-: In this lesson, 2 2
we're going to talk about Step 3 in the real world. 3 3
Step 3 is the Select step 4 4
inside of the risk management framework 5 5
and the purpose of the Select step is to select, tailor, 6 6
and document the controls necessary 7 7
to protect the system and the organization 8 8
commensurate with the risk. 9 9
Now, as we work through our Select step, 10 10
we are trying to get five main outcomes. 11 11
First, we need to ensure 12 12
that we have control baseline selected and tailored. 13 13
Second, we need to ensure the controls are designated 14 14
as system specific, hybrid or common. 15 15
Third, controls have to be allocated 16 16
to specific system components. 17 17
Fourth, system level continuous monitoring strategies 18 18
need to be developed. 19 19
And fifth, the security and privacy plans 20 20
that reflect the control selection, 21 21
designation and allocation have been reviewed and approved. 22 22
So, when it comes to step three, the Select step, 23 23
we're going to move forward 24 24
and take all the categorization we did back in step two 25 25
and now we're going to select all the different controls 26 26
to be able to meet that level of categorization. 27 27
Now remember, when we did our categorization, 28 28
we were looking at three main columns, 29 29
such as C, I and A 30 30
for confidentiality, integrity and availability. 31 31
So, for any type of data we had, 32 32
we may classify that as a low-low-low, or a high-low-low, 33 33
or something like that. 34 34
For example, if I said the system was a medium-low-low, 35 35
that means it is a medium confidentiality, 36 36
low integrity and low availability system. 37 37
And that would be totally fine, 38 38
and that would give us guidance 39 39
as to what type of controls we're going to select 40 40
to be able to provide that level of assurance 41 41
for that given system. 42 42
Now, as we go through the selection of our controls, 43 43
we need to go through and figure out 44 44
exactly what we want to do to achieve the goals set forth 45 45
in the information categorization matrix 46 46
that we created back in step two. 47 47
To do this, we're going to select different controls 48 48
and control families that will then apply 49 49
to those different areas, 50 50
such as confidentiality, integrity, 51 51
availability, authentication, 52 52
authorization and things like that. 53 53
Now, that's the starting place 54 54
but it doesn't mean we have to stop there. 55 55
Instead, we can actually tailor the RMF process 56 56
to be more or less stringent. 57 57
In some cases, 58 58
we'll want to be able to tailor those controls a lot 59 59
and give us additional security and lower the risk. 60 60
To do that, we're going to go ahead 61 61
and add some additional controls 62 62
and we call these control enhancements. 63 63
Now, when I look at a control enhancement, 64 64
this allows me to tune that control a little bit 65 65
in order to better manage the risk 66 66
that's associated with that given piece of information. 67 67
Now, when we look at that, 68 68
we have to consider the big picture. 69 69
What is our objective? 70 70
What is the control, and how am I doing it now, 71 71
and how can I do it in a better way? 72 72
Sometimes that's going to require more engineering 73 73
or more architecture 74 74
and sometimes it's just going to be a policy or a procedure. 75 75
That all comes down to the details of that control. 76 76
So, when you're looking at a control enhancement, 77 77
for example, let's say I was considering 78 78
doing full disc encryption for a system. 79 79
Now, normally I might be able to implement that 80 80
by using something like BitLocker or FileVault 81 81
or something like that 82 82
but maybe I want to enhance that control 83 83
by saying that that full disc encryption 84 84
has to occur within three minutes of booting up that system. 85 85
Now, that may or may not be possible 86 86
with the particular tool we chose, 87 87
such as BitLocker or File Vault 88 88
but we could replace our hard disc drive 89 89
with a self-encrypting drive 90 90
and that self-encrypting drive 91 91
will automatically be encrypted all of the time 92 92
as soon as that computer is turned on or turned off 93 93
based on the way you configure it. 94 94
And so, that would be a way 95 95
to enhance that control requirement 96 96
by adding an additional layer of control 97 97
that is more stringent than what you may already expect 98 98
based upon the categorization that we initially did 99 99
back in step two. 100 100
Now just like I said back in step two, 101 101
this is going to be one of those areas 102 102
where negotiation may occur. 103 103
So, I recommend that you work with other people 104 104
throughout the RMF process 105 105
to figure out what controls 106 106
are doing what level of protection for you 107 107
and how those controls could be enhanced 108 108
to be able to mitigate your risk down 109 109
