Attachment G - Information Assurance Division Organization.pdf

Attachment G – Information Assurance Division Organization version 1.0

This overview is provided for informational purposes only, as a means for providing background.

Specific contractor performance requirements are outlined in other areas of the Statement of Work

1.0 INFORMATION ASSURANCE COMPLIANCE & POLICY SECTION

The Information Assurance Compliance & Policy Section is responsible for ensuring that TSA complies with all the provisions of the FISMA law of 2002. The Section coordinates with other TSA and DHS security organizations concerning physical, facility, personnel, industrial, and information security to carry out assigned security tasks.

Provides the direction and guidance necessary to ensure TSA enterprise-wide information technology security is compliant with federal information security legislation, policies, and mandates for classified and SBU-level information technology systems.

The Section leads the successful development and implementation of SBU-level IT security programs to include: policy, architecture, processes, standards, governance, outreach, performance metrics, security program plan updates, information security, , records/documents management and critical infrastructure protection. The Section coordinates with other TSA and DHS security organizations concerning, physical, facility, personnel, industrial, and information security to carry out assigned security tasks.

The Compliance & Policy Section is composed of four Branches: Compliance, Certifier Services, Policy and Communications, and Cyber Security Awareness & Outreach. Below is a description of each

Branch detailing their specific areas of responsibility.

1.1 Summary of Compliance Branch

The Compliance Branch is a federally mandated program. This Branch will stay abreast of DHS requirement changes, communicate these changes to all FISMA stakeholders, and offer assistance with how to best comply with the new requirements. Providing system information, analysis, research capabilities, and a myriad of reports are some of the main daily initiatives of the Compliance Branch.

The Compliance Branch consists of two teams; the Compliance Team and the Risk Management Team.

The Compliance Team works to achieve TSA compliance with the FISMA Act of 2002. This team‘s members liaise with all FISMA stakeholders in order to achieve high levels of compliance and to disseminate related information. In FY10, TSA achieved a 100% compliance rating on the annual DHS

FISMA Scorecard. Each year DHS improves and further strengthens the level of rigor with which its‘ components must comply. TSA‘s consistent achievement each year underscores the level of success the

Compliance team has achieved, and supports why the team is annually involved in outreach campaigns in order to assist other struggling DHS components.

The Risk Management Team was created in FY10 and is on the cutting edge of evaluating risk across the enterprise, to include how to most efficiently and effectively collect and consolidate this information for executive consumption. The Risk Management team often collaborates with the department as well, and is the force behind the management of information system vulnerabilities for the entire agency.

1.2 Summary of Certifier Services Branch

The Certifier Services Branch conducts (C&A) activities that support a risk management process and are an integral part of TSA‘s information security program. The C&A process consist of the four distinct phases: Initiation, Certification, Accreditation, and Continuous Monitoring. Security accreditation is the official management decision to authorize operation of an information system. This authorization, given by a senior agency official, is applicable to a particular environment or operation, and explicitly accepts the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, remaining after the implementation of an agreed upon set of security controls. By accrediting an information system, the agency official is not only responsible for the security of the system but is also accountable for adverse impacts to the agency if a breach of security occurs. At TSA, this official is the Designated Accrediting Authority (DAA). Security accreditation is required under the

E-Government Act (Public Law 107-347), OMB Circular A-130, and DHS and TSA Management

Directives. Title III of the E-Government Act is entitled the Federal Information Security Management

Act (FISMA). Security certification is the comprehensive evaluation of the management, operational, and technical security controls in an information system. This evaluation, made in support of the security accreditation process, determines the effectiveness of these security controls in a particular environment of operation and the vulnerabilities in the information system after the implementation of such controls.

Security C&A of the TSA information systems support the legislative requirements of FISMA by ensuring that the TSA periodically: (i) assesses the risk resulting from the operation of those systems;

(ii) tests and evaluates the security controls in those systems to determine control effectiveness and system vulnerabilities; and (iii) assesses the information security programs supporting those systems

(e.g., security awareness and training, incident response, and contingency planning). Formalization of the C&A process ensures that information systems will be operated with appropriate management review, that there is ongoing monitoring of security controls, and that reaccreditation occurs periodically and whenever there is a significant change to the system or its environment.

