Security Controls.pdf

Baseline AC-2(1) Automated System Account Management

NIST SP 800-53

Revision 4

Access Control

Baseline AC-2(2)

Removal Of Temporary / Emergency Accounts

NIST SP 800-53

Revision 4

Access Control

Baseline AC-2(3) Disable Inactive Accounts

NIST SP 800-53

Revision 4

Access Control

Baseline AC-2(4) Automated Audit Actions

NIST SP 800-53

Revision 4

Access Control

Baseline AC-2(5) Inactivity Logout

NIST SP 800-53

Revision 4

Access Control

Baseline AC-2(7) Role-based Schemes

NIST SP 800-53

Revision 4

Access Control

Baseline

AC-2(10) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If credentials are not terminated, users who are no longer part of the group, or more importantly shared root groups, will inappropriately retain rights and privileges. Access control is jeopardized, compounding over time.

Shared / Group Account Credential Termination

NIST SP 800-53

Revision 4

Access Control

Baseline AC-2(12) Account Monitoring / Atypical Usage

NIST SP 800-53

Revision 4

Access Control

Baseline AC-3(4) Discretionary Access Control

NIST SP 800-53

Revision 4

Access Control

Baseline

AC-6(1) This control requires investigation because non-compliance has the potential to allow unauthorized individuals to modify security settings.

Authorize Access To Security Functions

NIST SP 800-53

Revision 4

Access Control

Baseline

AC-6(5) This control requires investigation because non-compliance has the potential to allow unauthorized individuals to modify security settings.

Privileged Accounts

NIST SP 800-53

Revision 4

AC-6(8) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If not prevented from elevating privileges, authorized AND

UNAUTHORIZED

users can easily subvert protections and modify information or processes, potentially gaining even higher levels of access. This is a common method adversaries use to get root access once they gain normal user access.

Privilege Levels For Code Execution

NIST SP 800-53

Revision 4

Access Control

Baseline

AC-7 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Unsuccessful Logon Attempts

NIST SP 800-53

Revision 4

Access Control

Baseline AC-10 Concurrent Session Control

NIST SP 800-53

Revision 4

Access Control

Baseline AC-11(1) Pattern-hiding Displays

NIST SP 800-53

Revision 4

AC-12(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Without a distinct logout notification to the user, user sessions could be left hanging, and adversaries could hi-jack the session.

User-initiated Logouts / Message Displays

NIST SP 800-53

Revision 4

Access Control

Baseline AC-16(6)

Maintenance Of Attribute Association By Organization

NIST SP 800-53

Revision 4

Access Control

Baseline

AC-17(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Managed Access Control Points

NIST SP 800-53

Revision 4

AC-17(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Privileged Commands / Access

NIST SP 800-53

Revision 4

Access Control

Baseline

AC-17(6) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Protection Of Information

NIST SP 800-53

Revision 4

Access Control

Baseline AC-17(9) Disconnect / Disable Access

NIST SP 800-53

Revision 4

Access Control

Baseline AC-18 Wireless Access

NIST SP 800-53

Revision 4

Access Control

Baseline

AC-18(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Disable Wireless Networking

NIST SP 800-53

Revision 4

AC-18(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Restrict Configurations By Users

NIST SP 800-53

Revision 4

Access Control

Baseline AC-20(2) Portable Storage Devices

NIST SP 800-53

Revision 4

Access Control

Baseline AT-2(2) Insider Threat

NIST SP 800-53

Revision 4

Awarenes s and Training

Baseline AT-3(2) Physical Security Controls

NIST SP 800-53

Revision 4

Awarenes s and Training

Baseline AT-3(4)

Suspicious Communications And Anomalous System Behavior

NIST SP 800-53

Revision 4

Awarenes s and Training

Baseline AU-2(3) Reviews And Updates

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline AU-3(1) Additional Audit Information

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline

AU-5 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Response To Audit Processing Failure

NIST SP 800-53

Revision 4

Audit and Accountab ility

AU-5(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Audit Storage Capacity

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline

AU-6(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Process Integration

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline AU-6(4) Central Review And Analysis

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline AU-8 Time Stamps

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline AU-8(1) Synchronization with Authoritative Time Source

