Login Form

Some Reading Ideas

Risk Management Framework - RMF SP 800-37

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (nist.gov)

Prepare Essential activities to prepare the organization to manage security and privacy risks.

Implement the controls and document how controls are deployed.

Categorize the system and information processed, stored, and transmitted based on impact analysis. 

Assess to determine if the controls are in place, operating as intended, and producing the desired results. 

Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)

Authorize: Senior official makes a risk-based decision to authorize the system (to operate).

Monitor: Continuously monitor control implementation and risks to the system. 
Table 1: RMF Steps Including Resources for Implementers and Supporting NIST Publications *Read More at Risk Management Framework (RMF) Overview - Risk Management | CSRC

Cybersecurity Framework

Cybersecurity Framework (CSF) Framework Core (nist.gov)

Identify –   Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. The activities in the Identify Function are foundational for effective use of the Framework. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs. Examples of outcome Categories within this Function include Asset Management; Business Environment; Governance; Risk Assessment; and Risk Management Strategy.

Protect – Develop and implement appropriate safeguards to ensure delivery of critical services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include Identity Management and Access Control; Awareness and Training; Data Security; Information Protection Processes and Procedures; Maintenance; and Protective Technology.

Detect – Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables the timely discovery of cybersecurity events. Examples of outcome Categories within this Function include Anomalies and Events; Security Continuous Monitoring; and Detection Processes. 

Respond – Develop and implement appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident. Examples of outcome Categories within this Function include Response Planning; Communications; Analysis; Mitigation; and Improvements.

Recover – Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact of a cybersecurity incident. Examples of outcome Categories within this Function include Recovery Planning; Improvements; and Communications. 

Read more about NIST Cybersecurity Framework CSF

Regulatory Compliance Standards and Frameworks

EXECUTIVE ORDER 14028, IMPROVING THE NATION'S CYBERSECURITY - NIST Content - Background

Details
Written by: NIST
Parent Category: Resources
Category: Regulatory Compliance Standards and Frameworks

Article Index

Page 2 of 5

Background

Recent incidents have demonstrated the need for the Federal Government to improve its efforts to identify, deter, protect against, detect, and respond to malicious cyber actions and actors. In particular, threat actors are exploiting the pervasive use of software and the complexity of the underlying code and software development and distribution practices. One of the goals of the EO is to assist in developing a security baseline for critical software products used across the Federal Government. The designation of software as EO-critical will then drive additional activities, including how the Federal Government purchases and manages deployed critical software. In particular, the EO seeks to limit acquisition to software that has met security measures such as use of a secure development process and integrity checks that are defined in Section 4(e) of the EO.

Given the broad scope of the EO and its potential impact on both government operations and the software marketplace, NIST set the following goals for the definition of critical software:

  • Clarity – The implementation of the program will drive activity across the entire Federal Government, with impacts on the software industry. Having a clear definition that can be used by the software industry and the Government is vital to the successful implementation of the EO.
  • Viability – For the EO to be viable, its implementation must take into consideration how the software industry functions, including product development, procurement, and deployment. The software marketplace is dynamic and evolves continuously. How software is developed, brought into an organization, and used by an organization is changing rapidly. Software is purchased as a product, as part of a product, and as a service. Software is often modular, consisting of many components.

There are many existing definitions and uses of the term critical. Most are based on how technology supports various tasks or processes, such as safety critical or critical infrastructure. The use of the term in the EO is slightly different because it is based not on the context of use, but on the properties of a given piece of software that make it likely to be critical in most use cases. That is, it focuses on critical functions that address underlying infrastructure for cyber operations and security. This is similar to the concept of Federal Civilian Enterprise Essential IT under the High-Value Assets program.

In order to separate the common usage of critical with the definition under the EO, we will use the term EO-critical when it is unclear which usage is being discussed.

Approach

Given the size, scope, and complexity of the software marketplace and the infrastructure needed within the government to implement the EO, NIST has consulted with key agencies regarding the concept of a phased approach for securing the supply chain of EO-critical software. This will allow both the Federal Government and the software industry to implement the EO in an incremental manner, thus providing the opportunity for feedback and improvements to its processes with each additional phase.

