-: Welcome to Your Cyber Path. 2 2
I'm Kip Boyle, 3 3
and we've got a guest who actually works 4 4
with the risk management framework a lot 5 5
and has some insider knowledge 6 6
on a particular tool 7 7
that sort of advertises itself 8 8
as a way of automating the risk management framework. 9 9
Her name is Rebecca Onuskanich, 10 10
and I hope to heck I said that right. (laughing) 11 11
Good, Rebecca 12 12
So, welcome. 13 13
We're so glad you're here. 14 14
Would you please tell the audience a little bit 15 15
about yourself and the work that you do? 16 16
-: Yeah. Hey, thanks Kip. 17 17
Thanks for having me. 18 18
So, as you mentioned, 19 19
I do work with the risk management framework. 20 20
Particularly, at this point in time, 21 21
I'm working specifically in the Department of Defense, 22 22
so most of my work is the Department of Defense's 23 23
interpretation of the RMF process. 24 24
I have worked in the federal agencies 25 25
for quite a bit of years, 26 26
but now, I'm back in the DOD. 27 27
I started working in this space 28 28
long before it was ever called the RMF process. 29 29
So, I've been in DOD security compliance 30 30
and information assurance for well over 20 years. 31 31
So, I've seen it transition 32 32
from very much keeping work process 33 33
to where we're getting to this point 34 34
of trying to automate the security configuration 35 35
and compliance requirements. 36 36
-: Again, I'm really happy you're here, 37 37
because you're bringing a real depth of expertise 38 38
to this topic for the benefit of our audience. 39 39
And yeah, I recall my first experiences working 40 40
kind of in this space, 41 41
when I was on active duty in the Air Force, 42 42
and let's just say it was primitive, (laughing) 43 43
compared to what we're, you know, 44 44
attempting to do now. 45 45
Well, listen, everybody, as a reminder, 46 46
RMF provides a process that integrates security, privacy, 47 47
and cyber supply chain risk management activities 48 48
all into a systems development life cycle. 49 49
And there's seven steps in the process. 50 50
So, I'll recap them now, and Rebecca, 51 51
you can chime in and, you know, 52 52
tell me if I get any of this wrong, 53 53
'cause I know you have more experience 54 54
with it than I do, 55 55
but the first step is you have to prepare your organization 56 56
to manage security and privacy risk. 57 57
The second step is you have to categorize your system 58 58
and the information that it processes, 59 59
stores, and transmits. 60 60
The third step is you got to get 61 61
into NIST special publication 800-53, 62 62
which is a catalog of controls, 63 63
and you have to select the ones 64 64
that are going to help you reduce risk. 65 65
Step number four is you implement the controls, 66 66
and you document how they're deployed. 67 67
Step number five is you assess to determine 68 68
if the controls are in place, 69 69
that they're operating as they're supposed to, 70 70
and that you're getting the correct results from them. 71 71
Step number six is a senior official then is asked 72 72
to make a risk-based decision 73 73
to authorize the system to operate, 74 74
you know, to become a production system. 75 75
And then the seventh step is 76 76
to continuously monitor the implementation of your controls 77 77
and to make sure that the risks 78 78
to your systems stay reasonable. 79 79
What do you think Rebecca, 80 80
was that an okay summary? 81 81
-: That was perfect, yes. 82 82
-: Okay, great. 83 83
All right, so now, what I want to do is 84 84
I want to really talk about using a particular tool 85 85
to automate some of this work, 86 86
'cause there's a lot to do here. 87 87
And when we were doing pre-show prep, 88 88
Rebecca was saying to me, 89 89
"You know, Kip, this tool, called eMASS, 90 90
it probably doesn't automate 91 91
as much as people might think," 92 92
which was kind of surprising to me. 93 93
I haven't used eMASS, 94 94
but Rebecca, I was hoping you could kind of unpack 95 95
that a little bit and tell people, you know, 96 96
what does that mean? 97 97
-: Yeah, so eMASS does definitely support the framework 98 98
in walking through the actual RMF process. 99 99
And you can do things like, 100 100
when you put your system into eMASS, 101 101
once you have a hardware list and a software list, 102 102
and you do your Nessus vulnerability scanners, 103 103
you do your security technical implementation guide 104 104
or your STIG checklist, 105 105
you can import that data into eMASS, 106 106
and then it will correlate those findings. 107 107
So, let's say that you run an ACAS scan, 108 108
and there is a vulnerability associated with the software 109 109
or a piece of hardware, 110 110
it will associate that security control 111 111
with that piece of software as a non-compliant item. 112 112
But it's not going to actually do things 113 113
like write all of your security documentation for you 114 114
on how you do identification and authentication. 115 115
You've actually got to do that work to put it into eMass. 116 116
-: I see, okay. 117 117
So, maybe eMASS would be better characterized 118 118
as just like a data store 119 119
and just a way to organize yourself. 120 120
Do you think that's a more accurate description 121 121
of what it does? 122 122
-: Yeah, it does definitely keep all of your data, 123 123
all of your system identification information, 124 124
like, you do security categorization in there. 125 125
So, we're talking step one, preparing. 126 126
That's when we build our system in eMASS. 127 127
When we start to move it or, step zero, prepare. 128 128
Step one, we start to look 129 129
at actually getting our team together. 130 130
That's when we assign all of the individuals eMASS, 131 131
and then we, you know, add things like our system name, 132 132
start looking at what version are we working on, 133 133
what network is it going on? 134 134
And then, when we move into that categorization phase, 135 135
eMASS does a very good job 136 136
of helping us categorize our system 137 137
