Instructor: In this lesson, we're going to discuss eMASS. 2 2
eMASS is the Enterprise Mission Assurance Support Service. 3 3
eMASS is a government-owned web-based application 4 4
that provides a wide range of fully integrated 5 5
comprehensive cybersecurity management services. 6 6
For example, eMASS provides a dashboard for reporting, 7 7
control scorecard measurement, 8 8
and the ability to conduct 9 9
system security authorization packages 10 10
all from within the eMASS system. 11 11
This Government Off-The-Shelf Software, known as GOTS, 12 12
allows for an easier and more automated method 13 13
of gaining authorization for your RMF packages, 14 14
as well as helping to minimize the risk 15 15
and preventing cyber attacks 16 16
by establishing process control mechanisms 17 17
for obtaining the authorization decisions 18 18
for government and military-based RMF packages. 19 19
Now, the eMASS system 20 20
was created by the Department of Defense, known as the DoD, 21 21
and it is recommended as the tool 22 22
for information system assessment 23 23
and authorizations within a military context. 24 24
Now, if you're working for the military in uniform, 25 25
as a civilian, or as a contractor, 26 26
you may be asked to use eMASS 27 27
when building out your risk management framework packages 28 28
or using older packages known as DIACAP. 29 29
Now, a DIACAP package is an older format 30 30
that is known as the DoD Information Assurance Certification 31 31
and Accreditation Process 32 32
and it was replaced in recent years by RMF packages. 33 33
But if you're taking over an older system, 34 34
you may be having to convert this old DIACAP package 35 35
into the newer RMF style package, 36 36
but both are supported with an eMASS. 37 37
Now, the eMASS system is used by the cybersecurity workforce 38 38
to create control requirements through linear workflows, 39 39
integrated training, 40 40
and the auto generation 41 41
of security compliance package reports 42 42
using the online web-based user interface. 43 43
By using this system 44 44
to help automate the RMF package approval process, 45 45
our cybersecurity professionals can now spend more time 46 46
on securing the network and its systems 47 47
instead of simply interpreting policy 48 48
and filling out lots of paperwork. 49 49
Now, this, in turn, 50 50
leads to an improved level of cyber situational awareness 51 51
because managers can now easily identify vulnerabilities 52 52
and make their decisions 53 53
about the cyber security resources needed 54 54
by their networks and their programs 55 55
in order to minimize the level of risk with their systems. 56 56
Now, by using an automated system like eMASS, 57 57
we're going to be able to improve our cycle time 58 58
during the RMF approval process, 59 59
and this allows everybody to work together 60 60
during the RMF process using the centralized system 61 61
to transfer information back and forth 62 62
and get faster approvals. 63 63
Now, the eMASS automated system has seven main capabilities 64 64
that you need to be aware of. 65 65
First, eMASS can be used to automatically generate DIACAP 66 66
and RMF reports to support package approval. 67 67
This automated capability 68 68
is going to be aligned to the Secretary of Defense's 69 69
Cybersecurity Scorecard Metrics 70 70
that's also linked directly 71 71
to the Enterprise Reporting Service 72 72
to ensure that the current status 73 73
is being reported up monthly. 74 74
Second, eMASS can be used 75 75
to create enterprise level visibility 76 76
of all authorization packages within a given organization. 77 77
This, in turn, leads 78 78
to a more comprehensive organizational security posture 79 79
because everything can be reviewed 80 80
in one centralized system 81 81
instead of being spread across numerous spreadsheets, 82 82
PowerPoints, and documents. 83 83
Third, eMASS can be used 84 84
to manage all the cybersecurity compliance activities 85 85
and automation throughout the workflow process. 86 86
Now, this workflow process improvement 87 87
is going to occur across the entire lifecycle of the system 88 88
and its associated packages, 89 89
going from our system registration 90 90
all the way through system decommissioning and retirement. 91 91
Fourth, eMASS can also be used 92 92
to maintain the enterprise baseline for security controls 93 93
by storing them inside of the eMASS repository. 94 94
And we'll continually update them with any modern 95 95
or approved industry standards as we update our packages. 96 96
Fifth, eMASS can be used to fully automate inheritance 97 97
by allowing the systems 98 98
to inherit security control statuses, artifacts, 99 99
test results, and system security postures 100 100
from other organizations and their RMF packages. 101 101
Sixth, eMASS can be integrated 102 102
with a Continuous Monitoring Risk Scoring system, 103 103
known as CMRS. 104 104
Now, the CMRS system is going to be used 105 105
to automatically populate the device 106 106
and scan result data into eMASS's asset module 107 107
to help us prioritize the asset management actions 108 108
within the overall RMF process. 109 109
And seventh, eMASS can allow product teams, testers, 110 110
and security control assessors 111 111
to effectively collaborate and execute security assessments 112 112
from geographically dispersed locations 113 113
all within using this Integrated Project Team Environment 114 114
inside of eMASS. 115 115
So, as you can see, 116 116
eMASS comes with a lot of great capabilities 117 117
to increase the overall security of our systems 118 118
and minimize our risk pod truth. 119 119
As you begin to work with eMASS, 120 120
you're going to find that it's very access control-oriented 121 121
and this means it has pretty tight restrictions 122 122
around the different permissions that are needed 123 123
to be able to access different parts of the eMASS system 124 124
and all that information that it contains. 125 125
That being said, if you work in a small organization, 126 126
you may have some people 127 127
who are going to be assigned multiple roles within eMASS 128 128
'cause each person will be performing multiple job functions 129 129
with an eMASS inside of your smaller organizations. 130 130
Now, as you begin to work in eMASS, 131 131
it's going to help you move throughout the seven steps 132 132