even further if necessary. 110 110
Now, if you're working in RMF as a policy person 111 111
and you're really good with policy 112 112
but you're not so good on the system administration side, 113 113
I recommend you work closely with a system administrator 114 114
who has a strong technical background 115 115
to be able to help you tailor these controls 116 116
and get the most out of them. 117 117
For example, there is a term known as the ISSE, 118 118
which is the information system security engineer. 119 119
The people who fill these roles are very specialized 120 120
and have a high level of technical capability, 121 121
so you could work with somebody who is an ISSE 122 122
or information system security engineer 123 123
to be able to define different implementations 124 124
for those controls to give you more mitigation 125 125
and lowers your overall risk. 126 126
These folks are going to be the smart people 127 127
that can help bridge the divide for you, 128 128
especially if you're more of a manager 129 129
or more of a policy person and less of a technician. 130 130
So remember, it's great to bring those people in 131 131
and bring them in early 132 132
as you start talking about these different controls, 133 133
so they can help you pick the controls 134 134
for the baseline of your categorization level 135 135
as well as doing some tailoring 136 136
to minimize the risk involved with that system 137 137
or to lower the overall cost of implementing those controls. 138 138
Because sometimes there's different ways 139 139
to achieve the same outcome and one of those things 140 140
may cost hundreds of thousands of dollars, 141 141
and the other one 142 142
may be a couple of lines of registry changes 143 143
that you can do for less than a few hundred dollars 144 144
by using your existing staff. 145 145
So, these are all things that you need to keep in mind 146 146
as you're working on selecting those controls 147 147
to achieve the outcomes that you want. 148 148
For example, I was working on a naval system 149 149
and trying to get it through the RMF process. 150 150
Now, this system was going to be specifically used 151 151
by our watchstanders who operate on a 24/7 basis. 152 152
So, every day of the year 153 153
there is somebody sitting behind that computer 154 154
24 hours a day, seven days a week, 365 days a year. 155 155
Now, to be able to do that, 156 156
we would have five different people 157 157
standing that watch on a rotational basis. 158 158
So, maybe person one came in from 8:00 AM 159 159
and they were there till 4:00 PM; 160 160
the next person came in from 4:00 PM 161 161
and stayed till midnight; 162 162
the third person came in from midnight 163 163
and stayed till 8:00 AM; 164 164
and we continued doing that for about three to four days 165 165
and then we would switch to another person 166 166
and give some people time off. 167 167
And as we did that, 168 168
it went through a five section watch rotation. 169 169
Now, the reason I'm giving you this background 170 170
is because one of the controls we had in the system, 171 171
it said that we had to make sure each person 172 172
individually logged into the computer using a smart card. 173 173
Now this means they were using two factor authentication, 174 174
something they have, the smart card, 175 175
and something they know, their individual PIN number. 176 176
The problem with that 177 177
is to be able to log in using a smart card, 178 178
you have to log out the other person. 179 179
So, if I was sitting on this mission critical watch station 180 180
and we need to have that up 24 hours a day, 181 181
seven days a week 182 182
but every time we're going to have a changeover 183 183
at 4 o'clock in the afternoon, midnight, 184 184
or 8:00 AM in the morning, 185 185
we're going to have somebody log out and then log back in, 186 186
that might take one, two or three minutes to complete. 187 187
And during that time, 188 188
the watchstander is losing their visibility 189 189
on what is going on in the world. 190 190
Now, we couldn't have this 191 191
and so we had to actually tailor this control 192 192
to make it something that would work for us. 193 193
Now inside the standard controls, 194 194
it says that every person needs to log in individually 195 195
with their own smart card and using their own PIN, 196 196
so that way we can have multifactor authentication 197 197
and that gives us good security 198 198
but that is something that was not going to be possible 199 199
on this system without us having 200 200
between one and three minutes of downtime three times a day. 201 201
So, we had to create an exception 202 202
based on this category control 203 203
that said you must have multifactor user identification 204 204
using PKI certificates and smart cards. 205 205
Now, by putting in an exception to this control, 206 206
we were asking permission to have a lower level control. 207 207
And in our case, the solution we came up with 208 208
