There are many different methodologies for implementing and testing security controls in an IT system to ensure that it is operating under an “acceptable level of risk.” Many of these methodologies require the use of software to aid in this measurement. While the execution of technical tools is important, it can sometimes place a financial burden on an organization (especially a small business) that may not have the resources to purchase the software or hire trained personnel to run the tools and conduct an analysis of the results. This presentation provides an overview of a security testing methodology developed by the Federal Government through the Department of Commerce’s National Institute of Standards and Technology (NIST) Computer Security Division that is available for use by the security community at no cost. The NIST methodology allows an organization to test their security posture by analyzing controls that are listed in 18 different security categories. Attendees will: 1. Be presented a comprehensive security testing approach that limits the need for using automated tools 2. Take away an understanding of National Institute of Standards and Technology (NIST) security controls and learn how to apply them to their information systems 3. Be shown techniques for documenting testing results 4. Be apprised of best practices for conducting security testing of information systems Tom Hasman, Senior Information Security Analyst, SRA International Tom is Senior Information Security Analyst on the Information Assurance team for SRA International. Tom specializes in Security Tests & Evaluations in support of the government’s Certification & Accreditation process. He performs risk assessments and makes recommendations to clients for prioritizing and mitigating vulnerabilities. Tom also develops security policies and procedures for government clients.

1. A Security Testing Methodology
that Fits Every IT Budget
Tom Hasman
SRA International, Inc.
Rochester Security Summit
October 20, 2010

2. 2 Copyright © 2010
Disclaimer
Points of view or opinions expressedPoints of view or opinions expressedPoints of view or opinions expressedPoints of view or opinions expressed
in this presentation do not necessarilyin this presentation do not necessarilyin this presentation do not necessarilyin this presentation do not necessarily
represent the official position orrepresent the official position orrepresent the official position orrepresent the official position or
policies of SRA.policies of SRA.policies of SRA.policies of SRA.
Points of view or opinions expressedPoints of view or opinions expressedPoints of view or opinions expressedPoints of view or opinions expressed
in this presentation do not necessarilyin this presentation do not necessarilyin this presentation do not necessarilyin this presentation do not necessarily
represent the official position orrepresent the official position orrepresent the official position orrepresent the official position or
policies of SRA.policies of SRA.policies of SRA.policies of SRA.

3. 3 Copyright © 2010
About SRA
SRA
– Founded in 1978
– Based in Washington, DC; offices throughout the US - Durham,
NC; San Diego; San Antonio; Colorado Springs; Scranton, PA,
Rochester, NY ☺
– Offices in Europe too – United Kingdom, Germany, France and
the Czech Republic
– Work for government organizations and commercial clients
serving the national security, civil government and global health
markets
– Expertise in areas including: air surveillance and air traffic
management; contract research organization (CRO) services;
cyber security; disaster response planning; enterprise resource
planning; environmental strategies; IT systems, infrastructure
and managed services; logistics; public health preparedness;
public safety; strategic management consulting; systems
engineering; and wireless integration.
– Current workforce: 7,100+ employees
– Website: www.sra.com

4. 4 Copyright © 2010
Speaker Biography
Tom Hasman
– Senior information security analyst on Information
Assurance team at SRA
– Joined SRA in December 2000 – Arlington, VA office
– Background in risk management and security testing;
conducted over 100 risk assessments and security tests
on government systems for clients including EPA, DHS,
DOC, DOI, USITC, and Dept of Treasury
– Advises clients on security policy and how they can
implement a strong risk management program with
limited security resources
– Past speaker at Computer Security Institute (CSI)
Conference and the RSA Security Conference
– MA in Government from Johns Hopkins University and
wrote/defended masters thesis on information warfare.

5. 5 Copyright © 2010
Agenda
Introduction – why test?
Problems with security testing
Alternate testing solution
– Implement security program and controls before testing
Testing security controls
Creating a test report
Best practices
Summary
Questions
POC information and web site link

6. 6 Copyright © 2010
Why Conduct Security Testing?
It’s the Law!
– FISMA - requires federal agencies have an effective program
for protecting their data and information systems (risk
management)
– HIPAA Security Standards
– Sarbanes-Oxley Section 404 Management of Internal Controls
A key component of risk management is the
implementation of a good security testing
program
Security Testing is part of “best practices”
– It increases awareness about security of the system
– Identifies system’s risks, vulnerabilities, etc.
– Provides improved basis for making decisions
– Provides justification of expenditures
– Security Test = High confidence that assets are adequately
protected - assuming the test went well ☺

7. 7 Copyright © 2010
Problems with Security Testing
Cost
– Many security testing methodologies require
the use of expensive software to aid in testing
Expertise
– Even free tools require technical expertise to
analyze results
Time
– A lot of time spent reviewing tool output
Hire an expert = $$$$
Do it yourself = lots of lost time
– Too much time/money spent on technical
solution, not enough time/energy on personnel

8. 8 Copyright © 2010
Alternative Testing Solution
Free “tools” from the federal
government’s Department of Commerce
– National Institute of Standards and Technology
(NIST) Computer Security Division
Requires “minimal” technical background
Series of Special Publications that:
– Help you categorize your system (C, I, A ratings)
– Help you choose the appropriate security control to
implement in your system
– Help you test those controls to ensure that are
implemented correctly (system operating at
“acceptable level of risk.”)