based on NIST Special Publication 800-60 Volume II, 138 138
and then select our security controls from there. 139 139
-: Okay, okay. 140 140
So, eMASS is helpful, 141 141
I guess is my takeaway from this part of our conversation. 142 142
And so, it's worth us, you know, 143 143
spending some more time on the episode now to, you know, 144 144
kind of understand it a little bit better. 145 145
And I suppose I should probably stop at this point 146 146
and tell people that eMASS is an acronym, 147 147
and it actually stands for 148 148
Enterprise Mission Assurance Support Service. 149 149
I'm sure, Rebecca, 150 150
you probably have other names for it, (laughing) 151 151
probably in frustration, but that's- (laughing) 152 152
I think that's the proper name. 153 153
So, let's talk about how you use RMF in your work 154 154
before we really start talking about eMASS, 155 155
because my understanding is, you know, 156 156
RMF and eMASS are kind of a one-size-fits-all 157 157
sort of a thing, but not everybody's doing the same kind 158 158
of work at the same scale. 159 159
So, how do you use RMF, and let's start there. 160 160
-: Yeah. So, I come from a tactical world. 161 161
So I come from a, we've got a mission coming up. 162 162
It starts on Sunday. 163 163
We have to get a system authorized 164 164
and out to the field for a military user. 165 165
And so, when we use RMF in that process, 166 166
it's much more agile, 167 167
it's how to be adapted to be flexible, 168 168
and it's all mission focused. 169 169
And when we start looking at system categorization, 170 170
it's more based not only just around confidentiality, 171 171
integrity and availability, 172 172
but we are also looking at the mission aspect of that. 173 173
So, when you start thinking about things 174 174
like weapon systems, IOT, 175 175
you have very unique requirements in those systems 176 176
where they can't necessarily implement 177 177
what would be selected 178 178
from a baseline categorization, 179 179
from a CIA perspective. 180 180
So, that's when tailoring comes in. 181 181
Tailoring is a key part of the control selection process 182 182
that, in my experience, a lot of people forget 183 183
that RMF is the framework that is to be adapted 184 184
by organizations, and it provides the executive leadership 185 185
in those organizations to make decisions 186 186
on how they're going to adapt that framework 187 187
for their systems and their missions. 188 188
And that's really what's left out a lot 189 189
in the DOD's implementation and interpretation of the RMF. 190 190
-: Hmm. Is this tailoring aspect that, 191 191
that people are expected to adapt the RMF 192 192
to their specific situation? Is that right? 193 193
-: That's correct, yes. 194 194
-: Yeah, 195 195
and I would think that, 196 196
especially newer people to RMF would, 197 197
would actually find that maybe a little bit intimidating 198 198
or maybe a little bit like scary, 199 199
'cause it's like, no, I want a checklist. 200 200
What do you mean it's not a checklist, right? 201 201
I mean, do you think that's part of maybe what's going on? 202 202
-: Yeah, and like you, 203 203
I was Air Force before I enlisted, 204 204
and everything is standard operating procedure, 205 205
TTP, we follow a checklist, 206 206
you don't deviate from the checklist, 207 207
'cause there's safety concerns, 208 208
there's mission concerns. 209 209
So, when we talk cybersecurity and RMF, 210 210
and it being such an interpretable process, 211 211
it's very difficult for us to kind of adapt our mindset 212 212
to be able to say, wait, 213 213
we can actually critically think 214 214
about the system design aspects, 215 215
the security requirements, the mission, the users, 216 216
and put all that together, 217 217
and, as a team, sit down and decide 218 218
what is the tailoring aspects of this system, 219 219
the baseline and the tailored controls, 220 220
and then get that authorizing official 221 221
or that AO's buy-in very early. 222 222
So, we designed the system 223 223
where it is not over-engineered 224 224
from a security perspective, 225 225
but it's also protecting the data, 226 226
the users, and the mission. 227 227
-: Yeah. Yeah. 228 228
And, do you think there's a risk that, 229 229
as people try to tailor RMF for their situation, 230 230
that they might make some big mistakes, 231 231
as far as like, they might leave things out 232 232
that they really shouldn't leave out? 233 233
I mean, is there a lot of risk, you know, 234 234
that people are really going to mess up the tailoring? 235 235
-: Yes. 236 236
Tailoring is one of those things, 237 237
and that's why we have such a hard time with it, the DOD. 238 238
And I have seen instances 239 239
where things have been tailored out 240 240
that actually increase the risk to the user 241 241
on the system, and that has to be sent 242 242
to the authorizing official 243 243
to help make that determination, 244 244
because there is a cost to all of this, right? 245 245
-: Yeah. 246 246
-: And especially, as someone who's worked as, you know, 247 247
a security manager, a security engineer, 248 248
we all think cost, we all think budget, 249 249
we all think schedules. 250 250
And that's where we're having a pretty large disconnect 251 251
in the DOD, is that we have our main area of expertise 252 252
and our focus, and we're concern 253 253
on securing data connections, users, risk. 254 254
I mean, cost and schedules, 255 255
that's program managers, that's program office, 256 256
that's not our concern. 257 257
And that's where we, 258 258
we really start to disconnect in the DOD. 259 259
-: Okay. 260 260
This is so helpful. 261 261
I mean, I think for anybody who hasn't worked 262 262
with RMF for very long, or maybe they have, 263 263
and they just find it really frustrating, 264 264
I would hope this conversation would be really helpful 265 265
to them to get them grounded 266 266
on how you actually do this stuff. 267 267
I'm interested though, Rebecca, 268 268
would you kind of tell us how you got into RMF? 269 269
