pen and ink or facsimile signatures in all cases, except where pen and ink signatures are required by public law, Executive Order, or other agency requirements.

1.11.b Components are encouraged to use electronic signatures whenever possible.

1.11.c

Components shall accept electronic signatures whenever the signature’s digital certificate is current, electronically verifiable, and issued by a medium or high assurance DHS Certification Authority or other medium or high CA under the FBWG or Common Authority.

1.11.d Components shall accept and be able to verify Personal Identity Verification (PIV) credentials issued by other Federal agencies as proof of identity.

1.12 Changes to Policy

DHS 4300A Policy and DHS 4300A Sensitive Systems Handbook serve as the foundation for the security policies contained in this Handbook. However, there may be additional policy areas that addressed within the 1400-05D that were not addressed by DHS or are addressed more strictly than the DHS 4300A documents. .

For interpretation or clarification of CBP information security policies found in this policy document, contact the CBP CISO or the CBP Security Policy Team at SecurityPolicy@cbp.dhs.gov.

Changes to this policy and to the handbook may be requested by submitting an email request to the Security Policy Team at SecurityPolicy@cbp.dhs.gov.

Policy

ID

DHS Policy Statements Relevant Controls

1.12.a The CBP CISO shall be the authority for interpretation, clarification, and modification of the CBP 1400-05D Handbook (inclusive of all appendices and…