Information technology and Cybersecurity

Critical Software - Definition & Explanatory Material

This section provides the definition of EO-critical software. Following that is a table with a preliminary list of software categories recommended for the initial phase along with some explanatory material. At a later date, CISA will provide the authoritative list of software categories that are within the scope of the definition and to be included in the initial phase of implementation. A pointer to that information will be provided here when available.

Finally, there is a set of FAQs at the bottom of the page that provides answers to questions that may arise about the interpretation of the definition, the phased approach, and other related topics.

EO-critical software is defined as any software that has, or has direct software dependencies upon, one or more components with at least one of these attributes:

  • is designed to run with elevated privilege or manage privileges.
  • has direct or privileged access to networking or computing resources.
  • is designed to control access to data or operational technology.
  • performs a function critical to trust; or,
  • operates outside of normal trust boundaries with privileged access.

The definition applies to the software of all forms (e.g., standalone software, software integral to specific devices or hardware components, cloud-based software) purchased for, or deployed in, production systems and used for operational purposes. Other use cases, such as software solely used for research or testing that is not deployed in production systems, are outside of the scope of this definition. (See FAQ #10 and FAQ #11.)

NIST recommends that the initial EO implementation phase focus on standalone, on-premises software that has security-critical functions or poses similar significant potential for harm if compromised. Subsequent phases may address other categories of software such as:

  • software that controls access to data.
  • cloud-based and hybrid software.
  • software development tools such as code repository systems, development tools, testing software, integration software, packaging software, and deployment software.
  • software components in boot-level firmware; or
  • software components in operational technology (OT).

The table below provides a preliminary list of software categories considered to be EO-critical. This table is provided to illustrate the application of the definition of EO-critical software to the scope of the recommended initial implementation phase described above. As noted previously, CISA will provide the authoritative list of software categories at a later date.

Category of Software

Description

Types of Products

Rationale for Inclusion

Identity, credential, and access management (ICAM)

Software that centrally identifies, authenticates, manages access rights for, or enforces access decisions for organizational users, systems, and devices
  • Identity management systems
  • Identity provider and federation services
  • Certificate issuers
  • Access brokers
  • Privileged access management software
  • Public key infrastructure

Foundational for ensuring that only authorized users, systems, and devices can obtain access to sensitive information and functions

Operating systems, hypervisors, container environments

 

 

Software that establishes or manages access and control of hardware resources (bare metal or virtualized/ containerized) and provides common services such as access control, memory management, and runtime execution environments to software applications and/or interactive users
  • Operating systems for servers, desktops, and mobile devices
  • Hypervisors and container runtime systems that support virtualized execution of operating systems and similar environments

Highly privileged software with direct access and control of underlying hardware resources and that provides the most basic and critical trust and security functions

Web browsers

Software that processes content delivered by web servers over a network, and is often used as the user interface to device and service configuration functions
  • Standalone and embedded browsers
  • Performs multiple access management functions
  • Supports browser plug-ins and extensions such as password managers for storing credentials for web server resources
  • Provides execution environments for code downloaded from remote sources
  • Provides access management for stored content, such as an access token which is provided to web servers upon request

Endpoint security
 

Software installed on an endpoint, usually with elevated privileges which enable or contribute to the secure operation of the endpoint or enable the detailed collection of information about the endpoint
  • Full disk encryption
  • Password managers
  • Software that searches for, removes or quarantines malicious software
  • Software that reports the security state of the endpoint (vulnerabilities and configurations)
  • Software that collects detailed information about the state of the firmware, operating system, applications, user and service accounts, and runtime environment
  • Has privileged access to data, security information, and services to enable deep inspection of both user and system data
  • Provides functions critical to trust

Network control

Software that implements protocols, algorithms, and functions to configure, control, monitor, and secure the flow of data across a network
  • Routing protocols
  • DNS resolvers and servers
  • Software-defined network control protocols
  • Virtual private network (VPN) software
  • Host configuration protocols
  • Privileged access to critical network control functions
  • Often subverted by malware as the first step in more sophisticated attacks to exfiltrate data

Network protection

Products that prevent malicious network traffic from entering or leaving a network segment or system boundary
  • Firewalls, intrusion detection/ avoidance systems
  • Network-based policy enforcement points
  • Application firewalls and inspection systems
  • Provides a function critical to trust, often with elevated privileges