Like, you know, where did this- 270 270
Where did RMF start for you? 271 271
Because to your point, you know, 272 272
you started doing this work before RMF came along, 273 273
but yeah, how did you and RMF meet? 274 274
-: Yeah, I was actually military intelligence, 275 275
and I took an assign networking for central command, 276 276
and I got into it 277 277
when it was still called information insurance. 278 278
So, before the cybersecurity terminology. 279 279
Kip: I remember that. 280 280
-: Yes. 281 281
Back in the pre-DITSCAP, then DITSCAP, 282 282
and then DIACAP days, 283 283
and then, actually, I got into RMF 284 284
when I separated from the Air Force 285 285
and started working for the federal agencies. 286 286
And so, they were already following the 800-37 framework 287 287
at that time. 288 288
And so, I had to learn their process 289 289
and how they do things. 290 290
And then, once I learned that, 291 291
and the DOD switched to the 8510.01 under the RMF, 292 292
I started getting a lot more clients 293 293
who were selling to the DOD 294 294
who needed to understand this new RMF process 295 295
and how to secure and sell to the Department of Defense. 296 296
-: Ah, okay. 297 297
Okay. Well, and you know, 298 298
that's another interesting story that I would love to talk 299 299
with you about, probably not during the episode today, 300 300
but I think what you said is 301 301
that you are actually a business owner, right? 302 302
That you kind of launched your own company 303 303
in order to help, but from a civilian point of view. 304 304
Is that right? 305 305
-: That's correct, yes. 306 306
-: And you know what, 307 307
I don't see a lot of people who leave the military 308 308
who start their own businesses. 309 309
I think that's a fairly uncommon thing. 310 310
That's what I did eventually, 311 311
but it took me a while to get there, 312 312
but I just want to congratulate you 313 313
for taking the road less traveled. 314 314
So, I just think it's really cool. 315 315
-: Thanks! 316 316
-: Yeah, you're welcome. 317 317
So, let's move on. 318 318
Let's continue to unpack this, you know, 319 319
how does RMF, you know, work in the real world? 320 320
And I think a big part of that 321 321
is something you said earlier, 322 322
which is, okay, well we've got RMF, 323 323
it's documented, we have to tailor it, 324 324
but it's kind of a one-size-fits-all thing. 325 325
It doesn't really anticipate, you know, every use case, 326 326
but so, how do you actually use it, right? 327 327
How do you make the best use of it, 328 328
given that it's such a slippery kind of thing? 329 329
-: So, right now, I'm in a situation 330 330
that I am actually starting 331 331
to help the acquisition community. 332 332
So, the acquisition community puts on government contracts, 333 333
the requirements for security, right? 334 334
And typically in the past, 335 335
it would be, you have to comply with DOD 8510.01. 336 336
Well, okay, that's a very- (chuckles) 337 337
A very large assumption is made there, 338 338
that anyone even understands the instructions to begin with. 339 339
And then how to interpret it and how to, you know, 340 340
select their baseline and then tailor. 341 341
So, what we've been working on recently is 342 342
developing acquisition language, 343 343
so that, when something gets put on contract, 344 344
the contractor, the integrator, the developer, 345 345
even a small business like me, 346 346
I understand exactly what I'm selling to the government, 347 347
because I- 348 348
I mean, something as simple as encryption type, 349 349
that I have to build into software, 350 350
can vastly change the cost, right? 351 351
So, I have to bring in someone that understands the- 352 352
A Type 2 encrypter versus a FIPS 140 encryption mechanism. 353 353
The cost of that type of engineer vary significantly 354 354
and the amount of time it'll take to develop. 355 355
So, actually getting into the acquisition cycle is going 356 356
to be key to actually being able 357 357
to implement RMF correctly across the DOD. 358 358
Kip: Mm. 359 359
-: And right now, there's a lot of, 360 360
I don't want to say animosity, 361 361
but there is quite a bit of frustration 362 362
with the RMF process in the DOD. 363 363
And I really think that's because the way 364 364
that it was rolled out, it was- 365 365
The way it was trained 366 366
to all of the security managers, 367 367
it was very much checklist mentality, 368 368
let's categorize the system, 369 369
no real tailoring was implemented, 370 370
and it was a very rigid interpretation of the framework. 371 371
-: Ah, so we're kind of our own worst enemies, right? 372 372
Going back to a previous part of our conversation, 373 373
where we were talking about how necessary it is 374 374
to tailor it, but that our- 375 375
The dominant culture is to not do that. 376 376
The dominant culture is to be very rigid 377 377
and to follow checklists. 378 378
And what I'm hearing you say is, yeah, 379 379
that's actually how they trained us to do it, 380 380
which is not very enabling of the intent. 381 381
And yeah, so I could see a lot of people 382 382
would be frustrated by that, for sure. 383 383
So, okay, so, is that how you were trained 384 384
and you know, how did you work through that 385 385
to be able to use RMF the way it was intended 386 386
versus the way you were trained? 387 387
-: I think that for me, 388 388
I think it was my leadership 389 389
and the fact that I come from a tactical environment, 390 390
it was fast-moving. 391 391
Our leadership all the way up the chain understood 392 392
that security is a priority, 393 393
but also, mission effectiveness is a higher priority. 394 394
So, trying to balance those two things, 395 395
we were able to have those very open conversations 396 396
as to, "Okay, that's fine. 397 397
We don't have time to acquire this encryption that we need, 398 398
or we don't have time to implement this, you know, 399 399
AV solution, and if you want to field it, that's a risk, 400 400