of the RMF process. 133 133
First, you're going to prepare, 134 134
and then you're going to move into categorization. 135 135
Now, when you're categorizing your system 136 136
and the information it processes, 137 137
it's going to be important 138 138
to use the NIST Special Publication 800-60. 139 139
Now, this is known 140 140
as the Guide for Mapping Types of Information 141 141
and Information Systems to Security Categories. 142 142
Luckily for us, 143 143
eMASS is going to use those exact same categories 144 144
within the eMASS system, 145 145
and therefore, it's relatively easy 146 146
to categorize your systems against the different 147 147
NIST Special Publication 800-60 categories 148 148
that are provided in that document. 149 149
Now, after you categorize your system in eMASS, 150 150
you're then going to select all of your controls, 151 151
you'll perform your implementation, 152 152
and you'll assess the control effectiveness. 153 153
And many of these controls can be tested and validated 154 154
using automated scans, 155 155
and the results of those scans 156 156
can then be uploaded into eMASS 157 157
to link against the selected controls 158 158
and produce a scorecard measurement and report, 159 159
along with a dashboard 160 160
that your authorizing official can review it any time. 161 161
All right, let's take another quick look at how eMASS works 162 162
and how it can help you 163 163
when you're walking through the RMF process. 164 164
First, you're going to need to start out 165 165
by inputting all of your data into the eMASS system. 166 166
This includes things like your hardware list, 167 167
your software list, 168 168
and the results of your most recent vulnerability scans. 169 169
Second, you're going to find the baseline 170 170
for your hardware and software of that proposed system. 171 171
For example, you might say 172 172
that this is a Dell R690 brack-matted server 173 173
that's running Windows Server 2019. 174 174
Then, you're going to notate 175 175
that it's running this window server 2019 system. 176 176
It has X, Y, and Z as its security patches. 177 177
As you put all that information 178 178
about your system's current state into eMASS, 179 179
you can then fully build out the entire hardware 180 180
and software list 181 181
for every part and component of this overall system. 182 182
Third, we're then going to create our authorization boundary. 183 183
Now, this authorization boundary 184 184
is used to define the components, 185 185
hardware, software, firmware, 186 186
and other pieces that are going to be connected 187 187
to create your overall system. 188 188
You'll also list out your configurations, 189 189
open ports, and any protocols 190 190
that you plan to use with that system. 191 191
Fourth, you're going to need to apply all the requirements 192 192
and controls from your STIGs, 193 193
which are known as 194 194
your Security Technical Implementation Guides 195 195
for that specific hardware, software, or firmware. 196 196
And fifth, once you have all that data inside of eMASS, 197 197
you're going to start working on getting your ATO, 198 198
which is your Authority to Operate, 199 199
and then moving yourself 200 200
into that final step of continuous monitoring 201 201
of your approved RMF package and its associated systems. 202 202
Now, the final thing we need to discuss in terms of eMASS 203 203
is what is expected of you as a cybersecurity professional 204 204
when you're asked to take over the RMF process 205 205
within your current organization. 206 206
If you take a new job with an organization 207 207
and you're asked to update 208 208
or review your current RMF packages, 209 209
you're going to need to realize 210 210
that you are now smacked at in the middle of step seven 211 211
of this RMF process, 212 212
and this is known as the monitoring step. 213 213
Now, during this monitor step, 214 214
which I like to refer to as continuous moderate, 215 215
you're going to be focused on reviewing the security controls 216 216
at predefined times. 217 217
Now, these times could be weekly, 218 218
monthly, quarterly, annually, 219 219
or every couple of years depending on your system, 220 220
your available resources, 221 221
and the requirements for that given system. 222 222
Let's say, for example, 223 223
I have some systems that are required 224 224
to have a weekly vulnerability scan conducted, 225 225
as well as a monthly review of some of their controls, 226 226
annual reviews of its access control rosters, 227 227
and then once every three years, 228 228
I'm also going to check the entire RMF package 229 229
and all of its security controls and policies. 230 230
As you can see, we're not doing everything all the time, 231 231
but we're doing some things some of the time 232 232
throughout this three-year cycle. 233 233
And at the end of the three-year cycle, 234 234
we then go through the entire package again. 235 235
Now, since all of our systems are sitting in eMASS 236 236
and we can upload our vulnerability scans into eMASS, 237 237
we can then use that to automate the process 238 238
of identifying any security controls 239 239
that are not being implemented properly 240 240
because this can allow us to detect the vulnerabilities 241 241
using those vulnerability scan results 242 242
and linking those to the different pieces or parts 243 243
of your overall system inside of eMASS. 244 244
Now, eMASS is not going to actually write 245 245
all your identification and authentication details for you, 246 246
but you can use it to notify you of any software or controls 247 247
that are considered noncompliant 248 248
based on your listed baseline 249 249
and your current vulnerability scans 250 250
that you took from a tool like Nessus, QualysGuard, 251 251
OpenVAS, or another type of SCAP scanner. 252 252
Now, as you can see, the eMASS system is really useful 253 253
when you're working in the Department of Defense 254 254
when you're working inside of this RMF process. 255 255
It can help you to identify controls 256 256
that are properly implemented 257 257
during your continuous monitoring phase, 258 258
but it also can help walk you 259 259
through the RMF process as a whole 260 260
and help you gain your initial Authority to Operate 261 261
from your authorizing official.