Network monitoring and configuration

Network-based monitoring and management software with the ability to change the state of—or with installed agents or special privileges on—a wide range of systems
  • Network management systems
  • Network configuration management tools
  • Network traffic monitoring systems
  • Capable of monitoring and/or configuring enterprise IT systems using elevated privileges and/or remote installed agents

Operational monitoring and analysis

 

Software deployed to report operational status and security information about remote systems and the software used to process, analyze, and respond to that information
  • Security information and event management (SIEM) systems
  • Software agents widely deployed with elevated privilege on remote systems
  • Analysis systems critical to incident detection and response and to forensic root cause analysis of security events
  • Often targeted by malware trying to deactivate or evade it

Remote scanning

Software that determines the state of endpoints on a network by performing network scanning of exposed services
  • Vulnerability detection and management software
  • Typically has privileged access to network services and collects sensitive information about the vulnerabilities of other systems

Remote access and configuration management

Software for remote system administration and configuration of endpoints or remote control of other systems
  • Policy management
  • Update/patch management
  • Application configuration management systems
  • Remote access/ sharing software
  • Asset discovery and inventory systems
  • Mobile device management systems
  • Operates with significant access and elevated privileges, usually with little visibility or control for the endpoint user

Backup/recovery and remote storage

Software deployed to create copies and transfer data stored on endpoints or other networked devices
  • Backup service systems
  • Recovery managers
  • Network-attached storage (NAS) and storage area network (SAN) software
  • Privileged access to user and system data
  • Essential for performing response and recovery functions after a cyber incident (e.g., ransomware)
Hits: 1614
Main Menu

FIPS PUB 200 Minimum Security Requirements

FIPS PUB 200 Minimum Security Requirements - Visit FIPS 200, Minimum Security Requirements for Federal Info and Info Systems | CSRC (nist.gov)
  • Access Control (AC)
  • Awareness and Training (AT)
  • Audit and Accountability (AU)
  • Certification, Accreditation, and Security Assessments (CA)
  • Configuration Management (CM)
  • Contingency Planning (CP)
  • Identification and Authentication (IA)
  • Incident Response (IR)

Read FIPS PUB 200 Minimum Security Requirements
  • Maintenance (MA)
  • Media Protection (MP)
  • Physical and Environmental Protection (PE)
  • Planning (PL)
  • Personnel Security (PS)
  • Risk Assessment (RA)
  • System and Services Acquisition (SA)
  • System and Communications Protection (SC)
  • System and Information Integrity (SI)

Standards.gov | NIST

Standards.gov | NIST
Documentary Standards can specify the definition of terms; classifications of components; delineation of procedures; specification of dimensions, materials, processes, products, systems, services, or practices; test methods and sampling procedures; or descriptions of fit and measurements of size or strength. Under the National Technology Transfer and Advancement Act (NTTAA), NIST is assigned the responsibility to coordinate federal, state, and local documentary standards and conformity assessment activities.
Standards.gov | Federal Use of Standards | Standards Incorporated by Reference (SIBR) | Industry Standards | International Standards | Military Standards | Standards Issued or Adopted by Federal Agencies | Standards Search Engines | Voluntary Product Standards

NIST Reading

Whether you're preparing for Cybersecurity certification, working with government standards, or simply starting your career in compliance, these are the NIST Federal Information Processing Standards (FIPS), Special Publication (SP), and Interagency Report (IR) topics you need to know. (The Perils of Mount Must Read™ Confessions of a Cliff Note Junky) These resources go onto the "Mountain of Must Read". If you don't recognize the standard reference, you've missed critical understanding. As of 2022, this is the minimum NIST alphabet. All of these documents are found at https://csrc.nist.gov/publications/ Be very careful about static content. Look at links before you launch them. Never use alternate sites for the Computer Security Resource Center. Get the full list here <NIST Reading Extended>

FIPS Publication 140-2 Security Requirements for Cryptographic Modules [FIPS 140-2]
FIPS Publication 199 Standards for Security Categorization of Federal Information and Information Systems [FIPS 199]
FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems [FIPS 200]
FIPS Publication 201-1 Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS 201-1]		 NISTIR 8212 ISCMA: An Information Security Continuous Monitoring Program Assessment
NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems [SP 800-18]
NIST SP 800-30 Risk Management Guide for Information Technology Systems [NIST SP 800-30]
NIST SP 800-34 Contingency Planning Guide for Federal Information Systems [SP 800-34]

US Cert CISA Tweets