Attachment_1_-__Judiciary_Info_Sec_Framework.pdf

Judiciary Information Security Framework

Version 1.1 Updated: June 15, 2017

Published: August 29, 2011

Judiciary Information Security Framework v1.1

Page i

Executive Summary

The Judiciary Information Technology Security Program (Program) promotes the confidentiality, integrity, and availability of information associated with all forms of technology utilized by the Judiciary. The Program benefits the Judiciary by making information available to enable it to conduct day-to-day operations and to accomplish its mission with security commensurate with identified security risks. To facilitate a consistent approach to managing security risks, the Program developed this Judiciary Information Security Framework1 (Framework) and recommends its use across the Judiciary. Any judiciary organization may implement this Framework, although the terms “national office” and “court unit” appear more frequently, and are a type of “judiciary information system.”

Emerging technologies combined with threats from hackers, spies, terrorists, professional criminals, and malicious and accidental internal threats make it paramount to protect information via a sound security framework. By doing so, the Judiciary is able to prioritize and identify its critical assets, the associated threats, and strategies for mitigating risk using a consistent vocabulary and approach. This Framework effectively leverages best security practices to create a recommended security controls baseline and supporting methodology to assist court units, national systems, and others within the Judiciary with the management of information security risks to judiciary systems.

Rather than simply providing a listing of minimally acceptable security controls, this Framework goes further by providing decision-makers with a repeatable process for managing information security risk consistently throughout the entire information system life cycle. Adoption of this process will result in the determination of appropriate best-practice controls as well as ensure that the Judiciary manages risk effectively. This process is based upon an easy-to-follow security risk management framework that includes the following six steps:

1. Categorize information system;

2. Select security controls;

3. Implement security controls;

4. Assess security controls;

5. Authorize information system; and

6. Monitor security controls.

These steps are part of a continuous improvement process built on management, operational and technical aspects of information security. As a result, this Framework is the basis for effectively securing judiciary information systems now and in the future.

1 The Judiciary Information Security Framework (this document) was unanimously endorsed by the Judicial Conference of the

United States - Committee on Information Technology, at its June 2011 meeting.

http://jnet.ao.dcn/information-technology/security/framework-shp/judiciary_info_sec_framework

Page ii

Document Change History

Version Date Author Description

1.1 June 15, 2017 AO-DTS-ITSO • Adjusted for NIST terminology and processes.

• Added links and updated references.

• Replaced Acronyms appendix with link to the IT Security Acronyms listing.

• Converted to new ITSO documentation format.

1.0 August 29, 2011 AO-DTS-ITSO Final version 1.0.

Page iii

Table of Contents

1. Making the Case for a Framework

1.1 Background

1.2 Approach and Implementation

2. Security Risk Management Framework in the Judiciary

2.1 Categorize Information System (Step 1)

2.2 Select Security Controls (Step 2)

2.3 Implement Security Controls (Step 3)

2.4 Assess Security Controls (Step 4)

2.5 Authorize Information System (Step 5)

2.6 Monitor Security Controls (Step 6)

3. Understanding the Judiciary Recommended Security Controls

4. Putting the Framework to Work

5. Information

Judiciary Control Families and Examples ..................................................................A-1

List of Figures Figure 1: Security Risk Management Framework

List of Tables Table 1 – Security Control Identifiers, Families, and Classes

Table A1 - Sample Judiciary Recommended Security Controls ......................................................A-3

1. Making the Case for a Framework The Judicial Information Technology Security Program (Program) promotes the confidentiality, integrity, and availability of information associated with all forms of technology utilized by the Judiciary. The Program benefits the Judiciary by making information available to enable it to conduct day-to-day operations and to accomplish its mission with security commensurate with identified security risks. To facilitate a consistent approach to managing security risks, the Program developed this Judiciary Information Security Framework (Framework) and recommends its use across the Judiciary.

