(U) NGAI80102_rev7_Information_System_Security_Training.pdf

UNCLASSIFIED

NI 8010.2R7 Approved: 24 December 2008 Information System Security and Training

NGA Instruction for

1. References.

a. Primary. NGA PD 8000R3, Policy Directive for Information Management and the Chief Information Officer, 24 November 2003.

b. Secondary.

(1) DoD Directive 8570.1, Information Assurance Training, Certification, and Workforce Management, 15 August 2004.

(2) DoD 8570.01-M Information Assurance Workforce Improvement Program, 19 December 2005.

(3) DCI Directive 6/3 Protecting Sensitive Compartmented Information Within Information Systems, 3 May 2002.

2. Purpose. Ensure security of all NGA information systems (IS) by establishing an information assurance security program (including training) consistent with DoD and Intelligence Community (IC) security guidance. This instruction supersedes NI 8010.2R6, same title, 5 June 2006.

3. Policy. The information assurance (IA) program provides effective security for Agency information technology assets that ensure the confidentiality, integrity, availability, and accountability for all NGA ISs. Security measures are based on the concept of providing risk management to thwart the evaluated threat.

4. Applicability and Scope. This instruction applies to all NGA organizations including all ISs that collect, process, transmit, store, disseminate, or display information essential to NGA and its partners.

5. Definitions. Definitions are located in the references.

6. Responsibilities.

a. The Chief Information Officer (CIO) and the Chief Information Security Officer (CISO) ensure that an adequate and effective information assurance program is developed, implemented, and maintained.

b. The Director of the Acquisition Directorate (D/A) is responsible for the design, development, and implementation of ISs including security engineering activities. In this capacity, the D/A will:

NI 8010.2R7

(1) Plan for evolving systems and security technologies while factoring IS security requirements into the programmatic and operational decision-making processes as they apply to IS design, acquisition, integration, and installation or upgrading.

(2) Implement IS planning by identifying and formally documenting both short-term and long-term security goals and objectives, and develops a formal plan for achieving the goals and objectives.

(3) Directorate contracting officers will ensure contracts containing information assurance services shall contain training and training certification clauses.

(4) Contracting officer representatives are responsible for ensuring contractor personnel performing information assurance (IA) functions possess and maintain certification within the specified timeframes.

c. Security and Installation Operations Directorate, Security Office (SIS) manages the following security functions:

(1) Incident management.

(2) Mandatory initial and annual Information Assurance Awareness (IAA) training in compliance with DoD and ODNI standards.

d. The Office of the Chief Information Officer (OCIO) Information Security Management Office (CS) provides the procedures for developing, implementing, and monitoring IS security controls and the following security functions:

(1) Appoints senior information assurance officers.

(2) Performs Information Assurance Officer (IAO) duties, Information Systems Security Representative (ISSR), and Senior IAO training.

(3) The CISO manages training for IA personnel certification program implementation in accordance with DoD 8570.01-M.

e. IAOs oversee the daily security operations of assigned systems. IAOs participate in the system security throughout the life cycle of an IS from the beginning of the concept development plan through its design, development, operation, maintenance, and secure disposal.

f. IA personnel must achieve and maintain the relevant IA training certification as specified by the current version of DoD 8570.01-M.

g. All NGA managers must ensure positions with IA duties and responsibilities are filled by trained and certified personnel.

7. Procedures. To ensure that a cohesive and comprehensive Information Assurance Security Program is maintained:

a. CS and SIS will establish information systems (IS) security interfaces with other DoD components and IC organizations to ensure IS security is applied in a consistent manner.

b. CS and SIS will certify that security measures are applied where NGA ISs may be interconnected to non-NGA ISs, including foreign ISs in support of combined or coalition operations.

c. CS will ensure the program requirements and applicable instructions are applied to contractor systems that process, transmit, store, display, or provide critical components that are vital to the overall infrastructure support to NGA ISs.

d. CS and SIS will ensure that IS information security processes are developed that meet the appropriate requirements without impeding operations.

e. CS and SIS will develop procedures so that processes and requisite paperwork can be completed in a timely manner.

f. CS and SIS will coordinate with the Acquisition Directorate for systems security activities during the design, development, and implementation of ISs.

g. Appendix 1 contains information on the training of IA personnel, Appendix 2 covers IS security engineering, and Appendix 3 explains IA training for all users, specialized training certification, and workforce management for information assurance staff.

