-: In this lesson, I want to give you 2 2
some basic thoughts on RMF that are important to realize 3 3
before we start diving into each of the steps individually. 4 4
Now for most of us who are working in the field, 5 5
our goal in using RMF is to be able to gain approval 6 6
to operate some kind of a sensitive system, 7 7
or some kind of a support system. 8 8
Now, for most of us working in the field, 9 9
we are going to be using RMF in order to gain approval 10 10
to operate a sensitive system within the federal government 11 11
because that is the biggest consumer 12 12
of using the RMF or risk management framework. 13 13
That being said, there are some government contractors, 14 14
as well as a lot of commercial institutions, 15 15
that also use RMF in their own business practices. 16 16
For this reason, it's important to understand 17 17
exactly how it's going to be implemented in your organization, 18 18
and how strictly they're going to follow RMF. 19 19
Now, you may have noticed I used the word 20 20
sensitive system when saying that we wanted to gain approval 21 21
for something using RMF. 22 22
And you may be wondering, 23 23
what exactly is a sensitive system? 24 24
Well, a sensitive system is a system 25 25
that contains or processes sensitive data 26 26
or plays a key role in mission support. 27 27
Now that brings up two additional terms we have to define, 28 28
these are sensitive data and mission support. 29 29
Now when I talk about sensitive data, 30 30
I'm really talking about information that must be kept safe 31 31
and out of reach from any outsiders unless they have 32 32
specific permission to be able to access it. 33 33
If you come from an information security background, 34 34
when you think of sensitive data, you may think of things 35 35
like classified data, like secret data, 36 36
or top-secret data in a military context, 37 37
and that is one type of sensitive data. 38 38
But data doesn't have to be classified 39 39
in order to be sensitive. 40 40
For example, if I took a copy of your medical record, 41 41
that would be considered sensitive data 42 42
because there's a lot of laws and regulations 43 43
that have to do with medical data being held by somebody. 44 44
And that all falls under the HIPAA protections 45 45
inside of the United States. 46 46
Now in addition to that, there's also rules that affect 47 47
how you're going to store educational data. 48 48
So if I was working at a public university and I had a list 49 49
of your grades for my course, that data has to be protected 50 50
under FERPA, which is another law here in the United States. 51 51
In addition to having things that are protected legally, 52 52
there's also data that we consider sensitive, 53 53
even if there's no requirement from a regulatory perspective 54 54
that says we have to protect it. 55 55
A good example of this might be a vulnerability scan 56 56
that you just conducted of your organization's network. 57 57
So you just scanned your network and you found 58 58
all the vulnerabilities on all of your servers 59 59
and desktops and laptops and tablets, 60 60
what are you going to do with that data? 61 61
Are you just going to place it on a hard drive 62 62
someplace that anybody can access? 63 63
Well, no, of course not, 64 64
because that is the keys to the kingdom. 65 65
If an attacker got ahold of that, 66 66
you've done all the reconnaissance for them 67 67
and they know exactly where to attack you. 68 68
So we would consider that to be sensitive data as well. 69 69
So I think you get the idea when I talk about 70 70
sensitive data, we're not just talking about classified data 71 71
or regulated data, but there's other data 72 72
that could be sensitive to your organization 73 73
and you want to make sure that's well protected too. 74 74
Now, the second definition we have to make 75 75
is what's called mission support. 76 76
And you may be wondering, what is mission support? 77 77
Well, this is a term that's used inside the OMB Circular 78 78
as well as in RMF, and when we talk about mission support, 79 79
we are talking about any kind of system 80 80
that is going to be used to assist another system 81 81
in the accomplishment of their objectives. 82 82
So if I think about back to my military days, 83 83
we used to have a system that allowed us to see 84 84
the position of all of the enemy aircraft 85 85
and ships that were near us. 86 86
This system is something we used for command and control. 87 87
Now the data inside of that system was classified 88 88
to the level of the network it was on. 89 89
So if I was on an unclassified network, 90 90
I would have unclassified data, such as the location 91 91
of cruise ships and container ships and things like that. 92 92
But if I went to a secret network, I could see 93 93
secret information such as, where are the enemies located? 94 94
If I went to the top-secret network, 95 95
I could get additional information such as, 96 96
how do I know where those enemies are actually at? 97 97
And that involves the technology involved 98 98
in locating those folks, not just their position. 99 99
So all that data is going to be kept in the system 100 100
based on the classification level of the system, 101 101
that's the sensitive data part. 102 102
Now in addition to that, this system which was critical 103 103
to us achieving our mission also got data 104 104
