(upbeat music) 2 2
-: Hi everyone, welcome to your Cyber Path. 3 3
My name is Kip Boyle and I'm here with co-host, Jason Dion. 4 4
Hi, Jason. 5 5
-: Hey, Kip! Nice to see you again. 6 6
-: Yeah, it's good to see you too. 7 7
And I just found out today 8 8
that there's a chance to actually meet up in person again, 9 9
believe it or not. 10 10
This thing about you relocating to Orlando 11 11
is working really well for me just so you know. 12 12
I don't know how you like it, but I like it, 13 13
'cause turns out I'm going to Orlando again 14 14
to make a presentation 15 15
at the ISSA CyberSecurity Executive Forum, 16 16
and that's going to happen in September, 17 17
and going to go talk to a bunch of CFOs from global companies. 18 18
But while I'm there, hopefully, 19 19
we can find some time to meet up and have a meal 20 20
and you have a new office, maybe I could see that. 21 21
-: Yeah, definitely. 22 22
Yeah, we're in the middle of still moving from Puerto Rico 23 23
up to Orlando. 24 24
We'll be finishing that move in 2023. 25 25
But right now, we have the offices at least finished, 26 26
they finished that as of this morning. 27 27
So they're ready to be moved into. 28 28
And I will be in town when you're in town, 29 29
so we'll definitely have to catch up. 30 30
That is one of the nice things about Orlando is, 31 31
Orlando and Vegas is where all the conventions seem to be, 32 32
so you get a lot of conventions and conferences. 33 33
So I get a lot of friends who are flying in, flying out, 34 34
and I get to hang out with them when they come into town. 35 35
-: Yeah, how super convenient for you. 36 36
And I love that it is a direct flight 37 37
from Seattle to Orlando 'cause I don't like changing planes. 38 38
I'm done with that. 39 39
-: Yeah, a lot less likely to have your luggage get lost 40 40
when you don't have to change planes, which is nice. 41 41
-: And it doubles my transit time, you know, coast to coast. 42 42
It just completely blows out my day 43 43
and makes it so much longer than it needs to be. 44 44
Anyway, it's good to be back recording our episode here. 45 45
Hey, what we're going to do today, everybody, 46 46
is we're going to take a closer look 47 47
at something called the NIST Risk Management Framework. 48 48
Now, this is a really important document 49 49
if you are working in the Department of Defense, 50 50
various parts of the US federal government, 51 51
on the civilian side, 52 52
and we're trying to bring more information about this 53 53
to you, our audience. 54 54
And we thought the best way to do that was to get an expert. 55 55
So on the podcast with us today is an RMF expert. 56 56
His name is Drew Church. 57 57
He's the global security strategist with Splunk. 58 58
If you've heard of Splunk, 59 59
I'll let Drew tell us what Splunk is, 60 60
but Splunk is a really important tool 61 61
for people working in cybersecurity. 62 62
Hey, Drew, thanks for being here. 63 63
-: Hey thanks, Kip. 64 64
Thanks for having me. 65 65
Thanks, Jason. 66 66
Jason and I go back quite a ways 67 67
and I also learned just a few moments ago 68 68
that you're from or at least located in Seattle. 69 69
When I'm not TDY for several months to Virginia, 70 70
I actually live about an hour outside of Seattle, 71 71
so hopefully we'll have a chance to meet up face to face. 72 72
But yeah, so Splunk, we're a big data platform, 73 73
we do analytics, 74 74
a lot of security use cases that we have in Splunk. 75 75
And that's kind of where I got my start with the technology 76 76
is actually doing part of continuous monitoring for RMF 77 77
using Splunk. 78 78
So we can definitely talk a little bit about that. 79 79
I'm not here on their dime today or anything like that. 80 80
Not a sponsored show or anything like that. 81 81
It's just me talking. 82 82
But happy to be here. 83 83
-: Yeah, as we have with a lot of other guests, you know, 84 84
the opinions expressed by Drew are Drew's opinions alone 85 85
and they do not reflect upon Splunk who is his employer. 86 86
So I just want to make sure we all pointed that out. 87 87
He works for Splunk, he's not here representing Splunk. 88 88
-: Yep. -: Yeah. 89 89
And the opinions might not even be mine. 90 90
(hosts chuckle) 91 91
That was a joke. 92 92
-: But yeah, as Drew said, him and I go way back. 93 93
We actually worked together several years ago 94 94
in a cybersecurity organization 95 95
and we spent quite a bit of time working together 96 96
and we've kept in touch over the years. 97 97
So when we started diving into RMF, 98 98
I started thinking about who in my network 99 99
has a lot of experience in RMF, 100 100
and Drew was one of like the top three names 101 101
that came to my head. 102 102
So I immediately reached out to him 103 103
and invited him onto the show so we could talk about RMF. 104 104
And the thing I wanted to mention with RMF is, 105 105
as Kip said, this tends to be used very heavily 106 106
in the government, especially in the DOD, 107 107
for either military, contractors or civilians. 108 108
That said, 109 109
if you're not working for one of those organizations, 110 110
I still would listen today, 111 111
because RMF is one of those things that 112 112
if you end up working 113 113
for one of these government contractors one day, 114 114
or you even work for a software as a service company 115 115
that has a contract with the DOD, 116 116
you sometimes have to deal with that. 117 117
For instance, Splunk is not a DOD person, 118 118
but they do sell a lot of things to the DOD 119 119
and so they have to go through this RMF process as well 120 120
with some of their tools to get them approved for use 121 121
on the different networks in the DOD. 122 122
So we'll be talking about that as well 123 123
as we go through today. 124 124
-: Excellent, excellent. 125 125
Okay, so what we want to do is really, 126 126
we want to get into RMF. 127 127
So RMF is a framework that has seven steps, 128 128
but I think maybe before we get into those seven steps, 129 129
it might be nice to talk a little bit about what RMF is, 130 130
what it's not at a high level. 131 131
So Jason or Drew, 132 132
would one of you guys like to just kind of give us 133 133
the thumbnail sketch of the purpose of RMF? 134 134
-: Sure, I'll let Drew jump in here if he wants. 135 135
-: Yeah. 136 136
RMF, the Risk Management Framework, 137 137
is that seven-step process, 138 138
and the really idea is to right size 139 139
and come up with the right amount of security 140 140
for the right system at the right time 141 141
and at the right cost. 142 142
And so if you think about the whole program as that 143 143
and work from that outwards, it gets a lot easier. 144 144
I did mention cost 145 145
and so hopefully, those of you in the commercial sector 146 146
that are thinking about that, 147 147
you hear bureaucracy and you hear cost 148 148
and those things usually are pretty high. 149 149
I think there's a way to do RMF at the right cost, 150 150
but the big picture there is selecting 151 151
the right kind of security for the system or systems 152 152
or company or organization, 153 153
and do that correctly in a pretty systematized, 154 154
systematic way. 155 155
-: Okay. -: Yeah. 156 156
I think that's a great point, 157 157
because when you're dealing with RMF, 158 158
the idea is not to 100% secure 159 159
every single system out there. 160 160
It's a matter of managing risk, 161 161
which is why it's called the RMF, 162 162
the Risk Management Framework. 163 163
And so if I have something 164 164
that is going to be used by one person 165 165
and connected to one dial-up computer terminal assignment 166 166
connected to the internet, normally, 167 167
there's probably a less of a risk posture there 168 168
and I wouldn't want to spend billions of dollars 169 169
protecting that. 170 170
On the other hand, if I have, you know, 171 171
a mobile device that can process top secret information, 172 172
I probably want to spend a lot of money protecting that 173 173
because it's mobile and it has top secret information, 174 174
so we want to make sure that is well-protected. 175 175
And so this allows you to kind of, you know, 176 176
as Drew said, right size based on what the thing is 177 177
you're trying to protect. 178 178
And the whole idea with RMF, at least in my experience, 179 179
is to get to a point where an authorizing official 180 180
can decide yes or no, 181 181
we're willing to accept the residual risk of this thing 182 182
when we connect it to a network, 183 183
because you're never going to get 184 184
100% of the things taken care of 185 185
when you're putting all your controls together, 186 186
there's just no way to protect everything 100% of the time, 187 187
and so you just want to get it down to a reasonable level 188 188
where the risk is willing to be accepted 189 189
based on the benefits you're going to get. 190 190
-: Yeah, oh, thank you. 191 191
I think that's an excellent summary. 192 192
Another thing that I'd like to point out 193 193
before we really start unpacking the seven steps, 194 194
and getting Drew's take on the kind of the reality 195 195
of using the seven steps, 196 196
'cause there's what's documented, 197 197
there's what the government's looking for, 198 198
and then there's like, 199 199
how do you really do it in the real world? 200 200
But the other thing I want to say 201 201
that I think is really important 202 202
and helpful to understand RMF 203 203
is that it's based on a lifecycle development process 204 204
like that seems to be the major lens 205 205
through which RMF describes what needs to be done. 206 206
And I like to compare and contrast that 207 207
to the NIST Cybersecurity Framework, 208 208
because some people seem to have this idea 209 209
that they're just sort of like synonymous with each other. 210 210
And in my experience, 211 211
I don't think that it's very synonymous. 212 212
I actually think it's complimentary 213 213
because the cybersecurity framework 214 214
is actually organized around the five steps 215 215
of a computer incident and how you handle it. 216 216
And so I think that's a really important distinction. 217 217
But Drew, what's your opinion of that? 218 218
-: Yeah, I think that they are complimentary. 219 219
I think that everything inside 220 220
of the cybersecurity framework is inside of RMF 221 221
and then RMF has a ton more stuff, 222 222
but it is organized differently. 223 223
And I think that makes it significantly more approachable 224 224
for smaller organizations or less mature organizations. 225 225
They could be a Fortune 5 company and very immature, 226 226
or they could be a mom-and-pop that stood up yesterday. 227 227
And at the end of the day, 228 228
both of those control sets, 229 229
and we'll talk about that I'm sure, 230 230
they are at the end trying to help you figure out 231 231
what to do and how to do it 232 232
and actually help you make smarter purchasing decisions, 233 233
which is another interesting topic as well. 234 234
And so overall, I think no matter how you approach it, 235 235
either from the RMF side 236 236
or from the cybersecurity framework side, 237 237
you're getting the same goodness 238 238
really coming out of NIST and the experts there. 239 239
-: Yeah, I completely agree. 240 240
I've seen a lot of people who they say CSF and RMF 241 241
in the same sentence and they think they're the same thing. 242 242
In fact, when Kip and I 243 243
started making our NIST Cybersecurity Framework course, 244 244
we were working with Udemy business 245 245
to get it added to their catalog, 246 246