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline AU-11 Audit Record Retention

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline AU-12(1) System-Wide / Time-Correlated Audit Trail

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline AU-14(1) System Start-Up

NIST SP 800-53

Revision 4

Audit and Accountab ility

Baseline CA-2(1) Independent Assessors

NIST SP 800-53

Revision 4

Security Assessme nt and Authorizat ion

Baseline

CA-3(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Unclassified National Security System Connections

NIST SP 800-53

Revision 4

Security Assessme nt and Authorizat ion

Baseline CA-5 Plan Of Action And Milestones

NIST SP 800-53

Revision 4

Security Assessme nt and Authorizat ion

Baseline CA-7(1) Independent Assessment

NIST SP 800-53

Revision 4

Security Assessme nt and Authorizat ion

Baseline CM-1

Configuration Management Policy & Procedures

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-2 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Baseline Configuration

NIST SP 800-53

Revision 4

Configurat ion Managem ent

CM-2(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Reviews And Updates

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-2(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Retention of Previous Configurations

NIST SP 800-53

Revision 4

Configurat ion

CM-2(7) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Given the enhancement is required for systems in high-risk environments, and given the systems are appropriately configured (i.e., locked down more than systems used in typical environments), the risk of sudden non-compliance is high, in that we would have unacceptable vulnerabilities exposed to

Configure Systems, Components, or Devices for High- Risk Areas

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-3 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Configuration Change Control

NIST SP 800-53

Revision 4

Configurat ion

CM-3(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Test / Validate / Document Changes

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-3(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Security Representative

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-5 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Access Restrictions For Change

NIST SP 800-53

Revision 4

Configurat ion

CM-5(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If access restrictions are not enforced, unauthorized users will have access to information or processes to which they have no need to/for and may be able to elevate privileges and gain a stronger foothold.

Automated Access Enforcement / Auditing

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-5(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Review System Changes

NIST SP 800-53

Revision 4

Configurat ion

CM-5(5) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Limit Production / Operational Privileges

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-5(6) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Limit Library Privileges

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-6 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Configuration Settings

NIST SP 800-53

Revision 4

Configurat ion

CM-6(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Automated Central Management / Application/Verific ation

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-7 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Least Functionality

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-7(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Periodic Review

NIST SP 800-53

Revision 4

Configurat ion

CM-7(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Prevent Program Execution

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline CM-7(3) Registration Compliance

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-7(5) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of the deny-all, permit-by-exception function will (unbeknownst to system/security admin) allow users the ability to install unauthorized and potentially dangerous software, thereby introducing vulnerabilities that can be exploited to elevate privileges and/or gain access to the system or its components.

Authorized Software / Whitelisting

NIST SP 800-53

Revision 4

Configurat ion

CM-8 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Information System Component Inventory

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline CM-8(2) Automated Maintenance

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-8(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Automated Unauthorized Component Detection

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline CM-8(5) No Duplicate Accounting Of Components

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline

CM-9 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Configuration Management Plan

NIST SP 800-53

Revision 4

Configurat ion

CM-10 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure to track software licenses does not typically jeopardize the security posture of the system; it is mostly related to the legality of using software. However, failure of this control could result in criminal prosecution.

Software Usage Restrictions

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline CM-10(1) Open Source Software

NIST SP 800-53

Revision 4

Configurat ion

CM-11 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. While sudden non-compliance in the policy portion in paragraph "A" is not so alarming, sudden failure of the enforcement methods may allow users to install software at will, some of which may contain malware and allow unauthorized access to the system.

User-Installed Software

NIST SP 800-53

Revision 4

Configurat ion

CM-11(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If the prohibition to privileged status suddenly fails, normal users can install software at will, some of which could contain malware.