Emerging technologies combined with threats, which are increasing in both number and sophistication, make it of paramount importance to protect the Judiciary’s information via a sound security framework. Human threats may be external (from hackers, spies, terrorists, or professional criminals) or internal (from employees, whether accidental or malicious). Natural threats (floods, earthquakes, electrical storms, etc.) and environmental threats (long-term power failure, pollution, chemicals, etc.) also threaten the Judiciary’s information. A security framework allows the Judiciary to prioritize and identify its critical assets, the associated threats, and strategies for mitigating risk using a consistent vocabulary and approach. This Framework effectively leverages best security practices to create a recommended security controls baseline and supporting methodology to assist court units, national systems, and others within the Judiciary with the management of information security risks to judiciary systems.

1.1 Background

Judicial independence is a core value that impacts the way the Judiciary operates at multiple levels – from guaranteeing freedom from reprisal for legal decisions to exercising autonomy in governance and management. As a result, court units have historically exercised significant independence, including in the administration and management of information systems. The Judicial Conference recognizes that the connectivity of court-unit systems in trusted relationships across national systems requires a common baseline for securing the Judiciary’s information systems, whether nationally or locally owned or managed. This Framework establishes that baseline. The Judiciary is not typically bound by Executive or Legislative Branch security requirements; however, those requirements and associated guidelines are benchmarks for many security best practices and, where appropriate and feasible, will continue to be adapted for use in the judiciary environment.2

1.2 Approach and Implementation

This Framework provides a high-level management view of a comprehensive security approach that applies to court units, national systems, and others within the Judiciary. It is designed to help the Judiciary meet the challenge of creating a security posture that balances risk and mission by providing a cyclical model for information security risk management; a detailed compendium of recommended controls based on best practices; and guidance for executing a repeatable and effective

2 The National Institute of Standards and Technology (NIST) has Federal responsibility for establishing guidance for the protection of sensitive, unclassified information. The Judiciary Framework is modeled on NIST Special Publication (SP) 800-37 Rev. 1, February 2010 (updated June 5, 2014), Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach and on NIST SP 800-53 Rev. 4, April 2013 (updated January 22, 2015), Security and Privacy Controls for Federal Information Systems and Organizations.

process for safeguarding information and information systems. Together, these Framework elements form the basis for effectively securing judiciary information systems now and in the future. The Guide to Implementing the Judiciary Information Security Framework (Framework Guide) provides details on how to implement this Framework.

2. Security Risk Management Framework in the Judiciary This Framework establishes a six-step, cyclical, continuous improvement process for managing security consistently throughout the entire system life cycle (see Figure 1).

Step 1. Categorize the information system and the information processed, stored, and transmitted by that system based on the potential impact to the Judiciary should the system suffer an incident. The greater the negative impact, the higher the system impact rating.

Step 2. Select baseline security controls for the system and tailor3 controls as needed based on impact levels, and the operating environment determined in Step 1.

Step 3. Implement security controls using sound information system and security engineering methodologies.

Step 4. Assess security controls to determine the extent to which they are implemented correctly and operating as intended to meet the security requirements for the system.

Step 5. Authorize operation of the information system if operational risks are acceptable.

Step 6. Monitor security controls on an ongoing basis to identify any changes to the information system or its operating environment that may affect control effectiveness.

Figure 1: Security Risk Management Framework

3 Tailoring security controls is the process by which a security control baseline is modified based on: (i) the application of scoping guidance; (ii) the specification of compensating security controls, if needed; and (iii) the specification of organization-defined parameters in the security controls via explicit assignment and selection statements.

http://jnet.ao.dcn/information-technology/security/framework-shp/framework-guide

2.1 Categorize Information System (Step 1)

Information system security categorization is based on the potential impact to the Judiciary should events occur that jeopardize the information or the information systems needed to accomplish its mission, protect its assets, fulfill its regulatory responsibilities, maintain its day-to-day functions, and protect individuals. Security controls applied to each system should be commensurate with the potential impact of a loss of confidentiality, integrity, or availability.