they were actually asking for a NIST Cybersecurity Framework 247 247
and RMF course and we're like, 248 248
whoa, whoa, whoa, whoa, 249 249
that's not the same thing. 250 250
Let's do one and then, you know, 251 251
if you want the other one, we'll make the other one too, 252 252
and we are, 253 253
we're currently making an RMF course 254 254
to go through how you actually do this in the real world. 255 255
But we had to break that apart for them, 256 256
because most people, 257 257
when they talk to hiring managers 258 258
when they talk to HR, 259 259
when they talk to all people 260 260
in the instruction and recruitment areas 261 261
of these large Fortune 500 businesses they deal with, 262 262
they kept hearing, we want CSF and RMF, 263 263
and they thought that was one thing. 264 264
We're like, no, no, those are two different things. 265 265
They just work really well together. 266 266
So that's why we're going to, you know, 267 267
talk about that in this episode. 268 268
I guess that brings us to the first thing we should do, 269 269
which is lay out what are the seven steps of RMF. 270 270
So I'll go ahead and kind of read those off 271 271
at a very high level. 272 272
And then we're going to talk with Drew 273 273
as we go through some of these steps and kind of figure out, 274 274
what does this look like in the real world? 275 275
Where are the pain points? 276 276
Where are the bodies buried, I guess, 277 277
as you start dealing with the stuff in the real world? 278 278
So when we look at the seven steps, as we said, 279 279
it is a lifestyle, a life cycle. 280 280
So it starts out with prepare. 281 281
And during the prepare phase, 282 282
you're going to be doing all the essential activities 283 283
to prepare your organization 284 284
to be able to manage your security and your privacy risks. 285 285
When you look at RMF, really, 286 286
there's two big risk areas they focus on. 287 287
One is the security risks 288 288
or the cybersecurity of your organization. 289 289
And the second is the privacy risks 290 290
because of all the data breaches that occur. 291 291
And so these are two main areas you're going to be focused on. 292 292
The second step is to categorize. 293 293
During the categorize phase, 294 294
we're going to be categorizing our systems 295 295
and all the information that it processes, 296 296
stores, and transmits based on an impact analysis. 297 297
And this goes back to what Drew said 298 298
when we start talking about right sizing. 299 299
Yes, you can categorize a system as, you know, 300 300
extremely important and needs to be protected at all costs, 301 301
but if it's going to cost a billion dollars 302 302
to protect this thing 303 303
and it's only protecting a piece of data 304 304
that's worth a dollar, 305 305
that doesn't make a lot of sense either. 306 306
So you want to make sure you're categorizing things 307 307
in the right mind based on the information that's processing 308 308
and the level of that information. 309 309
The third step is select. 310 310
When you're selecting, 311 311
you're going to be going through the control sets, 312 312
which are located in the NIST special publication, 800-53, 313 313
the same one that we referenced back 314 314
in our NIST Cybersecurity Framework course 315 315
as one of the places you can get controls from, 316 316
and this is why these work together, 317 317
and you're going to select the controls 318 318
based on the risk assessment of the systems 319 319
and the data you're trying to protect. 320 320
Then we get to step four. 321 321
This is where we're going to implement. 322 322
So we want to implement all those controls we selected. 323 323
For instance, we said, 324 324
we're going to implement two-factor authentication. 325 325
We're going to use data at rest encryption. 326 326
Now we have to go put all those things into the system 327 327
and that's where the implement step is. 328 328
Then we get down to our next step, which is step five, 329 329
which is to assess. 330 330
Now that we've implemented our controls, 331 331
we need to assess to determine if those controls 332 332
are in place, if they're working right, 333 333
and if they're giving us the results that we expected. 334 334
For example, if we said we're going to protect the system 335 335
using multifactor authentication 336 336
and we decide to use an SMS text code for that, 337 337
and then we find out that those can be easily hacked 338 338
or bypassed, 339 339
well, that's not giving us the protection we want, 340 340
so maybe we want to move 341 341
to an RSA key fob token solution instead 342 342
for our multifactor authentication. 343 343
That's the idea of assess. 344 344
Is this working the way we intended? 345 345
Then we get to number six, which is our authorize step. 346 346
In authorize, this is where your senior officials 347 347
start making risk-based decisions 348 348
to authorize the systems to operate. 349 349
And in every organization, 350 350
whether you're a government organization 351 351
or a civilian organization, 352 352
somebody should be making a decision 353 353
of when you can hook something up to the network. 354 354
And that senior official, whoever that is, 355 355
is going to be responsible for all the risk 356 356
that is now being accepted by that organization, 357 357
because somebody has to make that determination. 358 358
And then the final thing we do is step seven, 359 359
which is monitor. 360 360
At this point, we're going to continuously monitor our systems 361 361
and monitor all our controls 362 362
to make sure they're working the way they should, 363 363
to make sure the risk is at the level we thought it was. 364 364
And if those risks start creeping up and getting higher, 365 365
then we want to go back and iterate again and start 366 366
categorizing, selecting, implementing, 367 367
assessing, authorizing, and monitoring again, 368 368
to make our systems more secure and reduce that risk again. 369 369
And, again, this all goes back to 370 370
how you've categorized things back in step two 371 371
so you know what level you need to meet. 372 372
So guys, do you think I did a decent job of covering 373 373
the 50,000 foot view? 374 374
-: Yeah, definitely. 375 375
-: Yeah, absolutely, Jason. 376 376
-: All right, cool. 377 377
So let's talk a little bit about prepare. 378 378
What happens during the prepare stage 379 379
and what does this look like in the real world? 380 380
-: Yeah, and so, 381 381
when we start thinking about preparing, right, 382 382
you're going in and digging deep 383 383
as to like actually looking about what you're trying to do. 384 384
And I like to think that there's like a step before prepare, 385 385
but it's really all part of the prepare. 386 386
You have to look at this as a system of systems. 387 387
You have to look at your organization, 388 388
you have to look at the left and right lateral limits 389 389
that you're operating under. 390 390
You have to understand who those people are. 391 391
You need to identify folks, 392 392
like you mentioned that senior risk official 393 393
or the risk executive, whomever this happens to be. 394 394
Those people have to be identified. 395 395
You have to understand, 396 396
you know, what the part of the organization is. 397 397
If there are legal constraints, 398 398
you have to understand about, you know, 399 399
in those more military or government sectors 400 400
of the appropriate rank and whatnot 401 401
to be able to make those decisions. 402 402
So you have to do a lot of kind of pre-work 403 403
before you even get into the RMF stuff, 404 404
which is a big picture to me. 405 405
And the thing I think about is, 406 406
like understanding hierarchies of systems. 407 407
And so take big picture, right? 408 408
You've got a multinational corporation 409 409
and there's going to be, 410 410
we'll say six different sites, right? 411 411
And so when you're thinking about the prepare step, 412 412
are you looking and are going to be embracing this 413 413
as the overall entire organization 414 414
or are you looking at doing it 415 415
for one of those six locations in a specific location? 416 416
When you take that 417 417
and then also think about this concept of common controls, 418 418
and these are things that I think, 419 419
and this is where real world I wish people did 420 420
a little bit more of it, thinking about this big picture, 421 421
is saying, hey, if you go look at that category of controls, 422 422
there are things like traditional security controls, 423 423
do I have the right locks on my doors? 424 424
Do I have the right, you know, fire suppression systems 425 425
and other environmental controls? 426 426
Do I have redundant power? 427 427
The things that start getting into 428 428
the kind of the availability in the CIA triad, 429 429
which I am sure you talk a lot about. 430 430
Think about that, right? 431 431
One site may be different than another, 432 432
but when you think about 433 433
maybe the background investigations 434 434
that all people that come into the organization 435 435
have to go through, they're all the same. 436 436
And so that might be a great opportunity 437 437
to identify those common controls around personnel security 438 438
that apply to all systems, 439 439
so that you answer them once and once only, 440 440
because what I see in the real world 441 441
are folks that don't understand 442 442
what their common controls are, 443 443
and this is where you get into the concept of inheritance 444 444
and saying, hey, I'm inheriting that from another system 445 445
that I've authorized because yep, you know what, 446 446
everybody that works on my system 447 447
was already vetted through our organizational policies, 448 448
I don't need anymore, 449 449
boom, I'm not going to have to answer that. 450 450
And that flows into other steps. 451 451
So when you get this done right at the outset, 452 452
it significantly saves time, it saves money, 453 453
and quite frankly, it saves sanity throughout all of it. 454 454
And so really, 455 455
regardless if you're working on the big, big system 456 456
or you're working on that 457 457
super hyper important system in a corner 458 458
that does really important, but small-scale work, 459 459
it's all setting it up to right size, 460 460
the right amount of security to apply, 461 461
and manage that risk effectively. 462 462
-: Hmm. 463 463
-: Yeah, and I think one of the really interesting things 464 464
in what you just said, Drew, is you know, 465 465
we tend to be as cybersecurity folks 466 466
always thinking about the technical solution, 467 467
but you went right out to prepare 468 468
and you thought about, 469 469
hey, what about those physical solutions, right? 470 470
What about those door locks? 471 471
What about the personal background checks 472 472
and all those things? 473 473
Because you're right, 474 474
a lot of that, especially in large organizations, 475 475
a lot of those know, I used to be in the Navy, 476 476
and in the Navy we have networks all over the world 477 477
across six different continents. 478 478
And a lot of those same things and those same people 479 479
are moving between different areas. 480 480
And so if you're working in the United States 481 481
versus working in Italy or the Middle East or in Japan, 482 482
and I've worked in all those places, 483 483
we had different requirements 484 484
at the physical security level. 485 485
There was a baseline 486 486
and the lowest level was here in the United States. 487 487
