-: In this lesson, 2 2
we're going to talk about step two 3 3
of the risk management framework 4 4
in the real world. 5 5
Step two is the categorized step. 6 6
Now, the purpose of the categorized step is 7 7
to inform organizational risk management processes 8 8
and tasks by determining the adverse impact 9 9
with respect to the loss of confidentiality, 10 10
integrity, and availability of the systems 11 11
and the information process stored 12 12
and transmitted by those systems. 13 13
When we look at the categorized step, 14 14
we're really focused on three main outcomes. 15 15
First, the system's characteristics are documented. 16 16
Second, the security categorization of the system 17 17
and information has been completed. 18 18
And third, the categorization decision 19 19
has been reviewed and approved 20 20
by the authorizing official. 21 21
So as you can see, 22 22
when you're working through the categorized step, 23 23
it is really your responsibility to look at all 24 24
of your different systems that are going to 25 25
be a part of your RMF package and determine 26 26
what level they're going to be categorized at. 27 27
Now when we talk about categorizing a system, 28 28
it's not just based around the confidentiality, 29 29
integrity and availability of that system, 30 30
but we also have to ask what's unique 31 31
about that system and the mission 32 32
it's been designed to fulfill. 33 33
When you start thinking about things 34 34
like weapon systems, internet of things systems, 35 35
and other devices like this, 36 36
you have very unique requirements in all 37 37
of those types of systems. 38 38
And these can't necessarily 39 39
be implemented the same way that you might 40 40
do a baseline categorization based 41 41
on a server or a website or a workstation 42 42
or something like that. 43 43
This is because these systems 44 44
have unique CIA requirements in terms 45 45
of confidentiality, integrity and availability 46 46
as well as a lot of other requirements that goes 47 47
beyond the standards that are set out 48 48
in that CIA triad. 49 49
Now, this is really where the tailoring ability 50 50
of RMF comes into play and gives us a lot 51 51
of support here because RMF users are expected 52 52
to adapt RMF to their specific situation. 53 53
So if you're trying to get an RMF package through 54 54
for a new weapon system, 55 55
that is going to be very different 56 56
than if you're trying to put 57 57
through an RMF package for a new website 58 58
or a new cloud-based server. 59 59
All of those are going to have different requirements 60 60
and you're going to be able 61 61
to define those requirements 62 62
by selecting the right categorization 63 63
for each of those systems. 64 64
Now, as we move into the categorized step, 65 65
this is really where the rubber starts 66 66
to meet the road in terms of risk management 67 67
for us as professionals. 68 68
This is a great time for us 69 69
to open up the "NIST Special Publication 800-53", 70 70
which is the security and privacy controls 71 71
for information systems and organizations. 72 72
And so once you open up this document, 73 73
you are going to find 74 74
that there are several hundred pages 75 75
of different controls listed here. 76 76
Now, my goal here is not to have you read 77 77
and understand every single one of these controls 78 78
or to memorize all of these controls, 79 79
but instead I would like you to go 80 80
through this document and start seeing the types 81 81
of controls that you can select from. 82 82
And those controls that you're going to select 83 83
are going to be based on this categorization 84 84
that we're doing here in step two. 85 85
So it really is important for you to understand 86 86
what type of controls are out there, 87 87
because as you start categorizing your system 88 88
at a certain level, you're going to be buying yourself 89 89
into certain types of controls based on the level 90 90
of that classification. 91 91
So as you start going 92 92
through the "NIST Special Publication 800-53", 93 93
I want you to really focus on getting comfortable 94 94
with the terms and the taxonomy of the words 95 95
and the way things are laid out. 96 96
And so you can have a better idea 97 97
of the different types of controls 98 98
that you can select from as we move 99 99
into future steps as part of our RMF process, 100 100
such as the Select step in step three. 101 101
Now, one of the big decisions you're going to 102 102
have to make when categorizing a system is 103 103
how to define what type of information 104 104
is being used in those systems. 105 105
Now, the concept of an information type is 106 106
for us to start building and understanding 107 107
what type of system you have 108 108
and all the different types of data 109 109
that are being processed by that system. 110 110
Really, at the end of the day, 111 111
data is everything and it's the reason 112 112
why we have these information systems 113 113
