Why It’s Critical to Apply the Risk Management Framework to Your IT Modernization Plan

Why It’s Critical to Apply the
Risk Management Framework
to Your IT Modernization Plan

© Global Knowledge Training LLC. All rights reserved. Page 2
Your Presenter
Dave Buster
Security+, CISSP
Global Senior Portfolio Director
Global Knowledge

This is a terrain mapping exercise.
We’ll talk about Cybersecurity in the government space, and relevant:
• Laws
• Executive Orders
• Guidance
• Standards
We’ll also touch on the philosophy and approach.
Abstract

In 2002, legislators passed the Federal Information
Security Management Act (FISMA)
• FISMA assigned responsibly for information assurance to various agencies for the federal
government.
• FISMA mandated accountability, cost effectiveness, timeliness, and efficiency.
• FISMA requires annual reviews and the head of agencies to retain accountability.
• The National Institute of Standards and Technology (NIST) outlined the steps to
compliance.
• FISMA is now generally known as the Federal Information Security Modernization Act.
• FISMA requires federal agencies to secure government information, operations, national
security interests and assets against natural and man-made threats.
FISMA: Federal Information System Modernization Act

Supporting Publications
NIST has special publications (SP) supporting the FISMA legislations
• SP 800-18 (Security Planning)
• SP 800-30 (Risk Assessment)
• SP 800-37 (System Risk Management Framework)
• SP 800-39 (Enterprise-Wide Risk Management)
• SP 800-53 (Recommended Security Controls)
• SP 800-53A (Security Control Assessment)
• SP 800-59 (National Security Systems)
• SP 800-60 (Security Category Mapping)
(Hint: They are not in order. Start with 37/39)

Supporting Publications
Federal Information Processing Standards (FIPS) are standard developed by the federal
government for use by non-military government agencies and government contractors
• FIPS Publication 199 (Security Categorization)
• FIPS Publication 200 (Minimum Security Controls)
• FIPS Publication 140-2 (Cryptographic modules)
FIPS Publication 200 is the minimum standard.
SP 800-53 provides the security controls to get there.

Presidential Executive Order 13800
The Presidential Executive Order on Strengthening the
Cybersecurity of Federal Networks and Critical Infrastructure
This EO provides for the following:
• Securing the Federal networks that operate on behalf of the American
people
• Encouraging collaboration with industry to protect critical infrastructure that
maintains the American way of life
• Strengthening the deterrence posture of the United States and builds
international coalitions
• Places needed focus on building a stronger cybersecurity workforce, which is
critical for the long term ability to strengthen cyber protections and
capabilities
Action: Requires agency heads to submit reports.
Happy Birthday
May 11, 2018

Due to the increasing interconnectedness of Federal information and
information systems, EO 13800 has specific requirements regarding risk:
Agency heads are required to manage risk commensurate with the documented amount of
harm that would result from unauthorized access, use, disclosure, disruption,
modification, or destruction of a Federal information system or Federal information
Agency heads are to produce a risk management report to the Director of Office of
Management and Budget (OMB) and the Secretary of the Department of Homeland
Security (DHS) within 90 days of publication.
EO 13800 and Risk

Section 3 of EO 13800 prioritizes workforce
development to sustain and grow the US
cybersecurity workforce, and to maintain the
country’s advantage in national security-related
cyber capabilities:
Subject matter experts worked on a joint assessment on how
to support the growth and sustainment of the cybersecurity
workforce
• DHS, Commerce, DoD, the Department of Labor, the
Department of Education, and the Office of Personnel
Management
EO 13800 and the Cybersecurity Workforce
Published in May, 2018

Key RMF Baseline Concepts
Operating any information system results in risk
Risk must be highly managed in enterprise level organizations
Key standards and guidelines are required to mitigate risk efficiently
Risk Management Framework
1. Categorize Systems
2. Select Controls
Refine
Document
3. Implement Controls
4. Assess Controls
Determine
5. Authorize System
6. Monitor Controls

The NICE framework is a method for categorizing and defining cybersecurity work
NICE was developed by NIST
The NICE Framework is intended to be applied in the public, private, and academic sectors
The National Initiative for Cybersecurity Education (NICE) framework is defined in NIST Special Publication
800-181
NICE establishes a common taxonomy and vernacular that is to be used to describe all cybersecurity work
and the qualifications of the workers regardless of where the work is performed or for whom the work is
performed.
NICE Cybersecurity Workforce Framework
NICE Cybersecurity Workforce Framework Categories

Training Can Be Aligned to the NICE Framework

NIST SP 800-16
SP 800-16 defines a role‐based model for Federal information technology/cybersecurity
training
The NICE framework allows the Federal government to have a view into the cyber workforce and its
educational needs
The SP 800-16 document provides a methodology on how to train the workforce
Role-based training includes categories of cybersecurity awareness and cybersecurity essentials
The document also defines competencies and proficiencies.
Competencies are knowledge and skills
Proficiencies increase as competencies are utilized over time with education and
experience.