The security categorization for an information system is determined by the security categorization of each and every information type stored or processed by the system. Each information type is first identified then individually categorized by the impact to its security objectives (confidentiality, integrity and availability) should there be a breach of security.

Consider the following:

• Confidentiality – How important is it to ensure that information is accessible only to those authorized to have access?

• Integrity – What would be the impact to the Judiciary’s mission if the information was inaccurate, incomplete, improperly modified or destroyed?

• Availability – What would be the impact to the Judiciary’s mission if required information was not readily available?

This process is explained further in the Framework Guide, with the results summarized in the System Security Plan (SSP). The SSP is a document that provides an overview of the security requirements for an information system or program and describes the implementation of security controls selected to meet those requirements.

2.2 Select Security Controls (Step 2)

The next step is to select, tailor, and supplement the appropriate security controls based on impact level as well as the operating environment, individual circumstances, threat environments, and risk tolerance.

The following sub-steps are involved in arriving at a set of security controls which adequately protect a system:

• Step 2.1 – Identify the recommended controls to be implemented to protect the information system based on the security category identified in Step 1. The full compendium of controls and recommendations for which controls should be implemented for the security category is provided by the Framework Guide. Sample controls (showing how the information is provided in the Framework Guide) are in Appendix A.

• Step 2.2 – Tailor the initial set of recommended controls to more closely align with the operating environment and circumstances of this specific system. The recommended controls identified by the Framework Guide have been tailored to better reflect the needs of the Judiciary, however further modification of these controls may be required to sufficiently address the specific conditions of the system.

• Step 2.3 – Supplement the tailored controls by selecting additional controls to strengthen the level of protection for the system, if appropriate.

Document the resulting set of controls in the SSP.

2.3 Implement Security Controls (Step 3)

Once the control selection process has been completed, the controls should be implemented on the system. Details and status of the control implementation should be documented in the SSP. In general, the control status will be one of the following and its recording includes supplemental information, as noted.

• In Place. The control is fully implemented by the information system. Include implementation details.

• Partially In Place. The control is only partially implemented on the system. Include details of which components have been implemented and which have not. If a plan of action and milestones (POA&M)4 exist in an enterprise risk management tool, include that ID number in the SSP until successful remediation.

• Inherited. The control is implemented outside the system and is inherited by the system.

Specify the source of the inherited control and obtain assurance from the organization responsible for the control that it is operating effectively. Control inheritance reduces work because inherited controls do not have to be re-implemented by the System Owner (SO).5 For example, all systems hosted in a data center inherit the physical and environmental protections already implemented for the data center, such as badge reader access, fire protection, redundant power supplies, and adequate cooling. It is possible that a control may be only partially inherited, in which case its status is annotated with the Hybrid qualifier.

• Planned. The control is not yet implemented, but is scheduled for implementation. Include details of the planned implementation such as dependencies, target dates, and points of contact. If a POA&M exist in an enterprise risk management tool, include that ID number in the SSP until successful remediation.

• Not Selected. The control is recommended by the Framework Guide but is not selected for implementation. Include an explanation of why the control is not selected.

2.4 Assess Security Controls (Step 4)

It is important to validate through testing an information system’s security controls to ensure that they are functioning as expected. It is possible that controls have not been properly implemented or performance expectations are inaccurate. It is also possible that changes to the system design or the operating environment affect control suitability.

4 The purpose of the POA&M is to identify, assess, prioritize, and monitor the progress of corrective efforts for security vulnerabilities. It identifies tasks, required resources to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones.

5 SOs are responsible for the successful operation of information systems within their program area and are ultimately accountable for the security of those systems. SOs should ensure that each of their systems is deployed and operated according to good security practices.

Revise the SSP to reflect actual status of the controls. Any control deficiencies which result in an unacceptable level of risk should be remediated (improving the security of the system) or tracked for future remediation with a POA&M.