When I was overseas, they had a higher threshold, 488 488
so we accepted all those controls 489 489
from the people coming from the United States 490 490
and then added to those what was unique 491 491
to our particular site. 492 492
And I think when you're looking at prepare 493 493
and seeing how can you reuse the work of others, 494 494
that's really where this comes into 495 495
as making sure you're ready to start the whole process. 496 496
-: You know, as a person working in private sector only, 497 497
Drew, when you were talking about this, 498 498
the thing that popped into my mind was, 499 499
when I use a cloud provider, 500 500
they operate on a shared responsibility model. 501 501
And when I use like an AWS service, for example, 502 502
like S3 where I can store objects in the cloud, 503 503
I actually inherit all the controls 504 504
that Amazon already has in place, 505 505
like data center security and so forth, right? 506 506
And so to me, conceptually, that seems very similar. 507 507
Drew, am I getting it? 508 508
-: 100%, and nobody thinks about it, right? 509 509
You're like, oh, at CloudWorld, 510 510
I'm so far advanced, I moved past things 511 511
like risk management framework. 512 512
Haha, you really haven't? 513 513
It's just the same thing under different guides, right? 514 514
So that shared responsibility model, 515 515
exactly, 100%, Kip. 516 516
-: Got it, okay. That's cool. 517 517
All right. 518 518
Well, anything else, Drew, in the prepare step 519 519
that is particularly maybe difficult to understand 520 520
or tricky to get right? 521 521
Or just any anything else 522 522
that you could share with our audience, you know, 523 523
if they find themselves working on this step. 524 524
-: This is where you, the project management skills, right? 525 525
Understanding organization, right? 526 526
You're going to probably have some tooling. 527 527
They may be, if you're in the DOD, 528 528
you're going to know the system, 529 529
you're going to be doing this in, 530 530
depending on the classification of the environment, 531 531
like, hey, what tool or technology 532 532
are you going to use for this? 533 533
And there's a lot of, by the way, 534 534
Microsoft Excel and Microsoft Word 535 535
going through that whole process. 536 536
But there's also like other tools. 537 537
And so, you're probably going to be using those. 538 538
So understanding those, 539 539
understanding who has access to do what, 540 540
figuring out the roles of the people involved, right? 541 541
We mentioned that authorizing official, 542 542
there's other roles like the information system owner, 543 543
other things like assessors 544 544
that go into the other parts of the process, 545 545
and so part of that prepare step 546 546
is identifying those people. 547 547
And so making sure that you know who's on the hook for what 548 548
and kind of when, 549 549
because if you choose the wrong people 550 550
and you're like on a timeline, 551 551
it's not going to go so well. 552 552
So understand all of that, 553 553
and start building those relationships as soon as possible 554 554
within whatever the chains that you can do 555 555
to make sure that the whole process is successful. 556 556
It's all about getting prepared. 557 557
It's in the name, to get this whole process done as easily 558 558
and as smoothly as possible. 559 559
-: Yeah, and I think the other thing to bring up, 560 560
you know, when we talk about RMF is, 561 561
it's a lengthy process sometimes. 562 562
I've done several RMF packages. 563 563
The fastest I think I've gotten one through 564 564
was about five months, 565 565
and people thought I was lightning fast 566 566
because five months is really unheard of in the RMF world. 567 567
Generally, it can take you one to two years 568 568
to get these things from the time you start preparation 569 569
to the time you have finally gotten everything approved 570 570
and authorized in step six 571 571
and ready to actually put that thing on the network. 572 572
So the preparing, the more you can do in preparation, 573 573
the better you're going to be 574 574
as you move through the rest of the steps, 575 575
because you can grease the skids a lot of times. 576 576
As Drew said, if you have a choice of, 577 577
you know, Person A or Person B, 578 578
and you know that Person B 579 579
always lets things sit in their inbox for a month 580 580
before they look at it, 581 581
and Person A is kind of top of their game, 582 582
you may want to swing by Person A's desk 583 583
and buy them a cup of coffee 584 584
and see if they're willing to be the guy who's going to, 585 585
you know, the person going through your RMF package 586 586
instead of getting stuck with Person B, right? 587 587
And I've seen a lot of that where it's not necessarily, 588 588
you know, buying off the person 589 589
who's going to be looking at your stuff, 590 590
but it's just getting yourself a higher priority, 591 591
especially when they're competing for that one person 592 592
may have a thousand packages they're looking at 593 593
and they only have time to look at one a day or two a day. 594 594
So trying to get yourself as a higher priority sometimes 595 595
can work wonders. 596 596
-: I know we're all IT and cyber professionals, 597 597
but soft skills, folks, soft skills matter. 598 598
-: Yeah, so we talk about that time and time again 599 599
on this podcast. 600 600
Like being likable will get you to the top of the queue. 601 601
It's amazing. 602 602
-: Yeah, thank you, Drew, for saying that 603 603
because Jason and I emphasized 604 604
the importance of people skills all the time, soft skills. 605 605
We didn't pay Drew to say that, 606 606
he said it on his own because he knows it's true. 607 607
So I appreciate you weighing in on that. 608 608
How about the second step, the categorize step? 609 609
Drew, what would you tell somebody, again, 610 610
who's doing RMF for the first time, 611 611
what are your insights about how to get this step done 612 612
as quickly and as cleanly as possible? 613 613
-: Yeah, I think, the categorize step and select step, 614 614
the next two, 615 615
are really where the rubber starts meeting the road 616 616
for the risk management professional 617 617
to get and start digging deep. 618 618
And so this is a great time to actually open the 800-53 619 619
and whatever revision you happen to be working on, 620 620
currently publishes Rev. 5, 621 621
though I know a lot of people 622 622
do work on the Rev. 4 control sets, 623 623
and actually understand and start reading the pubs. 624 624
I'm not going to say read all of the controls yet, 625 625
but you want to go read and understand, 626 626
like go read the summary, go read how to do this, 627 627
especially if you've never done it before. 628 628
And so you're going to start getting familiar 629 629
with the vernacular, the taxonomy of the words, 630 630
and some of the things that are a little bit more common, 631 631
like the thing that I want to talk about first, 632 632
which is information types. 633 633
And the concept of an information type 634 634
is to start building and understanding 635 635
what type of system you have. 636 636
And that's all about, right, data. 637 637
Data really is everything. 638 638
And the reason why we have information systems 639 639
is to process information, right? 640 640
And we go back to our DIKW pyramid 641 641
and all that fun stuff, right? 642 642
You have to have that on it. 643 643
And so when you understand what that is, 644 644
that's how you start building out these information types. 645 645
And so the concept here is relatively simple. 646 646
Hey, I am using a system 647 647
that's processing medical records, for example, right? 648 648
I'm also going to have, 649 649
probably, some administration information, right, 650 650
about how to run the system on here, 651 651
but maybe I don't have 652 652
the nuclear secrets on this system, right? 653 653
And so when you start identifying that, 654 654
you're going to have the information types, 655 655
and this catalog is going to depend. 656 656
If you're working in the government sector, 657 657
and particularly, in the DOD, 658 658
you're going to have these information types 659 659
given to you in advance. 660 660
Like here is the registry of information 661 661
and here's some stuff. 662 662
And so if you're working in those cycles, 663 663
be aware of what that catalog is to pick from. 664 664
You don't have to make this up by yourself. 665 665
The challenge I've seen in that area 666 666
is people don't know what it means, right? 667 667
So if you say patient health information, 668 668
and in many cases, 669 669
these are much more granular information types. 670 670
What's in a name, right? 671 671
What does somebody think a patient record is, right? 672 672
You can go back to the '90s and look at, you know, 673 673
presidential testimony and, you know, 674 674
what is the definition of is or whatever, right? 675 675
Like people get to that level of detail here, 676 676
because when you get to why these matter, 677 677
which is the concept of the high watermark, right, 678 678
which feeds into the next set of controls, 679 679
your information dictate what your confidentiality, 680 680
integrity and availability impact levels are going to be, 681 681
which then further on down the process, 682 682
does some more stuff we'll get into in a second. 683 683
And so when you know your information types 684 684
and know the information, right, 685 685
we go back to our CIS control number one, 686 686
like know thy self, right? 687 687
Know your information. 688 688
So you identify these and then there's a matrix, 689 689
and this is where you get into the spreadsheet game, 690 690
where hey, okay, I've picked my information types, 691 691
I've pulled my catalog, and now I can say, 692 692
hey, my system, 693 693
because of all of this is a confidentiality, 694 694
you know, I look at the highest one, 695 695
oh, there's a medium here, 696 696
this other one's integrity is low and availability is high, 697 697
maybe because I'm processing life-saving information. 698 698
And that's where you get into 699 699
the rubber meeting the road bit, 700 700
and this is where you start getting into 701 701
the informal negotiation, 702 702
because I just said high, 703 703
the word high means a lot to a lot of people in RMF 704 704
because when you start getting into high anything, 705 705
that means not only are you going to be mandated 706 706
to start doing a lot of specific controls, 707 707
you're also going to have these things 708 708
called control enhancements. 709 709
And this is where you're like, 710 710
I'm doing a lot and, you know, 711 711
hey, the first 80% is pretty easy, 712 712
but then we start getting towards that top, 713 713
like what does it mean to get to 100% secure or whatever, 714 714
it gets really hard to do. 715 715
It's hard from a knowledge perspective, 716 716
from the professionals to knowing how to configure 717 717
those controls. 718 718
It's hard on the cost, 719 719
hey, I have to go buy something 720 720
or I have to spend more money on people to do these things. 721 721
And so nobody really ever wants anything ever to be high. 722 722
And you can go look at the matrix, 723 723
I don't have the reference off the top of my head, 724 724
but like when you go from medium to high, 725 725
it's just like an astronomical amount of controls 726 726
to get added. 727 727
And so these high water marks, 728 728
I think, are what cause a lot of contention. 729 729
