SCPMaR_BSRR_v3 2 4.doc

Business System Requirements Report (BSRR)

Security Compliance Posture Monitoring and Reporting (SCPMaR) Project Modernization and Information Technology Service (MITS) Cybersecurity

Version 3.2.4 : May 6, 2009 Table of Contents InTroduction

41.1 Purpose

41.2 Background

41.3 Project Vision

71.4 Scope

71.5 Description of the Operating Environment

71.6 Assumption and Constraints

System Capability Requirements

82.1 Overview

92.2 Definitions

Minimum Mandatory Requirements

Functional Requirements

144.1 Functional Capability: The solution shall provide the ability to monitor and measure the effectiveness of IRS mandated security controls on computing systems, enterprise-wide, in a timely manner.

144.1.1 Requirements Category: Security posture reporting (SPR)

164.1.2 Requirements Category: Security Configuration Assessment (SCA)

174.1.3 Requirements Category: Security Patch-Level Assessment (SPA)

174.1.4 Requirements Category: Security Vulnerability Identification & Enumeration (VIE)

184.2 Functional Capability: The solution shall provide the ability to manage security configurations throughout the system life cycle by assessing the level of compliance with US Government and IRS specified technical controls.

184.2.1 Requirements Category: Access Control (AC)

194.2.2 Requirements Category: Identification and Authentication (IA)

204.2.3 Requirements Category: Audit and Accountability (AU)

214.2.4 Requirements Category: System and Communications (SC)

214.2.5 Requirements Category: HW/SW Inventory & Discovery (DIS)

224.2.6 Requirements Category: Security Configuration Management (SCM)

224.2.7 Requirements Category: File Integrity (FI)

224.2.8 Requirements Category: Remediation (REM)

234.3 Functional Capability: The solution shall promote efficiency by implementing standard protocols and interoperability across the IRS enterprise.

234.3.1 Requirements Category: Interoperability to Legacy Security Tools (IOL)

Operational Requirements

255.1 Operational Capability: The solution shall provide the ability to automate the security assessment and reporting processes to reduce the level-of-effort in coordination and execution.

255.1.1 Requirements Category: Automated Assessment Process (OP-AAP)

255.1.2 Requirements Category: On-demand Assessment Process (OP-OAP)

255.1.3 Requirements Category: Reporting Process (OP-RPP)

265.2 Operational Capability: The solution shall provide the ability to facilitate the risk management process by verifying that systems are operating within established security configuration baselines and identify risk issues.

265.2.1 Requirements Category: Risk Management Process (OP-RMP)

265.3 Operational Capability: The solution shall provide the ability to support the change control process by assisting the authorized organizations to define and maintain baseline security configurations with risk commensurate RBDs.

265.3.1 Requirements Category: Security Configuration Baseline Management Process (OP-BMP)

265.3.2 Requirements Category: Change Control Process (OP-CCP)

Acronyms

Reference

1 InTroduction

1.1 Purpose

This Business System Requirements Report (BSRR) establishes the system requirements for the IRS Modernization Information Technology Services (MITS) Security Compliance Posture Monitoring and Reporting (SCPMaR) Project. The objective of this project is to provide the IRS with the ability to monitor, measure, and manage the FISMA compliance of its implemented technical security controls, enterprise-wide.

1.2 Background

MITS is the functional organization that provides mission critical and general IT services to IRS business operational organizations (i.e., LMSB, TE/GE, SB/SE, and W&I) and functional operational organizations (i.e., AWSS, Appeals, CC, CI, CFO, HCO, ETA, RAS, and SOI.) As a part of the fiscal year (FY) 2008 strategic initiative to improve information security to meet the IRS Information Technology Program’s security objectives, MITS is seeking an automated security posture monitoring and management solution.

Security posture, as defined by Federal Information Processing Standard (FIPS) 200, and National Institute of Standards and Technology (NIST) SP 800-53, is the level of assurance that adequate technical security controls have been implemented to meet the information protection needs. The security posture metrics:

· Degree of assurance that the technical security controls and security configurations defined by IRS and NIST have been implemented.

· Level of assurance that security patches specified by the IRS Computer Security Incident Response Center (CSIRC) and the United States Computer Emergency Readiness Team (US-CERT) have been implemented.

· Identification of IRS CSIRC/US-CERT-announced security vulnerabilities have been enumerated (e.g., SANS Top 20 and CVE) utilizing the Common Vulnerability Scoring System.

1.3 Project Vision

The objective of this project is to provide IRS the ability to monitor, measure, and report the effectiveness of its implemented technical security controls, enterprise-wide, in a timely manner. The “solution”, in this case, is composed of “people, process, and technology”. The other words, the solution shall consist of IRS information security stakeholders executing the security configuration management processes, supported by a technology solution.

Figure 1 illustrates the contextual relationships between people, process, and technology.

