What publication defines the impact levels used by the US DoD RMF?
Federal Information Processing Standards (FIPS) Publication 199
This publication outlines the impact levels for security categorization.
List the three impact levels defined by FIPS Publication 199.
- Low
- Moderate
- High
These levels describe potential adverse effects on operations, assets, or individuals.
What does the Low impact level indicate?
A limited adverse effect, primary functions can still be performed but effectiveness is noticeably reduced
May involve minor financial loss or harm to individuals.
What does the Moderate impact level indicate?
A serious adverse effect, possibly causing significant operational disruption
This may include major asset damage, significant financial loss, or significant harm to individuals.
What does the High impact level indicate?
A severe or catastrophic adverse effect, potentially leading to inability to perform primary functions
This can result in severe financial damage, national security risks, or loss of life/severe life-threatening injuries.
How is the overall system impact level determined?
Assessed for each security objective (Confidentiality, Integrity, Availability) and determined by the highest impact level
This is known as the high-water mark.
Fill in the blank: A system with low confidentiality, moderate integrity, and low availability would be categorized as a _______ impact system.
Moderate
This categorization dictates the baseline security controls required for the system.
What is the US DoD Risk Management Framework (RMF)?
A structured, seven-step process for managing cybersecurity risks to information systems and assets
It culminates in an Authority to Operate (ATO) decision and is guided by NIST SP 800-37.
What is the first step in the RMF Seven-Step Process?
Prepare
This step involves identifying roles, responsibilities, system boundaries, and an inventory of assets.
What does the Categorize step involve in the RMF?
Categorizing the system and information based on potential impact (Low, Moderate, High)
This step uses FIPS 199 standards.
What is the purpose of the Select step in the RMF?
Selecting an initial set of security controls from NIST SP 800-53
Tailored using DoD-specific guidance based on the system’s categorization.
What is documented during the Implement step of the RMF?
How the selected security controls are deployed within the system’s environment of operation
This includes the implementation details of the controls.
What does the Assess step evaluate?
Determines if controls are implemented correctly, operating as intended, and achieving desired security outcomes
Typically performed by an independent assessment team or validator.
Who makes the risk-based decision to authorize the system to operate in the Authorize step?
The Authorizing Official (AO)
They review the authorization package to decide on ATO or denial.
What is continuously monitored in the Monitor step?
The system’s security posture and the effectiveness of its controls
This includes documenting changes and conducting ongoing assessments.
What is the System Security Plan (SSP)?
The core document providing a comprehensive overview of the system and its security controls
It describes the system’s boundaries and operational context.
What does the Security Assessment Plan (SAP) outline?
How the security controls will be assessed
It includes procedures, methods, and responsibilities for conducting the assessment.
What is documented in the Security Assessment Report (SAR)?
Results of the control assessments, including findings and vulnerabilities
It details the residual risk posture of the system.
What is the purpose of the Plan of Action and Milestones (POA&M)?
Tracks the status of vulnerabilities and deficiencies identified during assessment
It outlines a plan for mitigating or accepting these risks.
What does the Authority to Operate (ATO) Letter/Decision Briefing signify?
The AO accepts the residual risk of the system’s operation and grants an ATO
The decision is based on the entire authorization package.
What is included in the System Inventory / Configuration Management Plan?
A detailed, up-to-date inventory of all hardware and software components
Often includes STIG results and automated scan results to demonstrate compliance.
What is the Information System Continuous Monitoring (ISCM) Plan?
Details the strategy and procedures for ongoing monitoring of security controls
Established in the Monitor step after authorization.
7 Phases of RMF: People Cut Slices into Apples, Almonds and Mushrooms
Prepare
Categorize
Select
Implement
Authorize
Assess
Monitor
What are SCAP Scans
SCAP scans are automated processes that use the Security Content Automation Protocol (SCAP), a suite of open standards developed by the U.S. National Institute of Standards and Technology (NIST), to manage and measure system security, identify vulnerabilities, and ensure compliance with security policies.
Purpose and Function
The primary goal of SCAP is to standardize and automate the way organizations monitor the security posture of their systems. SCAP scans achieve this by:
Comparing Systems to Baselines: Scans compare the configuration of a target system to established security baselines or benchmarks, most notably the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) within the DoD context.
Automating Compliance Checks: They automate the labor-intensive process of manually checking system settings against specific security requirements, which is a crucial part of the RMF’s Assessment and Monitoring steps.
Vulnerability Management: SCAP uses standardized identifiers, such as Common Vulnerabilities and Exposures (CVE) and the Common Vulnerability Scoring System (CVSS), to identify and score known software flaws on a system.
Standardized Reporting: The results of SCAP scans are produced in standardized, machine-readable formats (like XCCDF or ARF XML files), which allows different tools to interoperate and share data efficiently. This allows for consistent reporting across various systems and organizations.
Note use DoD Gold Master or Iron Bank container, etc