from lots of other systems, 105 105
and those systems may have been unclassified sources. 106 106
For example, in the Navy, one of the sources of data 107 107
we get is what's known as AIS, 108 108
which is the automatic identification system. 109 109
Every commercial ship out there, whether it's a cruise ship 110 110
or a fuel tanker, they all have to have a beacon 111 111
on their ship that says, here I am, 112 112
this is my purpose and here is my location, 113 113
and here's my next port of call. 114 114
And all that data is considered unclassified. 115 115
But we may take that data 116 116
and move it into a classified system as well. 117 117
Because that unclassified system is now talking 118 118
to this classified system that is supporting our mission, 119 119
it becomes something that is a key role in mission support, 120 120
and therefore we would want to make sure 121 121
we have the proper protections 122 122
and put it through the RMF process as well. 123 123
Now, the reason this is important to think about 124 124
is because RMF doesn't have to be used 125 125
for every single system you have, 126 126
but it does have to be used to gain approval 127 127
to operate any sensitive systems. 128 128
And sensitive systems are those that contain or process 129 129
sensitive data or play a key role in mission support, 130 130
so keep that in mind. 131 131
Now another thing we need to talk about when it comes to RMF 132 132
is the fact that this is a framework, 133 133
and a framework is not a checklist. 134 134
A lot of times people who are new to RMF 135 135
think they have to do everything inside of RMF 136 136
and do it perfectly, exactly how it says, 137 137
but that is not true. 138 138
When it comes to RMF, 139 139
it is not to be followed exactly as written. 140 140
Instead, there's often going to be a difference 141 141
between how RMF is documented and how it's actually 142 142
interpreted by the organizations who are going to use it. 143 143
Remember, RMF can be tailored for your organization. 144 144
If you're using it in a very small environment, 145 145
you may want to tailor it downwards. 146 146
If you're using it in a larger environment, 147 147
you may want to scale it upwards. 148 148
And, again, depending on the size of your system, 149 149
you can scale it up or down as well too. 150 150
Now, this ability to scale RMF upwards or downwards 151 151
may seem really strange to you, especially if you come 152 152
from a federal government or military background. 153 153
And the reason for this is we tend to be used to people 154 154
following rigid checklists and rigid procedures 155 155
inside the Department of Defense, 156 156
and most of the government at large. 157 157
But each organization does have the ability and authority 158 158
to interpret RMF and apply it as they see fit. 159 159
According to the OMB Circular A-130, 160 160
federal agencies must use RMF. 161 161
But it doesn't dictate exactly how they have to use RMF, 162 162
and that is where the power comes 163 163
inside of your organization 164 164
and specifically from your authorizing officials. 165 165
So, what does this mean in the real world? 166 166
Well, it means that some organizations are going to be better 167 167
than others at interpreting it and figuring out the ways 168 168
that they're going to identify risk, prioritize that risk, 169 169
identify the threats, perform their risk assessments, 170 170
and manage the risks and mitigations. 171 171
And they can do this very stringently 172 172
and in a very well-defined process, 173 173
or much more loosely if they're a more agile organization. 174 174
This means you may not know where exactly to begin 175 175
when you start working at a new organization 176 176
and you're trying to tailor RMF for that organization. 177 177
Instead, you need to start talking to other people 178 178
in the organization and figure out, 179 179
how is RMF done in your organization? 180 180
Because every organization is a little bit different. 181 181
Now, all the things we talk about in this course 182 182
are applicable to RMF 183 183
and you're going to be using them in your organization, 184 184
but they may be done in slightly different ways. 185 185
For example, when you do the selection process 186 186
for your controls, how are you going to do that? 187 187
Is this going to be done in hard copy, on paper? 188 188
Is it going to be done in an Excel spreadsheet? 189 189
What about an email? 190 190
Maybe it's going to be using a specific system 191 191
that's going to collect all that data for you 192 192
and which controls you're going to select. 193 193
There are many different ways to do it, 194 194
and you don't have to do it any particular way. 195 195
It really is up to your organization 196 196
and how they want to do it. 197 197
So I encourage you, if you're starting a new job 198 198
and you're asked to do RMF, I want you to talk 199 199
with your supervisor and other senior decision makers 200 200
in your organization to find out which steps and tasks 201 201
inside of RMF are particularly useful to them 202 202
and which ones aren't, this will help you be able 203 203
to tailor it for your organization. 204 204
Also, remember, you cannot decide things in a vacuum 205 205
when working in RMF. 206 206
RMF, unlike a lot of other things in the IT world, 207 207