was having a log book. 209 209
So, the whole reason 210 210
that we have this multifactor authentication 211 211
in the first place is so that somebody cannot say 212 212
they were not the person who was logged into the computer 213 213
doing that thing at that time. 214 214
Now, this means that if you were logged in with your card 215 215
and your PIN number, 216 216
any action you took on the system would go back to you. 217 217
But if we were all logged in using the same account, 218 218
such as the watchstander account, 219 219
we wouldn't be able to tell who was doing that thing. 220 220
Now, that's the idea behind this control 221 221
but the outcome we're trying to achieve is non-repudiation. 222 222
We want to be able to say that the person standing the watch 223 223
is the person who was using the computer. 224 224
Now, how did we overcome this? 225 225
Well, the exception we put in place 226 226
was to say this is a 24/7 watchstander 227 227
and because we need that system up and running all the time, 228 228
we are going to issue a watchstander token 229 229
that we're going to give 230 230
and that's going to be passed from watch to watch. 231 231
So, as I log in with the watchstander token, 232 232
which is a smart card and a PIN number, 233 233
all five watchstanders would know that 234 234
but only one of them is on watch at any given time. 235 235
When it was time for person one to go home 236 236
and person two to take over, 237 237
they would actually sign a document saying 238 238
"I have transferred ownership of this token 239 239
"from Jason to Kip, 240 240
"and that means Kip is now responsible 241 241
"because he is the second watchstander 242 242
"and he has it for the next eight hours." 243 243
So if something happened, 244 244
we could check the logs and say, 245 245
"Oh, this happened on the watchstander account." 246 246
And then we can go back to this written log and say, 247 247
"Okay, who was the watchstander 248 248
"on February 1st, 2021 at 3:23 PM?" 249 249
And we could check in the logs and go, 250 250
"Oh that was was watch team number two, 251 251
"watch team number two was led by Kip. 252 252
"Kip is the person who was logged in at this time 253 253
"and therefore Kip is the person who did that thing." 254 254
As you can see, it's not a technical solution. 255 255
It was a policy-based solution that we came up with 256 256
but it was acceptable to our authorizing official. 257 257
They signed off on it 258 258
and we were able to get our RMF package through the process 259 259
and get our authority to operate for that system. 260 260
Now, that's the whole idea here 261 261
by creating this exception to loosen that control 262 262
and figure out who is using that computer at any given time. 263 263
Now, I know I went really in depth into this idea 264 264
of how you can modify these controls 265 265
but this is an important thing to think about 266 266
as you're selecting all of your controls. 267 267
Remember, there are lots of different controls you can use. 268 268
They don't have to just be logical or technical controls. 269 269
You can also use administrative or management controls, 270 270
such as using policies and procedures 271 271
like we did here by having a written log 272 272
of who was logged into the computer at any given time. 273 273
In addition to this, 274 274
you can have controls that are detective controls, 275 275
corrective controls and other things. 276 276
And as you're figuring out which controls you want to use, 277 277
you're always focused on 278 278
what is the outcome that I'm trying to achieve? 279 279
In this example, I need to know 280 280
who was logged into that computer at any given time. 281 281
So if something happened, 282 282
we knew who to go back to and ask the questions of. 283 283
And you can do that 284 284
by having each person log in individually 285 285
with their own smart card and PIN number 286 286
or by simply writing down and signing, 287 287
"I am the person on this computer", 288 288
and the date and time that you took over 289 289
and then when you leave for the day, 290 290
the date and time that you left. 291 291
Either way is an acceptable way to achieve this. 292 292
One is a technical solution 293 293
and one is a managerial or administrative solution 294 294
but they both achieve the exact same outcome 295 295
that we are trying to get. 296 296
So remember, when it comes to the Select step, 297 297
which is step three of the risk management framework, 298 298
your job here is to select, tailor, 299 299
and document the controls that are necessary 300 300
to protect the system and the organization 301 301
commensurate with the risk. 302 302
Because of this, you can use all sorts of different controls 303 303
and you can tailor those controls to your individual system 304 304
and your mission requirements based on where that system 305 305
and how that system is going to be operated.