-: In this lesson, 2 2
we're going to talk about step one in the real world. 3 3
Now, step one is the Prepare step. 4 4
The purpose of the Prepare step is to carry out 5 5
essential activities to help prepare all levels 6 6
of the organization to manage its security 7 7
and privacy risks using the RMF 8 8
or risk management framework. 9 9
Now as we move through step one, 10 10
we are trying to achieve five key outcomes. 11 11
First, we want to ensure that 12 12
key risk management roles are identified. 13 13
Second, we want to ensure that organizational 14 14
risk management strategies have been established 15 15
and that the risk tolerance has been determined. 16 16
Third, we want to ensure that an organization-wide 17 17
risk assessment has occurred. 18 18
Fourth, we want to ensure an organizational-wide strategy 19 19
for continuous monitoring 20 20
has been developed and implemented. 21 21
And fifth, we want to ensure 22 22
that common controls have been identified. 23 23
Now, when we start thinking about this preparation step 24 24
you're going to be going in and digging deep 25 25
into what you actually want to accomplish 26 26
during your risk management framework steps. 27 27
Now, I like to think about this 28 28
as having a step before the preparation step 29 29
but a lot of organizations will combine all of this 30 30
into that first step of preparation. 31 31
Really, you're going to start looking at your system 32 32
as a system of systems, 33 33
and then you're going to look at the left and right limits 34 34
that may be placed on you 35 35
that you're going to have to operate within 36 36
as you're going through this RMF process. 37 37
Part of this is ensuring you understand who the people are 38 38
in your organization that are going to be using RMF. 39 39
You also need to identify what roles 40 40
those people are going to have, 41 41
and you're going to have to determine 42 42
who is your senior risk official or the risk executive 43 43
that is going to be the person who is going to be 44 44
overseeing this entire process 45 45
and eventually making that go/no-go decision 46 46
of whether or not your ATO will be approved 47 47
or whether it's going to be denied. 48 48
By taking a look at all of these things 49 49
you're going to be able to set yourself up for success 50 50
and identify any issues or barriers 51 51
that may stop you from gaining that ATO 52 52
and that authority to operate as part of the RMF process. 53 53
For example, if you're looking at a project 54 54
that has to do with some kind of a legal issue, 55 55
you need to be aware of that 56 56
and understand what legal constraints may exist. 57 57
For example, let's say you're processing credit card data, 58 58
that would fall under PCI DSS. 59 59
If instead, you're processing healthcare data 60 60
that might fall under HIPAA. 61 61
Either of these cases, there's going to be rules, 62 62
regulations and laws that you're going to have to follow 63 63
to ensure you're protecting that data properly 64 64
and to identify that here in the preparation stage 65 65
is going to be critical to your success 66 66
as you move through the rest of the steps 67 67
in the RMF process. 68 68
Additionally, you want to make sure you're identifying 69 69
who has the appropriate rank and title 70 70
to be able to make that approval decision for you. 71 71
For example, RMF is used a lot 72 72
inside of the military and government sectors. 73 73
So if you're working in a military environment 74 74
there's going to be a certain level or rank 75 75
that's going to be associated with the person 76 76
who has the approval to create that ATO 77 77
for your RMF package. 78 78
In most organizations, this will be a rather senior officer 79 79
inside of a military contract 80 80
or a senior executive in the civilian government service. 81 81
Either way, during the preparation stage, 82 82
it's really important to identify who that person is. 83 83
So as you're building out your package 84 84
you can make sure you're checking all the boxes 85 85
so they can give you the approval to operate 86 86
at the end of this RMF process. 87 87
So as you're working through the preparation step 88 88
it's important to realize that this is a lot of pre-work 89 89
that you're going to be doing 90 90
before you even start diving deep 91 91
into all the different concepts of RMF. 92 92
And this is really the big picture. 93 93
When I think about what is happening 94 94
in the preparation step, 95 95
I like to think about the fact 96 96
that we're understanding the hierarchies of our systems, 97 97
that we understand the big picture 98 98
and we understand how everything is interconnected. 99 99
For example, let's say you're working 100 100
at a multinational corporation 101 101
and there's going to be six different sites 102 102
that are underneath your control. 103 103
So when you're thinking about the preparation step 104 104