And if I was to go and have a magic wand 730 730
and change RMF a bit, 731 731
I would really maybe make this more like the pirates code, 732 732
and it's more like guidelines, right, 733 733
where hey, this is what the high water marks should be, 734 734
but understand what this means 735 735
and then you're going to move into the select phase. 736 736
And we can talk about that, 737 737
but you probably have some questions for me. 738 738
-: Yeah, definitely. 739 739
Jason, if it's okay, 740 740
I want to actually rewind a little bit, 741 741
because, Drew, you mentioned a pyramid 742 742
that I've never heard of before. 743 743
-: The DIKW, yes. 744 744
-: Yeah, DIKW pyramid. 745 745
I don't know what that is. 746 746
Help a brother. 747 747
-: Yeah, go for it, Jason. 748 748
I think you have the cert designator 749 749
for knowledge management, so go for it. 750 750
-: Yes, yeah. 751 751
I was a former knowledge management officer 752 752
in an earlier life, and DIKW is really important to that. 753 753
So when we talk about DIKW, 754 754
these are the four types of information 755 755
that you can have, or knowledge. 756 756
You start at the lowest level, which is data, right? 757 757
So the number 32, that is a data point, 758 758
that's a piece of data, 759 759
but it doesn't really tell you much. 760 760
If I go to information, 761 761
you have a little bit more fidelity of that. 762 762
For instance, I might say 32 Fahrenheit. 763 763
Now, you know a little bit more information, right? 764 764
And so it's a little bit more than just data 765 765
because you know what that thing is about. 766 766
And you start moving up and you go D, I, 767 767
then you go to K, which is knowledge. 768 768
Now, when I say 32 Fahrenheit, 769 769
well, that is the freezing point of water 770 770
in the United States and any place that is, you know, 771 771
using the imperial system I guess, 772 772
which I think is pretty much just the United States, 773 773
if I remember correctly. 774 774
And so, you know, in the United States, 775 775
32 F would tell me, hey, that's the freezing point. 776 776
So if I'm an insurance company, 777 777
I might know that when the temperature gets down to 32 F, 778 778
we're going to have a lot more car accidents, 779 779
we're going to be paying more money. 780 780
That becomes knowledge because I'm taking the data point, 781 781
the information, 782 782
and now I'm extrapolating that 783 783
with other pieces of information 784 784
to combine that into some kind of knowledge. 785 785
And then wisdom tells me that, 786 786
hey, if I can work from home, 787 787
I should just stay home today because it's 32 degrees out, 788 788
and I don't want to deal with snow and ice 789 789
on the roads, right? 790 790
And so you go from this data to information 791 791
to knowledge to wisdom. 792 792
And it's always harder to get up to wisdom, 793 793
but that's where you start learning from your mistakes 794 794
over time and things like that. 795 795
So we talk a lot about data science 796 796
and we get all this data collected, 797 797
but really data by itself is not that useful. 798 798
It's what we do with the data 799 799
and how we combine it to get information 800 800
or knowledge from it, 801 801
and that's where knowledge management organizations 802 802
was really big in the '90s and 2000s. 803 803
Now, we all go into data science and data analysis instead, 804 804
but it's a lot of the same. 805 805
-: Yeah, I think it showed my age there. 806 806
-: Yep. 807 807
-: Well. -: You're not that old, Drew. 808 808
I mean, you're younger than I am. 809 809
-: Yeah. 810 810
So DIKW, thank you for explaining what that is. 811 811
Now, Drew, how does that help you with RMF? 812 812
-: Right, it's understanding, 813 813
it's the context 814 814
that your information system lives in, right? 815 815
And so knowing that you have patient health information 816 816
is great, right? 817 817
But how is that information used? 818 818
Where does it start transiting your network? 819 819
Where is that data stored? 820 820
What legal complications and regulatory bodies 821 821
do you have to work with when you have that information? 822 822
And so as you start thinking about, 823 823
32 may have been a number, 824 824
but now you start putting that F on it, 825 825
okay, now you know it's a temperature, 826 826
and then as you grow up the period, 827 827
now you're tied to a person 828 828
and you know that that was Drew Church's temperature 829 829
on this data this time, 830 830
and now you have a patient health record, right? 831 831
And so when you start thinking about 832 832
how the data comes together 833 833
and how you need to protect it 834 834
and where that goes in your information system, 835 835
I think it allows you to really start digging into 836 836
what that information means a little bit better. 837 837
-: Yeah, okay. 838 838
Thank you very much for unpacking that acronym 839 839
and then connecting it to RMF. 840 840
So, okay, thank you. 841 841
Now, I feel like I can focus on the topic. 842 842
-: The other thing I wanted to point out is, you know, 843 843
when Drew was talking about the categorize and select state, 844 844
one of the things that he mentioned 845 845
was how it was not guidance 846 846
and he would love it to be guidance, 847 847
whereas, when we talk about in this cybersecurity framework, 848 848
Kip, I know you make a big point of this in our course, 849 849
that this is not a requirement. 850 850
You do not have to do every single thing 851 851
inside this cybersecurity framework 852 852
to be using the NIST Cybersecurity Framework. 853 853
It's kind of the guidelines, 854 854
it's the guidance, 855 855
and you can change it based on your organizational needs 856 856
to more or less based on what you need. 857 857
RMF is not that way. 858 858
RMF is much more a structure. 859 859
You have to do all seven steps. 860 860
You have to put a certain amount of effort 861 861
into each of those steps 862 862
based on whether it's high, medium, or low, as Drew said. 863 863
And knowing that, 864 864
and knowing that if you go to a high, 865 865
you just bought yourself into a whole bunch of more work 866 866
and a whole bunch of more stuff is important to realize. 867 867
Not saying you should never categorize high, 868 868
but you just need to be aware of 869 869
what you're buying yourself into 870 870
when you say this is a high system 871 871
instead of a medium or a low system. 872 872
The other thing I think that's really important 873 873
when you start dealing with RMF is to realize that 874 874
usually the person who is doing this, 875 875
it's not that you're going to be doing all seven steps 876 876
by yourself either. 877 877
RMF tends to work in very large organizations, 878 878
like we said, it's very heavily used in the government, DOD, 879 879
and so I may be the person who's categorizing 880 880
and selecting the controls, 881 881
but I'm not the actual system administrator 882 882
who has to actually go and implement all this stuff. 883 883
So if I say, yes, we want full-disk encryption, 884 884
that's a requirement, 885 885
now, I don't get to tell the system administrators 886 886
that they're going to do that using a third party product 887 887
or BitLocker, or you know, FileVault 2 or whatever it is, 888 888
they get to determine what meets that requirement. 889 889
I just got to say what the requirement is. 890 890
And that's what we're really doing in the categorize 891 891
and especially in the select phase is we're saying, 892 892
here are all the requirements that we're going to put in place 893 893
to make sure this system is secure 894 894
and has a lower level of risk. 895 895
And then we get into our fourth step, 896 896
which is what we're going to talk about now, 897 897
which is implement. 898 898
And this is what that stuff- -: Wait, wait. 899 899
Before we go to implement, 900 900
I wanted to make a comment about one thing. 901 901
The NIST Special Publication 800-53. 902 902
I have seen so much confusion about that publication, 903 903
and I've heard people say like, 904 904
are you, you know, SP 800-53 compliant? 905 905
Or people will say, well, have you implemented 800-53? 906 906
And, I think, what people don't understand, 907 907
and Drew, 908 908
and Jason, you can tell me if I got this totally wrong, 909 909
but it's a catalog of controls. 910 910
-: Yes. 911 911
-: You don't implement everything, not even close. 912 912
You are picking and choosing out of that catalog 913 913
based on need. 914 914
And then I remember you said something about enhancements. 915 915
Almost every control has additional things that you can add 916 916
in order to strengthen the control or, you know, 917 917
make it more suitable for a higher level of protection. 918 918
And did I get that right on the publication? 919 919
-: Yeah, and I glossed over 920 920
a huge part of that selection of controls 921 921
as to kind of how that selection happens, right? 922 922
So big picture, right? 923 923
You have that high water mark 924 924
and that when you go look at the matrix 925 925
and how all those controls and the control families, 926 926
it will literally say, 927 927
this applies to confidentiality high or whatever, right? 928 928
And only that. 929 929
Or maybe it's a low, low, low, 930 930
meaning every system will have this in the control set 931 931
that is built from that categorization process, right? 932 932
And so that's like the starting place. 933 933
And then selection's all about tailoring. 934 934
You'll hear the phrase tailoring these controls a lot. 935 935
And so that's adding and removing controls 936 936
and control enhancements in just a second that say, 937 937
okay, how do I kind of tune this a little bit, right? 938 938
We got the big picture, which is like objective, 939 939
which is the control, 940 940
and then how I go about doing that in more, 941 941
not the architecture way, 942 942
but like the policy and the how and the big picture, 943 943
how am I going to measure this later? 944 944
That's what's in the details of these controls. 945 945
And so the control enhancements 946 946
turn that like full-disk encryption requirement up to 11. 947 947
So it's full-disk encryption 948 948
and it has to be done within three minutes 949 949
of the system coming online 950 950
or whatever the crazy thing happens to be, right? 951 951
And so the big point of selection has to be a conversation. 952 952
So I mentioned in prepare 953 953
that we need to be talking to people. 954 954
And this is where the negotiation happens. 955 955
And this is where I would recommend 956 956
that if you're like a strong policy person 957 957
or a strong RMF person, 958 958
but not like you've never really worked 959 959
as an administrator or an assistant before, 960 960
your information systems security engineer or architect, 961 961
the different implementations of RMF 962 962
have different role names, 963 963
but this concept of the ISSE, 964 964
these are your smart people that bridge the divide. 965 965
This is where you really want to be bringing them in 966 966
and talking about the controls 967 967
that were picked from this baseline of controls, 968 968
based on your categorization, 969 969
and starting to pick, 970 970
what do you really think you should do? 971 971
What should you take out? 972 972
Because maybe that control won't do what it says it will 973 973
on our system 974 974
because of A, B and C, 975 975
or maybe, like everyone's favorite, screen lock. 976 976