Prohibit Installation without Privileged Status

NIST SP 800-53

Revision 4

Configurat ion Managem ent

Baseline CP-3 Contingency Training

NIST SP 800-53

Revision 4

Contingen cy Planning

Baseline

CP-4 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Contingency Plan Testing

NIST SP 800-53

Revision 4

Contingen cy Planning

Baseline CP-9(1) Testing For Reliability / Integrity

NIST SP 800-53

Revision 4

Contingen cy Planning

Baseline CP-10(2) Transaction Recovery

NIST SP 800-53

Revision 4

Contingen cy Planning

Baseline IA-1

Identification And Authentication Policy And Procedures

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-2(1) Network Access to Privileged Accounts

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-2(2) Network Access to Non-Privileged Accounts

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-2(3) Local Access to Privileged Accounts

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-2(4) Local Access to Non-Privileged Accounts

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-2(5) Group Authentication

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-2(8)

Network Access to Privileged Accounts - Replay Resistant

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-2(9)

Network Access to Non-Privileged Accounts - Replay Resistant

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-2(12) Acceptance of PIV Credentials

NIST SP 800-53

Revision 4

Identificat ion and

IA-3 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Device Identification and Authentication

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-3(1) Cryptographic Bidirectional Authentication

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-4(4) Identify User Status

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-5(1) Password-Based Authentication

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-5(2) PKI-Based Authentication

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-5(3) In-Person Or Trusted Third- Party Registration

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-5(4)

Automated Support for Password Strength Determination

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-5(7)

No Embedded Unencrypted Static Authenticators

NIST SP 800-53

Revision 4

Identificat ion and

Baseline IA-5(8) Multiple Information System Accounts

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-5(11) Hardware Token- Based Authentication

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-5(13) Expiration Of Cached Authenticators

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-5(14) Managing Content of PKI Trust Stores

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-8(1) Acceptance of PIV Credentials from Other Agencies

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-8(2) Acceptance of Third-Party Credentials

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-8(3) Use Of FICAM- Approved Products

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IA-8(4) Use Of FICAM- Issued Profiles

NIST SP 800-53

Revision 4

Identificat ion and Authentic ation

Baseline IR-3 Incident Response Testing

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-3(2) Coordination With Related Plans

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-4(1) Automated Incident Handling Processes

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-4(3) Continuity Of Operations

NIST SP 800-53

Revision 4

Incident Response

Baseline

IR-4(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Information Correlation

NIST SP 800-53

Revision 4

Incident Response

Baseline

IR-4(6) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Due to the current exploitation of the insider threat concern, its necessary to have special procedures to identify, manage, thwart and prosecute the insider threat.

Insider Threats - Specific Capabilities

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-4(7) Insider Threats - Intra-organization Coordination

NIST SP 800-53

Revision 4

Baseline IR-4(8) Correlation With External Organizations

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-6(1) Automated Reporting

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-6(2) Vulnerabilities Related To Incidents

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-7 Incident Response Assistance

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-7(1)

Automation Support For Availability Of Information / Support

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-7(2) Coordination With External Providers

NIST SP 800-53

Revision 4

Incident Response

Baseline

IR-9 Spillage implies the potential for loss of confidentiality for classified information. Failure to identify, alert, isolate, eradicate, etc. will undoubtedly lead to compromise of classified information.

Information Spillage Response

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-9(1) Responsible Personnel

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-9(2) Training

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-9(4) Exposure To Unauthorized Personnel

NIST SP 800-53

Revision 4

Incident Response

Baseline IR-10

Integrated Information Security Analysis Team

NIST SP 800-53

Revision 4

Baseline MA-2 Controlled Maintenance

NIST SP 800-53

Revision 4

Maintena nce

Baseline MA-3 Maintenance Tools

NIST SP 800-53

Revision 4

Maintena nce

Baseline MA-3(1) Inspect Tools

NIST SP 800-53

Revision 4

Maintena nce

Baseline MA-3(2) Inspect Media

NIST SP 800-53

Revision 4

Maintena nce

Baseline MA-3(3) Prevent Unauthorized Removal

NIST SP 800-53

Revision 4

Maintena nce

Baseline

MA-4 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Maintenance conducted through network must be secured with proper authentication occurring by maintenance persons.

Nonlocal Maintenance

NIST SP 800-53

Revision 4

Maintena nce

MA-4(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Granted, this is an after the fact procedure, but it might identify suspicious activity of maintainers who may be more or less trusted with access to the system. This is especially concerning, because it is non-local maintenance.