The Certifier Services Branch consists of primary certifiers (PC) assigned to designated information systems to support the TSA mandate to develop, document, and implement an agency-wide information security program for federal information systems; promote a better understanding of agency-related risks resulting from the operation of information systems; create more reliable, complete, and trustworthy information for authorizing officials—thus, facilitating more informed security accreditation decisions;

and help achieve more secure information systems within the TSA.

1.3 Summary of Cyber Security Awareness & Outreach Branch

The Cyber Security Awareness and Outreach Branch is responsible for enhancing the cyber security posture of the agency and its stakeholders within the Transportation community. Within this realm of responsibility, the team has two primary focus areas: an internally-focused IT Security Outreach program, and an external partnership, with the Transportation Sector Network Management program, to promote Cyber Critical Infrastructure Protection within the private sector.

The IT Security Outreach program is responsible for developing accurate monthly figures for IT

Security Awareness completions to report to DHS, as mandated by FISMA. In support of this program, the team designs, develops (with the technical assistance of expertise from within ITSD or guest speakers from industry and government), schedules, coordinates, and produces the monthly Information

System Security Officer (ISSO) SSR professional development meetings that are required to meet

FISMA Compliance obligations. And, finally, the Team advances the cause of IT Security Awareness throughout the TSA community via communication with the ISSO and SO communities on topics specifically regarding IT Security and FISMA Compliance, to the general TSA community through distribution of IT Security flyers, and other publications to TSA field offices, and by producing and hosting semi-annual IT Security Awareness Days at HQ.

Homeland Security Presidential Directive – 7 (HSPD – 7) and the National Infrastructure Protection

Plan (NIPP) designate TSA as the Sector Specific Agency (SSA) for the Transportation Systems Sector and the Postal and Shipping Sector. Under this authority, TSA, OIT and ultimately the CSAO are responsible for developing and implementing a coordinated national approach to protect both sectors‘ critical cyber infrastructure. This will be accomplished by providing best practices in cyber among the modal representatives, facilitating information sharing between the public and private sector, hosting the

Transportation Systems Sector Cyber Working Group (TSSCWG) meetings, participating in and hosting cutting edge training/workshops highlight cyber security, and providing guidance and input to the Sector

Annual Report and the Sector Security Plan as needed by TSNM.

1.4 Summary of Policy Branch

The TSA IAD Policy Branch enhances TSA‘s security posture by ensuring that TSA IT security policies, standards and procedures are compliant with overarching federal mandates, developed to address emergent technology, and effectively communicated to TSA employees. TSA Information

Technology (IT) Security is governed by the: Management Directive (MD) 1400.3 IT Security Policy, TSA IT Security Policy Handbook, and Information Security Technical Standards (TS).

The efforts of this team are invaluable in defining the baseline information security requirements by which all TSA systems, assets, and data must

Published updates to the MD 1400.3 Information Security Policy and IT Security Handbook

Collaborated in the development of the TSA wide policies and procedures, DHS IT Security Policies, and other Federal Mandates;

Identified the impact of new government laws/regulations and the implementation of new IT technologies on TSA IT security policy based on policy inquiry questions received and evolve the policies accordingly;

Identified and developed over 30 TSA Technical Standards;

Effectively communicated IT Security Policies to TSA personnel through interactive training sessions.

The IAD Policy Branch has a primary focus on developing and maintaining the IT security foundation of TSA by researching and integrating requirements that provide multi-layer security across the enterprise.

1.5 Primary Stakeholders and Interfaces of the Information Assurance Compliance & Policy Section

The Information Assurance Compliance & Policy Section supports all major programs within the TSA.