I'm in Virginia right now, 977 977
and you might hear a plane fly over my head 978 978
in the recording of this podcast, 979 979
and if somebody mandates a screen lock 980 980
on one of those jet fighters flying over my apartment, 981 981
that's probably a bad control for that system. 982 982
But I bet that if I was to go through the RMF process, 983 983
that would be a control that would be selected. 984 984
And this is where, I think, 985 985
the real life people that don't think about this critically 986 986
and don't have partnerships in their organizations 987 987
get it wrong. 988 988
We have selected this control and it will be implemented, 989 989
and you're just like, 990 990
this is never going to get implemented, 991 991
because literally the computer in the plane 992 992
doesn't work that way. 993 993
And so I think that's a big thing to think about 994 994
with selection. 995 995
-: Okay. 996 996
Okay, and is this what you meant 997 997
when you said tailoring before? 998 998
-: Yes, exactly. 999 999
It's, hey, what do I want to do? 1000 1000
What do I not want to do? 1001 1001
And it can't be I don't want to do it because it's hard 1002 1002
and I don't want to do it because it's too expensive. 1003 1003
Now, there may be, 1004 1004
this costs too much based on the, again, it's the old, 1005 1005
you don't apply a $10,000 security control 1006 1006
to a $5 hamburger, 1007 1007
like that doesn't, you don't do that, right? 1008 1008
So that may come out in the wash, 1009 1009
but if that's your only reason, 1010 1010
is this is an X dollar number 1011 1011
and you aren't actually making a risk, 1012 1012
like that's not your decision at this point, right? 1013 1013
You need to be bringing all those people in to saying, 1014 1014
hey, what is the right amount of stuff? 1015 1015
-: Yeah, I think Drew gave a really good example 1016 1016
of, you know, these aircraft are computerized, right? 1017 1017
And you don't want them to have a lock screen, right? 1018 1018
Another good example of this is, when I was in the Navy, 1019 1019
I was getting a system through RMF 1020 1020
that was specifically being used by watch standers 1021 1021
who have a 24/7 watch, 1022 1022
and there'd be three different people 1023 1023
who would stand that position. 1024 1024
Now they couldn't afford to log out of the computer, 1025 1025
which was running, you know, Windows 10 or whatever, 1026 1026
wait the three minutes and then log back in, 1027 1027
because during that three minutes 1028 1028
there was time that bad things could be happening 1029 1029
and that watch stander couldn't do their job. 1030 1030
So, you know, one of the controls says, 1031 1031
every person needs to log in individually 1032 1032
with their username and password 1033 1033
using a smart card and a pin, 1034 1034
that we have multifactor authentication 1035 1035
for all these good security controls. 1036 1036
That's great, except for the fact that 1037 1037
it takes three minutes to log out a user 1038 1038
and log in the next one. 1039 1039
And so what we had to do was create an exception 1040 1040
based on that category control that was said, 1041 1041
you must have, you know, 1042 1042
multifactor user identification using a PKI certificate. 1043 1043
And we were able to get a... 1044 1044
-: An exception? 1045 1045
-: An exception, thank you. 1046 1046
My brain stopped working. 1047 1047
An exception to that rule that allowed, 1048 1048
instead of having to have them log in and log out each time 1049 1049
that for that particular thing, 1050 1050
since it was a watch stander and the goal of that control 1051 1051
was to figure out who was using the computer 1052 1052
at a given time if there was a security breach, 1053 1053
so we had to do something like having a log. 1054 1054
So the first one would actually log in. 1055 1055
I have the watch, 1056 1056
I'm now in charge from midnight to 8:00 AM, 1057 1057
and now, you know, Jason's on watch instead of Drew, 1058 1058
so Jason gets blamed if something happens 1059 1059
at three in the morning. 1060 1060
-: Ah, so you actually got pen register? 1061 1061
-: Now an administrative control instead, right? 1062 1062
But that met the requirement for the system 1063 1063
using the logic of we can't be offline 1064 1064
for three to six minutes 1065 1065
'cause people are logging in and logging out. 1066 1066
-: So if I'm taking watch from you Jason, 1067 1067
you're picking up a pen or a pencil 1068 1068
and you're signing in a log saying I'm out of here, 1069 1069
and then Kip picks up the pen or pencil and signs in 1070 1070
and says, okay, it's me, 1071 1071
and that is the change of ownership on that account. 1072 1072
-: That's exactly what they did, yeah. 1073 1073
And it was basically, you know, 1074 1074
I signed out, I no longer have possession, 1075 1075
Kip now has possession and he's in charge. 1076 1076
-: I love that. 1077 1077
That's a fantastic example. 1078 1078
-: Yep. 1079 1079
Now, it's not as good technically, 1080 1080
but it works administratively, right? 1081 1081
And it met the requirement using that tailoring 1082 1082
of what is the system need to be done? 1083 1083
And, you know, same thing, 1084 1084
if you're on the back of an EP3, for instance, 1085 1085
you can't afford to log out 1086 1086
when it's the next person's time 1087 1087
to take their six-hour watch, 1088 1088
you need to continue that mission the entire time. 1089 1089
So you have to be able to have these type of controls 1090 1090
that can be tailored to your particular unique environment. 1091 1091
-: Love it. 1092 1092
-: All right, can we move to number four now, Kip? 1093 1093
-: Yeah, please, sorry for the hesitation there. 1094 1094
-: All right, number four, implement. 1095 1095
So at this point, 1096 1096
we are going to implement all these controls. 1097 1097
We've picked out all our controls, 1098 1098
we've categorized our system, 1099 1099
we said, here is the 3000 controls 1100 1100
that we're going to implement on this new server. 1101 1101
Before we hook it up, what do we do now, Drew? 1102 1102
-: Yeah, and I think as we, 1103 1103
like I think about the audience of this podcast, 1104 1104
I think a lot of the people probably listening 1105 1105
aren't going to be the ones doing a lot 1106 1106
of the implementation. 1107 1107
So my advice here is really about 1108 1108
what your role of that is going to be. 1109 1109
And if you're an administrator 1110 1110
you know this is where your job starts 1111 1111
and things get really hard. 1112 1112
I think, one of the big pictures here is like, 1113 1113
okay, so a security control says 1114 1114
I need to have multifactor authentication. 1115 1115
It doesn't say what vendor I'm going to use. 1116 1116
It doesn't say what tool and technology or process 1117 1117
inside of that I'm going to use. 1118 1118
Now there are some caveats to that. 1119 1119
There are in the concept 1120 1120
of organizationally defined attributes, 1121 1121
these will be listed within the controls that say, 1122 1122
hey, here maybe specific timeouts, like that 15 minutes 1123 1123
would probably be an organizationally defined attribute. 1124 1124
And there may be other types of prescriptive nature 1125 1125
coming from the very highest levels 1126 1126
of whatever organization you work with 1127 1127
that may say you are going to use this piece of software 1128 1128
or this hardware, but that's very rare. 1129 1129
And so this is where, 1130 1130
the people have to figure out 1131 1131
what they're going to do to meet these controls. 1132 1132
And outside of the Department of Defense 1133 1133
in the United States, 1134 1134
this is the hardest thing, 1135 1135
because they're like, oh, I just got to do the MFA. 1136 1136
Now, I work in the commercial sector now 1137 1137
in my role at Splunk, 1138 1138
but my background is actually over 10 years 1139 1139
working for the Navy as well. 1140 1140
And we just, this is what you're going to do. 1141 1141
You have these things, here's the tool, 1142 1142
here's the technology, 1143 1143
and you're just going to do it, 1144 1144
because you're not thinking about that at the level. 1145 1145
But if you're a commercial or maybe a private business 1146 1146
that's working in support of a contract, 1147 1147
like you're going to have to start thinking about these things. 1148 1148
And so my biggest piece of advice 1149 1149
to anybody here that's never heard this is, what some, 1150 1150
and I think Jason might think of as a four-letter word 1151 1151
and I'm going to say it, STIGs. 1152 1152
And what these do, 1153 1153
are these security technical implementation guides. 1154 1154
And these say, and they're each tied to a control, 1155 1155
an RMF control, that says, 1156 1156
hey, if you have to implement multifactor authentication, 1157 1157
it's this control, right, 1158 1158
there's a cross-reference, 1159 1159
here's technologies that you can use 1160 1160
and here's literally the steps you have to follow 1161 1161
to enable it on that tool or technology 1162 1162
or that platform, for example. 1163 1163
I make it sound very easy and it's not that easy, 1164 1164
but that's some great guidance that can get you started. 1165 1165
I think a really important thing to understand 1166 1166
is implementation is hard and it takes time. 1167 1167
The next thing I would say, Kip, on this is, 1168 1168
implement, a part of this, 1169 1169
and there's a lot of Excel spreadsheets and timelines, 1170 1170
like the project management skills 1171 1171
are going to be important here. 1172 1172
And when you start building out your plan, 1173 1173
your implementation plan, you have to give dates. 1174 1174
If you lie here, your life got a lot harder 1175 1175
and will be forever impossible, right? 1176 1176
And this goes all the way back to that selection as well. 1177 1177
If you said you like, 1178 1178
that control is never going to get implemented in my system 1179 1179
and you let it through into the implementation, 1180 1180
now you've got to say, 1181 1181
when you're going to have it done by, 1182 1182
and how much it's going to cost, 1183 1183
and who's going to do it, right, 1184 1184
you're kind of building a RACI chart. 1185 1185
So if you don't give realistic timelines 1186 1186
and you are trying to say that you will do these controls 1187 1187
that you're never going to do, 1188 1188
you enter this do loop 1189 1189
and you're just never going to get out of it. 1190 1190
And that is where folks get into a lot of trouble. 1191 1191
There's a whole, I know, 1192 1192
we could talk for hours, 1193 1193
but this is where you get into this whole concept 1194 1194
of POAM extensions, 1195 1195
your dates weren't right, 1196 1196
like it's just the whole thing. 1197 1197
So when you're doing your implementation, 1198 1198
it's very important to like actually talk to the people 1199 1199
that are going to do in the work, 1200 1200
talk to your resource managers 1201 1201
if you're like a project management organization and say, 1202 1202
hey, here's the work, what's your estimate? 1203 1203
And then listen to them. 1204 1204
If they said it's going to take six months to get this done 1205 1205
and you put down three months, 1206 1206
you're at fault, not them. 1207 1207
Like, you can't just, 1208 1208
it's the old adage, right? 1209 1209
Nine women can't make one baby in a month, right? 1210 1210
-: Yeah, yeah, yeah, yeah. 1211 1211
-: It's just going to take what it takes. 1212 1212
And you have to listen to your experts here. 1213 1213
And so, if you're an executive, 1214 1214