Failure to audit could fail to identify activities that could lead to unauthorized access

Auditing And Review

NIST SP 800-53

Revision 4

Maintena nce

Baseline MA-4(2) Document Nonlocal Maintenance

NIST SP 800-53

Revision 4

Maintena nce

Baseline MA-4(3) Comparable Security / Sanitization

NIST SP 800-53

Revision 4

Maintena nce

Baseline MA-4(7) Remote Disconnect Verification

NIST SP 800-53

Revision 4

Maintena nce

MP-7 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure to prevent the use of dangerous media types (e.g., thumb drives, personally owned mobile devices) on the system can easily lead to introduction of malware and compromise of the system.

Media Use

NIST SP 800-53

Revision 4

Media Protection

Baseline MP-7(1) Prohibit Use Without Owner

NIST SP 800-53

Revision 4

Media Protection

Baseline PE-1

Physical And Environmental Protection Policy And Procedures

NIST SP 800-53

Revision 4

Physical and Environm ental Security

Baseline PE-3(1) Information System Access

NIST SP 800-53

Revision 4

Physical and Environm ental Security

PE-6 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If it is not done or done correctly, how do we ensure unauthorized access is not occurring.

Monitoring Physical Access

NIST SP 800-53

Revision 4

Physical and Environm ental Security

Baseline PE-6(1) Intrusion Alarms / Surveillance Equipment

NIST SP 800-53

Revision 4

Physical and Environm ental Security

Baseline PE-8 Visitor Access Records

NIST SP 800-53

Revision 4

Physical and Environm ental Security

Baseline PE-12 Emergency Lighting

NIST SP 800-53

Revision 4

Physical and Environm ental Security

Baseline PE-13 Fire Protection

NIST SP 800-53

Revision 4

Physical and Environm ental Security

Baseline PE-14 Temperature And Humidity Controls

NIST SP 800-53

Revision 4

Physical and Environm ental Security

Baseline PE-15 Water Damage Protection

NIST SP 800-53

Revision 4

Physical and Environm ental Security

Baseline PE-16 Delivery And Removal

NIST SP 800-53

Revision 4

Physical and Environm ental Security

Baseline PL-1 Security Planning Policy And Procedures

NIST SP 800-53

Revision 4

Planning

Baseline PL-2(3)

Plan / Coordinate With Other Organizational Entities

NIST SP 800-53

Revision 4

Planning

Baseline PL-4(1) Social Media and Networking Restrictions

NIST SP 800-53

Revision 4

Planning

Baseline PL-8(1) Defense-In-Depth

NIST SP 800-53

Revision 4

Planning

Baseline PL-8(2) Supplier Diversity

NIST SP 800-53

Revision 4

Planning

Baseline PM-4 Plan Of Action And Milestones Process

NIST SP 800-53

Revision 4

Program Managem ent

Baseline PM-5 Information System Inventory

NIST SP 800-53

Revision 4

Program Managem ent

Baseline PM-6 Information Security Measures Of Performance

NIST SP 800-53

Revision 4

Program Managem ent

Baseline PM-8 Critical Infrastructure Plan

NIST SP 800-53

Revision 4

Program Managem ent

Baseline PM-12 Insider Threat Program

NIST SP 800-53

Revision 4

Program Managem ent

Baseline PM-15 Contacts With Security Groups And Associations

NIST SP 800-53

Revision 4

Program

Baseline PM-16 Threat Awareness Program

NIST SP 800-53

Revision 4

Program Managem ent

Baseline PS-4(1) Post-employment Requirements

NIST SP 800-53

Revision 4

Personnel Security

Baseline PS-6(3) Post-employment Requirements

NIST SP 800-53

Revision 4

Personnel Security

Baseline

RA-5 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Would need to investigate to determine if the unremediated vulnerabilities change the risk level.

Vulnerability Scanning

NIST SP 800-53

Revision 4

Risk Assessme nt

Baseline RA-5(1) Update Tool Capability

NIST SP 800-53

Revision 4

Risk Assessme nt

Baseline RA-5(2)

Update By Frequency / Prior To New Scan / When Identified

NIST SP 800-53

Revision 4

Risk Assessme nt

Baseline RA-5(4) Discoverable Information

NIST SP 800-53

Revision 4

Risk Assessme nt

Baseline RA-5(5) Privileged Access

NIST SP 800-53

Revision 4

Risk Assessme nt

Baseline SA-1

System And Services Acquisition Policy And Procedures

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline SA-4(1) Functional Properties Of Security Controls

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline

SA-4(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure to comply with this control could lead to serious security concerns as critical system elements could go untested/ invalidated.