NIST SP 800-16 – Path to Expertise
Proficiency is a living process
Through structured education,
proficiency is increasingly attained
over time.
As knowledge and skills are
attained, they form competencies
required for proper job performance
Proficiency is attained as
competencies are exercised over
time, building expertise

The Cybersecurity Learning Continuum
Security Awareness Security Essentials Role-based Training Education and Experience
Increasing Knowledge and Skills
The Cybersecurity Learning Continuum is a progression of learning across the spectrum
of roles within an organization. It is spelled out in SP 800-16.
Security awareness training is provided to all users within an organization.
Cybersecurity Essentials training is provided to all users involved with IT Systems.
Role-based training is provided to users with responsibilities relative to IT Systems.
Education and/or experience is gained by IT Security Specialists and Professionals. The appropriate level of
Cybersecurity awareness, training and education is determined by the role within an organization.
Individuals gain knowledge, and experience as they participated in role-based training with their agency.

Security Awareness
Security Awareness
Security Essentials Role-based Training Education and Experience
Security Awareness is expressly required for all individuals in the organization.
All users of resources and systems are designated risk holders and require annual security awareness
training.

Security Essentials
Security Awareness
Security Essentials
Role-based Training Education and Experience
Security Essentials is needed for those employees and contractors who have any
involvement with IT systems
Cybersecurity Essentials is the transitional stage between “Basic Awareness” and “Role-based Training.” It
provides the foundation for subsequent specialized or role-based training by providing a universal baseline
of key security terms and concepts.

Role-Based Training
Security Awareness Security Essentials
Role-based Training
Education and Experience
Role-based security training is focused on providing the knowledge and skills specific to
an individual’s roles and responsibilities relative to Agency information systems.
Their role within the organization is primary with IT secondary. Decision responsibilities come from the
organization role, whereas the technical responsibilities are derived from the relationship with IT.
At this level, training recognizes the differences between competencies among the trainees.

Security Awareness Security Essentials Role-based Training
Education focuses on developing the ability and vision to perform complex multi-
disciplinary activities and the skills needed to further the information
technology/cybersecurity profession and to keep pace with threats and technology
changes.
This can be accomplished with experience, cooperative training such as “on the job” training or through
certification and advanced education such as undergraduate and graduate studies and degrees as accepted
by the particular Federal Organization.

Roles, and Knowledge and Skills
Roles are defined in certain terms, as well as being mapped to defined
knowledge and skills required for that specific role.
Roles are defined by position or general task. Job titles can vary depending on
organization, requirements and vernacular.
Knowledge and skills are listed within knowledge units and are mapped to the role
definition matrix.
There is no hierarchy within the Knowledge and Skills. No Knowledge or Skill is of greater
value than another. The first Knowledge and Skill listed within the knowledge unit has no
order preference on those Knowledge and Skills listed elsewhere in list.

Knowledge and Skills Catalog
The knowledge and skills catalog defines the K/S required to be mapped for appropriate
job roles. The list of K/S is assigned a designator to be easily referenced in the matrix.
Example:

Job Role – Knowledge Skill Mapping
Job roles are mapped to K/S by role, functional area, role, responsibility, and knowledge
unit.

Global Knowledge has developed our own functional mapping of knowledge
and skills in the cybersecurity space.
- Based on interviews and reviews with many large and small companies.
- Based on reviews with hundreds of our own industry experts
- Based on input from our Industry technology partners
What about cybersecurity roles in private industry?

How many employees are at each level in the organization? Has career progression been planned?
SKILLS DEVELOPMENT CERTIFICATION PREP
ARCHITECTURE
Senior Architect, Compliance Auditor
MANAGEMENT
CISO
TECHNICAL
SME, Lead Engineer
TECHNOLOGY SOLUTIONS
NEW TO ROLE
MID-CAREER “CASTLE” SPECIALIZATION
SENIOR LEADERSHIP
IT FOUNDATIONS
CYBERSECURITY FOUNDATIONS
The Global Knowledge “Crown”
Organizational Map/Career Progression

The Global Knowledge “Castle”
Functional Specialization
ARCHITECTURE
and POLICY
DATA LOSS
PREVENTION
GOVERNANCE, RISK,
and
COMPLIANCE
INDENTITY and
ACCESS
INCIDENT RESPONSE
and
FORENSIC ANALYSIS
PENETRATION
TESTING
SECURE DEVOPS
SECURE SOFTWARE
DEVELOPMENT
Designs and implements
secure architectures,
translates standards,
business processes, and
frameworks into internal
policies
Deploys and manages
security applications such
as malware detection on
endpoints and servers
Measures and quantifies
risk, performs internal
audits against best
practices and standards,
develops plans for
business continuity and
disaster recovery
Manages identification,
authorization, and
permissions across all
systems
Detects and analyzes
security events and
correctly responds
Intentionally attacks
systems to expose
vulnerabilities and probe
weaknesses, Red Team
Securely installs,
configures, and operates
systems and software
Develops applications
with minimal
vulnerabilities, application
security testing