The primary stakeholders within TSA‘s programs are the IT System Owners, the Information System

Security Officers (ISSOs), and the individual Program Managers assigned within each TSA wide program. Ultimately the Section supports all TSA personnel who use any IT asset in the performance of their assigned duties. Outside of TSA, there are needs for personnel such as the Compliance Branch to regularly interface with the Department of Homeland Security‘s compliance and information security office in order to analyze pending requirements, troubleshoot the mandated C&A tools, liaise on DHS audits or reviews, and affect changes to TSAs system inventory. Other TSA entities interfaced with are the Capital Planning and Investment Control (CPIC) team under the Finance and Administration program. This collaboration is often needed when evaluating information systems for entry to the official system inventory. The Certifier Services Branch interfaces regularly with the ISSOs and SOs for

TSA‘s information systems, especially during the time where C&A activities are ongoing. Certifiers will also deal with third party facilities and personnel as they spearhead site visits in order to conduct the system test and evaluations (ST&Es) during the C&A process. The CSAO Branch is unique as it https://team.ishare.tsa.dhs.gov/sites/ITSEC/CP/PC/policy/default.aspx https://team.ishare.tsa.dhs.gov/sites/ITSEC/CP/PC/policy/wiki/TSA%203/TSA%20MD%201400.3.pdf https://team.ishare.tsa.dhs.gov/sites/ITSEC/CP/PC/policy/Shared%20Documents/1400.3%20Handbook/TSA%20Information%20Technology%20Security%20Policy%20Handbook%20V.7.0.1.pdf https://team.ishare.tsa.dhs.gov/sites/ITSEC/CP/PC/policy/Policy/Technical%20Standards.aspx supports all major programs within TSA either through cyber or SSA responsibilities. The primary stakeholders within the TSA for cyber critical infrastructure are General Managers for the six (6) transportation modes and the PSS within TSNM, Global Strategies, and TSA‘s Office of Intelligence.

Other areas supported and who interface with the Compliance and Policy section are the DHS Office of the Chief Information Security Officer (CISO) and the Office of Management and Budget (OMB).

1.6 FY 10 Achievements of the Information Assurance Compliance & Policy Section

In an effort to provide an overview what was accomplished by the Compliance & Policy Section in

FY10, the following metrics are provided. This overview is provided for informational purposes only, as a means for providing background. Specific contractor performance requirements are outlined in other areas of the Statement of Work.

1.6.1 Compliance Branch

• The Compliance Branch assisted with obtaining a perfect 100 percent score on the DHS FISMA scorecard.

• Reviewed 48 C&A packages. 47 packages were validated by DHS giving TSA an overall success rate of 98%, higher than DHS‘s threshold of 90%.

• Reviewed1,868 artifacts in support of continuous monitoring efforts

• Remediated 1,437 out of 1769 security weaknesses (81% completion rate).

• Achieved the highest 12 month steady state (99%) of all DHS components, a perfect 100% score for

4 out of 12 months, and a 100% for FY10 on the DHS FISMA scorecard.

• Tracked the compliance of approximately 160 ISVM alerts and bulletins for each TSA system. TSA complied with 95% of applicable ISVMS.

• Compliance And Risk Management Application awarded on September 23 rd

1.6.2 Certifier Services Branch

• This Branch conducted 41 Certification and Accreditations, which resulted in all information systems receiving an Authorization to Operate (ATO).

• Met or exceeded DHS FISMA mandates throughout FY10 by exceptional Certifier Services C&A support

• Coordinated and completed concurrent ST&E activities for several large systems.

• Continued support in assessing and mitigating risk to TSA IT Systems regarding information security and privacy, and assisting in the effort to modify the TSA culture to emphasize the importance of information security.

• Completed 41 C&As, completed 50 ST&Es, 12 new systems (Development) identified, 15 new systems (concepts) identified, and 25 OIT Intake Systems Identified.

• Out of 631 Open Weaknesses, approximately 611 have been closed to date

1.6.3 Policy Branch

• The Policy team actively researched complex security inquiries throughout FY10 and began tracking the number of responses in May 2010.

• In FY10, the IAD Policy team accomplished a major achievement by updating the TSA MD 1400.3

Information Security Policy and IT Security Handbook. Additionally, the team published updates to the TSA Information Technology (IT) Security Policy Handbook in September 2009 and June 2010.

• TSA TS were identified, developed and published throughout FY10. Highlights of TS published in

FY10 include: TS-007 - Host Intrusion Detection Systems, TS-024 - Radio Frequency Identification

(RFID), TS-055 - Federal Desktop Core Configuration Compliance (FDCC).

• IAD Policy developed key partnerships in FY10, including a new working group with the TSA SSI

Office to better align the SSI Policy & Procedures Guide with IT Security policies.