and we have to understand 401 401
what are the consequences of those risks." 402 402
And so, having a leadership- 403 403
Having the leadership in place 404 404
that understood that we could make these trade-offs, 405 405
but we needed to understand what we were trading off 406 406
to ensure that we are doing our due diligence 407 407
to protect the data, the users, and the missions. 408 408
-: Okay. So, in other words, 409 409
my interpretation of what you just said is, 410 410
"Well, I went and got this training on RMF, 411 411
and then I went to the real world." (laughing) 412 412
And the real world said, "Hmm, we have to do a little, 413 413
you have to do things a little differently," 414 414
because, real world, right? 415 415
We've got to balance all these competing priorities, 416 416
and at the end of the day, 417 417
we've got to accomplish the mission, right? 418 418
Whatever that takes. 419 419
And so, those are the real world, you know, 420 420
kind of trade-offs that a person has to make. 421 421
So, yeah, so I guess maybe something that I would say 422 422
to people is, if you're learning RMF, 423 423
or maybe you've already been through the training 424 424
and you're struggling with it, 425 425
what I'm hearing is, you know, 426 426
lean into the reality of the situation that you're in, 427 427
and you know, 428 428
draw what you can from RMF, 429 429
but don't be such a slave to RMF 430 430
that you can't get your mission accomplished. 431 431
Is that like a reasonable way to kind of summarize 432 432
what you were saying? 433 433
-: Yes it is. 434 434
Oh, and the one thing I'm always very adamant 435 435
about telling people is that, make sure you're truthful. 436 436
So, even when you're putting together, 437 437
like your security plan, 438 438
if you're not doing something annotated in there, 439 439
documented, be truthful, you know, 440 440
do a risk analysis on it, 441 441
determine what risks that bring to the system 442 442
and what are some mitigations that can be put into place, 443 443
and then document all of that, 444 444
so you can communicate that up to leadership, 445 445
because, as you mentioned earlier, 446 446
that authorizing official has to sign off on it, 447 447
and they need to actually understand 448 448
the reality of the situation, not a clouded view. 449 449
-: Yeah. 450 450
And it's not reasonable to expect an authorizing official 451 451
to really even understand RMF, is it? 452 452
-: I think, yes, 453 453
I mean, a part of their training 454 454
to be an authorizing official, 455 455
they're supposed to actually take training 456 456
in the RMF process. 457 457
And those that I have worked with recently are pretty aware 458 458
of the RMF process and frustrated with it, right? 459 459
Because it is holding up some progress. 460 460
It is making the system development life cycle take longer. 461 461
-: Yeah, okay. 462 462
-: And from my experience, 463 463
all that hold up is in the middle tier. 464 464
It's all of those middle. 465 465
The leadership, they want to be able 466 466
to make those decisions quickly. 467 467
They want to be able to move quickly, 468 468
but we're holding it up in the middle 469 469
with this whole checklist mentality problem we're having. 470 470
-: Okay, right. 471 471
And you'd mentioned that before. 472 472
Now, in DOD anyway, you had told me previously, 473 473
when we were talking about, you know, 474 474
the episode here we're doing our preparations, 475 475
and you said DOD has some initiatives 476 476
to try and address these issues 477 477
and to actually revise RMF. 478 478
What are you seeing? 479 479
-: Yeah, we're seeing what's called RMF 2.0. 480 480
We're seeing the Fast-Track RMF, or Best-Track ATO. 481 481
We're seeing Continuous ATO. 482 482
So, depending on where you're at in the DOD, 483 483
it's being called a different name, 484 484
but really it, kind of, peel all the layers to it, 485 485
what it means is, 486 486
do very good system security engineering, 487 487
design systems that can be continuously monitored, 488 488
monitor those systems, monitor the risk, 489 489
continue to report that risk up, 490 490
and then your ATO should continue to flow. 491 491
-: Mm. Okay. 492 492
Now, let's define that term for a moment, ATO, 493 493
'cause I don't think we've defined it yet, 494 494
but we've been using it. 495 495
So, what's ATO? 496 496
-: So, your ATO is your authorization to operate. 497 497
So, for the DOD, it's what allows you 498 498
to take a system and actually use it as a DOD entity. 499 499
So, rather that's a standalone system, 500 500
or it's connected to some type of network 501 501
or cloud environment. 502 502
-: Okay. Okay, got it. 503 503
So, which- 504 504
Do you have an opinion of your own, as far as, 505 505
you know, RMF 2.0, Fast-Track ATO, Continuous ATO, 506 506
do you think that they're headed in the right direction 507 507
in terms of addressing what the real, you know, 508 508
issue is with RMF and making it more useful? 509 509
-: I mean, any steps 510 510
for an improvement are helpful, obviously. 511 511
Some of those processes have, kind of, 512 512
a subset of control in the beginning 513 513
that are implemented, 514 514
and then as you move through your ATO process, 515 515
you implement more and more security controls. 516 516
But really, a lot of that should have been done 517 517
in the development life cycle 518 518
for developing software for a system 519 519
that has multiple pieces of software. 520 520
We should have already have done most of that. 521 521
So, I think the initiatives are good. 522 522
I don't think they're, you know, 523 523
the final be all that'll get us 524 524
to where we need to be. 525 525
I honestly believe that a lot of it 526 526
is coming down to the training. 527 527
-: Mm, okay, okay. 528 528
That's really interesting. 529 529
So again, it's not that RMF itself is so much of an issue, 530 530
it's just the culture, the institution, right? 531 531
Trying to evolve itself to this kind of, 532 532