Design / Implementation Information For Security Controls

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline SA-4(7) NIAP-approved Protection Profiles

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline SA-4(9) Functions / Ports / Protocols / Services In Use

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline SA-4(10) Use Of Approved PIV Products

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline SA-5 Information System Documentation

NIST SP 800-53

Revision 4

System and Services

SA-9 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Critical information is located on any of these external services sites and must be monitored.

External Information System Services

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline SA-9(1) Risk Assessments / Organizational Approvals

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline

SA-9(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If this control fails, capabilities will be limited for the system or service and could result in a DoS to it with a direct mission impact.

Identification Of Functions / Ports / Protocols / Services

NIST SP 800-53

Revision 4

System and Services

Baseline SA-10 Developer Configuration Management

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline SA-10(1) Software / Firmware Integrity Verification

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline SA-12 Supply Chain Protection

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline SA-15

Development Process, Standards, And Tools

NIST SP 800-53

Revision 4

System and Services Acquisitio n

Baseline

SA-19 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. As identified in the counterfeit Cisco routers, failure to ID fake products/parts could have undesirable consequences in the loss or compromise of data.

Component Authenticity

NIST SP 800-53

Revision 4

System and Services

Baseline SC-1

System And Communications Protection Policy And Procedures

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-5 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Denial Of Service Protection

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline SC-5(1) Restrict Internal Users

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-7 Ensures protection at the boundary. Publically accessible systems are provided protections by DMZ.

Boundary Protection

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline SC-7(3) Access Points

NIST SP 800-53

Revision 4

System and Communi cations Protection

SC-7(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Simply must tightly manage the firewalls to ensure they stay in compliance and do not open a window or door for our advanced adversaries.

External Telecommunicatio ns Services

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-7(5) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. The alternative is disastrous -that is allow all by default.

Allowing all allows our advanced adversaries to get in, and then all bets are off-systems are quickly compromised.

Deny By Default / Allow By Exception

NIST SP 800-53

Revision 4

System and Communi

SC-7(7) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. This is preventing split tunneling. A split tunnel in effect creates an external connection to the internal network resources, and that can be easily compromised.

Prevent Split Tunneling For Remote Devices

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline SC-7(8) Route Traffic To Authenticated Proxy Servers

NIST SP 800-53

Revision 4

System and Communi

SC-7(9) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of this control allows malicious "insiders" to initiate an attack against other DoD systems. Note that these "insiders" may actually be outsiders who have gained access to DoD systems and are using the system as a launching pad for other attacks or to increase their foothold and impact.

Restrict Threatening Outgoing Communications Traffic

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-7(10) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of this control allows malicious "insiders" to exfiltrate terabytes of information.

Prevent Unauthorized Exfiltration

NIST SP 800-53

Revision 4

System and Communi

SC-7(11) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of this control means the firewall is not checking source/destination addresses, which is a low-tech means of thwarting attacks.

More sophisticated means exist to get around this control when it is working correctly.

Restrict Incoming Communications Traffic

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-7(12) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Based on the importance of host-based protection across the DoD.

Host-based Protection

NIST SP 800-53

Revision 4

System and Communi

Baseline SC-7(13)

Isolation Of Security Tools / Mechanisms / Support Components

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-7(14)

Unintended physical connections are the worst kind, far worse than a logical connection. With a physical connection, all bets are off, the outsider (could be a system the adversary has compromised) now has direct access to internal network components.

Protects Against Unauthorized Physical Connections

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-10 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Risk presented to the compromise of IS data through non-compliance warrants further investigation by the DAA/AO. The security control can be automated.

Network Disconnect

NIST SP 800-53

Revision 4

System and Communi

SC-15 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If collaborated devices are being used without the owners knowledge, potential compromise of information.