Figure 1: Contextual architecture of the SCPMaR solution People. Enterprise-wide, there are eighteen project stakeholder organizations (i.e. six MITS service organizations and twelve mission-focused business units.) MITS is the primary IT services provider for the IRS. MITS is functionally organized in the following sub-organizations: Cybersecurity, Enterprise Operations (EOps), End User Equipment Services (EUES), Enterprise Networks (EN), Enterprise Services (ES), and Applications Development (AD). The business units includes the Agency-wide Shared Services (AWSS), Appeals, Chief Counsel (CC), Criminal Investigation (CI), Electronic Tax Administration (ETA), Human Capital Office (HCO), Large and Mid-size Business (LMSB), Research, Analysis, and Statistics (RAS), Small business/ Self-employed (SB/SE), Statistics of Income (SOI), Tax Exemption / Government Entities (TE/GE), and Wage and Investment (W&I).

Process. There are four elemental operations: assessment, reporting, change control/baseline management and risk management operations. These operations are divided into six principle processes: Security configuration and RBD management process, change control process, automated security assessment process, on-demand security assessment process, security assessment reporting process, and risk management process.

Technology. The “solution” – Security Compliance Posture Monitoring & Reporting (SCPMaR) system shall provide the following six functional and operational capabilities:

Functional capabilities:

1. The solution shall monitor and measure the effectiveness of mandated security controls (i.e. security configuration benchmarks) on computing assets, enterprise-wide, and in a timely manner.

2. The solution shall manage security configurations throughout the system life cycle (or security C&A life cycle) by assessing and reporting the level of compliance with the agency/US Government-specified technical security controls continuously.

3. Technology of the solution shall use NIST-defined open security automation standards – Security Content Automation Protocol (SCAP).

Operational capabilities:

4. The solution shall automate the security compliance assessment and reporting processes to reduce the level of effort in coordination and execution, across the enterprise.

5. The solution shall facilitate the risk management process by verifying the information systems operate within the established security configuration baselines and identify risks at the appropriate level of abstraction.

6. The solution shall support IRS change and baseline control processes by documenting and storing configuration managed security configuration baselines with risk commensurate RBDs.

In addition, the solution shall provide FISMA compliance reports in accordance with OMB M-07-19 and Federal Desktop Core Configuration (FDCC) compliance report as defined in OMB-M-07-11 using NIST-defined Security Content Automation Protocol (SCAP) format.

For interoperability with the existing IRS IT investments, the solution shall be able to import or integrate data from existing IRS systems and tools including but not limited to:

· The solution shall provide the ability to import a list of identified vulnerabilities generated from IRS-CSIRC’s ISS Internet Scanner (Version 7.x or most current release) and Nessus (Version 3.x or most current release).

· The solution shall provide the ability to import a list of required security patches specified by IRS-CSIRC or US-CERT.

· The solution shall provide the ability to import a list of EA approved software specified in the IRS EA Enterprise Standards Profile.

· The solution shall provide the ability to import a list of baseline IT hardware assets from IRS Information Technology Asset Management System (ITAMS) (i.e., HP Peregrine Asset Management) and EOPS Master Server Database (MSDB) (i.e., Oracle RDBMS).

· The solution shall integrate with Microsoft Active Directory to facilitate the management of Group Policy Objects (GPO)

· The solution shall integrate with the IRS Employee User Portal (EUP) (i.e., SiteMinder) for user authentication.

1.4 Scope

IRS has established agency-wide policy and guidance for information systems security and maintaining records of system activities in conjunction with appropriate tools and procedures that can assist in detecting security violations, performance problems and flaws in IT operations. The scope of this system requirements document includes the following computing platforms:

· Windows-based platforms: Windows Server 2000, Windows 2003 Server and Windows XP.

· UNIX-based platforms: Solaris 10, 9, 8, Red Hat Enterprise Linux 5, 4, AIX 5.2, and HP-UX-11.

1.5 Description of the Operating Environment

The IRS IT computing infrastructure operates in a geographically diverse environment in multiple domains and includes:

· 120,000+ Windows XP desktop workstations and laptops

· 1,000+ Windows-based servers running Windows 2000 Server

· 3,000+ Windows-based servers running Windows 2003 (x-32 and x-64 bit platforms)

· 1,000+ Unix-based servers running Solaris 8, 9, and 10

· 300+ UNIX-based servers running Red Hat Enterprise Linux 4 and 5

· 100+ UNIX-based servers running HP-UX 11 and IBM AIX 5.2 IRS plans to begin migrating Windows servers to Windows Server 2008 by the end of 2009. Most of the servers are located in 3 geographically diverse enterprise computing centers (ECC) and 10 major campuses. The desktop workstations and laptops are mostly located in 700 Posts-of-Duty (POD) station throughout U.S. and overseas.

1.6 Assumption and Constraints

Vulnerability scans shall be performed by existing IRS tools (i.e., ISS or Nessus). Results from these tools will be provided to the solution to be used in analysis and incorporated in reports and displays.