you know, more flexible approach. 533 533
Okay, well that's fascinating, 534 534
and hopefully, with time, you know, 535 535
maybe these two things will meet in the middle. 536 536
RMF will change a little bit, 537 537
and the cultural will change a little bit, 538 538
and we'll be able to get someplace. 539 539
You know, one thing that I was curious about, 540 540
this is a little off-the-cuff question here to you, 541 541
but I've been thinking about the difference 542 542
between RMF and the NIST cybersecurity framework, 543 543
and, you know, some people have said to me, 544 544
"Well, actually, they're kind of complimentary." 545 545
And I think to myself, 546 546
well, they're definitely different, 547 547
and so I suppose they could be complimentary, 548 548
whereas RMF is focused on the, you know, 549 549
development life cycle and the cybersecurity framework is 550 550
really more about an incident orientation. 551 551
So, do you think that the NIST cybersecurity framework 552 552
would be a good way to do step seven, 553 553
that continuously monitor step in RMF, 554 554
or, you know, how do you think 555 555
about the way these two frameworks, kind of, 556 556
fit up to each other? 557 557
-: Yeah, I mean, they definitely have their place, 558 558
They're both a little bit different from each other, 559 559
but they do compliment each other. 560 560
And I do think that I am actually seeing more entities 561 561
in the DOD start looking at the CSF. 562 562
So, the cybersecurity framework, 563 563
and how to bring that 564 564
into that continuous monitoring type phase. 565 565
-: Okay. 566 566
So, you do think that that that's a natural touch point 567 567
for these two frameworks is 568 568
that step seven continuous monitoring. 569 569
Okay, thanks, I appreciate that. 570 570
I was trying to figure that out for myself. 571 571
All right, so, let's see. 572 572
You know, when we were doing show prep, 573 573
you had mentioned a few other things 574 574
that I think our audience would really benefit 575 575
from hearing about, 576 576
which is some examples around, you know, 577 577
some of the difficulties of legacy systems in RMF, 578 578
and, you know, the fact that you've got systems 579 579
that are no longer in a development state, right? 580 580
Their development is finished, 581 581
and maybe they'll never be enhanced again. 582 582
And yet, you're still expected to use a SDLC-style approach 583 583
to achieving approval to operate. 584 584
What's that been like for you? 585 585
How do you deal with a situation like that? 586 586
-: It's been a struggle for everybody involved, right? 587 587
So, we have systems in the DOD that are, I mean, 588 588
designed and deployed in the sixties, the seventies, 589 589
they're not even running on- 590 590
-: Back when they were new. (laughing) 591 591
-: Exactly. (laughing) 592 592
So, a lot of them are still running on that platform. 593 593
And so, when you take something 594 594
that can only take a six-digit password, 595 595
and you try to say, 596 596
"Well, you have to put a 14-character password on it." 597 597
How much development expense do you put 598 598
in finding a developer, first of all, 599 599
and then, I mean, 600 600
are you actually improving the security of that system? 601 601
Is it really a necessary requirement for that system? 602 602
And a lot of that, as we're going through, 603 603
and that's where I believe the training problem is coming 604 604
into play, because those that are saying, 605 605
"Okay, you have to come to my organization 606 606
as a security controls assessor, 607 607
and I'm doing your independent assessment, 608 608
and you only have a six-character password, or even PIN, 609 609
on your system, you fail." 610 610
Well, do you really fail 611 611
if the system isn't capable of doing that? 612 612
And so, that is where we're really struggling in the DOD, 613 613
is that kind of, that's what I said earlier, 614 614
that middle tier, where I have to send my system 615 615
to an assessor who has no idea at all. 616 616
You know, they're right out of college, maybe, 617 617
they're a new airman, 618 618
this is a new position. 619 619
And I'm trying to explain, 620 620
and that's why it's very important that, 621 621
in that documentation, you say, you know, 622 622
you clearly state the system is, you know, 623 623
legacy, it can't support 14-character password. 624 624
And this is a very simple example 625 625
that's very true, but- 626 626
-: Oh, oh it is. 627 627
And you know, Rebecca, as you talk about this, 628 628
I'm reminded of some experiences I've had 629 629
in the private sector, 630 630
where I had a customer who was going 631 631
through a payment card industry 632 632
data security standard audit, right? 633 633
Because they wanted to conform to the PCI DSS, 634 634
and, similar things. 635 635
This was a while ago, but you know, 636 636
there would be a mainframe computer 637 637
that was processing credit card transactions, 638 638
and it was legacy, and you know, 639 639
it just couldn't, you know, 640 640
whether it was a password, 641 641
or just some other things, 642 642
it just could not perform 643 643
to all of the requirements in PCI DSS. 644 644
And so, we had to figure out 645 645
how to create compensating controls 646 646
and do other things 647 647
in order to meet the intent of the requirement, 648 648
knowing that the requirement itself was not going to be met 649 649
in a very, you know, inside that system. 650 650
And so, that sounds very similar to what you said. 651 651
I mean, right? 652 652
That's the same, isn't it? 653 653
-: Absolutely, that's the same. 654 654
Everyone's having the problem. 655 655
Medical community is having it. 656 656
Anybody that is trying to meet a compliance standard 657 657
that is built on modern development processes 658 658
and platforms are having the same issue. 659 659
-: Right, okay. 660 660
So, listen, for anybody out there 661 661
who has experience working in PCI DSS, or HIPAA, 662 662