2.5 Authorize Information System (Step 5)

Prior to any system being used or placed into a production mode, an Authorizing Official should be designated within the appropriate management structure to provide written authorization for the deployment. For national systems, the Director of the Administrative Office is the Authorizing Official. For court-unit systems, typically a court-unit executive is the Authorizing Official. Any Authorizing Official may delegate this responsibility. Additionally, production systems should undergo reauthorization on a periodic basis, not to exceed five years for court units, where Steps 1 through 5 are executed again. A typical schedule for national systems (such as those operated and used by DTS, DPS, and DAS) is three years for high priority national systems, five years for moderate priority national systems, seven years for low priority national systems;6 or upon significant changes.

This authorization implies that the system functions as expected and that implemented controls are sufficient and operating as intended to address the system’s impact level. The sub-steps involved in authorization are:

• The SO provides the Authorizing Official the information needed to make a risk-based decision regarding the system’s readiness to operate;

• The Authorizing Official reviews the system information to determine if the operational risk7 is acceptable; and

• The Authorizing Official authorizes or denies authorization for the system to operate.

2.6 Monitor Security Controls (Step 6)

Security assessments provide a snapshot of security at a point in time. To ensure that Judiciary information systems controls remain effective as changes in the system and the operating environment occur requires continuous monitoring. The following processes are recommended to perform this monitoring:

• Assess Changes. Determine the security impact of proposed or actual changes to the information system and its operating environment. Systems are in a constant state of change due to upgrades to hardware, software, firmware, and modifications to the system’s environment, which makes monitoring a necessity. An effective security continuous monitoring program entails a disciplined and structured approach to managing, controlling, and documenting changes to the information system. The security impact of a change should be determined by a risk assessment prior to implementing the change and, if needed, additional controls implemented to address the level of risk. The SSP should be updated to reflect these system changes.

6 National system priority processes can be found in the National System Assessment Prioritization Criteria.

7 Operational risk is that portion of overall information security risk that remains after the selected controls are successfully implemented. For example, vulnerabilities that are not remediated prior to deployment (for which no plan for remediation is adopted) contribute to operational risk.

http://jnet.ao.dcn/information-technology/security/framework-shp/nat_sys_assess_pri_criteria

• Test Regularly. Continue to monitor or regularly test a selected subset of the management, operational, and technical security controls employed within and inherited by the information system. A recommended subset of controls and monitoring/testing frequency are provided in the Continuous Monitoring of Control Effectiveness Resource Packet available on JNet at Best Practices, Resource Packets, and Guidelines.

• Document and Track Outstanding Weaknesses and Mitigation Activities. To ensure that system vulnerabilities are corrected, remediation actions should be conducted and documented. Any system vulnerabilities that are not immediately corrected should be tracked and their status periodically reported to appropriate management, such as the Authorizing Official. This can be done as POA&Ms, tracked through an enterprise risk management tool.

• Update Security Documentation. The implementation of a monitoring program results in ongoing updates to security documentation, e.g. the SSP and POA&Ms.

Security Framework Steps 1 through 5 of the Judiciary’s Security Risk Management Framework (see Figure 1) should be performed on the information system. This will validate the security category and the controls applied to the system, reassess the effectiveness of those controls, and ensure that reauthorization to continue to operate is appropriately considered.

3. Understanding the Judiciary Recommended Security Controls Security controls are implemented to reduce risk to an acceptable level. For example, a badge reader on a door may be used to limit access to a restricted area. To assist with security risk management across the Judiciary, the Framework’s companion document, the Framework Guide, includes a customized set of security controls, the Judiciary Recommended Security Controls, which are recommended for selection based upon the impact level. The Framework was originally modeled on the controls identified in NIST SP 800-53 Rev. 3, August 2009, Recommended Security Controls for Federal Information Systems and Organizations, then updated using NIST SP 800-53 Rev. 4, April 2013 (updated January 22, 2015), Security and Privacy Controls for Federal Information Systems and Organizations.