• In FY10, the Policy team initiated a new ‗Puzzled by Policy‘ Outreach campaign held in conjunction with the June 2010 Security Awareness Day. The team created the new TSA IAD Policy Outreach page to provide a new centralized location for IT Security policy. Other outreach efforts included presenting on IT Security Topics such as the monthly ISSO Training and monthly FRM/IT Specialist

Calls.

1.6.4 Cyber Security Awareness & Outreach

• The Branch prepared 24 Significant Security Responsibility training modules for presentation to the

ISSOs (60 ISSOs).

• The Branch executed the day to day administration of the Training and Awareness program to include day-to-day liaison with the ISSOs to ensure they have all the latest information and tools to perform their duties.

• The Branch hosted monthly training sessions, sending out Bi-monthly agency wide broadcast to ensure all computer users are in compliance with the DHS mandated IT awareness training.

• Presented cyber initiatives and capabilities to Freight Rail stakeholders at 2 Intermodal Security

Training and Evaluation Programs (I-STEP). Provided cyber risk assessment guidelines and survey questions to the Rail modal team for inclusion in the corporate security review.

• Participated in the Transportation Sector, Highway Motor Carrier and Maritime Government/Sector

Coordinating Council meetings; marketing cyber team accomplishments and modal support capabilities.

• Supported TSA Preparedness, Postal & Shipping Sector, and Freight Rail injects at the Cyber Storm

III national level exercise.

• Developed a Homeland Security Information Network (HSIN) Portal as a communication and collaboration tool for all TSA critical infrastructure external stakeholders.

• Hosted 3 IT Security Awareness Day events including the first of it‘s kind at TSA‘s Freedom center.

Over 700 information packets were distributed.

1.7 Information Assurance Compliance & Policy Section Goals and Objectives

Using the metrics and information obtained from FY10, the following represent the Compliance &

Policy Section Goals and Objectives for FY10. It is the expectation that these goals and objectives will be met in FY09 and beyond. It is expected that the goals and objectives outlined in the annual DHS

Information Security Performance Plan will continue to increase year after year to measure success in the area of FISMA compliance for DHS. The Compliance Section will be expected continue to meet and/or exceed the goals and objectives outlined in the annual DHS Information Security Performance

Plan.

1.7.1 Compliance Branch Goals and Objectives

• Work closely with DHS to align the Performance Plan with DHS‘s three year plan to redesign its

FISMA Reporting and Scorecard approach and streamline the FISMA process.

• Collaborate with DHS to revamp and restructure C&A templates and content with a focus on quality and accuracy.

• Develop a cutting edge risk management and assessment solution while working closely with stakeholders and DHS to ensure a smooth transition from current security monitoring and reporting.

• Achieve a 98% 12 month steady state and a consistent end of year FISMA score of 98%.

• Maintain security compliance and ISSO support for the 4 IAD operational systems.

• Conduct 55 Certification and Accreditation packages which will result in 45 of the TSA IT systems receiving an Authorization to Operate.

• Conduct 78 Security Controls Self-Assessments in accordance with NIST 800-53 publication requirements.

• Execute and submit 78 Contingency Test Plans to DHS.

• Upload and manage over 1,800 Plans of Actions and Milestones and 800 C&A documents, which include the 11 mandated DHS documents needed to obtain an IT system ATO (SSP, CP, CPTR, E-

Auth, FIPS-199, PTA, Self-Assessment, Risk Assessment, ST&E Plan, SAR and ATO Letter).

• Manage the agency official IT Systems inventory. This includes adding, deleting, disposing, and tracking all systems changes while they are in the development or operational status of the System

Life-Cycle process.

• Review all FISMA and C&A artifacts and provides agency level validation attesting that all documentation meets the DHS annual FISMA performance plan.

1.7.2 Certifiers Services Branch Goals and Objectives

• Staying at the forefront of upcoming NIST Requirements and DHS FY11 Performance Plan

• Improving upon Overdue POA&M management and Waivers/Exception process by providing training and workshops to ISSOs and PCs

• Establishing and maintaining collaboration with other OIT divisions

• Early intervention/participation during the intake process to ensure IT security issues are being addressed

• Prepare 24 Significant Security Responsibility training modules for presentation to the ISSOs (60 plus ISSOs).