or what have you, where you're trying 663 663
to take a framework, 664 664
and you're trying to get a legacy system 665 665
to conform to it, 666 666
well, if you come over to RMF, 667 667
welcome to the party, because it sounds like (laughing) 668 668
it's going to just be more of the same. (laughing) 669 669
RMF does another thing too, 670 670
which I thought was really interesting. 671 671
You know, these days, 672 672
we talk about advanced persistent threats, 673 673
and we talk about zero trust, 674 674
and those things really bring up this idea 675 675
of assume breach, right? 676 676
As a philosophy, right? 677 677
Because, for so long, we've been in this mindset 678 678
that we are assuming that a system is not breached, 679 679
so we can build nice walls around it, right? 680 680
And keep it pure, 681 681
but we've realized that 682 682
that's just not the way the world works anymore. 683 683
But, during the show prep, you were saying, 684 684
"Yeah, unfortunately, RMF, 685 685
kind of, hasn't really caught up 686 686
to the reality of assume breach." 687 687
Did I get that right? 688 688
-: Yes, yes. 689 689
So, it doesn't- 690 690
It's not looking at advanced persistent threat. 691 691
So, that's why, in the DOD, 692 692
and not to throw us off track at all, 693 693
but we are really starting 694 694
to look at resiliency and survivability in our systems. 695 695
-: And, and that's- 696 696
This cybersecurity framework is really designed 697 697
around resilience, and I don't know 698 698
that they ever used the term assume breach in there exactly, 699 699
but they certainly do emphasize the fact that, 700 700
you know, it's not all about prevention. 701 701
That you have to detect, respond, and recover as well, 702 702
and be prepared to do those things, 703 703
and as fast as you can, 704 704
because that really matters, 705 705
in terms of being able to survive. 706 706
Okay, so, (laughing) now we get to the part 707 707
that we really were aiming at, 708 708
which is eMASS, right? 709 709
What is eMASS? 710 710
Who should use it, 711 711
and what are its limitations? 712 712
What are the things that are really good about it? 713 713
So, hi Rebecca, I'm new. 714 714
What's eMASS? 715 715
-: So, the first thing to understand about eMASS is 716 716
it is, what we, a call a government off-the-shelf. 717 717
So, you can't go and buy it 718 718
from a commercial vendor. 719 719
It is developed for the DOD by DOD contractors, 720 720
available to DOD users on DOD systems. 721 721
So if you were, you know, 722 722
an integrator or a small business trying to use eMASS, 723 723
or, you know, learn, teach yourself how to use it, 724 724
you can't do that. 725 725
It has to be from a DOD network. 726 726
And so, really, what it does is it helps walk you 727 727
through the seven steps. 728 728
So, you start by registering your system, 729 729
and it's very access-control oriented. 730 730
Restrictions are pretty tight around permissions. 731 731
So, like right now, 732 732
one of my organizations I work with is very small. 733 733
There are two of us. 734 734
And so, we have to get multiple roles in eMASS 735 735
to be able to do all the jobs, 736 736
to work the system through the process. 737 737
-: So, are you having to log out and log back in, 738 738
depending on what step you're trying to accomplish? 739 739
Is it that awkward? 740 740
-: No, they're able to actually give you the permissions 741 741
under one account, thankfully. 742 742
Kip: Oh, good. 743 743
-: But, it's very permission-based, 744 744
which it obviously should be, right? 745 745
We're trying to prevent me from being able to say, 746 746
"Oh, I'm doing this, you know, 747 747
for this control, and I do it really well, 748 748
and oh, let me just go ahead and assess myself." 749 749
You know, you've got to have a separation of duty there. 750 750
-: Right, right. 751 751
Yeah, listening to you talk about using eMASS 752 752
when you were such a small organization, 753 753
makes me think about, 754 754
maybe like a two-person startup who says, 755 755
"Let's use Salesforce for our CRM, you know, (laughing) 756 756
and it's like, wait a minute. 757 757
(Rebecca and Kip laughing) 758 758
That's a highly scaled system, 759 759
and probably not the best place for you to start. 760 760
When I talk with mid-market companies 761 761
about doing different things for the cybersecurity, 762 762
sometimes they'll say to me, 763 763
"Well, what if we get, you know, XYZ product, 764 764
because that's very popular 765 765
and all the big companies use it." 766 766
And I say, "You know, I understand why you say that, 767 767
but that's kind of like putting your 14-year-old son 768 768
into his dad's suit and sending him off to, you know, 769 769
the junior high dance. 770 770
It's really not going to work. 771 771
It's just, you know, 772 772
that suit was never designed for such a small kid, 773 773
and he's going to look silly, and worse yet, 774 774
I mean, it can be so expensive 775 775
to use something that's been sized 776 776
beyond the scale that you're operating at." 777 777
And so what I'm hearing is, 778 778
is that if you're a small organization, 779 779
eMASS can kind of feel like you're wearing, 780 780
you know, too big of a dress. (laughing) 781 781
-: Yeah. But on the other end, if you are- 782 782
So, we work a lot with system of systems. 783 783
I don't know if you've ever talked about that 784 784
in any of your podcasts. 785 785
-: I haven't, we haven't. 786 786
Tell us what that is, please. 787 787
-: So, a system of systems is, 788 788
if you think about, 789 789
think about like Navy Ships, a good example, right? 790 790
It is a system, the ship is a system in its own, 791 791
but there are thousands of systems on that ship 792 792
that have to work together. 793 793
Some of them are standalone, 794 794
some are working together, 795 795
some are communicating back home. 796 796
But that is what we call a system of systems. 797 797
These all have to work together. 798 798