in the first place to process all that data 114 114
and information to give us 115 115
some kind of actionable result. 116 116
So, the concept here is really simple. 117 117
We're going to look at a system 118 118
that's processing some kind of data. 119 119
Let's say it's medical records in this example. 120 120
Now, if I have medical records 121 121
that means I'm going to have to categorize 122 122
that as Protected Health Information or PHI. 123 123
That is the information type. 124 124
Now, based on that, I would then look 125 125
at my system and categorize what level I need 126 126
to protect the system to. 127 127
Is this a low, medium, or high type of system? 128 128
Well, because we're dealing with something 129 129
like Protected Health Information or PHI, 130 130
it's going to probably be a medium system 131 131
or even possibly, a high system. 132 132
Now, again, this is going to depend on the system, 133 133
its requirements and what you're doing 134 134
with that system and how many controls we're going to 135 135
need to add in order to get that risk down 136 136
to an acceptable level. 137 137
So once again, it's important for us 138 138
to understand the risk tolerance 139 139
of our organization so we can determine exactly 140 140
how much we have to mitigate down that risk 141 141
to what is considered unacceptable level. 142 142
Now, if you're working in the government sector 143 143
or particularly the military sector, 144 144
you're going to have a lot 145 145
of different information types 146 146
that are given to you in advance. 147 147
Things like unclassified, sensitive 148 148
but unclassified, classified, secret, top secret 149 149
and then top secret with certain caveats. 150 150
And all of these have certain levels 151 151
of controls that are going to be associated 152 152
with that level of information. 153 153
So if I have a brand new web application 154 154
and it's going to be processing top secret data, 155 155
I already know that because I'm dealing 156 156
with top secret data, there are certain controls 157 157
that I'm going to have to select 158 158
because those are defined by the military 159 159
and the Department of Defense 160 160
for that level of information. 161 161
So once you decide what level 162 162
of information you have, you can then figure out 163 163
what things are being dictated to you 164 164
and what things your organization can add 165 165
on top of that to give you additional controls 166 166
and mitigate down the risk further. 167 167
Now, the biggest challenge I see for people 168 168
when they're working on this categorization step is 169 169
that they don't know 170 170
how to categorize their information. 171 171
Like I said, some information is really easy 172 172
because it says this is top secret 173 173
or this is protected health data. 174 174
And in those cases, there's a set of controls 175 175
that most organizations are already going to 176 176
have set up and you can just select 177 177
from those controls. 178 178
But if you're dealing 179 179
with something a little bit more special, 180 180
for example in my company, we deal with a lot 181 181
of information that we collect from our students 182 182
such as the test scores that they have, 183 183
which exams they've taken, 184 184
which certifications they've earned, 185 185
and things like that. 186 186
That type of information 187 187
is not necessarily considered PII 188 188
or Personally Identifiable Information 189 189
or it may not be considered 190 190
something like student records 191 191
under FERPA because we are not a non-profit 192 192
or government based organization. 193 193
And because we're not, 194 194
we don't have to follow FERPA rules 195 195
because those only apply to colleges 196 196
and universities and high schools 197 197
and things like that. 198 198
So as you look at your information, 199 199
you have to look at it and figure out 200 200
what level does it need to be protected to. 201 201
If it's something defined like patient records 202 202
or a presidential testimony or some kind 203 203
of top secret information, 204 204
that becomes pretty clear. 205 205
But when you're dealing with other things, 206 206
it's going to really be based on your organization 207 207
and how you classify your data. 208 208
So it's important for you to start looking 209 209
at that and then categorizing your systems based 210 210
on the information it's going to be processing. 211 211
Now, once you know your information types 212 212
and you've made a list of all the different types 213 213
of information that you're going to be categorizing 214 214
as part of this system, 215 215
you then are going to identify for each of those 216 216
which categorization level it's going to be. 217 217
For example, you might look at a piece of data 218 218
or information and say, 219 219
"This is going to be a confidential item. 220 220
This other one over here, 221 221