Judiciary controls have been selected and modified to better address the unique needs of the Judiciary. The security controls are organized into eighteen families distributed among the following three classes:

• Management controls focus on the management of risk and the management of information system security;

• Operational controls are primarily implemented and executed by people (as opposed to information systems); and

• Technical controls are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system.

A control family is associated with a given class based on the dominant characteristics of the controls in that family. Table 1 shows the distribution of the eighteen families among the three classes, as well as each family’s two-character identifier.

http://jnet.ao.dcn/information-technology/security/best-practices http://jnet.ao.dcn/information-technology/security/best-practices

Table 1 – Security Control Identifiers, Families, and Classes

Identifier Family Class

AC Access Control Technical

AT Awareness and Training Operational

AU Audit and Accountability Technical

CA Security Assessment and Authorization Management

CM Configuration Management Operational

CP Contingency Planning Operational

IA Identification and Authentication Technical

IR Incident Response Operational

MA Maintenance Operational

MP Media Protection Operational

PE Physical and Environmental Protection Operational

PL Planning Management

PM Program Management Management

PS Personnel Security Operational

RA Risk Assessment Management

SA System and Services Acquisition Management

SC System and Communications Protection Technical

SI System and Information Integrity Operational

Appendix A contains a brief summary of each control family’s functionality. The Framework Guide contains a comprehensive compendium of controls across each of these control families that are recommended for selection based on the system’s security category.

4. Putting the Framework to Work Sections 1 and 2 summarize the Judiciary’s approach to a comprehensive information security framework as a cyclical and repeatable process for managing security consistently throughout the entire information system life cycle. Section 3 introduces the Judiciary Recommended Security Controls, which form the basis for an information system’s protection profile and are the focus of ongoing monitoring activities. While the Security Risk Management Framework and compendium of controls have been outlined, more detail is necessary to apply this Framework to existing and future systems in a meaningful way. That additional detail is available in the Framework Guide. Together, this Framework and its companion document provide effective guidance for managing information security risk and for protecting judiciary information and information systems.

5. Information The IT Security Acronyms listing and Glossary of Judiciary Information Security Framework Terms are available for further clarification.

Questions or comments concerning this document may be directed to the IT Security Office at

(202) 502-2350.

http://jnet.ao.dcn/information-technology/security/framework-shp/framework-guide http://jnet.ao.dcn/information-technology/security/framework-shp/it_sec_acronyms http://jnet.ao.dcn/information-technology/security/framework-shp/framework-glossary http://jnet.ao.dcn/information-technology/security/framework-shp/framework-glossary mailto:AO_ITSO@ao.uscourts.gov

Page A-1 of 3

Judiciary Control Families and Examples

Judiciary controls are organized into eighteen families. Each security control family contains security controls related to the security functionality of the family. The eighteen control families for the Judiciary, in summary, are:

• Access Control (AC): The Judiciary should limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) and to the types of transactions and functions that authorized users are permitted to exercise.

• Awareness and Training (AT): The Judiciary should: (i) ensure that managers and users of judiciary information systems are made aware of the security risks associated with their activities and of the applicable laws, directives, policies, standards, instructions, regulations, or procedures related to the security of judiciary information systems; and (ii) ensure that judiciary personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

• Audit and Accountability (AU): The Judiciary should: (i) create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and (ii) ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.

• Security Assessment and Authorization (CA): The Judiciary should: (i) periodically assess the security controls in judiciary information systems to determine if the controls are effective in their application; (ii) develop and implement POA&Ms designed to correct deficiencies and reduce or eliminate vulnerabilities in judiciary information systems; (iii) authorize the operation of judiciary information systems and any associated information system connections; and (iv) monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the controls.

• Configuration Management (CM): The Judiciary should: (i) establish and maintain baseline configurations and inventories of judiciary information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; and (ii) establish and enforce security configuration settings for information technology products employed in judiciary information systems.

• Contingency Planning (CP): The Judiciary should establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery for judiciary information systems to ensure the availability of critical information resources and continuity of operations in emergency situations.