So, eMASS doesn't do a great job 799 799
of looking at risk across that entire enterprise, 800 800
a system of systems, either. 801 801
So, it's really right in that mid-level development size 802 802
of system that works really well in. 803 803
-: Interesting, okay, yeah. 804 804
So, in my brain, I think of like subsystems, right? 805 805
You know, 'cause you can't really operate a ship 806 806
without all these subsystems 807 807
and, kind of, how they integrate with each other. 808 808
You know, if Jason Dion was here, 809 809
he'd be all over this, 810 810
because, as a person who was just retired from the Navy, 811 811
he could probably tell us all kinds of really cool stories 812 812
about, you know, how subsystems on ships 813 813
don't work the way they're supposed to, or what have you. 814 814
But, let's get back to eMASS. 815 815
So, okay, so what I'm hearing is 816 816
eMASS is not something you can buy without a prescription. 817 817
And I'm hearing that eMASS is like kind of complicated, 818 818
and a little difficult to kind of get your arms around, 819 819
and that the only way you're going to get into eMASS is 820 820
if you apply to somebody in the government, right? 821 821
To issue you an account. 822 822
And they probably won't do that 823 823
unless you've got some kind of contract you're working on. 824 824
Is that about right? 825 825
-: Yes, and typically you have to have a DOD CAC. 826 826
So, it is CAC. 827 827
-: Okay. 828 828
And that's a common access, how do- 829 829
Rebecca: Card. 830 830
-: Okay, common access card, right. 831 831
So that's like a smart card, is it not? 832 832
Rebecca: It is. 833 833
-: When I- 834 834
They didn't have these things when I was on active duty, 835 835
so I've heard about them, 836 836
but I've never actually had one. 837 837
And is eMASS web-based or is it like a piece 838 838
of software you install on your local computer? 839 839
-: It is a web-based app, yep. 840 840
-: Okay, okay, got that. 841 841
Okay, cool. 842 842
And now, what else about using eMASS? 843 843
I mean, are there any, in your experience, 844 844
any particular gotchas, or tips, or tricks? 845 845
I mean, like again, hi Rebecca, I new, 846 846
I'm using eMASS for the first time. 847 847
What should I know? 848 848
What else would you tell me so I can be successful? 849 849
-: So, it's going to depend on when you come in 850 850
and the life cycle of your system. 851 851
So, if you come in new to an organization, 852 852
and all of their systems are already built in eMASS, 853 853
you're just, let's say you already have an ATO, 854 854
you'll be working on continuous monitoring. 855 855
So, there are requirements 856 856
to review the security controls 857 857
at a scripted time. 858 858
So, let's say, every three years you're required 859 859
to review your security policies. 860 860
Every year, you're required 861 861
to review your access control rosters. 862 862
So, in eMASS, we actually go in there 863 863
and validate that we review those. 864 864
But, if you're building a new system in eMASS, 865 865
you have to request the access, 866 866
you've got to have somebody 867 867
build the initial system for you. 868 868
So, let's say, you know, you have your system is, 869 869
you know, whatever you want to call it, you know, 870 870
New DOD System 2. 871 871
And then, you sit down and you categorize the system 872 872
and tailor it in there, 873 873
and then that gets approved. 874 874
And so, once your, 875 875
we call it your security controls baseline, 876 876
tailored, once that's been approved, 877 877
then you actually- 878 878
Then the work starts, the implementation, right? 879 879
So you've got to write security policies, 880 880
you've got to add SOPs and TTPs, 881 881
you've got to, what we refer to as, 882 882
harden the system, or utilize the STIGs, 883 883
the security technical implementation guides. 884 884
So, you got to have a software and hardware baseline, 885 885
and you put that into eMASS, actually. 886 886
You will actually put in there, 887 887
you know, I'm using, you know, this Dell version, 888 888
this model, this is the OS that's running on it, 889 889
this is the path level the OS is on. 890 890
You put all of that information in there, 891 891
and you start to build your hardware and software list. 892 892
You'll build what they call the authorization boundary. 893 893
-: Okay. 894 894
-: So, you have to actually say, 895 895
here's all the components, hardware, software, firmware. 896 896
Here's how they're connecting. 897 897
Here's all my ports I'm using. 898 898
Here's all the protocols we're using. 899 899
-: Wow. 900 900
-: So, all of this data 901 901
that supports the system security plan 902 902
goes into eMASS, and you're essentially 903 903
building your system security plan in eMASS. 904 904
-: And this also sounds like 905 905
a really heavy-duty configuration control 906 906
sort of an approach too, right? 907 907
Because I'm hearing you say, like you're putting, you know, 908 908
all these component items in there, 909 909
down to the patch level, 910 910
and getting this all in, 911 911
and I can see why that would be an advantage, 912 912
but I'm also just sort of fatigued 913 913
just thinking about, you know, (laughing) 914 914
all of all of the information 915 915
that I'm going to have to, you know, pound into eMASS. 916 916
So, fascinating. 917 917
Well then, that actually brings up a question 918 918
that I wanted to ask you 919 919
as we get to the end of our episode today, 920 920
which is, is there any risks 921 921
to using eMASS to manage risks? 922 922
-: The number one concern right now, okay, 923 923
now, I'm putting all of my systems, 924 924
all of the software, 925 925
the versions, IP addresses, 926 926
boundary diagrams, ports, protocols, services, 927 927
how I'm a authenticating my users, 928 928
my encryption type. 929 929
Uploading every single design and system security 930 930
engineering aspect into one web-based application, 931 931
which in itself has some vulnerabilities, right? 932 932