Collaborative Computing Devices

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-17 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Risk presented to the compromise of IS data through non-compliance warrants further investigation by the DAA/AO. The security control can be automated.

Public Key Infrastructure Certificates

NIST SP 800-53

Revision 4

System and Communi

Baseline SC-18 Mobile Code

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-18(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Reducing the ability to monitor mobile code reduces your ability to monitor technologies that allow adversary compromise.

Identify Unacceptable Code / Take Corrective Actions

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline SC-18(2) Acquisition / Development / Use

NIST SP 800-53

Revision 4

System and Communi

SC-18(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Allowing the implementation/ installation of prohibited mobile code allows for the installation of frequently used attack vectors.

Prevent Downloading / Execution

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-18(4) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Allowing the implementation/inst allation of prohibited mobile code allows for the installation of frequently used attack vectors.

Prevent Automatic Execution

NIST SP 800-53

Revision 4

System and Communi

Baseline SC-19 Voice Over Internet Protocol

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-20 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Risk presented to the compromise of IS data through non-compliance warrants further investigation by the

DAA/AO.

Secure Name / Address Resolution Service (authoritative Source)

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-21 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Risk presented to the compromise of IS data through non-compliance warrants further investigation by the

DAA/AO.

Secure Name / Address Resolution Service (recursive Or Caching Resolver)

NIST SP 800-53

Revision 4

System and Communi

Baseline SC-22

Architecture And Provisioning For Name / Address Resolution Service

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-23 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Risk presented to the compromise of IS data through non-compliance warrants further investigation by the

DAA/AO.

Session Authenticity

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline SC-23(1) Invalidate Session Identifiers At Logout

NIST SP 800-53

Revision 4

System and Communi

SC-23(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Risk presented to the compromise of IS data through non-compliance warrants further investigation by the

DAA/AO.

Unique Session Identifiers With Randomization

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SC-23(5) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure of this control means falsified certificates may be used. Given the intent of the control is to establish protected sessions, we could be unknowingly establishing sessions with adversaries wishing to exploit our systems or web applications.

Allowed Certificate Authorities

NIST SP 800-53

Revision 4

System and Communi

Baseline SC-38 Operations Security

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline SC-39 Process Isolation

NIST SP 800-53

Revision 4

System and Communi cations Protection

Baseline

SI-2 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Not updating or failure to update makes them vulnerable to known exploits.

Flaw Remediation

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline SI-2(1) Central Management

NIST SP 800-53

Revision 4

System and Informatio n Integrity

SI-2(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Without automation in large enclaves, it would be nearly impossible to keep up with flaws, and they'd soon allow adversaries access and control.

Automated Flaw Remediation Status

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline SI-2(3)

Time To Remediate Flaws / Benchmarks For Corrective Actions

NIST SP 800-53

Revision 4

System and

SI-2(6) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Leaving older versions of software/firmware could negatively impact the security posture, as older versions tend to be less secure than the most recent versions and the vulnerabilities could be exploited. The concern is that this failure may not be discovered, as it is a procedural control;

and the system becomes more and

Removal Of Previous Versions Of Software / Firmware

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline

SI-3 Core capability that if not running will not thwart even the less advanced adversary exploits.

Malicious Code Protection

NIST SP 800-53

Revision 4

System and

SI-3(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Central management allows situational awareness of all aspects, any of which could be an attack vector.

Central Management

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline

SI-3(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failing will allow signature definition files to quickly become out of date, and systems/networks will not catch latest exploits, which will allow access and control of systems.

Automatic Updates

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline SI-3(10) Malicious Code Analysis

NIST SP 800-53

Revision 4

System and

SI-4(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. It is unrealistic to think that we could perceive and understand an attack if we don't monitor from a system wide perspective. Low and slow attacks would go unnoticed, and advanced adversaries would quickly own our systems/networks.

However, failure of the system-wide perspective does

System-wide Intrusion Detection System

NIST SP 800-53

Revision 4

System and

SI-4(2) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Without automation, it will be difficult to identify events or attacks and thwart adversary attempts to gain access and/or a foothold.

Automated Tools For Real-time Analysis

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline

SI-4(4) Failure to monitor at ingress/egress points is loss of core capability. This is where we are most likely to identify attacks. AO notification for disconnect is critical due to the compromise of integrity of the system.