The solution shall be used to remediate mis-configurations through the execution of the IRS change control process. Remediation such as software updates and patch installations shall be performed by existing IRS tools (e.g. Tivoli Configuration Manager (TCM), or Altiris Patch Manager). The solution shall not initiate remediation without authorized change approval.

The solution shall be used to assess virtualized operating system instances hosted by VMWare.

The solution shall facilitate asset discovery.

The solution shall integrate with existing IRS systems including but not limited to:

· The solution shall integrate with other NIST SCAP validated products.

· The solution shall integrate with the IRS Network Admission Control (NAC) solution.

· The solution shall integrate with Active Directory and SiteMinder.

2 System Capability Requirements

2.1 Overview

The system requirements are driven by the need to: 1) be compliant with current and future US Government security policies, standards, and guidelines. These may include, but are not limited to, Internal Revenue Manual (IRM) and Law Enforcement Manual(s) (LEM), National Institute of Standards and Technology (NIST) standards, including Federal Information Processing Standards (FIPS) publications, Treasury Directives and OMB mandates; 2) be able solve operational issues (i.e. reporting, assessment, change/configuration management, and risk management issues); and 3) must address the audit findings from TIGTA, GAO, and Computer Security Material Weaknesses (CSMW)). (As depicted in Figure 2.)

The system requirements are composed of the following six functional and operational needs categories:

1. Ability to monitor and measure the effectiveness of IRS mandated security controls on computing assets, enterprise-wide, in a timely manner. (Functional)

· Security Posture Reporting

· Security Configuration Assessment

· Security Patch-Level Assessment

· Vulnerability Identification & Enumeration

2. Ability to manage security configurations throughout the system life cycle by assessing the level of compliance with IRS and US Government standard technical controls. (Functional)

· Access Control

· Identification and Authentication

· Audit and Accountability

· System and Communications

· Hardware/Software Inventory & Discovery

· Security Configuration Management

· File Integrity

· Remediation

3. Ability to efficiently implement the solution by improving technology standardization across the IRS enterprise. (Functional)

· Interoperability to Existing IRS Security Tools

4. Ability to automate the security compliance assessment and reporting processes to reduce the level of effort in coordination and execution. (Operational)

· Automated Assessment Process

· On-demand Assessment Process

· Reporting Process

5. Ability to facilitate the risk management process by verifying that computing assets operate within established security configuration baselines and identify risks at the appropriate level of abstraction. (Operational)

· Risk Management Process

6. Ability to support the change control process by assisting the authorized organizations to define and maintain baseline security configurations with risk commensurate RBDs throughout the system life cycle. (Operational)

· Security Configuration Baseline Management Process

· Change Control Process

Figure 2: Contextual description of required capabilities.

2.2 Definitions

· Security posture is defined as the level of assurance that adequate technical security controls have been implemented to meet the information protection needs. Security posture metrics are:

· Degree of assurance that the technical security controls and security configurations defined by IRS and NIST are implemented.

· Level of assurance that security patches specified by the IRS are implemented.

· Identification of IRS/ US-CERT-announced security vulnerabilities enumerated (e.g., SANS Top 20 and CVE) utilizing the Common Vulnerability Scoring System.

· A security configuration baseline is a set of security configuration benchmarks with the IRS accepted risks and approved patches.

· A security configuration benchmark is a set of security configuration settings defined by the IRS. (The security configuration benchmarks are described using SCAP, originating from the NIST National Checklist Program.)

· A Risk Based Decision (RBD) is the accepted difference between an approved security configuration benchmark and the actual, accepted security configuration of a system.

· A non-conformance is a deviation from the accepted security configuration baseline and approved patches for the system.

Figure 3: Contextual description of system requirements

3 Minimum Mandatory Requirements

MR-1:

The solution shall use NIST-defined Security Content Automation Protocol (SCAP) and agency-wide security configuration policies (e.g. IRS policies and NIST National Checklist Program) and provide Federal Desktop Core Configuration (FDCC) compliance reports using the NIST-defined SCAP-based reporting format. At a minimum, the solution must be SCAP validated as a FDCC Scanner, Authenticated Configuration Scanner, and Authenticated Vulnerability and Patch Scanner.

MR-2:

The solution shall use SCAP-based security configuration policy/benchmarks approved by IRS to assess compliance on the following computing platforms, including but not limited to:

· Microsoft Windows 2000 Server

· Microsoft Windows Server 2003 (x-32 and x-64 bit platforms)

· Microsoft Windows XP Professional Edition

· Sun Solaris 10

· Sun Solaris 9

· Sun Solaris 8

· Red Hat Enterprise Linux 5

· Red Hat Enterprise Linux 4

· HP HP-UX 11

· IBM AIX 5.2

MR-3:

The solution shall be compliant with FDCC and it shall perform security configuration compliance assessments in a manner that is compliant with FDCC requirements for Windows-based workstations and in accordance with IRS policy for Windows-based servers and UNIX-based servers.