oh, go ahead, Kip. 1215 1215
-: You used a term that I don't know 1216 1216
if everybody understands. 1217 1217
-: Sure. -: POAM. 1218 1218
And that's a program of action? 1219 1219
-: Plan of Action and Milestone. 1220 1220
-: Yeah, Plan of Actions and Milestones. 1221 1221
-: I'll use a great example, right? 1222 1222
I want to get Security Plus certified. 1223 1223
Well, I can come up with a POAM that in the next 90 days, 1224 1224
here are the things I'm going to do. 1225 1225
In the first week, I'm going to read the textbook. 1226 1226
In the next three weeks, I'm going to watch the videos. 1227 1227
In the next month, I'm going to do the labs. 1228 1228
The next month, I'm going to do all practice exams. 1229 1229
And by doing, these are all the things I need to do 1230 1230
in order to get to my final goal 1231 1231
of passing the certification, right? 1232 1232
It's the same thing. 1233 1233
If I said I wanted to implement MFA, 1234 1234
that might include buying the software, 1235 1235
getting the software approved, 1236 1236
getting the software installed, 1237 1237
getting the software configured, 1238 1238
and we're going to say, okay, that's going to take a month, 1239 1239
three weeks, two months, five months, 1240 1240
whatever it is. 1241 1241
That total time now is nine months, 1242 1242
whatever that happens to be. 1243 1243
-: So it's kind of just a project plan? 1244 1244
-: Exactly, it's just a project plan. 1245 1245
And the other term that I heard Drew say 1246 1246
that some people may not be aware of is RACI, R-A-C-I. 1247 1247
This stands for the responsible, 1248 1248
accountable, consulted, and informed. 1249 1249
And essentially, when you're doing a project, 1250 1250
this all goes to my project management side of my courses, 1251 1251
when you're doing any kind of project 1252 1252
and RMF is a large project essentially 1253 1253
of trying to get this system approved, 1254 1254
you need to figure out who is doing what, 1255 1255
and who is being consulted, and who's being informed. 1256 1256
So, for example, you know, 1257 1257
we were getting this podcast ready, 1258 1258
there was several people involved 1259 1259
and some were responsible for things like, 1260 1260
I was responsible to reach out to Drew 1261 1261
and figure out a good date and time 1262 1262
that works for his calendar, and my calendar, 1263 1263
and Kip's calendar. 1264 1264
Kip was accountable for doing some research on RMF, 1265 1265
so he is ready to open up the show, right? 1266 1266
And then we had people who were consulted, 1267 1267
like we may have had to consult Drew's wife 1268 1268
to make sure that she was okay letting us borrow him 1269 1269
for this hour instead of him calling her tonight, right? 1270 1270
And things like that, right? 1271 1271
And so you have these four roles that do take place. 1272 1272
And as you go through RMF, 1273 1273
you will assign different roles 1274 1274
and different responsibilities and actions and information 1275 1275
based on what you're doing 1276 1276
as you're going through this process. 1277 1277
The other thing I wanted to bring up real quick 1278 1278
is implement. 1279 1279
You know, Drew said for most people on the podcast, 1280 1280
you may not be involved in the implement stage 1281 1281
unless you're a system administrator, right? 1282 1282
I know we have a lot of people in our audience 1283 1283
who are system administrators 1284 1284
trying to break into cybersecurity as well. 1285 1285
So the place where you might be involved with RMF 1286 1286
is doing all the implementation 1287 1287
as opposed to doing the paperwork process 1288 1288
of the categorization and selecting controls. 1289 1289
Remember, when you're doing your resumes, 1290 1290
these are transferable skills, 1291 1291
because when you're doing that implementation 1292 1292
of putting in the multifactor authentication, 1293 1293
you are doing cybersecurity. 1294 1294
In fact, you're doing a very important part of cybersecurity 1295 1295
in securing the system. 1296 1296
And a lot of people don't think about that 1297 1297
when they're implementing their different controls, 1298 1298
registry edits, installing patches and things like that. 1299 1299
That all is how cybersecurity work, so keep that in mind. 1300 1300
And then again, I think a Drew brought up a great example 1301 1301
when you talked about MFA as a good example. 1302 1302
You might have a system that says you must have MFA. 1303 1303
And in the DOD, there's a lot of systems 1304 1304
that don't always have access to smartphones. 1305 1305
So using a MFA solution that requires a text message 1306 1306
is a horrible idea, 1307 1307
because most people can't bring their smartphone to work 1308 1308
because they're in a secret or top secret space. 1309 1309
And so that would not be a good implementation of MFA, 1310 1310
even though it meets the RMF requirement. 1311 1311
And this goes back to your preparation stage 1312 1312
and identifying what is your system, 1313 1313
where is it going to be used, 1314 1314
and then deciding where it's going to be. 1315 1315
For instance, if I'm in a submarine, under the water, 1316 1316
in the middle of the Atlantic, 1317 1317
using a two-factor authentication 1318 1318
that relies on a text message code is not going to work. 1319 1319
So instead, we use what the DOD has decided, 1320 1320
for most of the services, 1321 1321
is that they have to have a smart card, 1322 1322
which is their ID card, and a pin number. 1323 1323
That's something you have, something you know, 1324 1324
and that is kind of the defacto 1325 1325
multifactor authentication on every system in the DOD. 1326 1326
And it works really well 1327 1327
because it doesn't rely on this third party 1328 1328
text messaging type system. 1329 1329
-: Fascinating. 1330 1330
-: All right, next one. 1331 1331
We're going to move into number five, 1332 1332
'cause I know we're starting to get low on time here. 1333 1333
So, next one, number five is assess. 1334 1334
So here now we're going to do our assessment. 1335 1335
We're going to assess to determine 1336 1336
if the controls have been put in place properly 1337 1337
from the implementation standpoint 1338 1338
and if they're actually working the way they should 1339 1339
and producing the desired results. 1340 1340
So Drew, I'll kick it over to you, 1341 1341
what are your thoughts on assess? 1342 1342
-: Yeah, I think, this is honestly the easiest step to do 1343 1343
if you know what you're doing. 1344 1344
And the reason I say this is, it's an open book test. 1345 1345
This is you're generally not going to be assessing yourself. 1346 1346
There's going to be some kind of third party, 1347 1347
and I don't want to say 1348 1348
that's going to necessarily be an external third party, 1349 1349
meaning, they don't work for the same organization, 1350 1350
but generally speaking, 1351 1351
the assessment of your system 1352 1352
against risk management framework controls 1353 1353
is going to be by some kind of person 1354 1354
who doesn't report through your same reporting chain. 1355 1355
Maybe not your same, 1356 1356
like it's a third party of some kind. 1357 1357
They follow a guide. 1358 1358
And that guide is the assessment procedures 1359 1359
for these controls. 1360 1360
And those are contained in a different publication. 1361 1361
And that's NIST Special Publication 800-53 A or Alpha. 1362 1362
And that has the entire process 1363 1363
by which these controls will be assessed. 1364 1364
My secret to being successful in this process, 1365 1365
as somebody who was almost always on the other side of it 1366 1366
not being an assessor, 1367 1367
was actually reading their checklist, right? 1368 1368
Like that's what they're going to go do, 1369 1369
so if I know what they're going to do in advance, 1370 1370
I can make sure that I have the right documentation, 1371 1371
I know how they're going to examine it, 1372 1372
so I may have done it 1373 1373
and I'm familiar with how to show them 1374 1374
how it's going to be done here, 1375 1375
but that's not how they check it. 1376 1376
But it says over here how they check it. 1377 1377
I go check it their way and I'm like, 1378 1378
oh, okay, I didn't realize that registered, whatever, right? 1379 1379
Like you know it's done, 1380 1380
but like you're proving it to the test, right? 1381 1381
You're answering to the test. 1382 1382
And I'm sure, Kip and Jason have talked a lot about 1383 1383
what's the right answer to a question. 1384 1384
It's the one that the test writer wanted you to get 1385 1385
and they're giving you the test ahead of time. 1386 1386
And so go read 800-53 Alpha. 1387 1387
That's the short version. 1388 1388
The next bit of that is understand three key words, 1389 1389
and this is to all of the people 1390 1390
who might perform an assessment, 1391 1391
because they get tapped on the shoulder to come help a team. 1392 1392
There are three concepts, 1393 1393
observe, interview, and test, right? 1394 1394
And these are how things will be assessed, right? 1395 1395
So observe, right? 1396 1396
Go watch it happen. 1397 1397
If you said that the screen lock was going to do, 1398 1398
in 15 minutes, get a stopwatch out, right, 1399 1399
wait 15 minutes, 1400 1400
and did it lock with no inactivity? 1401 1401
Okay, yeah, passed the test. 1402 1402
Interview. Very simple. 1403 1403
Go talk to people. 1404 1404
Go talk to a couple of people. 1405 1405
Did they get the right answer? 1406 1406
Good. Test. 1407 1407
Now on the screen lock one, right, 1408 1408
like you kind of observed in test 1409 1409
and so there's some crossover here, 1410 1410
but maybe if you said it's a multifactor authentication, 1411 1411
ask somebody like have them provision you a user account 1412 1412
and with username, password, 1413 1413
and then go try and log into a system. 1414 1414
And if the system doesn't let you log in 1415 1415
because it now asks you for some kind of second factor 1416 1416
to authenticate into that system, 1417 1417
you've now tested to say that that's successful. 1418 1418
And so those are really like, that's the whole process, 1419 1419
and they're just doing that for all of the controls. 1420 1420
Money and time are not infinite. 1421 1421
Different assessors and the organizations that support them 1422 1422
are going to have different skill sets, 1423 1423
they're going to have different priorities, 1424 1424
and they're going to probably have communications 1425 1425
with whomever the authorizing official, 1426 1426
which we'll get to here in just a second, 1427 1427
what they care a lot about. 1428 1428
A quick story here is I've done a number of systems on 1429 1429
a very traditional streamlined RMF process 1430 1430
following the same people 1431 1431
that Jason's worked very closely with. 1432 1432
They have a very regimented process. 1433 1433
Here's how you're going to do absolutely everything. 1434 1434
There's no room for deviation 1435 1435
because it's really a gigantic bureaucracy. 1436 1436
Things are getting better, 1437 1437
but it's still at the end of the day, it's a long process. 1438 1438
Very strict in the process. 1439 1439
I worked on the side 1440 1440
doing for other people that do RMF, 1441 1441
but they do it a little different way. 1442 1442
And literally, 1443 1443
the person that was doing the assessment for the package 1444 1444
called the authorizing official 1445 1445
at the kickoff of the assessment and said, 1446 1446
what do you care about? 1447 1447
And that conversation 1448 1448
really fed into the entire assessment plan 1449 1449