ARCHITECTURE
and POLICY
DATA LOSS
PREVENTION
GOVERNANCE,
RISK, and
COMPLIANCE
INDENTITY and
ACCESS
INCIDENT
RESPONSE
and
FORENSIC
ANALYSIS
PENETRATION
TESTING
SECURE DEVOPS
SECURE
SOFTWARE
DEVELOPMENT
SENIOR
LEADERSHIP
(Expert)
9719: CSFI:
Introduction to Cyber
Warfare and
Operations Design
2951: CompTIA
Advanced Security
Practitioner (CASP)
Prep Course
1638: CISSP
Certification Prep
Course
3796: Certified
Information Privacy
Technologist (CIPT)
Prep Course
2951: CompTIA
Advanced Security
Practitioner (CASP) Prep
Course
1638: CISSP Certification
Prep Course
3796: Certified
Information Privacy
Technologist (CIPT) Prep
Course
2951: CompTIA
Advanced Security
Practitioner (CASP)
Prep Course
1638: CISSP
Certification Prep
Course
3401: Computer
Hacking Forensic
Investigator (CHFI) v9
1638: CISSP
Certification Prep
Course
3617: Certified Ethical
Hacker
1638: CISSP
Certification Prep
Course
1642: SSCP
Certification Prep
Course
1638: CISSP
Certification Prep
Course
1697: CSSLP
Certification Prep
Course
1638: CISSP
Certification Prep
Course
MID-CAREER
“CASTLE”
SPECIALIZATION
(Practitioner)
3407: (DoD) Risk
Management
Framework (RMF)
Process
1697: CSSLP
Certification Prep
Course
1638: CISSP
Certification Prep
Course
3404: CompTIA
Security+ Prep Course
4935: Certified Network
Defender (CND)
3794: Certified
Information Privacy
Professional US
Private-Sector
(CIPP/US) Prep Course
5867: Cybersecurity
Analyst+ (CySA+) Prep
Course
3404: CompTIA
4935: Certified Network
Defender (CND)
3794: Certified
Information Privacy
Professional US Private-
Sector (CIPP/US) Prep
Course
5867: Cybersecurity
Analyst+ (CySA+) Prep
Course
9871: CISM Prep Course
3404: CompTIA
4935: Certified
Network Defender
(CND)
5867: Cybersecurity
Analyst+ (CySA+)
Prep Course
3404: CompTIA
2180: CyberSec First
Responder: Threat
Detection and
Response
5867: Cybersecurity
Analyst+ (CySA+)
Prep Course
3404: CompTIA
4935: Certified
Network Defender
(CND)
1967: Hacking
Methodologies for
Security Professionals
3404: CompTIA
4935: Certified
Network Defender
(CND)
5867: Cybersecurity
Analyst+ (CySA+)
Prep Course
3812: EC-Council
Certified Secure
Programmer Java
(ECSP)
2046: Introduction to
Python Scripting for
the Security Analyst
1123: Securing Java
Web Applications
NEW TO ROLE
(Foundation)
CYBERSECURITY FOUNDATIONS
9701: Cybersecurity Foundations
4277: Introduction to Cybersecurity
IT FOUNDATIONS
3150: Understanding Network Fundamentals
9025: TCP/IP Networking
2892: CompTIA Network+ Certification Prep
4666: CompTIA A+ Certification Prep

DoD approved 8570.01-M Baseline Certifications

Summary
FISMA mandated accountability, cost effectiveness, timeliness, and efficiency regarding
information assurance and critical infrastructure for Federal systems.
NIST has special publications (SP) detailing security and guidance for supporting the
FISMA legislations, including risk management and the proper framework for its
implementation.
Executive Order 13800 addresses risk by requiring agency heads to report Risk
Management findings to the DHS, and also requires a plan to strengthen and evolve a
more highly skilled, trained, and proficient cybersecurity workforce.
NIST SP 800-16 defines a path to expertise for cybersecurity personnel, including a
knowledge and skills definition that maps to specific job roles in the information systems
organizations.
The proper method to compliance involves a proactive, detailed training and education
program that enables long term proficiencies among key personnel in strategic areas of
the organization.

Why It’s Critical to Apply the Risk Management Framework to Your IT Modernization Plan

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a Why It’s Critical to Apply the Risk Management Framework to Your IT Modernization Plan

Similar a Why It’s Critical to Apply the Risk Management Framework to Your IT Modernization Plan (20)

Más de Global Knowledge Training

Más de Global Knowledge Training (20)

Último

Último (20)

Why It’s Critical to Apply the Risk Management Framework to Your IT Modernization Plan

Notas del editor