are you going to be looking at the entire organization, 105 105
including all six of those locations, 106 106
or are we only looking at one of those locations 107 107
and the other five are not going to be affected by 108 108
this particular RMF process? 109 109
Again, there is no right answer here 110 110
and it really does depend on your organization 111 111
and the system that you're trying to gain an ATO 112 112
or approval to operate for. 113 113
And so it's important to identify this all the way back here 114 114
in step one as part of the preparation stage 115 115
so you know what systems are going to be included 116 116
as part of this RMF package and which ones are not. 117 117
Another thing that we're going to be looking at 118 118
is this concept of common controls, 119 119
and this is one of those things 120 120
that I really wish people did more of 121 121
at the beginning of their RMF process. 122 122
If you start looking at your different 123 123
categories of controls, 124 124
you can see things like traditional security controls. 125 125
This would include things like 126 126
do you have the right locks on your doors? 127 127
Do you have the right security cameras? 128 128
Do you have the right fire suppression systems? 129 129
And other things like that. 130 130
All of these things would be traditional security controls 131 131
that you're going to have as a set 132 132
of common controls in your data center. 133 133
In addition to that, 134 134
you may have some things that have to do 135 135
with availability inside of the CIA triad 136 136
or confidentiality, such as different encryption techniques 137 137
that you may be using as part of the system. 138 138
And as you go through each of these different areas, 139 139
thinking about the confidentiality, integrity, availability 140 140
identification, authorization, authentication and access, 141 141
these are all things that are going to have to be considered 142 142
as part of your common controls 143 143
because a lot of this is going to be inherited 144 144
from other systems or other locations 145 145
that that system is connected to or operating within. 146 146
Another issue you may have to consider is the fact 147 147
that there may be some things that are going to happen 148 148
at different sites in different ways 149 149
but they're going to achieve the same objective. 150 150
For example, let's say that 151 151
I'm working in a military context 152 152
and everybody's going to have to have a secret 153 153
or a top secret clearance 154 154
in order to work in this data center. 155 155
Well, depending on which service they're in, 156 156
whether they're Navy, Army, Air Force, or Marines, 157 157
they may go through a different background process 158 158
even though they're using similar forms 159 159
and similar processes 160 160
because this operates in a different way in each place. 161 161
You have to take that into account 162 162
as you're building out your controls inside of RMF. 163 163
And the reason for this is you have to decide 164 164
are those four services doing the same thing 165 165
and achieving the same outcome? 166 166
And do we consider that equivalent? 167 167
Now, in the case of the US government and the military, 168 168
they do consider a security clearance from one branch, 169 169
such as the Army, to be equivalent to that 170 170
that's being issued by another branch, 171 171
such as the Navy or the Marines or the Air Force. 172 172
And so in this case, those are all considered equivalencies 173 173
and they become a way to use those as a common control 174 174
around the personal security that would be applied 175 175
to all of our systems inside of our data center 176 176
because all the people working on all of those systems 177 177
do have a security clearance at a certain level 178 178
and therefore, they're authorized to work on those systems. 179 179
And this also brings us to the concept of inheritance. 180 180
Now, when it comes to inheritance, 181 181
these are the things that you're going to be able to 182 182
assume inside of your RMF package 183 183
because you're inheriting them from a higher level control. 184 184
For example, 185 185
let's say I'm going to be putting your system 186 186
inside of my data center. 187 187
Well, if it's my data center, 188 188
I'm going to be the one responsible 189 189
for doing all the physical security, all the availability 190 190
and all of the redundancy in our systems. 191 191
So you're going to be able to inherit all of those controls 192 192
that I create as part of your RMF package 193 193
because your server is sitting in my data center. 194 194
And that's the idea of inheritance here. 195 195
If you're inheriting things 196 196
from another system that is great 197 197
and you just need to make sure you document that 198 198
inside of your RMF package to say, 199 199
"My boundaries are now smaller 200 200