this is going to be a secret item. 222 222
This other one over here, 223 223
this is going to be credit card data. 224 224
This other one over here, 225 225
it's going to be health data." 226 226
And then once you've listed out each 227 227
of those different types of information 228 228
and categorize them, we'll then be able to move 229 229
into step three where we'll start putting controls 230 230
against those different types of information 231 231
as a way to protect that information 232 232
inside of our new system. 233 233
Now, one of the things you're going to see 234 234
in the real world is that oftentimes, 235 235
the classification of that information 236 236
is going to be a negotiation and not a clear black 237 237
and white decision. 238 238
Now, the reason I say that is 239 239
because we're going to be negotiating 240 240
with other people in our team to determine 241 241
what categorization we're going to apply 242 242
to a given type of information. 243 243
This is because if you use high for everything, 244 244
which a lot of people tend to do, 245 245
you're going to be buying yourself 246 246
into a lot of extra work 247 247
and a lot of extra controls 248 248
that are going to be mandated based 249 249
on that high classification. 250 250
On the other hand, 251 251
if you categorize everything as low, 252 252
you're going to have a lot less controls 253 253
which makes getting 254 254
through the RMF process easier. 255 255
But you may be accepting additional risk 256 256
by setting those information types 257 257
as a low categorized item. 258 258
And this is one of those things you're going to 259 259
have to go back and think about 260 260
as you're negotiating what level each type 261 261
of information should be. 262 262
Because as you go higher in levels, 263 263
you're going to have additional controls, 264 264
additional costs and additional time added 265 265
to that system. 266 266
And for that reason, most people who do RMF 267 267
don't really want to list anything as a high item, 268 268
because if you look at that as a high item, 269 269
this means it's a lot more work 270 270
for us to get there. 271 271
For example, 272 272
if you have something labeled as a medium, 273 273
it may take 50% of the work, 274 274
but if you label something as a high, 275 275
it may take a 100% of the work. 276 276
On the other hand, if you label as a low, 277 277
it may be 25% of the work. 278 278
And so you're going to have a lot more controls 279 279
and a lot more cost associated with a high item 280 280
than you are with a medium item and a lot more 281 281
with a medium than you will the low. 282 282
And for this reason, people will try 283 283
to negotiate downward the level they're 284 284
going to categorize that information 285 285
so they can get through the process easier. 286 286
Now, if I was king for a day, 287 287
I would actually change RMF 288 288
to be a little bit more specific 289 289
in what they consider low, medium, and high. 290 290
So it would be easier for us as practitioners 291 291
to decide what it's going to be. 292 292
But because RMF is a framework 293 293
and it's designed to be very tailor able 294 294
they leave this up to each 295 295
and every organization based 296 296
on their organizational risk appetite 297 297
as well as their place in the larger ecosystem 298 298
that they're involved with, 299 299
such as the Department of Defense 300 300
or the overall US government 301 301
or wherever else they fit into based 302 302
on their organization type. 303 303
Basically what I'm saying is 304 304
that as you work with RMF over time, 305 305
you're going to start creating your own list 306 306
of where you think different types 307 307
of information should be. 308 308
For example, if I'm dealing 309 309
with Protected Health Information or PII 310 310
I may categorize that as a medium, 311 311
but if I'm dealing with secret 312 312
or top secret information, I might categorize 313 313
that as a high level of information 314 314
that needs to be protected 315 315
with additional controls. 316 316
And based on those and based on my organization, 317 317
we may have certain controls that will apply 318 318
to all medium systems or all high level systems 319 319
that we're going to be processing data on. 320 320
And because of that, 321 321
that then tells us which controls we're going to add 322 322
to each and every package that we move forward 323 323
with based on whether we classify 324 324
that data as low, medium, or high 325 325
or PII, PHI, confidential, secret, top secret 326 326
and things like that. 327 327
And that's really what we're talking 328 328
about here in step two in the categorized step. 329 329
We're deciding how we're going to categorize the information 330 330
in the system and the system that processes 331 331
that information so we know what level 332 332
of controls we're going to have to add later 333 333
on in the RMF process.