MR-4:

For client console interfaces, the solution shall use Microsoft Active Directory Service for user authentication.

MR-5:

For web-based client interfaces, the solution shall integrate with CA SiteMinder for authentication.

MR-6:

The solution shall provide role-based access control (RBAC) with audit records for all system functionality.

MR-7:

The solution shall be able to import ISS Internet Scanner and Nessus data to enumerate identified vulnerabilities. Each identified vulnerability shall be associated with a specific computing asset.

MR-8:

The solution shall provide the ability to import a list of security patches specified by the IRS.

MR-9:

The solution shall be able to document and preserve records of approved risk based decisions (RBDs) and measure the level of security compliance against an approved baseline (i.e., security configuration benchmarks with approved RBDs) for a user-specified period of time, up to 3 years at minimum.

MR-10:

The solution shall be able to perform security configuration compliance assessments of IRS computing assets across multiple Microsoft Active Directory domains.

MR-11:

The solution shall provide both networked and non-networked assessment solutions.

MR-12:

The solution shall use NIST FIPS 140-2 validated cryptographic module.

MR-13:

The solution shall provide the capability to initiate the patching process for approved patch change requests through existing IRS patch tools: Altiris Patch Manager and Sun N1 Patch Manager.

MR-14:

The solution shall integrate with NetIQ Group Policy Administrator.

MR-15:

The solution shall provide the capability to support the FISMA reporting process mandated by OMB.

MR-16:

The solution shall provide the capability to generate metrics and provide status information for measuring the effectiveness of information security controls. (i.e., NIST SP 800-55 Rev.1, Performance Measurement Guide for Information Security, and Common Vulnerability Scoring System (CVSS).)

MR-17:

The solution shall provide metrics in the form of numbers and percentage that indicate the degree of compliance with the required security controls; and organized by flexible, expandable, and configurable grouping of assets.

MR-18:

The solution shall provide a set of user-defined, role-based, security compliance posture dashboards in accordance to the job functions defined in IRS policies.

MR-19:

The solution shall provide a set of status reports for tracking the effective period for approved RBDs and non-conformances.

MR-20:

The solution shall provide the capability to assess and report on the conformance to patch-levels established by the IRS for computing platforms.

MR-21:

The solution shall be scalable to support the IRS enterprise as described in Section 1.5, “Description of Operating Environment”.

MR-22:

The solution shall assess the degree of compliance to IRS-specified security configuration benchmarks (in SCAP format) and approved security configuration baselines for IRS UNIX-based computing assets.

MR-23:

The solution shall assess the degree of compliance to IRS-specified security configuration benchmarks (in SCAP format) and security configuration baselines for Windows-based assets.

MR-24:

The solution shall provide the capability to create user-defined (i.e. customized) automated security configuration checklists in SCAP format.

MR-25:

The solution shall enumerate identified vulnerabilities in CVE and correlate to a specific computing asset.

MR-26:

The solution shall provide functionality that allows for the acceptance of identified non-conformance or weakness, based on the existence of an approved waiver/ variance that acknowledges and accepts the risk, on a per asset or per asset group basis.

MR-27:

The solution shall be able to import or integrate data from other SCAP-enabled solutions.

MR-28:

The solution shall provide the ability to perform periodic and pre-scheduled automated security configuration assessments.

MR-29:

The solution shall provide the ability to perform on-demand security configuration assessments.

MR-30:

The solution shall provide the capability to support automation of IRS reporting processes for security compliance posture reporting.

MR-31:

The solution shall provide the capability to automate the IRS Security Configuration Risk Management process by recording RBDs as part of the security configuration baseline for a computing asset as described in the SCPMaR Concept of Operations.

MR-32:

The solution shall provide the capability to automate the IRS Security Configuration Baseline Management process as described in the SCPMaR Concept of Operations.

MR-33:

The solution shall provide the capability to automate the IRS Security Configuration Change Control process as described in the SCPMaR Concept of Operations.

4 Functional Requirements

4.1 Functional Capability: The solution shall provide the ability to monitor and measure the effectiveness of IRS mandated security controls on computing systems, enterprise-wide, in a timely manner.

4.1.1 Requirements Category: Security posture reporting (SPR)

F-SPR1.1:

The solution should report the number of compliant/ non-compliant information systems against security configuration baselines delineated by FIPS 199 security categories – High, Moderate, and Low.

F-SPR1.2:

The solution should report the number of compliant/ non-compliant information systems against security configuration baselines in accordance to the security controls specified in NIST SP 800-53 in accordance with FIPS 199 security categories – High, Moderate, and Low.

F-SPR1.3:

The solution should report number of compliant/ non-compliant information systems against security configuration baselines for Windows and UNIX operating system.

F-SPR1.4:

The solution should retain historical assessment data for a minimum of one year. (Assessments for each computing asset will be performed weekly.)