9. 9 Copyright © 2010
Questions to ask before testing
What am I trying to protect?
– How sensitive is the data
Do I have a security program?
– What methodology is used?
– How mature is it?
Have I implemented a minimum set of
security controls?
– Implemented
– Planned
– Accept risk

10. 10 Copyright © 2010
Sensitivity of Data
Based on three security objectives
Confidentiality
– Assurance that information is not disclosed to
unauthorized persons, processes, or devices
Integrity
– Guarding against improper information modification
or destruction
Availability
– Timely, reliable access to data and information
services for authorized users

11. 11 Copyright © 2010
What am I trying to protect?
(Categorize Your System’s C, I, A Levels)
FIPS 199 – security categorization of federal systems
– Use is required for government information systems
– Used to determine C, I, A levels of system
– NIST SP 800-60 – carries out FIPS 199 requirements
NIST SP 800-60 – Guide for Mapping Types of
Information and Information Systems to Security
Categories
– Revision one released in August 2008
– Contains guidelines for mapping types of information and
information systems to security categories
– In other words, helps determine C, I, A levels (L, M, H) based
on type of information system processes
All NIST SP are available at
http://csrc.nist.gov/publications/nistpubs/
index.html

12. 12 Copyright © 2010
What am I trying to protect? (cont)
NIST SP 800-60 Example
Financial Management Heading
LMMSecurity Category Rating
LMLPayments
LMLAccounting
LMMFunds Control
AICInformation Type
Overall Rating = Moderate

13. 13 Copyright © 2010
Do I have a security program?
(Risk Management Framework)
NIST SP 800-37 – Guide for Applying the Risk
Management Framework to Federal Information
Systems
– Latest version released in February 2010
– Old Model
Conduct system certification & accreditation (C&A)
once every 3 years
Ignore IT security program until C&A is due again
– New Model
Maintains the need for a C&A every 3 years
Organizations must practice continuous monitoring
A subset of controls should be tested yearly
Minimizes burden of C&A (controls constantly tested)

14. 14 Copyright © 2010
Have I Implemented a minimum
set of controls?
NIST SP 800-53 Rev3
– Latest version is August 2009 (updates to May 1, 2010)
– Establishes minimum set of security controls based on
system information C, I, A levels
– Document has baseline + “control enhancements” for
those areas where C, I, A is medium or high
– 17 families among Management, Operational and
Technical controls + 1 family for Program Management
– Originally designed for systems but many controls can be
applied at the organization level
Awareness & Training
Incident Response
Contingency Planning

15. 15 Copyright © 2010
Implementing Security Controls (continued)
Rev 3 removed duplicate questions in rev2
– Example: Session Termination (AC-12) and Network
Disconnect (SC-10) very similar
– Now under SC-10 in revision 3
New controls added
– Many new controls in SC family including:
Fail state, honeypots, security of information “at rest”
– Program Management (PM) family also added
Implementing controls at organization level
Ex – appointing CISO, capital planning for security
Offers the ability to designate common- and
hybrid-controls
– Common – implement at a organizational level (AT-2)
– Hybrid – combination of organization/system (CP-2)

16. 16 Copyright © 2010
Implementing Security Controls (cont2)
Minimum Security Requirements
Access Control (T)
Awareness and Training (O)
Audit and Accountability (T)
Security Assessment and Authorization (M)
Configuration Management (O)
Contingency Planning (O)
Identification and Authentication (T)
Incident Response (O)
Maintenance (O)
Media Protection (O)
Physical and Environmental Protection (O)
Planning (M)
Personnel Security (O)
Risk Assessment (M)
Systems and Services Acquisition (M)
System and Communications Protection (T)
System and Information Integrity (O)
Program Management (PM) – organization-wide

17. 17 Copyright © 2010
Implementing Security Controls (cont3)
Rev3 also provides priority for control
implementation
– Priority Code (P1) – implement first
– Priority Code (P2) – implement only after all P1
controls are in place
– Priority Code (P3) – implement only after all P1
and P2 controls in place
– Unspecified Priority Code (P0) – government
does not require for federal systems
Organization may choose to implement

18. 18 Copyright © 2010
Implementing Security Controls (cont4)
Use the priority codes to help guide
what controls you will implement
– Make Adjustments for:
Budget
Organizational/company mission
Includes capability to test technical
controls
– Minimizes the need for security scans*
*As long as your honest
*Security scans still needed periodically
*Big organizations should run scans on a
regular basis

19. 19 Copyright © 2010
Now tested
under SC-10
Screen capture from NIST 800-53 rev3

20. 20 Copyright © 2010
Control enhancement is optional – see next slide
NIST SP 800-53 Example #1 (AT-2)

21. 21 Copyright © 2010
No control
enhancements
for L, M, H
NIST SP 800-53
Example #1 (AT-2)
No control
enhancements