of what we were going to do and how we assess the system. 1450 1450
And it was much more effective 1451 1451
when we got out what they cared about, 1452 1452
because they were the people who owned the information. 1453 1453
I think that was really important, 1454 1454
and I hope that as people 1455 1455
maybe embark on their own organizational journeys of RMF 1456 1456
or people listening, 1457 1457
and maybe there's somebody in DOD organization 1458 1458
that's like in charge of something, 1459 1459
like that's a great way to do this. 1460 1460
The last piece advice on assessment that I would say here 1461 1461
is like give grace to one another, 1462 1462
because a lot of the time the people coming in to assess you 1463 1463
aren't going to know maybe your system as well as you do 1464 1464
or the tool or technology that you chose to do it. 1465 1465
So they're going to maybe ask 1466 1466
what are perceived to be ridiculous or silly questions 1467 1467
or maybe make them appear ignorant. 1468 1468
And they may be some of the smartest people, 1469 1469
but they just don't know how 1470 1470
this particular vendor's product implements that control. 1471 1471
So going back to what we talked about a little bit before, 1472 1472
and it sounds like Kip and Jason have talked a length about, 1473 1473
this goes back to your soft skills. 1474 1474
So understand that these people are not your enemies. 1475 1475
It may feel like it's a battle, 1476 1476
it may feel like it's a war and they're adversaries, 1477 1477
don't treat them that way, 1478 1478
and this will be a much better time. 1479 1479
-: Yeah, the other thing I would say 1480 1480
that I've had a lot of success with with the RMF process is, 1481 1481
as Drew said, knowing what you're being graded on 1482 1482
and the format that they're expecting to see that in. 1483 1483
So there may be things where it says, you know, 1484 1484
are you doing proper logging? 1485 1485
And that person may want to do that as simply an interview 1486 1486
and go, hey Drew, do you guys do logging? 1487 1487
Yes, we do. 1488 1488
Okay, check, move on, right? 1489 1489
Or you may get an assessor who's saying, 1490 1490
well, show me your logs, 1491 1491
show me exactly how often you rotate your logs, 1492 1492
show me how you're protecting your logs and encrypt them, 1493 1493
show me all of these things, 1494 1494
in which case you got to log in the system 1495 1495
and show them that. 1496 1496
If you already know ahead of time 1497 1497
what you're going to be asked, 1498 1498
you can actually have all this stuff ready to go. 1499 1499
I had one system I was doing an RMF on 1500 1500
and they originally scheduled a week-long assessment. 1501 1501
We were done in two days, 1502 1502
because by the time they showed up, 1503 1503
we had everything printed out, 1504 1504
we had all the checklists, 1505 1505
we knew exactly what to show. 1506 1506
I had basically a big binder, 1507 1507
and I just walked them through everything 1508 1508
and they go, great, you guys are good, 1509 1509
check, move on, we're out of here. 1510 1510
So there is some of that. 1511 1511
And then the other thing I wanted to mention 1512 1512
as far as the assess goes is, 1513 1513
for those of you looking for a cybersecurity career, 1514 1514
this tends to fall into the IT auditing bucket. 1515 1515
So if you're going to be an IT auditor, 1516 1516
very checklist oriented, 1517 1517
very much checking, are these controls right? 1518 1518
Are you observing them? 1519 1519
Are you testing them? 1520 1520
Are you interviewing about them? 1521 1521
And making sure that they're meeting all of the requirements 1522 1522
that were set back in the categorized and select. 1523 1523
Now remember, all the way back in step two and three, 1524 1524
we categorized and we selected 1525 1525
what we are going to basically be graded on 1526 1526
by choosing all those different controls, 1527 1527
and now it's our turn to live up and show that, 1528 1528
yes, we've made those controls actually a reality. 1529 1529
All right, number six. 1530 1530
This gets to be the, what should be a very easy part, 1531 1531
which is the authorization place. 1532 1532
So in the number six of the Risk Management Framework, 1533 1533
we go to authorize. 1534 1534
And this is where your senior official 1535 1535
is going to make their risk decision 1536 1536
based on whether or not they want to authorize that system 1537 1537
to actually be able to operate. 1538 1538
So, if I was in the military for instance, 1539 1539
and I went through the RMF process, 1540 1540
I've got this brand new system 1541 1541
that's going to connect to the top secret network, 1542 1542
somebody has to say, yes, you can connect that. 1543 1543
Now, where this gets a little funky in the real world 1544 1544
is sometimes, they have a hard time figuring out 1545 1545
who is the senior official 1546 1546
who should actually be the one to make that risk decision. 1547 1547
And we could talk a little bit about that as well. 1548 1548
But, Drew, from your perspective, 1549 1549
what have you seen that are challenges 1550 1550
inside this authorization space? 1551 1551
For me, the biggest one I've seen is the finger pointing 1552 1552
of who is the right authorizing official. 1553 1553
-: Yeah, fortunately, 1554 1554
I've never had the who is the right person. 1555 1555
We know exactly who the right person is, 1556 1556
but they just don't have time. 1557 1557
And so really, 1558 1558
you know, I talk a lot about, in my civilian capacity, 1559 1559
about Zero Trust. 1560 1560
And so it's in vogue right now. 1561 1561
Here in RMF, you got to have some trust. 1562 1562
And so if you're an authorizing official, 1563 1563
these things need to be delegated out, right? 1564 1564
So maybe you have an expert of these types of systems, 1565 1565
maybe like you have a delegated authorizing official 1566 1566
for healthcare systems, right? 1567 1567
Because they are very up to speed on, you know, 1568 1568
all the latest in HIPAA and all as we look at, 1569 1569
you know, a global company and organizations, right? 1570 1570
The different like nuances there. 1571 1571
So they're the ones that get to make that risk decision 1572 1572
unless there's like, it rises to some high level, right? 1573 1573
So as practitioners, generally speaking, 1574 1574
this is where people in suits and ties, 1575 1575
wearing, you know, scrambled eggs on their hats 1576 1576
that we call covers, 1577 1577
like very important people are having conversations. 1578 1578
And this is where 1579 1579
there's going to be a lot of prepping your boss 1580 1580
to go have meetings and just be honest and truthful, 1581 1581
but give them what they need to know 1582 1582
and not a whole lot of extra stuff, right? 1583 1583
This goes back, 1584 1584
you probably heard the, you know, talking to a lawyer, 1585 1585
hey, do you know what time it is? 1586 1586
The correct answer was yes or no. 1587 1587
It is not, it is 5:36 PM, right? 1588 1588
Just say, yep. 1589 1589
Hey, is this control done? 1590 1590
The answer is yes. 1591 1591
Like the answer is no. 1592 1592
No, and it'll be done by this day or whatever happens to be. 1593 1593
So I think that's really important. 1594 1594
Other than that, this is up usually like, 1595 1595
if you've done everything above it, 1596 1596
it's a check and you move on, 1597 1597
there's usually some kind of formal documentation 1598 1598
and if that formal documentation happens, 1599 1599
that's when there's a huge party 1600 1600
and you print it up like poster size, 1601 1601
tack it to the wall, 1602 1602
everybody goes home, you know, 59 minutes early. 1603 1603
-: Yeah so, you know, when we talk about authorize, 1604 1604
you know, the cases where I've had issues is, 1605 1605
specifically about five to 10 years ago, 1606 1606
the Navy started doing a switch 1607 1607
and they created a Fleet Cyber Command 1608 1608
that was now in charge of authorization. 1609 1609
Well, a lot of the other commanders 1610 1610
in different fleet areas like the Pacific region 1611 1611
or the African region or the Europe region thought, 1612 1612
well, hey, I used to be the authorizing official 1613 1613
for all these computer networks. 1614 1614
I still should be able to, 1615 1615
'cause it's operating in my network, 1616 1616
in my geographical region. 1617 1617
And so we had a lot of fights in there 1618 1618
of who was the authorizing official 1619 1619
and why could these people 1620 1620
who used to be able to be authorizing officials 1621 1621
no longer become authorizing officials, 1622 1622
and when can they still act as an authorizing official, 1623 1623
and there was, I think a lot of that has gotten fixed 1624 1624
over the last five, 10 years, 1625 1625
but that was something I saw a lot of finger pointing 1626 1626
back and forth with some of this, 1627 1627
where people just didn't know 1628 1628
who was the person who was authorized. 1629 1629
They go, look, I got approved. 1630 1630
They're like, oh no, that person wasn't actually authorized 1631 1631
to approve that, and that became an issue. 1632 1632
-: You know, that's fascinating, 1633 1633
because I thought what you were going to say is that 1634 1634
people were fighting to not be the authorizing official, 1635 1635
because that's what I see in the private sector 1636 1636
where I would go to somebody and I'd say, 1637 1637
will you please sign off on this risk? 1638 1638
And they're like, nope, not me. 1639 1639
I don't sign off on risk. 1640 1640
And I was like, I couldn't get anybody to sign anything. 1641 1641
-: Well, that became like a real big issue, 1642 1642
especially, you know, I speak for the Navy 1643 1643
'cause I spent a lot of years working in and around the Navy 1644 1644
and what I saw was, you know, the operational commanders, 1645 1645
they want to be able to approve it 1646 1646
because if they can approve it, 1647 1647
they can make that process go as fast as they need. 1648 1648
So when they have a brand new system, 1649 1649
they say, I want this on here 1650 1650
because it can do this new thing I need 1651 1651
to be able to fight this war. 1652 1652
I don't want to wait two years for Fleet Cyber Command 1653 1653
to eventually get around to going through the seven steps, 1654 1654
and they just wanted to fast track it 1655 1655
by doing everything internal to their staff, 1656 1656
they would do their own categorization, 1657 1657
selection, implementation, 1658 1658
they'd assess themselves, 1659 1659
and then bring it to the admiral. 1660 1660
You know, as Drew said, 1661 1661
the scrambled eggs that it's yellow on the top of their cap 1662 1662
if you're an O5 or above in the pecking order of rank 1663 1663
in the military, at least in the Navy. 1664 1664
And so that's how you tell who's the important people 1665 1665
is if they have this scrambled eggs on their hat. 1666 1666
And they want to be able to just sign in and say, 1667 1667
yep, go ahead and connect that thing. 1668 1668
And there's a lot of issues 1669 1669
because of the way the networks are built with the Navy 1670 1670
that you can't always do that, 1671 1671
because they only see their little portion of it, 1672 1672
not the larger network that everybody else is tied into. 1673 1673
So that's where I've seen a lot of problems 1674 1674
with the authorize step. 1675 1675
So just keep that in mind. 1676 1676
Depending on where you work that may become an issue. 1677 1677
But as Drew said, if you prepare ahead of time, 1678 1678
the authorization step should be fairly quick 1679 1679