F-SPR2.1:

The solution should provide user-customizable reporting capability to generate metrics based on, but not limited to NIST SP 800-55 Rev.1, Performance Measurement Guide for Information Security.

F-SPR2.2:

The solution should provide the capability to report metrics and status information by criticality and severity of non-conformance. Risks should use the Common Vulnerability Scoring System (CVSS).

F-SPR3.1:

The solution should provide the number and percent of computing assets that are compliant with security configuration baselines by FIPS 199 security categories – High, Moderate, and Low; and delineated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups.

F-SPR3.2:

The solution should provide the number and percent of technical vulnerabilities enumerated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups.

F-SPR3.3:

The solution should provide the number and percent of computing platforms that have addressed the technical vulnerabilities identified by IRS/ US-CERT and delineated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups.

F-SPR4.1:

For security compliance posture dashboards , the solution should provide the number and percent of computing assets that are compliant with security configuration baselines by FIPS 199 security categories – High, Moderate, and Low; and delineated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups.

F-SPR4.2:

For security compliance posture dashboards, the solution should provide the number and percent of technical vulnerabilities enumerated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups.

F-SPR4.3:

For security compliance posture dashboards, the solution should provide the number and percent of computing assets that have addressed the technical vulnerabilities identified by IRS CSIRC and delineated by Enterprise-wide, by UNIX-based computing assets, by Windows-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups.

F-SPR5:

The solution should provide a set of hardware/software asset discovery reports to include, but not limited to IP address, machine name, operating system, and hardware platform.

F-SPR6.1:

The solution should provide role-based RBD status reports specific to the user's AOR.

F-SPR6.2:

The solution should provide the capability to alert and notify users on the status of RBDs within their AOR.

F-SPR7.1:

The solution should provide the capability to track number of patches that have been issued by the IRS delineated by computing platforms, by GSS, and by AOR.

F-SPR7.2:

The solution should provide the capability to assess the number and percent of patches that have been implemented.

F-SPR8:

The solution should provide the capability to export all user generated reports.

F-SPR8.1: The solution should provide the capability to export all user generated reports in formats including but not limited to: xls, csv, html, xml, pdf.

F-SPR9:

The solution should be capable of supporting a minimum of 50 simultaneous users accessing detailed security posture reports.

F-SPR10:

The solution should be capable of supporting a minimum of 50 simultaneous users accessing aggregate level (GSS, AOR, etc…) security posture reports.

4.1.2 Requirements Category: Security Configuration Assessment (SCA)

F-SCA1.1:

The solution should track amount of time to implement the approved change for UNIX-based computing assets and by operating system.

F-SCA1.2:

The solution should track the number of UNIX-based computing assets and by operating system.

F-SCA1.3:

The solution should track number and percent computers that are compliant/ non-compliant with security configuration benchmarks and approved security configuration baselines for UNIX-based computing assets.

F-SCA2.1:

The solution should track amount of time to implement the approved change for Windows-based computing assets and by operating system.

F-SCA2.2:

The solution should track the number of Windows-based computing assets and by operating system.

F-SCA2.3:

The solution should assess the number and percent computers that are compliant/ non-compliant with security configuration benchmarks and approved security configuration baselines for Windows-based computing assets.

F-SCA3:

The solution should assess the degree of compliance to the IRS-specified security configuration benchmarks and approved security configuration baselines for Unisys systems using MCP operating system and z/OS systems using RACF.

F-SCA3.1: The solution should track amount of time to implement the approved change for mainframe computing assets by operating system.

F-SCA3.2:

The solution should track the number of mainframe computing assets.

F-SCA3.3:

The solution should assess the number and percent of computers that are compliant/ non-compliant with security configuration benchmarks and approved security configuration baselines for mainframe computing assets.

F-SCA4.1:

The solution should provide the capability to create user defined security configuration benchmarks using SCAP.

F-SCA4.2:

The solution should provide the capability for user to create severity-level definitions for non-conformance.

F-SCA5:

The solution should be capable of completing security configuration assessments for 6000 server assets weekly.

F-SCA6:

The solution should be capable of completing security configuration assessments for 125,000 desktop and laptop assets monthly.

F-SCA7:

The solution should be capable of performing security configuration assessments for a single computing asset within 60 seconds.

4.1.3 Requirements Category: Security Patch-Level Assessment (SPA)

F-SPA1.1:

The solution should track the number of patches that have been issued by the IRS delineated by platform, by GSS, by AOR, and by other user-defined groups.

F-SPA1.2:

The solution should assess the number and percent of patches that have been implemented delineated by platform, by GSS, by AOR, and by other user-defined groups.

F-SPA2: The solution should be capable of completing patch-level assessments for 6000 server assets weekly.

F-SPA3: The solution should be capable of completing patch-level assessments for 125,000 desktop and laptop assets monthly.

F-SPA4: The solution should be capable of performing patch-level assessments for a single computing asset within 60 seconds.