That it's web-based. 933 933
Now, you want me to put all of that together, 934 934
along with everyone else's stuff, 935 935
and really, you have built a treasure chest 936 936
for the adversary to get you. 937 937
It is a crown jewel with that piece of software on the web. 938 938
-: Right, huh, I wonder 939 939
if anybody used eMASS to assess eMASS? (laughing) 940 940
-: I do know it has an ATO. (laughing) 941 941
-: Oh, well that's good. (laughing) 942 942
Okay, so that's eMASS. 943 943
Just a quick question, 944 944
are there other ways that you can automate RMF, 945 945
or just make it easier for yourself, 946 946
other than eMASS? 947 947
-: So, Exacto is one of the tools 948 948
that you'll see being used across the DOD. 949 949
The federal side has their own tools. 950 950
So, they have CCM, could not tell you what it stands for. 951 951
-: Okay. 952 952
-: So, and then some organizations develop 953 953
their own internal systems, 954 954
where they'll use things like SharePoint. 955 955
I've seen, you know, custom-build workflow processes. 956 956
I've seen CRM be leveraged 957 957
to build a workload process for this. 958 958
-: Okay, so eMASS is really optional then, 959 959
is what I'm hearing, 960 960
that there's other, you know, 961 961
that RMF doesn't require you to use eMASS, 962 962
and that you can sort of bring 963 963
whatever automation you'd like to the party. 964 964
Is that right? 965 965
-: Well, that was correct. 966 966
Now it's starting, -: Oh-oh. (laughing) 967 967
Now, more services are starting to require it. 968 968
So, across the Air Force, Army, Navy, Marine Corps. 969 969
like I mentioned, you know, 970 970
RMF is an interpretable process, 971 971
so every community has kind of decided 972 972
what tools and which processes they're going to use. 973 973
eMASS is just DOD-funded tool, 974 974
and I do have a couple organizations I work with now, 975 975
who don't use eMASS, 976 976
but they have been mandated to move to it, 977 977
and they are on a large initiative 978 978
to move everything over to eMASS, 979 979
and they're very nervous about. 980 980
-: Oh, okay, okay. 981 981
And probably in a couple of years, 982 982
we'll be talking about, you know, 983 983
how everyone's using eMASS now, and you know, 984 984
different sets of problems. 985 985
So this really- 986 986
The whole thing just really strikes me 987 987
as a bit of a moving target, right? 988 988
-: It's been moving for 20 years, so. (laughing) 989 989
-: Well, welcome to cybersecurity. (laughing) 990 990
'Cause that's just sort of 991 991
the nature of the beast, isn't it? 992 992
Everything is always moving. 993 993
Well, we're running out of time. 994 994
Rebecca, this has been a fantastic conversation, 995 995
and I'm, again, really thankful 996 996
that you've decided to spend 997 997
some of your valuable time talking with me today, 998 998
recording this episode, 999 999
so that people can benefit from your experience. 1000 1000
Is there anything else you want to share? 1001 1001
Just like a final word before we wrap up? 1002 1002
-: My biggest thing, when it comes to cybersecurity, 1003 1003
RMF in the DOD, is really, you know, 1004 1004
do good system security engineering. 1005 1005
Think through problems, 1006 1006
do risk assessments, 1007 1007
document the outcomes, and be honest, 1008 1008
so our leadership can make the best decisions 1009 1009
for their community, 1010 1010
and we've really got to start looking, 1011 1011
one, at training people better, 1012 1012
and two, making your mission-focused decisions 1013 1013
when it comes to cybersecurity 1014 1014
and risk management in the DOD. 1015 1015
-: So, putting the mission first, 1016 1016
and putting RMF and all these other things 1017 1017
in a supporting role, 1018 1018
not making them the point of the work that we do. 1019 1019
I absolutely agree with that. 1020 1020
Rebecca, if anybody wanted to contact you, 1021 1021
after they listen to this episode, 1022 1022
would that be okay? 1023 1023
And how would you like them to do that? 1024 1024
-: Absolutely, and you can email me, 1025 1025
it's Becca, Becca@ICyberI.com, 1026 1026
International Cyber Institute. 1027 1027
That's probably the best way 1028 1028
to get ahold of me, is by email. 1029 1029
-: Okay, and that's the name of your organization 1030 1030
that you started, right? 1031 1031
-: That's correct, yes. 1032 1032
-: Ah, I just think that's fantastic. 1033 1033
I love, as a small business owner, 1034 1034
I love meeting and talking 1035 1035
to other small business owners. 1036 1036
So, thank you so much Rebecca. 1037 1037
You know, everybody, 1038 1038
as with every episode that we create, 1039 1039
you can access a full transcript 1040 1040
of everything we talked about right on our website. 1041 1041
All you have to do is put www.yourcyberpath.com, 1042 1042
forward slash, and then just put the episode number. 1043 1043
This is episode 83. 1044 1044
Just put 83 in your favorite web browser, 1045 1045
and then, you'll be able 1046 1046
to actually pull up the page dedicated to this episode 1047 1047
and access all the show notes 1048 1048
and all of the transcript. 1049 1049
It's a complete transcript. 1050 1050
You can also sign up for my mentor notes. 1051 1051
Now, if you don't know what mentor notes are, 1052 1052
every two weeks, I send out an email. 1053 1053
About 500 words, and I just tell you 1054 1054
something that's going on, 1055 1055
for those of you trying to get into cybersecurity. 1056 1056
Something that's going on that I think will help you. 1057 1057
And so, I focus on being very short, 1058 1058
to-the-point, and practical. 1059 1059
Listen, give it a try. 1060 1060
You can unsubscribe any time. 1061 1061
There's no trouble with that. 1062 1062
If you go to yourcyberpath.com, 1063 1063
you'll find the sign up there. 1064 1064
Like I said, give it a try. 1065 1065
But in any event, we're happy you were here. 1066 1066
Thanks for listening. 1067 1067
We're going to see you next time on Your Cyber Path.