and fairly painless. 1680 1680
The biggest thing is just getting it onto their desk, 1681 1681
because by the time you're done with this RMF package, 1682 1682
it's 100, 200, 300 pages of documentation, 1683 1683
and trying to get somebody's attention to go through that 1684 1684
and then say yes, 1685 1685
that can be the time consuming part 1686 1686
because it's just so long and they go, 1687 1687
oh, I don't have time for that today, 1688 1688
I'll get to it tomorrow. 1689 1689
And then three months later, they're still, 1690 1690
I'll get to it tomorrow. 1691 1691
So that's kind of the biggest issue I've had 1692 1692
with the authorization piece of it. 1693 1693
And then the last step we get to is monitor, 1694 1694
which is step seven. 1695 1695
And this is where you're going to continuously monitor 1696 1696
your control implementation 1697 1697
and all the risks to your system, 1698 1698
which is the end of our seven steps. 1699 1699
And, at this point, you're basically doing all the work 1700 1700
of a cybersecurity analyst 1701 1701
to make sure your risk controls are meeting the need, 1702 1702
that people aren't breaking into your network, 1703 1703
that everything is working properly, 1704 1704
and if it's not, 1705 1705
then you want to go back and select some new controls 1706 1706
to mitigate new risks and be able to go through. 1707 1707
One last thing I forgot to mention as far as authorize, 1708 1708
the outcome of authorize, 1709 1709
there's three possible outcomes you can have. 1710 1710
One is you can be accepted 1711 1711
and you get your three-year authorization to operate. 1712 1712
One is you can be rejected and they say, 1713 1713
nope, you're not secure enough, 1714 1714
I'm not willing to accept the risk, 1715 1715
too risky, go away. 1716 1716
And the third is you can get what's called 1717 1717
interim authority to operate or IATO, 1718 1718
which gives you 12 months, essentially say, 1719 1719
you're still kind of risky, 1720 1720
I don't want to give you a full authorization, 1721 1721
so I'm going to give you the authority 1722 1722
to start working the system, plug it in, get it going, 1723 1723
but based on your POAM, over the next 12 months, 1724 1724
these are all the things you need to fix 1725 1725
in order to go from this IATO into the full ATO. 1726 1726
And I've seen a lot of IATOs over the years. 1727 1727
The biggest problem with that is, 1728 1728
now it's a one-year refresh cycle 1729 1729
instead of a three-year refresh cycle. 1730 1730
And so you are going to have to go through this RMF process 1731 1731
and go through your POAM pretty quickly 1732 1732
to make sure it's authorized, 1733 1733
otherwise, they will pull you off the network in a year. 1734 1734
So keep that in mind as well. 1735 1735
Sorry, back to monitor now. 1736 1736
Drew, what are your thoughts on monitor? 1737 1737
-: No, I think that's actually a really great point. 1738 1738
I'm glad you brought up the results 1739 1739
of the authorization step 1740 1740
because it does feed into monitor significantly, right? 1741 1741
You tied it in beautifully, right? 1742 1742
If you're a SOC analyst right now, why are you doing that? 1743 1743
And the answer should be, 1744 1744
because people have made a risk decision that have said, 1745 1745
hey, the way we've staffed this, the way we funded it, 1746 1746
the way what tooling we've put in there, 1747 1747
all the sensors and things sending it into your SIEM, 1748 1748
like there's a reason for all of that. 1749 1749
And it shouldn't just be because I thought 1750 1750
it was a good idea 1751 1751
or I listened to Kip and Jason's podcast. 1752 1752
Well, maybe you should do that too, but I digress. 1753 1753
The other reason you might be doing something 1754 1754
is because of that interim authority to operate. 1755 1755
And sometimes you'll hear that also called an ATO 1756 1756
with conditions. 1757 1757
And those conditions will be, 1758 1758
maybe you have to have some kind of enhanced monitoring 1759 1759
or some other kind of like, 1760 1760
hey, we're going to be checking at this like every week, 1761 1761
every two weeks, every month, whatever it happens to be. 1762 1762
Maybe, look like this has happened to absolutely, 1763 1763
I think everyone at some point or another, 1764 1764
you have to do your vulnerability scans, 1765 1765
because like this is not always a continuous process. 1766 1766
It is definitely moving that direction with tools 1767 1767
that do things all the time. 1768 1768
But everyone's familiar with vulnerability scanning, right? 1769 1769
Microsoft Patch Tuesday comes out, 1770 1770
your scanners are updated, 1771 1771
boom, you re-scan your network on Wednesday 1772 1772
because that's when you had that schedule 1773 1773
for your entire package to do. 1774 1774
And man, you have the latest like zero-day vulnerability. 1775 1775
There's not even a patch out, right, literally. 1776 1776
So you have 10.0 CSF scores on every single host, 1777 1777
but you have to submit that process. 1778 1778
You go through this entire thing and they say, 1779 1779
okay, the condition is in, you know, 1780 1780
60 days from this date of this letter or this approval, 1781 1781
you have to submit scans that show that those are all gone. 1782 1782
And so that all goes into that monitoring step. 1783 1783
You're doing your continuous things, 1784 1784
your vulnerability scanning, 1785 1785
we call it cyber hygiene in this industry, right? 1786 1786
You're eating your fruits and vegetables, 1787 1787
you're having a salad with lunch 1788 1788
instead of the burger again that had a salt. 1789 1789
-: Washing your hands. 1790 1790
-: Oh, that absolutely. 1791 1791
You're cyber washing your hands. 1792 1792
So that's really what the monitoring step is, 1793 1793
because the goal and the dream of this, 1794 1794
and this is why I want to leave, 1795 1795
people might be like disheartened at this point, 1796 1796
I want to leave him with the nugget. 1797 1797
If you've done all of this properly 1798 1798
and everyone's bought into it, the monitoring step 1799 1799
gets rid of that three-year number, right? 1800 1800
Because you've agreed, 1801 1801
and this is how we're going to manage this system, 1802 1802
that we're going to operate it on. 1803 1803
So if they're going to do some spot checks, 1804 1804
they're going to do some inspections sometimes, 1805 1805
some assessments, 1806 1806
but ideally, right, 1807 1807
until there's major changes in the system, 1808 1808
we're just going to operate on this cadence. 1809 1809
And so that monitoring step is critical. 1810 1810
So that's where you do what you need 1811 1811
you said you were going to do, 1812 1812
have your evidence or objective quality evidence, 1813 1813
whatever you happen to call in your world, right? 1814 1814
It's your, hey, I said I was going to check this log 1815 1815
every third Tuesday at 6:00 PM in my implementation plan. 1816 1816
I have to have the logs that show I did that, right? 1817 1817
So you're doing all of those things that you said you were 1818 1818
to make sure that the controls are doing 1819 1819
and continue to do what you configured 1820 1820
and set them up to do. 1821 1821
-: Awesome. -: All right. 1822 1822
-: Yeah, so I really appreciate you 1823 1823
sharing your wisdom with us on RMF today, Drew. 1824 1824
I know this was kind of a longer episode 1825 1825
than we're used to doing, 1826 1826
but I thought there was a lot of great information, 1827 1827
especially for people who really dealt with RMF 1828 1828
to kind of see behind the scenes, 1829 1829
what does this process look like 1830 1830
as you move through your seven steps of prepare, 1831 1831
categorize, select, implement, assess, 1832 1832
authorize, and monitor. 1833 1833
If you want to learn more about RMF, stay tuned. 1834 1834
We have another expert that's going to be coming in 1835 1835
to talk with us about RMF. 1836 1836
And one of the reasons 1837 1837
why we start bringing all these experts in and start, 1838 1838
you know, pounding them with all these different questions 1839 1839
is because Kip and I are currently working on 1840 1840
a risk management framework course 1841 1841
that will be the sister course or brother course, 1842 1842
sibling course to the NIST Cybersecurity Framework course 1843 1843
that we did earlier this year. 1844 1844
And that'll be available on Udemy and Udemy for Business. 1845 1845
So if you want to learn more about RMF, 1846 1846
that should be coming out in October timeframe, 1847 1847
and we'll be doing a deep dive into RMF 1848 1848
and all the different pieces and parts of it 1849 1849
and how you do this in the real world 1850 1850
and really dive into it. 1851 1851
And I think we did a really good job today 1852 1852
of giving a really good overview of those seven steps 1853 1853
and where the real world intersects, you know? 1854 1854
'Cause sometimes you read these books and they say, 1855 1855
hey, here's how it's supposed to work. 1856 1856
And then you see what it's like in the real world 1857 1857
and they don't always line up. 1858 1858
There's some of those things where your soft skills 1859 1859
have to come into play 1860 1860
if you want to get through this process sometimes, 1861 1861
and the book won't tell you that, 1862 1862
but it's something that real world practitioners like Drew 1863 1863
can tell you from experience that happens all the time. 1864 1864
So that's kind of why we took the time to do that today. 1865 1865
Before we close up the episode, 1866 1866
I'm going to see if Drew has any final comments 1867 1867
or any words of wisdom to share. 1868 1868
And then I'll go over to Kip. 1869 1869
-: One thing you said that 1870 1870
really resonated with me, Jason, 1871 1871
was if you're trying to get into cybersecurity, 1872 1872
things like those implementation, 1873 1873
about implementing security controls, 1874 1874
or maybe doing some kind of IT auditing, right? 1875 1875
These are great places to get into it. 1876 1876
And quite frankly, my story and my entry into cybersecurity 1877 1877
was implementing controls based on RMF package, 1878 1878
particularly vulnerability management, right? 1879 1879
I started as an administrator and I got into this business 1880 1880
through embracing risk management framework and saying, 1881 1881
hey, this is the rules of the road. 1882 1882
I want to know how they are, 1883 1883
and I became kind of a subject matter expert. 1884 1884
And that opened a multitude of doors to go do cool things. 1885 1885
I know cool things in RMF don't always fit, 1886 1886
but believe me, it opened a ton of doors. 1887 1887
And so, that really resonated with me, Jason, 1888 1888
because that's literally, that's my story. 1889 1889
So I hope that becomes a story for other people 1890 1890
that are listening to this podcast. 1891 1891
-: Awesome. Thank you, Drew. 1892 1892
Kip? 1893 1893
-: I just want to thank Drew for his generosity 1894 1894
and his willingness to share 1895 1895
what it's really like to work with RMF. 1896 1896
Thank you so much, Drew. 1897 1897
-: Absolutely. Thanks for having me. 1898 1898
-: Yeah, thank you again, Drew. 1899 1899
You know, I really appreciate you taking the time today. 1900 1900
And for everybody else, 1901 1901
thank you again for spending another episode 1902 1902
of your Cyber Path with us. 1903 1903
You can always find this and other episodes 1904 1904
at yourcyberpath.com, 1905 1905
and we hope you join us again next time. 1906 1906
Thanks. 1907 1907
-: Thanks, everyone. 1908 1908
(upbeat music)