4.1.4 Requirements Category: Security Vulnerability Identification & Enumeration (VIE)

F-VIE1.1:

The solution should enumerate identified vulnerabilities in CVE or US-CERT Alert ID.

F-VIE1.2:

The solution should provide the number and percent of patches or fixes implemented to date; and the data should be compiled by Windows-based computing assets, UNIX-based computing assets, by operating systems, by GSS, by AOR, and by other user-defined groups.

4.2 Functional Capability: The solution shall provide the ability to manage security configurations throughout the system life cycle by assessing the level of compliance with US Government and IRS specified technical controls.

4.2.1 Requirements Category: Access Control (AC)

F-AC1:

The solution should provide controlled access (i.e., TCSEC C2 level) capability to implement user-defined need-to-know, least-privilege, and separation-of-duties, where: (To meet this requirement, the solution should meet all of the following sub-requirements)

F-AC1.1:

The solution should allow only authorized users access to add, modify, or delete security configuration benchmark and baseline information.

F-AC1.2:

The solution should allow only authorized users to initiate security configuration assessments, where authorization may be on a per asset or per asset group basis.

F-AC1.3:

The solution should allow only authorized users to add, modify, or remove RBDs, where authorization may be on a per asset or per asset group basis.

F-AC1.4:

The solution should allow only authorized users to add, modify, or remove attributes within security posture dashboards and reports, where authorization may be on a per asset or per asset group basis.

F-AC1.5:

The solution should allow only authorized users to add, modify, or remove hardware/software discovery reports, where authorization may be on a per asset or per asset group basis.

F-AC1.6:

The solution should allow only authorized users to add, modify, or delete user permissions.

F-AC2:

The solution should authenticate users using Microsoft Active Directory, but assign user access and privilege through the tool.

F-AC3:

The solution should automatically disable user access after 45 days of inactivity.

F-AC4:

The solution should enforce assigned authorizations for controlling access to the system in accordance with IRS policies (i.e., through the IRS's Active Directory Service.)

F-AC5:

The solution should restrict access to privileged functions (deployed in hardware, software, and firmware) and security-relevant information to explicitly authorized personnel.

F-AC6:

The solution should enforce assigned authorizations for controlling the flow of information within the system and between interconnected systems in accordance with IRS policies.

F-AC7:

The solution should implement information flow control enforcement using protected processing domains (e.g., domain type enforcement) as a basis for flow control decisions.

F-AC8:

The solution should enforce separation of duties through assigned access authorizations.

F-AC9:

The solution should enforce the most restrictive set of rights/privileges or accesses needed by users (or processes acting on behalf of users) for the performance of specified tasks.

F-AC10:

The solution should limit the number of concurrent sessions to 1 for normal users.

F-AC11:

The solution should limit the number of concurrent sessions to 3 for system/security administrators.

F-AC12:

The solution should prevent further access to the system by initiating a session lock that remains in effect until the user reestablishes access using appropriate identification and authentication procedures.

F-AC13:

The solution should automatically terminate a session after 15 minutes of inactivity, except in the case of applications requiring continuous, real-time screen display, as exempted by IRS policies.

F-AC14:

Automatic session termination should apply to local and remote sessions.

F-AC15:

The solution should mark output using standard naming conventions to identify any special dissemination, handling, or distribution instructions.

4.2.2 Requirements Category: Identification and Authentication (IA)

F-IA1:

The solution should uniquely identify and authenticate users (or processes acting on behalf of users). The solution should integrate with IRS Directory Service (DS) (i.e., Microsoft Active Directory) for user authentication. For web-based user interface, the solution should integrate with SiteMinder for user authentication.

F-IA2:

The solution should identify and authenticate specific devices (i.e., SCPMaR System, subsystems, and components) before establishing a connection.

F-IA3:

The solution should obscure feedback of authentication information during authentication process to protect the information from possible exploitation/use by unauthorized individuals.

F-IA4:

The solution should employ authentication methods that meet the requirements of applicable laws, Executive Orders, directives, policies, regulation, standards, and guidance for authentication to a cryptographic module.

4.2.3 Requirements Category: Audit and Accountability (AU)

F-AU1:

The solution should generate audit records for specified events, in accordance with IRS policies.

F-AU2:

The solution should provide the capability to compile audit records from multiple components throughout the system into a single system wide (logical or physical), time-correlated audit trail.

F-AU3:

The solution should provide the capability to manage the selection of events to be audited by individual components of the system.

F-AU4:

The solution should produce audit records that capture sufficient information to establish what events occurred, the sources of the events, and the outcomes of the events, in accordance with IRS policies.

F-AU5:

The solution should provide the capability to include additional, more detailed information in the audit records for audit events identified by type, location, or subject.

F-AU6:

The solution should provide a warning when allocated audit record storage volume reaches a specified percentage of maximum audit record storage capacity.

F-AU7:

The solution should provide a real-time alert when an audit failure occurs, in accordance with IRS policies.

F-AU8:

The solution should provide an audit reduction and report generation capability.