• Execute the day to day administration of the Training and Awareness program to include day-to-day liaison with the ISSOs to ensure they have all the latest information and tools to perform their duties.

• Host monthly training sessions to include a minimum of three topics, sending out Bi-monthly agency wide broadcast to ensure all computer users are in compliance with the DHS mandated IT awareness training.

1.7.3 Policy Branch Goals and Objectives

• Develop new TSA Classified Systems and COMSEC IT Security Policy

• Implement regular updates and publications of the TSA IT Security Handbook

• Continue creating and updating Technical Standards to address evolving technology

• Support IT Security outreach efforts to enhance TSA enterprise-wide awareness

1.7.4 Cyber Security Awareness & Outreach (CSAO) Branch Goals and Objectives

• Staying at the forefront of upcoming NIST Requirements and DHS FY11 Performance Plan

• Improving upon Overdue POA&M management and Waivers/Exception process by providing training and workshops to ISSOs and PCs

• Establishing and maintaining collaboration with other OIT divisions

• Early intervention/participation during the intake process to ensure IT security issues are being addressed

2.0 INFORMATION ASSURANCE TECHNICAL SERVICES SECTION

2.1 Summary of the Information Assurance Technical Services Section

The Technical Services Section is a component of the IAD, a federally mandated program. The

Technical Services Section is comprised of four Branches: Focused Operations, Computer Network

Defense, Communications Security (COMSEC), and Security Architecture & Infrastructure Testing.

2.1.1 Focused Operations Branch

The Focused Operations Branch is a component of the IAD. The Branch provides forensics analysis capabilities and guidance necessary to accurately investigate/analyze incidents throughout the TSA enterprise. The Branch also provides federally mandated capabilities for electronic discovery providing collection and analysis services. The Branch coordinates with other TSA and DHS security organizations concerning inspections, counter intelligence, and physical, facility, personnel, industrial, and information security to carry out assigned investigations as well as providing support services to requesting organizations. The Branch proactively investigates incidents and requests, producing detailed forensics analysis reports that are vital to enduring success of the TSA mission.

• The Focused Operations Branch supports IAD CIRC operations providing deep dive forensics analysis and data parsing of digital evidence relating to incidents. CIRC is the Focused Operations

Branch Primary customer.

• The Focused Operations Branch provides data recovery services to all requesting TSA operations.

These types of operations include data recovery from failing hard disks, email recovery, and log recovery.

• The Focused Operations Branch supports two Departments within Office of Inspections, Inspections

Division, and Program Review. The IAD Focused Operations Branch provides technical support and guidance on specific case work. To include email tape backup and recovery operations, network drive recovery, and encryption key recovery. These efforts are vital support operations since all necessary decryption of OI evidence items are dependent on these services.

• The Focused Operations Branch supports Office of Chief Council in pursuit of their investigations regarding digital evidence. Services provided include email recovery, data recovery, forensic guidance, device imaging, and complete forensics analysis of all related requests.

• The Focused Operations Branch also supports requests from the Office of Information Technology to include drive degaussing/destruction, data recovery, and forensics analysis when necessary.

2.1.2 Computer Network Defense Branch

The Computer Network Defense Branch has 2sub-teams corresponding to its three functions: the SOC

Management team provides oversight to the Security Operations Center, and the Threat and

Vulnerability Management manages the response to threat intelligence and publicly announced vulnerabilities.

The Computer Network Defense Branch is composed of 2separate groups that report to the Branch

Chief.

The First group is the SOC Management Team (SMT). Growing insight into the monitoring capability of the incumbent Managed Service provider led to the realization that the functions of the Security

Operations Center needed to be separated from the rest of the Managed Services. An independent SOC function became a priority, resulting in initiating the acquisition of a new vendor for SOC services.

The SMT is responsible for overseeing the TSA SOC. This includes acting as a liaison between IT

Security and the SOC, providing continuous monitoring and evaluation of SOC performance, and maintaining subject matter expertise knowledge of the TSA IT Security devices. The SMT maintains a presence on the SOC premises.