Appendix 1 Information System Security Program Training

Procedures. The Information Assurance training objective is to educate all personnel on their responsibilities and duties for accessing, processing, controlling, and distributing information in a secure manner for all NGA systems. Information Assurance training provides the procedures and processes to be followed to ensure information system security.

1. CS establishes and manages Information Assurance training for IA personnel including programming resources.

2. CS, in coordination with SIS, identifies the legal and technical requirements for each of the courses of the IS security curriculum including, but not limited to:

• Approving authority

• Certification authority

• Senior IAO, IAO, ISSR

• System administrator

• General user

3. SIS (Security Education and Awareness) will implement the IA awareness course for general users.

4. CS and SIS will provide registration services for IS security courses to personnel requiring training.

5. IAOs will ensure that all users receive the applicable IS security training before users are granted system access.

6. SIS will maintain information on general users who received IS information assurance awareness training.

7. CSII will verify that all approving authorities, certification authorities, IAOs, and system administrators have been formally certified through Information Assurance Security training.

8. CSII will maintain a master list of all Senior IAOs, IAOs, and ISSRs.

9. As NGA systems evolve and technology advances, SIS and CSI will review and adjust curriculum as needed.

10. CSI hosts and is responsible for maintaining the Information Assurance Security Training Workshops. Program Managers, System Administrators and Information System Security Representatives/Information System Security Engineers as defined below, must attend training on an annual basis. The Information Assurance Security training status will be maintained in Peoplesoft. Each role and course # is defined as:

• Certification and Accreditation Security Workshop 1 Course # 017318 for Program Managers and Information Systems Security Representatives

PM and ISSR Training Overview:

This training will provide students with the knowledge necessary to ensure certification and accreditation security is implemented and maintained throughout the life cycle of the system they are responsible for. The target audience for each role is defined below:

PM roles are defined as the following:

• Manages the IS throughout the life cycle including cost, schedule, performance, and system development. After initial operating capability (IOC), the PM transitions the system to the owner for operation.

• Initiates the Certification and Accreditation process (drafts the SSAA) and negotiates, at an early stage, which security requirements must be met and which technical security features the IS requires.

• Prepares, maintains, and manages the SSAA that properly tracks the IS definition, development, security testing processes, and relevant security requirements.

ISSR roles are defined as the following:

• Ensures all NGA program security requirements are consistent with National, DoD, and IC security guidelines.

• Reviews proposed new or modified IS designs to determine the adequacy of the security features and assurances and makes recommendations to the PM for improvements.

• Consults with the PM and SIS to ensure that applicable security requirements are reflected in IS specifications.

• Coordinates with the PM to ensure development contractors properly address the required documentation for each IS.

• Ensures all required security documentation is developed and delivered on schedule.

An overview of Workshop 1 training includes:

FISMA and DCID 6.3 Roles and Responsibilities NGA OCIO-CS Certification & Accreditation Information Assurance Vulnerability Management Incident Handling Information Technology Disaster Recovery Software Approval Process Xacta Training will cover some of the Workflows.

Training Recurrence:

Training must be maintained and kept current every 12 months while assigned the role of a PM or ISSR.

• Information Technology Security Workshop 2 Course# 014317 for System Administrators (SA) or Privileged Users:

System Administrator Training Overview:

This training will provide students with the knowledge necessary to ensure information assurance security is implemented and maintained throughout the life cycle of the system they are responsible for. The target audience is defines below:

• System Administrators (SA) or Privileged Users are defined as users who have access to system control, monitoring, or administration functions; example of privileged users include:

1. Users having “superuser,” “root,” or equivalent access to a system (e.g., system administrators, computer operators); users with near or complete control of an IS or who set up and administer user accounts, authenticators and the like.

2. Users having access to change control parameters (routing tables, path priorities, addresses, etc.) on routers, multiplexers and other key IS equipment.

3. Users who have been given the authority to control and change other users’ access to data or program files (e.g., applications software administrators, administrators of specialty file systems, database managers).

4. Users who have been given special access for troubleshooting or monitoring an

IS’s security functions (e.g., those using IS analyzers, management tools).