F-AU9:

The solution should provide the capability to automatically process audit records for events of interest based upon selectable, event criteria.

F-AU10:

The solution should provide time stamps for each recorded event.

F-AU11:

The solution should integrate with the existing IRS time synchronization infrastructure in accordance with IRS policies.

F-AU12:

The solution should protect audit information and audit tools from unauthorized access, modification, and deletion.

F-AU13:

The solution should produce audit information on hardware-enforced, write-once media.

F-AU14:

The solution should provide the capability to determine whether a given individual took a particular action.

4.2.4 Requirements Category: System and Communications (SC)

F-SC1:

The solution should prevent unauthorized and unintended information transfer via shared system resources.

F-SC2:

The solution should protect the integrity of transmitted information.

F-SC3:

The solution should protect the confidentiality of transmitted information.

F-SC4:

The solution should terminate a network connection at the end of a session.

F-SC5:

The solution should terminate a network connection after 15 minutes of inactivity.

F-SC6:

The solution should establish a trusted communications path between the user (i.e., SCPMaR client) and the security functions of the system (i.e., SCPMaR server), in accordance with IRS policies.

F-SC7:

The solution should reliably associate security parameters with information exchanged between information systems.

F-SC8:

The solution should provide mechanisms to protect the authenticity of communications sessions.

4.2.5 Requirements Category: HW/SW Inventory & Discovery (DIS)

F-DIS1:

The solution should perform passive and active discovery of hardware and software (HW/SW) inventory installed on the IRS computing assets by authorized user.

F-DIS2:

The solution should provide manual entry capability to allow tracking of computing assets that are not on the IRS network.

4.2.6 Requirements Category: Security Configuration Management (SCM)

F-SCM2:

The solution should provide the ability to create, maintain, and report on user-defined custom fields for computing assets.

F-SCM3:

The solution should provide configuration management functionality that allows authorized users to add, modify, and delete security configuration settings for security configuration benchmarks.

F-SCM4:

The solution should provide configuration management functionality that allows authorized users to add, modify, and delete security configuration settings for security configuration baselines.

F-SCM5:

The solution should provide configuration management functionality that allows authorized users to add, modify, and delete security configuration settings for security configuration RBDs.

F-SCM6:

The solution should provide configuration management functionality that allows authorized users to add, modify, and delete security configuration settings for security patch lists.

4.2.7 Requirements Category: File Integrity (FI)

F-FI1:

The solution should provide the ability to perform integrity checks for specified system configuration files (e.g., system registries (on Windows-based platforms), or system configuration files (on UNIX-based platforms)).

4.2.8 Requirements Category: Remediation (REM)

F-REM1:

The solution should provide the capability to remediate the mis-configuration of security configuration settings based on IRS approved security configuration baseline for IRS computing assets. (To meet this requirement, the solution should meet all of the following sub-requirements) F-REM1.1: The solution should provide the capability for authorized users to remediate mis-configurations after the change request has been validated and approved through the IRS change control process.

F-REM1.2: The solution should provide the capability to automate the submission of change requests to apply missing patches.

4.3 Functional Capability: The solution shall promote efficiency by implementing standard protocols and interoperability across the IRS enterprise.

4.3.1 Requirements Category: Interoperability to Legacy Security Tools (IOL)

F-IOL1:

The solution should be able to import or integrate data from existing IRS systems and tools, including but not limited to: (To meet this requirement, the solution should meet all of the following sub-requirements)

F-IOL1.1:

The solution should provide the ability to import a list of identified vulnerabilities generated from ISS Internet Scanner (Version 7.x or most current release) and Nessus (Version 3.x or most current release).

F-IOL1.2:

The solution should provide the ability to import a list of approved software specified by IRS. (e.g. Tivoli Configuration Manager.)

F-IOL1.3:

The solution should provide the ability to import a list of baseline IT hardware assets from IRS Information Technology Asset Management System (ITAMS) (i.e., HP Peregrine Asset Management), EOPS Master Server Database (MSDB) (i.e., Oracle RDBMS), and FISMA Inventory Database (i.e., Microsoft Access).

F-IOL1.4:

The solution should provide the ability to import and export Microsoft security policy templates.

F-IOL1.5:

The solution should provide the ability to import vulnerabilities enumerated by Application Security AppDetective and DB Protect.

F-IOL1.6:

The solution should provide the ability to import vulnerabilities enumerated by HP WebInspect.

F-IOL1.7:

The solution should provide the ability to export audit logs to ArcSight Logger.

F-IOL1.8:

The solution should be capable of integrating with Business Objects Enterprise reporting.

F-IOL3:

The solution should be able to operate and use SCAP-based security configuration policy/benchmarks approved by the IRS to assess compliance on the following computing platforms being planned for deployment. Solutions should have this capability by the end of 2009.