• Identification and Authentication (IA): The Judiciary should identify information system users, processes acting on behalf of users, or devices and authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to judiciary information systems.

Page A-2 of 3

• Incident Response (IR): The Judiciary should: (i) establish an operational incident handling capability for judiciary information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities; and (ii) track, document, and report incidents to appropriate Judiciary officials and/or authorities.

• Maintenance (MA): The Judiciary should: (i) perform periodic and timely maintenance on judiciary information systems; and (ii) provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct information system maintenance.

• Media Protection (MP): The Judiciary should: (i) protect information system media, both paper and digital; (ii) limit access to information on information system media to authorized users; and

(iii) sanitize or destroy information system media before disposal or release for reuse.

• Physical and Environmental Protection (PE): The Judiciary should: (i) limit physical access to information systems, equipment, and the respective operating environments to authorized individuals; (ii) protect the physical plant and support infrastructure for information systems;

(iii) provide supporting utilities for information systems; (iv) protect information systems against environmental hazards; and (v) provide appropriate environmental controls in facilities containing information systems.

• Planning (PL): The Judiciary should develop, document, periodically update, and implement security plans for judiciary information systems that describe the security controls in place or planned for the information systems and the rules of behavior for individuals accessing the information systems.

• Program Management (PM): The Judiciary should develop, document, periodically update, and implement security program management controls to provide a foundation for the Judiciary’s information security program. Program management controls complement the security controls for an information system by focusing on the judiciary-wide (or court-unit-wide) information security requirements that are independent of any particular information system and are essential for managing information security programs.

• Personnel Security (PS): The Judiciary should: (i) ensure that individuals occupying positions of responsibility within the Judiciary (including third-party service providers) are trustworthy and meet established security criteria for those positions; (ii) ensure that judiciary information and information systems are protected during and after personnel actions such as terminations and transfers; and (iii) employ formal sanctions for personnel failing to comply with judiciary security policies and procedures.

• Risk Assessment (RA): The Judiciary should periodically assess the risk to judiciary operations (including mission, functions, image, or reputation), judiciary assets, and individuals, resulting from the operation of judiciary information systems and the associated processing, storage, or transmission of judiciary information.

• System and Services Acquisition (SA): The Judiciary should: (i) allocate sufficient resources to adequately protect judiciary information systems; (ii) employ system development life cycle processes that incorporate information security considerations; (iii) employ software usage and installation restrictions; and (iv) ensure that third-party providers employ adequate security measures to protect information, applications, and/or services outsourced from the Judiciary.

Page A-3 of 3

• System and Communications Protection (SC): The Judiciary should: (i) monitor, control, and protect judiciary communications (i.e., information transmitted or received by judiciary information systems) at the external boundary and key internal boundaries of the information systems; and (ii) employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within judiciary information systems.

• System and Information Integrity (SI): The Judiciary should: (i) identify, report, and correct information and information system flaws in a timely manner; (ii) provide protection from malicious code at appropriate locations within judiciary information systems; and (iii) monitor information system security alerts and advisories and take appropriate actions in response.

Table A1 provides examples of baseline controls recommended to be implemented for a Judiciary system based on its impact level as determined during Step 1 of the Security Risk Management Framework (see Figure 1 and Section 2.1).

The Impact Level column identifies the recommended controls for each impact level: High (H), Moderate (M), or Low (L). “Yes” indicates that the control is recommended for implementation.

“Opt” indicates that implementing the control would provide additional security protection (above the recommended security baseline) and is optional.

Table A1 - Sample Judiciary Recommended Security Controls

Control Name & Number Control Description

Impact Level H M L

AC-6

Least Privilege

The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

Yes Yes Opt

PE-9

Power Equipment and Cabling

The organization protects power equipment and power cabling for the information system from damage and destruction. Yes Yes Opt

The complete table of Judiciary Recommended Security Controls can be found in the Framework Guide.

http://jnet.ao.dcn/information-technology/security/framework-shp/framework-guide