An overview of Workshop 2 training includes:

DCID 6/3 and Application Security Auditing and Auditing Requirements Access Controls DISA Gold and Vulnerability Assessment Testing (VAT) Scanning Incident Response Risk Management Disaster Recovery

Training Recurrence:

Training must be maintained and kept current every 12 months while assigned the role of a SA or Privileged User.

Appendix 2 Information System Security Engineering

Procedures. The objective of the security engineering process is to standardize procedures to ensure security policy and requirements are addressed and standardized for all NGA IS programs throughout their life cycle. The OCIO develops security engineering procedures in cooperation with SIS. Security Engineering incorporates the following activities:

• Architecture concept design

• Requirements identification and review

• Risk analysis

• System development

• Operational testing

• Functional and system testing

• Certification and accreditation

• Integration testing

• Interface definition

• Industry and community standards

• Cost.

1. Program Manager.

a. Identifies a minimum of one information system security engineer (ISSE).

b. Maintains proper configuration management of the program in conjunction with the NGA Configuration Control Board (NCCB), the NGA Engineering Review Board (NERB), and National System for Geospatial Intelligence (NSG)-level forums.

c. Incorporates the ISSE recommendations as a critical part of the cost, performance, and schedule tradeoffs made throughout the development and life cycle of all ISs.

2. Information System Security Engineer.

a. Ensure security requirements for each assigned system are consistent with national, DOD, and IC security guidelines.

b. Reviews proposed new or modified IS designs to determine the adequacy of the security features and assurances and makes recommendations to the PM for improvements.

c. Consults with the PM and CSI to ensure that applicable security requirements are reflected in IS specifications.

d. Coordinates with the PM to ensure development contractors properly address security requirements documents in IS specifications.

e. Ensures all required security documentation is developed and delivered on schedule.

3. CSI.

a. Serves as the NGA IS security certification authority to ensure that the required technical and non-technical evaluation of each system is conducted.

b. Develops detailed guidance on security engineering policy, requirements, practices, and technology to comply with DoD and IC guidance.

c. Conducts evaluations of changes in system architecture, configuration, or network connections and recommends recertification and reaccreditation to the approving authority if required.

4. Information Assurance Officer.

a. Manages the daily security operations of assigned systems.

b. Participates in system security throughout the life cycle of the IS from the beginning of the concept development plan through its design, development, operation, maintenance, and secure disposal.

Appendix 3 IA Training, Training Certification, and Workforce Management

Procedures. DoD 8570.01-M establishes requirements for IA awareness training for all network users. It also establishes the requirement that all staff with identified IA responsibilities be trained and certified according to their management or technical levels of responsibility.

1. IA awareness training for the general network user:

a. SI is responsible for managing the IA awareness training program for all NGA personnel with network accounts. Managing the program includes:

(1) Identifying all personnel requiring IA awareness training and notifying those members when their annual training is due.

(2) Ensuring all deployed personnel that are required to complete the training have adequate access to such training.

(3) Tracking IA awareness training status for the Agency.

(4) Reporting IA awareness training status when requested by NGA senior leadership.

b. CS acts as the information assurance subject matter experts and is responsible for:

(1) Reviewing the existing computer-based training module annually and ensuring that the training content is up-to-date and meets requirements established by DoD, ODNI, and NGA policy for such training.

(2) Updating the IA awareness computer-based training module annually to meet any new requirements.

2. Training and certification of IA professionals:

CS is responsible for managing the IA Workforce Improvement Program (IAWIP) office for the Agency. This office implements DoD guidance for IA training certification that is intended to produce IA personnel with the demonstrated ability to perform the functions of their assigned positions in accordance with DoD 8570.1 and DoD 8570.01-M. Each IA category and skill level has specific training and certification requirements. Managing the program includes:

a. Reviewing IA-related responsibilities and identifying government and contractor staff who fall under this certification requirement.

b. Informing all identified staff of their responsibilities under this requirement.

c. Providing information to IA staff about training opportunities that prepare them for required certification examinations.

d. Ensuring that any new contracts or contracts that are revised include language that requires contractor staff to meet these training and certification requirements.

e. Providing status updates to NGA seniors, when required, on the training and certification status of government and contractor staff.