The third group is the Threat and Vulnerability Management Team (TVMT). This team monitors both public and classified intelligence sources in order to identify threats and vulnerabilities that impact the

TSA environment. The TVMT maintains a working knowledge of the technologies used within TSA systems and the various security controls used to protect those technologies. The TVMT also accepts

Information Security Vulnerability Management announcements from DHS, distributes those announcements to the Information System Security Officers within TSA, tracks compliance efforts, and reports the results back to DHS. The TVMT works closely with the SMT to insure that they have the best possible advance intelligence upon which to take proactive action.

2.1.3 Communications Security Branch

The IAD Communications Security Branch is responsible through the TSA CISO and CIO to the DHS

Central Office of Record (COR) for the receipt, transfer, accountability, safeguarding, and destruction of

COMSEC material assigned to their TSA COMSEC account and management/operation of the TSA HQ

Local Management Device (LMD)/Key Processor (KP) and the associated Local COMSEC

Management Software (LCMS). The Secure Communications Regional Manager provides policy oversight, technical guidance and Help Desk support to every TSA HQ, field Federal Security Directors, and Mass Transit and Railroad COMSEC equipment users. The COMSEC Regional Manager is based on the East Coast, currently located in Philadelphia.

2.1.4 Security Architecture & Infrastructure Testing Branch

The Security Architecture (SA) team enhances the security of TSA‘s IT environment by establishing and maintaining an IT Security Architecture program conforming to Federal and DHS mandated Enterprise

Architecture (EA) initiatives that guide the development of IT infrastructure. This team also ensures that

IT security strives to improve the productivity of the IAD through continuous development and documentation of processes that enhance the functional performance of IAD. This team evaluates existing and new systems, as well as new security technologies that could be implemented to improve

TSA‘s security posture. Security Architecture also develops models that illustrate the proper design of security technologies to meet the DHS and TSA policies.

2.2 Primary Stakeholders and Interfaces of the Information Assurance Technical Services Section

The Technical Services Section supports all major programs within the TSA. The primary stakeholders within the TSA programs are the IT System Owners, ISSOs, the Offices of Inspection, the Office of

Chief Counsel, the Office of Special Counsel, the DHS SOC, U.S. Computer Emergency Response

Team (CERT), the DHS Office of the CISO, other divisions within the Office of the CIO, TSA HQ, field

FSD staffs, Mass Transit and Railroad COMSEC equipment users, and the individual Program Managers assigned within each TSA wide program. In summary, the Section supports all personnel who use any

TSA IT or COMSEC assets in the performance of their assigned duties, or who need data about such usage.

2.3 FY10 Achievements of the Information Assurance Technical Services Section

In an effort to provide an overview what was accomplished by the Technical Services Section in FY09, the following metrics are provided. This overview is provided for informational purposes only, as a means for providing background. Specific contractor performance requirements are outlined in other areas of the Statement of Work.

2.3.1 Computer Network Defense

• Development of an Information Security Vulnerability Management (ISVM) Notice compliance program. This program brought TSA in alignment with DHS ISVM compliance requirements.

Based on past experience, 60 ISVM‘s are expected in 2009.

• Developed a mature SOC Management capability that brought significant visibility into the managed

SOC.

2.3.2 Focused Operations

• 250 recorded cases in which 30 % of those cases involved over two weeks of effort per case.

• 10 E-Discovery cases were performed. Each case encompassed approximately 40 hours of time.

• Began active participation in the DHS Focused Operations group including weekly meetings.

• Began participation in the internal IT Security Network Intrusion Working Group

• Moved Forensic lab into new facility and redesigned layout to respond to evolving workload.

2.3.3 Communications Security

• TSA COMSEC responds to approximately 100 customer inquiries or service calls a month. The

COMSEC Staff at TSA is based at on the East Coast. The regional areas are subject to change they are currently located in Philadelphia, PA COMSEC personnel will have core working hours with emergency on-call status.

2.3.4 Security Architecture & Infrastructure Testing

Review and comment on IT Security artifacts including architectural principles contained in internal & external security focused documents, on TSA and DHS management directives

(MDs), Technical Reference Model (TRM) and on other security related documents.

Lead IT Security discussions and requirement gathering with internal and external stakeholders for new IT technology solutions.

