-: You've heard us call 2 2
special publication 800-37 a framework, right? 3 3
It's the Risk Management Framework, RMF. 4 4
So why isn't it called the Risk Management Checklist? 5 5
After all, aren't organizations expected to complete 6 6
all the steps and tasks in the RMF 7 7
apart from the ones that are clearly labeled as optional? 8 8
Well, yes. 9 9
However, organizations have significant flexibility 10 10
in how each of the RMF steps and tasks are carried out 11 11
as long as organizations are meeting 12 12
all applicable requirements 13 13
and effectively managing security and privacy risk. 14 14
That's why 800-37 is a risk management framework 15 15
and not a risk management checklist. 16 16
The intent is to allow organizations to implement the RMF 17 17
in the most efficient, effective and cost effective manner 18 18
to support mission and business needs 19 19
in a way that promotes effective security and privacy. 20 20
Ultimately, however you tailor RMF 21 21
you've got to accomplish your mission, whatever that is. 22 22
Flexible implementation may include completing tasks 23 23
in a non-sequential order, 24 24
emphasizing certain tasks over other tasks 25 25
or combining certain tasks wherever appropriate. 26 26
You can also use the Cybersecurity Framework 27 27
to enhance RMF task execution, particularly step seven 28 28
which is called monitoring. 29 29
The flexibility of implementation can also be applied 30 30
to control selection, control tailoring 31 31
to meet organizational security and privacy needs 32 32
or conducting control assessments. 33 33
For example, the selection, tailoring, 34 34
implementation, and assessments of controls 35 35
can be done incrementally as a system is being developed 36 36
rather than all at one time before it goes into production. 37 37
But this flexibility can also present a great challenge 38 38
to people who are inexperienced or have been taught 39 39
a very rigid interpretation of RMF, 40 40
or people who just simply have not been trained 41 41
as to how to do the tailoring. 42 42
And some people are just simply more comfortable 43 43
following a checklist. 44 44
After all, checklists are great tools 45 45
especially when safety is concerned. 46 46
Also, there's a risk with the flexibility of implementation 47 47
as people try to tailor RMF for their situation 48 48
that they might make some big mistakes. 49 49
Maybe they leave out things 50 50
that they really shouldn't leave out. 51 51
Now, this kind of error could actually increase the risk 52 52
to the system rather than decrease it, 53 53
which is what we really want. 54 54
Be sure to send big tailoring decisions 55 55
to the authorizing official to help make sure 56 56
it's the best choice for the system. 57 57
Now, even though I've just spent time during this lesson 58 58
telling you that RMF is flexible, 59 59
there are some real challenges to using it in the real world 60 60
because it lacks enough flexibility in the right places. 61 61
For example, RMF can be difficult to use 62 62
with legacy systems, and that's because RMF 63 63
inherently assumes that the system is new 64 64
or that it's still being actively enhanced. 65 65
But many of the systems in the federal government are legacy 66 66
and are only being changed when absolutely necessary, 67 67
and that means it's very difficult or even impossible 68 68
to make engineering and design changes 69 69
to support the RMF requirements. 70 70
For example, there are systems in the Department of Defense 71 71
that were designed and deployed in the 1960s and 1970s 72 72
that can only accept a six character password. 73 73
And so when you take something that can only 74 74
store a six character password, and you try to say, 75 75
well you have to put a 14 character password 76 76
on that account, how much development expense is reasonable 77 77
to change the system so that it can handle 78 78
the increased character length of a password? 79 79
Another RMF assumption that's actually quite rigid 80 80
is that the system is not currently breached. 81 81
Much of our current cybersecurity concerns 82 82
really need to focus on an assumed breach scenario, 83 83
but of course, in practice an advanced persistent threat 84 84
might have silently gained access to a system 85 85
that's already operating and unfortunately, 86 86
RMF is silent on this problem. 87 87
But the cybersecurity framework isn't silent on that issue 88 88
because it assumes breach. 89 89
So here's another justification 90 90
to use the cybersecurity framework with RMF.