22. 22 Copyright © 2010
NIST SP 800-53 Example #2 (AC-2)

23. 23 Copyright © 2010
NIST SP 800-53
Example #2 (AC-2)
Control enhancements
for M, H

24. 24 Copyright © 2010
NIST SP 800-53
Example #2 (AC-2)
No enhancements Enhancements
Control enhancements
for M, H

25. 25 Copyright © 2010
Increasing control
enhancements for each level
NIST SP 800-53
Example #3 (AU-3)
Control enhancements
increase for L, M, H

26. 26 Copyright © 2010
NIST SP 800-53
Example #4 (AT-5)
Optional control
(Not selected for L, M, H)

27. 27 Copyright © 2010
Testing Security Controls
NIST SP 800-53A – used to test implemented controls
Latest version published in June 2010
Three types of tests
– Examine
– Interview
– Test (require the use of automated tools)
Observe – new account with weak password, user attempting
to perform administrative functions, obscuring passwords
Follows the same format as NIST SP 800-53
– 17 control families + 1 program level family
– Categorized under 3 classes
Management, Operational, Technical
Guidelines for testing vary based on sensitivity of
information
– Low, moderate, high system impact levels

28. 28 Copyright © 2010
AT-2: Testing the control

29. 29 Copyright © 2010
AC-2: Assessment Objective

30. 30 Copyright © 2010
AC-2: Testing the baseline control
System Manager, System Administrator, HR

31. 31 Copyright © 2010
AC-2: Testing the control enhancements

32. 32 Copyright © 2010
AU-3: Assessment Objective and
Testing the baseline control

33. 33 Copyright © 2010
AU-3: Testing the control enhancement

34. 34 Copyright © 2010
Test Report
Output of all testing activities
Used to communicate to management
security posture of organization
Several ways to communicate results:
– Table format
– Paragraph format
– Hybrid
Paragraph format – executive summary of
testing activities
Table format – lists test results

35. 35 Copyright © 2010
Pass- PowerPoint slides very detailed and
easy to understand.
- Security posters placed around
building (elevators, kitchen) are
eye catching and communicate
message effectively
- Training records spreadsheet
includes names of all
employees and date PowerPoint
presentation was completed.
- Training coordinator very
knowledgeable
- Employees discussed content of
slides (verified that they
actually took the training)
10/2/10
10/2/10
10/4/10
10/8/10
10/8/10
- Examined security awareness
PowerPoint slides
- Examined security awareness
poster near elevator (wear
badge and don’t let people
tailgate)
- Examined training records Excel
spreadsheet
- Interviewed Training
Coordinator [Name here]
- Interviewed five employees
[list names here]
AT-2
Fail- Account management handbook
contains procedures for opening
and closing accounts but often
system administrator creates
new accounts without system
manager approval
- Human resources rep not contacted
on a regular basis. Result =
many accounts of departed
employees remain open
10/16/10
10/19/10
10/20/10
10/20/10
- Examined Account Management
Handbook V1.4 dated
5/12/10
- Interviewed System Manager
Abigail Hasman
- Interviewed System
Administrator Sam Hasman
- Interviewed Human Resources
Rep Linda Hasman
AC-2
Pass/FailTest ResultTest DateTest MethodControl
Sample Test Report

36. 36 Copyright © 2010
Fail- Visitor sign in log was missing
information. In many cases,
the name of the employee
accompanying the visitor was
not listed. In some other
cases, the date of the visit was
missing.
- Front desk security officers noted
that they are often
overwhelmed with multiple
tasks and therefore can’t
always scrutinize employees
when they are signing in
visitors.
10/2/10
10/2/10
- Examined visitor sign in log for
9/15/10-9/30/10
- Interviewed two front desk
security officers
[list names here]
PE-7
(Visitor
Control)
Pass- Audit procedures very detailed and
contain list of specific events
to be audited.
- Sample report included the list of
audited events identified in the
procedure.
9/30/10
9/30/10
- Examined auditing procedures
- Examined sample audit report
AU-3
Pass/FailTest ResultTest DateTest MethodControl
Sample Test Report (continued)

37. 37 Copyright © 2010
Best Practices
Do not begin testing until you:
– Know sensitivity of system/organizational data
– Have a security methodology in place
– Implemented minimum set of security controls
Give interviewees background on task before
conducting interview
Take interview notes on a laptop
– Do not use paper and pen
Write up test results as you complete
interviews
When possible, try to include something
positive in test results

38. 38 Copyright © 2010
Summary
Testing leads to a good risk management
program
High confidence that assets are protected
from external and internal threats
Following a test methodology such as NIST
or OCTAVE minimizes your need to conduct
expensive and time consuming vulnerability
scans
Practice “Continuous Monitoring” of security
controls

39. 39 Copyright © 2010
Questions

40. 40 Copyright © 2010
Contact Information &
Website for NIST Publications
Tom Hasman
– tom_hasman@sra.com
– 585-473-6512 (office)
– 585-857-3718 (cell)
All NIST SP are available at:
– http://csrc.nist.gov/publications/PubsS
Ps.html