Review and comment on submitted Technical Insertion (TI) packages from TSA Enterprise

Architecture (EA)

Develop or assist in the development of required documentation for procurement of IAD IT system including Market Research, Request for Information (RFI), Independent Government

Cost Estimate (IGCE), Statement of Work (SOW) and Statement of Objectives (SOO).

Research and review new emerging technologies and develop reports for senior IAD and TSA leadership consumption.

2.4 Information Assurance Technical Services Section Goals and Objectives

Using the metrics and information obtained from FY10, the below objectives represent the Technical

Services Section Goals and Objectives for FY11. It is the expectation that these goals and objectives will be met in FY10 and beyond. It is expected that the goals and objectives outlined will continue to increase year after year to measure success in Technical Services Section. The Technical Services

Section will be expected continue to meet and/or exceed these goals and objectives. There is an anticipated workload increase of 5-10 percent annually as the agency and the discipline of security operations continues to mature.

This overview is provided for informational purposes only, as a means for providing background.

Specific contractor performance requirements are outlined in other areas of the Statement of Work.

2.4.1 Focused Operations Branch Goals and Objectives

Projected case load to be equal to or greater than 250cases for FY11; 50% of those cases are expected to be detailed forensic support or email recovery taking more than two weeks of effort each.

Expanded support effort will be provided to Office of Inspections to included Program Analysis and E-

Discovery. The Office of Inspection has developed a counter intelligence capability and our support from a network forensics perspective is critical.

Expanded support is also projected in training development and delivery for necessary skill development throughout DHS. As one of the most mature Focused Operations Programs within DHS, we are asked to provide significant support for DHS Wide efforts.

The Focused Operations Branch will be developing a malware reverse engineering capability. As the threats to our network evolve, rapid detection and analysis of malware behavior is critical to effective containment and remediation.

The Focused Operations Branch will also be developing a malware sandbox network. Malware sandboxes are critical tools for detecting the behavior of malware.

The Branch will also be continuing a technical refresh of the lab environment including the introduction of Forensic workstations that utilize the Mac Operating system

In addition, the Branch will develop advanced processes and procedures to proactively detect network intrusions and compromises.

2.4.2 Computer Network Defense Branch Goals and Objectives

A big effort to be undertaken in FY10 will be the addition of remote systems to TSA SOC Monitoring.

This will require significant effort from the CND Team. The IAD expects the FAMS Data Center 2

(DC2) migration and OneNet efforts of DHS to continue to be a challenge. Oversight of the new

Managed Service provider‘s IT Security program and management of the SOC services contract will become crucial to maintenance of a low-risk security posture. Oversight of the contractor implementation of the ISO 27001 standard for the ITIP, the Human Resources Access (HRAccess) system, and SOC contracts may take more resources than expected. Multiple Laws and Regulations are pending. These will have to be monitored.

The CND team will begin Security Monitoring of the non-OIT managed IT systems and integrate these systems with the IAD‘s Incident Response procedures. The CND team will support the revision of the

CONOPS and the SOPs.

The CND team will develop a Cyber Intelligence capability. This capability will help manage the continuing threat that Government networks are currently under.

2.4.3 Communications Security Branch Goals and Objectives

The team expects the workload to grow with the operational and technical cryptographic upgrades for new generation equipments supporting TSA HQ, Freedom Center, Site W, and TTAC. Enhancements to

LMD/KP and sub-account LMDS will focus on transitioning key material support all secure telephony devices and accounting procedures from manual input/output of the obsolete NSA-supported Distributed

Information Security Accounting System (DIAS) to fully electronic capabilities supported 100% through the NSA Electronic Key Management System (EKMS) and the DHS Central Office of Record (COR).

With the activation of the DHS COR LMD/KP system, improved management processes, on-the-job/formal training, and major improvements should be experienced.

The Communications Security Branch will explore the functional requirements and oversight requirements to establish a DHS TSA Central Office of Record (COR) Manager. The DHS TSA COR

Manager (the Secure Communications Branch Chief) will be responsible for policy oversight, coordination of COMSEC training and auditing the three TSA HQ LMD sub-accounts, whereas the TSA

HQ Parent Account would remain under audit responsibility of the DHS COR. Additionally, authority would be requested from the DHS COR for the new DHS TSA COR Manager to assume policy coordination, cryptographic modernization coordination, internal audit, and training coordination with the COMSEC Custodians/Managers of the four other TSA COMSEC Accounts at TSA HQ Intel, TSA

FAMS, TTAC Annapolis Junction and Colorado Springs.