· Windows 2008 Server (x-32 and x-64)

· Windows Vista

· Mac OS X 5 Operational Requirements

5.1 Operational Capability: The solution shall provide the ability to automate the security assessment and reporting processes to reduce the level-of-effort in coordination and execution.

5.1.1 Requirements Category: Automated Assessment Process (OP-AAP)

OP-AAP1.1:

The solution should permit only authorized users to schedule automated security assessment based on their security awareness needs and AOR.

OP-AAP1.2:

Each automated security configuration assessment performed by the solution should be based on IRS assigned security configuration baselines.

OP-AAP1.3:

The solution should store or archive automated assessment results to support the reporting and risk management processes for an agency-defined period of time.

OP-AAP1.4:

No automated security configuration assessment task should negatively affect IRS workstation timeout threshold.

5.1.2 Requirements Category: On-demand Assessment Process (OP-OAP)

OP-OAP1.1:

The solution should limit on-demand security configuration assessments on IRS computing assets to groups of authorized users.

OP-OAP1.2:

Each on-demand security configuration assessment should be based on IRS assigned security configuration baselines.

OP-OAP1.3:

The solution should store or archive on-demand assessment results to support the reporting and risk management processes for agency-defined period of time.

OP-OAP1.4:

No on-demand security configuration assessment task should negatively affect IRS workstation timeout threshold.

5.1.3 Requirements Category: Reporting Process (OP-RPP)

OP-RPP1.1:

The solution should provide the capability to support the reporting sign-off process for security compliance posture reports.

OP-RPP1.2:

The solution provided reporting process automation should incorporate the use of IRS X.509 digital certificate.

5.2 Operational Capability: The solution shall provide the ability to facilitate the risk management process by verifying that systems are operating within established security configuration baselines and identify risk issues.

5.2.1 Requirements Category: Risk Management Process (OP-RMP)

OP-RMP1:

The solution should provide the capability to automate the risk management process for security configuration benchmarks, baselines, and RBDs. (To meet this requirement, the solution should meet all of the following sub-requirements)

OP-RMP1.1:

The solution should capture and record all identified information security risks.

OP-RMP1.2:

The solution should record the approved RBD as part of the security configuration baseline for a computing asset.

5.3 Operational Capability: The solution shall provide the ability to support the change control process by assisting the authorized organizations to define and maintain baseline security configurations with risk commensurate RBDs.

5.3.1 Requirements Category: Security Configuration Baseline Management Process (OP-BMP) OP-BMP1: The solution should provide the capability to automate the IRS baseline management process for security configuration benchmarks, baselines, and RBDs as described in the Security Compliance Posture Monitoring and Reporting (SCPMaR) Concept of Operations.

5.3.2 Requirements Category: Change Control Process (OP-CCP)

OP-CCP1:

The solution should provide the capability to automate the IRS change control process for security configuration benchmarks, baselines, and RBDs. (To meet this requirement, the solution should meet all of the following sub-requirements)

OP-CCP1.1:

The solution should provide the capability to permit authorized users to initiate the change control process by submitting a change request to the CM organization.

OP-CCP1.2:

The solution should provide the capability to test and verify security configuration changes as a part of the change control process.

OP-CCP1.3:

The solution should provide the capability for multiple approval levels throughout the change control process.

6 Acronyms

7 Reference

1. Federal Information Security Management Act of 2002 (FISMA) (Title III, 2002 E-Gov Act)

2. FIPS 140-2, Security Requirements for Cryptographic Modules, May 2001.

3. FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004.

4. FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006.

5. NIST SP 800-18, Rev. 1 Guide for Developing Security Plans for Information Technology Systems.

6. NIST SP 800-30, Risk Management Guide for Information Technology Systems.

7. NIST SP 800-53, Rev 2, Recommended Security Controls for Federal Information Systems.

8. NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems.

9. NIST SP 800-65, Integrating IT Security into the Capital Planning and Investment Control Process.

10. OMB Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources.

11. OMB Circular No. A-11, Preparation, Submission and Execution of the Budget, Part 2 Section 53—Information Technology and e-Government, and Part 7—Planning, Budgeting, Acquisition, and Management of Capital Assets.

12. OMB Memorandum for Chief Information Officers, Establishment of Windows XP and VISTA Virtual Machine and Procedures for Adopting the Federal Desktop Core Configurations, July 31, 2007.

13. OMB M-07-19, FY 2007 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management, July 25, 2007.

14. OMB M-07-18, Ensuring New Acquisitions Include Common Security Configuration, June 1, 2007.

15. OMB Memorandum for Chief Information Officers, Top 10 Risks Impeding the Adequate Protection of Government Information, July 17, 2007.

16. OMB M-07-11, Implementation of Commonly Accepted Security Configuration for Windows Operating Systems, March 22, 2007.

17. OMB M-06-20 FY 2006 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management, July 17, 2006.

18. TD 85-01 Department of the Treasury Information Technology (IT) Security Program, February 13, 2003.

19. TD P 85-01 Treasury Information Technology Security Program, November 3, 2006.