Inbound And Outbound Communications Traffic

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline

SI-4(5) Failure of alerts means we do not know if we are under attack.

Adversary gains access and gets in deep before we have a chance to do anything about it.

System-generated Alerts

NIST SP 800-53

Revision 4

System and

SI-4(10) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If the traffic remains encrypted, it is not visible to monitoring tools; therefore, exploits and attacks would bypass the monitoring tools.

Visibility Of Encrypted Communications

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline

SI-4(11) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Needed for identification of exfiltration and data loss protection analyzes outbound communications traffic.

Analyze Communications Traffic Anomalies

NIST SP 800-53

Revision 4

System and

SI-4(12) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Without automation of alerts, we are left with manual means of reviewing logs, reports, etc., and it would allow more time for adversaries to get a foothold, making it more difficult to identify attacks, thwart them, or get adversaries out.

Automated Alerts

NIST SP 800-53

Revision 4

System and

SI-4(14) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Wireless attacks are easy and ever more present.

Undetected, adversaries can easily and quickly gain access without being noticed.

Wireless Intrusion Detection

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline

SI-4(15) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Wireless IDS is just as important as wired IDS. Without IDS, we have few, if any, means of knowing if/when we're under attack.

Wireless To Wireline Communications

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline SI-4(16) Correlate Monitoring Information

NIST SP 800-53

Revision 4

System and

SI-4(19) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure to increase the monitoring of individuals known to pose an increased level of risk is the Ostrich in the sand scenario leaving the door open to an attack by those individuals.

Individuals Posing Greater Risk

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline SI-4(20) Privileged User

NIST SP 800-53

Revision 4

System and

SI-4(22) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Failure to detect unauthorized services means we could be using unreliable services or allowing malicious rogue services to be used instead of valid services. Given this is a technical control, failure may not be evident;

therefore, the impact could be unrealized and prolonged.

Unauthorized Network Services

NIST SP 800-53

Revision 4

System and

SI-4(23) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. The presumption is that we had identified key components that need to be monitored, due to their asset value and the level of impact if compromised. As such, failure to monitor these key components means they could be compromised without out knowledge. This is very damaging for servers, and possibly

Host-based Devices

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline

SI-5 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. If they are not receiving and disseminating alerts, will be open to risk.

Security Alerts, Advisories, And Directives

NIST SP 800-53

Revision 4

System and

SI-7(1) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. Cannot rely on a static assessments; must reassess periodically to identify adversary activity over time.

Integrity Checks

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline SI-7(7) Integration Of Detection And Response

NIST SP 800-53

Revision 4

System and

SI-7(8) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. This is an automated control that if not functioning correctly (and that would likely go unnoticed) will allow integrity violations to continue indefinitely, because there is no auditing or notification, thereby steadily increasing the risk of the system being compromised.

Auditing Capability For Significant Events

NIST SP 800-53

Revision 4

System and

SI-7(14) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. While this is an organizational/proc edural control, it can become noncompliant over time. If it does, the lack of the ability to assess the source code for vulnerabilities or malicious functions means the security posture of the system using the code will steadily decrease over time.

Assuming non-

Binary Or Machine Executable Code

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline SI-8(1) Central Management

NIST SP 800-53

Revision 4

System and Informatio n Integrity

Baseline SI-8(2) Automatic Updates

NIST SP 800-53

Revision 4

System and

SI-10(3) The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm.

Submission of invalid inputs is a common means of attacking a system.

If the system does not recognize the invalid inputs and/or respond in a predictable manner, the attacks are more likely. Note that this capability must be engineered into the system from the start. Non-compliance after the fact will be

Predictable Behavior

NIST SP 800-53

Revision 4

System and

SI-16 The security control should be further investigated before escalating to the AO for a disconnect decision. Yellow security controls want to have an alert on them, not an alarm. It is common for adversaries to launch attacks by executing code in non-executable regions of memory or in memory locations that are prohibited. Doing so often allows adversaries to perform unauthorized functions and/or elevate privileges.

Memory Protection

NIST SP 800-53

Revision 4

System and