requires massive collaboration across your organization. 208 208
Very rarely is there going to be a single person 209 209
who's going to do all seven steps of RMF. 210 210
Instead, you may be involved with just steps one, 211 211
two, and three, or you may only be involved with step six 212 212
if you're a senior decision maker who's been told 213 213
they're going to be the authorizing official. 214 214
And so it's important to realize that RMF 215 215
and your usage of RMF is going to vary depending on your job, 216 216
role, and organization that you're working inside of. 217 217
The final thing we need to talk about in terms of RMF 218 218
is the fact that RMF has a lot of different supporting tools 219 219
that you can use, but RMF is not considered 220 220
a one-size-fits-all type of solution. 221 221
Instead, everybody's going to be working at different scales, 222 222
whether that's a bigger scale or a smaller scale, 223 223
based on their own unique organizational needs. 224 224
For example, RMF can be applicable to a large 225 225
web-based piece of software that you're using 226 226
as a Software as a Service, and this is going to be used 227 227
by hundreds or thousands or hundreds of thousands of people. 228 228
For example, I used to work with the United States Navy 229 229
and they have a system called NSIPS, 230 230
N-S-I-P-S, which stands 231 231
for the Navy Standard Integrated Personnel System. 232 232
This system is a web-based Software as a Service application 233 233
that everybody in the Navy uses, 234 234
whether they're a Navy person in uniform 235 235
or a Navy civilian working for the Department of the Navy. 236 236
Either way, this system is used for everything they do, 237 237
including the ability for them to ask for vacation time, 238 238
which they call leave inside of the Navy. 239 239
In addition to that, they can go into that system and ask 240 240
to be able to quit the Navy and retire once they've hit 241 241
their 20 years if they're active duty, 242 242
and lots of other things like that. 243 243
And all of this is done inside this massive web-based system 244 244
and that web based-system had to go through RMF 245 245
and get approval to operate because it's containing 246 246
a lot of sensitive data, in this case, 247 247
a lot of PII or personally identifiable information. 248 248
Now on the other hand, I've also used RMF in a lot 249 249
of smaller tactical style systems 250 250
that are only going to be used for a handful of people 251 251
to support a specific mission, 252 252
and it may only last for a specific amount of time. 253 253
For example, many years ago, I went through the RMF process 254 254
for a smaller network that was going to support 255 255
about 50 to 100 users. 256 256
This network had to be designed, engineered, 257 257
and architected, and then installed on a ship at sea. 258 258
This network was going to support 50 to 100 people 259 259
that were going to come out to the ship, 260 260
and they were going to be there for about two weeks for a major 261 261
exercise with the US Navy's international partners. 262 262
And because we had these international partners on the ship, 263 263
they weren't allowed to use the regular ship-based network 264 264
because that was only reserved for American crew members. 265 265
So we had to create a substitute network 266 266
that we allowed them to be able to access 267 267
while they were at sea for that one to two weeks. 268 268
Now, again, this was a smaller network 269 269
for a very short period of time. 270 270
And so as we built out that system 271 271
and we built out our authorization boundaries, 272 272
we kept it at a very small scale so we can move through 273 273
the RMF process very quickly, gain approval, 274 274
and then put this thing on the ship 275 275
and allow people to use it. 276 276
After the two weeks was done, we took down the network, 277 277
removed all the equipment, and closed out that network, 278 278
and the RMF authorization for it. 279 279
This is what we're talking about when we talk about 280 280
the ability to scale up or scale down 281 281
based on the number of users and the scope of control 282 282
for that system that is going to be authorized 283 283
by the authorizing official in the RMF process. 284 284
So remember, when it comes to RMF, it is not a checklist, 285 285
it is a framework, which means you can pick 286 286
and choose the things you need, 287 287
based on your organization's requirements, 288 288
but you can't do that in a vacuum. 289 289
This is going to be something that's going to be a discussion 290 290
between you, your supervisor, and the other decision makers 291 291
in your organization to determine exactly how RMF 292 292
is going to be implemented where you are. 293 293
And then when it comes to using RMF, 294 294
it can be done in many different ways 295 295
from a very small scale thing on a PDF or a Word document. 296 296
Or a very large scale thing like using eMASS, 297 297
which is a tool we'll talk talk about later, 298 298
that allows you to do RMF using a web-based 299 299
Software as a Service application that can support 300 300
these massive, large, and complex systems 301 301
that you may be using if you're building large scale 302 302
information systems that are going to be dealing 303 303
with sensitive data inside of a federal agency.