Authorize Initial Order with airSlate SignNow

Authorize initial order

- This is Christian Espinosa with Alpine Security. This video provides a high level overview of the Risk Management Framework, or RMF. RMF is a risk management framework used by the, primarily, by the Department of Defense and the U.S. Government. It is defined by NIST 800-37, the latest revision is version two which you can see in the top of the PowerPoint page here of the presentation. And the process has six main steps and we're gonna go through those steps at a very high level. Really, there's like a seventh step not listed here and that is preparation. Generally, it's a good idea to prepare for something before you just start it. You're not always gonna be able to prepare as well as you should, but some preparation is better than none. So, the first step, and I'll just kind of run through these from a high level and then we'll dig into them a little more detailed. The first step is to categorize the information system. And, there's a couple inputs that go into the categorization and you can see them on the chart here. There's the architecture description, so the architecture reference models, the system boundaries is extremely important. So, how that system interfaces with other systems and what defines the boundary. There's also organizational inputs that play a role in the categorization. This could be laws, directives. It could be how you handle protected health information for like HIPAA for instance, et cetera. So, that's the categorization and those two inputs go into that, the architecture description and the organizational inputs. Then we have select controls, so we categorize our system, we select the security controls for the system, then we implement those controls, then we assess the controls effectiveness, then somebody makes the decision to accept the risk and authorize the system on the network, and then we want to continuously monitor to make sure that the controls we chose are actually effective. So, that's the six steps and we'll go in a little more detail on each of them. Also, it's important to realize that RMF as the F stands for is a framework, not a regulation. And it's important to realize that because different bodies of the government or defense organizations use RMF differently, they don't follow it the exact same method. So, the army may do it one way, the air force may do it another way, and even within the air force for instance, two units within the air force may do it differently. So, the first step and, this is where we go into a little more information, the first step is to categorize the information system. And, this is to categorize the system and the information on that system that's processed, stored, or transmitted. And, we typically do the categorization based on the three tenants of information security: confidentiality, integrity, and availability or the CIA triad. This is very similar to a business impact analysis in which you identify critical systems, except a business impact analysis typically focuses on the maximum tolerable down time, the recovery time objective, and the recovery point objective. With RMF, we're focused on security. So, the security objectives are CIA: confidentiality, integrity, availability and then we look at the impact values and we rate those low, moderate, or high. Remember, risk is the intersection of the impact and the probability. Then, we assign a security category, which is the bottom of the page here. The security category, or SC, is assigned per information type or per information system. And, it is assigned for the confidentiality, integrity, and availability. Those Xs shown here are replaced with low, moderate, or high. And this helps us determine how to best implement controls to protect that data. A little bit more about information types, it's a confusing topic. There are lots of categories or types of information. It could be privacy, it could be medical such as PHI, it could be intellectual property, it could be classified information, et cetera. And, there could be a law or directive or something that requires information to be protected a specific way. The example we have below here is for protected health information, or PHI. So, our security category for PHI is confidentiality of high, we don't want someone to be able to steal our protected health information. Integrity of high, we don't want someone to be able to go in there and alter my medical records for instance. But, the availability can be low, it's not like a patient has to have their records accessed all the time. And, these could change based on the use case, but this is just a general example. The next step is selecting the security controls. This is defined by NIST 800-53, the latest revision is five. In this step of RMF, we're selecting an initial set of baseline controls for the system based on the categorization classification we did before. And, we wanna consider tailoring and supplementing the baseline set of controls based on risk or local conditions. An example would be if this were a weapon system, for instance, let's say it's a drone aircraft. We would have a baseline set of security controls for that drone aircraft, but if that drone aircraft flies to an enemy territory, depending on the enemy and the country it's flying in, we may need to add additional controls. That's the local condition we're talking about. And, the bottom here, this is an example, an excerpt, of the families of controls in 800-53. So, this is what you would choose for your security controls. Step three is very simple, you implement the controls that you chose in step two. You also want to document how you implement them. Step four, you assess the controls. So, you've categorized the system. You've chosen some controls. You implement the controls. And, now you want to assess those controls to see if they're actually implemented as intended and they're producing the desired results, so are they actually reducing the risk. This is a very important step. A companion guide to NIST 800-53 is NIST 800-53a, which gives you some guidance on how to assess the controls that you chose in 800-53 or just assess controls in general. Here's an excerpt of that. This is from 800-53a and you can see here, it tells you how to do an assessment of the control: Information System Backup. And, it walks you through this process. And this methodology you can apply to any control. It gives you at the very bottom there, which is important, the assessment methods and objectives. So, you can examine, you can interview, and you can test. And, typically, when you do an audit, you need some artifacts from a combination of those to substantiate the control is actually working. The next step, step five, is to authorize the information system. So, when we've gone through the first four steps, now we're getting to the point where we know the controls are working properly 'cause we've assessed them. So, somebody with the right authority has to make the decision to authorize the system to operate in a normal environment. So, they are accepting the risk formally for the system. The next step is to monitor. So, you need to monitor the security controls, this is step six. Once the system is in operations, it's not like that's it. It's not like a set and forget. You have to continuously monitor it because risks change. What may have been a low risk today or a low rated risk could change to critical tomorrow or if there's a different mission for this system, depending on the type of system, if the system is being used in a different capacity, the risk may change as well. So, you have to continually monitor the controls and make sure they're still effective. Environments change, risks change, likelihood of exploits change, so it's important to monitor this routinely. Typically, with RMF, most organizations monitor this once a year or re-assess this once a year. I personally think it should be a little more frequent, especially with a critical system. So, this is a summation of what we talked about. This is the picture we basically started with at the beginning. So, we talked about the inputs into step one, categorization. So, the architecture description, the organizational inputs. Then, we moved on to step two, we're gonna select the controls based on how we categorized the information system or information types. Step three, we're gonna implement the controls we chose or selected in step two. Step four, we're gonna assess to make sure those security controls that we implemented in step three are actually effective. And remember step two, a guide for that is 800-53. Step four, 800-53a. Then, we're gonna authorize it in step five. So, somebody formally has to accept the risk that this system can operate in this environment. And, then step six, we wanna monitor the controls to make sure that they are effective over time and with different conditions. And, this process repeats itself 'cause risk is not a thing you just do once and forget about it. It's something you have continuously assess. Hopefully you found this video useful. It was just intended to be a quick overview of RMF, which is a framework, not a regulation like we talked about. If you have any questions about the video, any comments, any suggestions, or would like a future video, please leave it beneath this video. Also, please subscribe to our channel. We also have a class on the Risk Management Framework. It is the certified authorization professional class, so if you're interested in learning more about Risk Management Framework and this whole process, the class is a four day class. I will put the link beneath this video. Thanks and have a great day working with the Risk Management Framework.