Streamlining COMSEC and other Secure Communication procedures, and TSA-wide support is necessary for our three COMSEC Regional Managers to provide ―Depot-Level‖ support and technical training to our users in TSA, and Mass Transit and Railroad users nationwide.

The Communications Security Branch, in conjunction with the TSA Office of Security Physical Security

Division, is continuously evaluating existing and new requirements for all COMSEC within TSA HQ:

the Federal Security Directors, their staffs, and SPOKE airports; and Mass Transit and Railroad customers. In order to improve the secure data communications infrastructure to support OIT and IAD, the Secure Communications Branch is reliant upon IAD and OIT for funding for the multiple HSDN Fly

Await Units (classified laptop units with TALON cryptographic cards) to support IAD FISMA compliance for classified systems; critical Incident Response/Forensics exchange with National, Federal, Civil, DHS HQ and other DHS components. TSA is highly dependent on the Homeland Security Data

Network Program Management Office for providing baseline Department System Security policy directives, procedures, and initial formal/informal training. Additionally, FY09/10 funding for the new

Secure Mobile Environment Portable Electronic Device (SMD/PED) to support TSA HQ Senior

Executives needs to be earmarked for equipment acquisition when the final requirements are known and the DHS HSDN PMO infrastructure has been implemented.

Additional Activities for the Communications Security Branch are as follows:

• Conduct HQ element data call to identify potential Mass Transit and Railroad COMSEC Users to be sponsored and implemented in FY09. Current data trend is not available on a consistent basis, making it extremely difficult to plan efficiently and target COMSEC assets to meet the changing operational and mission requirements within TSA HQ. Prepare a COMSEC requirements database with all new requirements stipulated along with the New Requirements Letters, clearance validation and Physical Security Certification letters for all specified deployment locations.

• Implement a new COMSEC Awareness Training Program on the On-line Learning Center (OLC).

No formal COMSEC Training Program exists on OLC or within DHS Headquarters and any other

DHS component. Develop and implement an interactive COMSEC Awareness Program.

• Develop and implement a TSA COMSEC System Security Plan and Local Operating Manual for the new Secure Mobile Environment-Personal Electronic Device (SME/PED to support the TSA

Administrator and Deputy Administrator and potentially other TSA Senior Executives. The

SME/PED system is currently being BETA tested with follow-on Security Test and Evaluation by the HSDN PMO and final system certification by the DHS HSAWG.

• Revise and update the TSA Cryptographic Modernization Plan to support upgrading existing desktop telephony and network encryption systems with new generation COMSEC cryptographic technologies. Current secure telephony and network encryptor technologies in use are coming to the end of their product life and cannot support new and expanded secure data, video teleconferencing, and voice requirements for the TSA HQ Administrator and his/her staff and field units. Implement new generation secure telephony, data, and network cryptographic units to support the strategic and operational requirements at TSA HQ, Freedom Center, and Site W.

• Obtain Final Operational Capability of the TSA HQ LMD/KP system as the central COMSEC accountability system, and migration of the NSA DIAS system.

• Implement the NSA Electronic Key Management System (EKMS) with the Local Management

Device/Key Processor (KP) system as the primary accounting system for the TSA HQ COMSEC

Parent Account and three Sub-Accounts by 4thd Qtr FY 09.

2.4.4 Security Architecture & Infrastructure Testing Goals and Objectives

Develop and submit Procurement Package for Enterprise Data Protection (EDP) to Office of

Acquisition (OA)

Research new emerging IT Security technologies or solutions that will provide TSA with enhanced security capabilities.

Develop Security Architecture methodologies, processes, and toolsets in support for the acquisition of IT Security solutions.

Develop and align TSA Enterprise Security Architecture (ESA) model with DHS ESA.

Research and create IT Security Architecture models based on TSA Security Architecture and

IAD policy requirements.