because everything outside of my boundaries 201 201
are things that I'm going to be collecting 202 202
from my inherited controls, such as my physical security 203 203
or confidentiality, integrity and availability 204 204
that's put in place at the data center level." 205 205
So as you start looking at this, you could say things like, 206 206
"Everybody that works on my systems has already been vetted 207 207
and authorized to work on those systems 208 208
because they have a top secret clearance 209 209
and this is a top secret facility, 210 210
so I don't need to go and check that again 211 211
and run another background check. 212 212
Instead, I could check if their clearance is still active 213 213
and valid and hasn't expired. 214 214
And as long as all three of those things are true, 215 215
we can say we've now met this requirement for this control 216 216
because we inherited that by hiring only trained personnel 217 217
that were already in a cleared facility 218 218
taking care of other systems." 219 219
Now, when I use a cloud provider, on the other hand, 220 220
they're going to be operating on what's known as 221 221
a shared responsibility model. 222 222
For example, if I'm using Amazon Web Services 223 223
and I use something like an S3 bucket, 224 224
that's a place where I can store objects in the cloud 225 225
but I'm actually inheriting all the controls 226 226
that Amazon already has in place, 227 227
like their data center, their security, their availability, 228 228
their confidentiality, their integrity, 229 229
and all of those things. 230 230
Conceptually, this is an example of inheriting controls 231 231
in a cloud environment, and it works the same way, 232 232
whether you're going into a commercial data center, 233 233
such as AWS, Azure, or Google Cloud, 234 234
or you're moving into a government or military data center 235 235
that works as a private cloud model. 236 236
Either way, you're going to be able to 237 237
inherit some controls. 238 238
It's important you identify what those are 239 239
so you're not repeating those 240 240
and creating more work for yourself. 241 241
Also, the last thing that we have to think about 242 242
in terms of this Prepare step 243 243
is the fact that we have to understand 244 244
who has access to do what. 245 245
And this means we need to figure out the roles 246 246
of the different people involved in the RMF process. 247 247
Now, we've talked previously about authorizing officials 248 248
but there's lots of other roles out there 249 249
like the information system owner, 250 250
the information system auditor, 251 251
the information system assessors, and things like that. 252 252
So as we go through our Prepare step, 253 253
our job is to identify all of those people 254 254
and ensure we understand who's on the hook for what things 255 255
and when in the process are they going to be called upon 256 256
to do those things. 257 257
Because if you choose the wrong people 258 258
and you're on a tight timeline, 259 259
you can actually cause a lot of problems for yourself 260 260
down the road because the person you chose 261 261
as your authorizing official, for example, 262 262
may be going on vacation for a month 263 263
or on a work trip for a couple of weeks 264 264
and that can significantly delay your project 265 265
as it's going through the RMF process 266 266
because you selected the wrong people. 267 267
Also, as you've identified these people 268 268
I want you to start going out 269 269
and building relationships with them as soon as possible. 270 270
This means you should reach out to those people 271 271
and start a conversation. 272 272
Let them know that your RMF package 273 273
is going to be coming through the process 274 274
and they've been identified to have X role in this project. 275 275
By doing this, you can basically grease the skids 276 276
and start shortening your timeline 277 277
because people are going to be expecting to see your package 278 278
as it's moving through the process. 279 279
And like the old saying goes, 280 280
"The squeaky wheel gets the grease." 281 281
So if you are that person who's already reached out to them 282 282
and they're expecting your RMF package, 283 283
they're going to be keeping an eye out for it 284 284
and they may be able to move it up in the queue 285 285
so your RMF package can get attention quicker 286 286
and hopefully move through the process 287 287
in a more timely manner. 288 288
Remember, during our first step, 289 289
it's all about getting prepared 290 290
and that's really in the name of this 291 291
because the whole process is really there 292 292
to make sure that the rest of our processes 293 293
and our steps as we move through the seven step model 294 294
is going to work very efficiently and smoothly 295 295
because we've done all 296 296
of our preparation work here in step one.