-: In this lesson, 2 2
we're going to talk about the seven-step process 3 3
that's used in RMF. 4 4
Now, we've mentioned these seven steps a couple of times, 5 5
but that's because they're really important. 6 6
In this lesson, we're going to dive a little bit deeper 7 7
into each of those seven steps 8 8
and then in section three of the course, 9 9
we're going to dive into each of those steps individually 10 10
and really break them apart in depth. 11 11
But for now, I really want to give you 12 12
a good overview of what these steps are 13 13
and how they're used inside of RMF. 14 14
Now, the first step in the seven-step process 15 15
is what's called prepare. 16 16
Now, during the prepare phase, 17 17
you're going to be doing all the essential activities 18 18
to get your organization ready 19 19
to manage your security and your privacy risks. 20 20
As you go through the prepare phase, 21 21
it's important for you to remember 22 22
that you're doing this to get ready to execute RMF 23 23
from an organizational and system level perspective. 24 24
And this allows you to get clear guidance on your context 25 25
that you're going to be using during RMF 26 26
as well as the priorities you're going to be using 27 27
for managing your security, privacy, and supply chain risks. 28 28
Now, when we're conducting step one, also known as prepare, 29 29
we're really focused on two big risk areas 30 30
that you need to think about. 31 31
The first is the cybersecurity of your organization 32 32
or the security risks that you're going to be facing. 33 33
And the second is going to be the privacy risks 34 34
that are going to be facing your organization. 35 35
And this is really important as well 36 36
because there are so many data breaches that are occurring 37 37
against organizations in the real world these days. 38 38
And so it's important to think about 39 39
both the cybersecurity aspect 40 40
and how you're going to protect bad actors 41 41
from getting into your network, 42 42
as well as the privacy concerns 43 43
that if they do get into your network, 44 44
what kind of things can they achieve 45 45
and what kind of data can they get their hands on? 46 46
If you keep both of these areas in mind 47 47
as you're preparing yourself, 48 48
you're going to be able to think about 49 49
all the bad things that could happen to your network 50 50
and then figure out what type of controls 51 51
you're going to want to select and implement 52 52
to be able to mitigate those risks later on 53 53
in the seven steps. 54 54
This brings us into our second step. 55 55
And our second step is known as categorize. 56 56
During the categorized step, 57 57
you're going to go through each and every one of your assets. 58 58
This includes your software, your hardware, 59 59
your servers, your network. 60 60
Anything you have in your organization 61 61
that's considered an asset or has some kind of value to you, 62 62
it needs to be categorized 63 63
in step two of the risk management framework. 64 64
During this step, 65 65
we're going to be categorizing all of our systems 66 66
as well as all the information that's being processed, 67 67
stored, or transmitted in that system 68 68
based on an analysis of how big the impact would be 69 69
if those assets were deleted, corrupted, stolen, 70 70
or simply not available when you need them. 71 71
Yes, you can categorize the system 72 72
as an extremely important asset 73 73
and it needs to be protected at all costs, 74 74
but this isn't always necessary 75 75
and it's not always the best practice to do this. 76 76
For example, I have a small network printer 77 77
sitting in my office. 78 78
Now, I might say that this is a critically important asset 79 79
because we only have one printer in our small office 80 80
and if that printer went away, 81 81
we wouldn't be able to print things out. 82 82
So I might say, this is critically important 83 83
and I have to protect it at all costs. 84 84
Well, that might mean 85 85
that I'm going to spend millions of dollars 86 86
to be able to protect this single printer 87 87
because I classified it 88 88
as as this really high and important thing. 89 89
The problem with that though is that printer 90 90
isn't worth more than about $500, 91 91
so if it's going to cost more than $500 to protect it, 92 92
I really shouldn't do it 93 93
because it doesn't make good business sense. 94 94
And these are the kind of things 95 95
that you have to think about 96 96
when you're categorizing something. 97 97
Yes, it may be important, 98 98
but how much value does it hold to your organization? 99 99
In my case, if somebody was able to attack that printer 100 100
and make it so it doesn't even print anymore, that's fine. 101 101
I'll just go to the store, buy a new one for $500, 102 102
bring it back to the office, hook it up, 103 103
and we'll be back up and running in less than an hour. 104 104
So when it comes time to categorize that printer, 105 105
even if it is critically important, 106 106
it may not be a critically high important item in RMF 107 107
because the cost to protect that device 108 108
may actually cost us more than simply replacing the device 109 109
if it was destroyed or hacked by an intruder. 110 110
These are the kind of things you need to think about 111 111
when you're doing your categorization. 112 112
So remember, when it comes to categorizing your system, 113 113
remember that you need to be focused on the information 114 114
that it's processing, storing, and transmitting, 115 115
and then you're going to do your categorization 116 116
based on your analysis based on the impact of loss. 117 117
Now, this is really important 118 118
because that loss is really what we're focused on. 119 119
If I have a one terabyte solid state device 120 120
that I spent $100 to procure, 121 121
but it's holding data that contains 122 122
millions of dollars of value 123 123
because it contains proprietary source code for my company, 124 124
or my customer's data, or things like that, 125 125
well, the value isn't the $99 hard drive, 126 126
but instead it's all the value associated 127 127
with the information that's being stored on that hard drive. 128 128
So we're going to have to categorize that hard drive 129 129
based on the contents of the data 130 130
that's going to be stored or processed on that device, 131 131
and then based on that we can determine 132 132
what type of controls we're going to select. 133 133
And this brings us into step three. 134 134
When we get to step three, we are in the select phase. 135 135
Now, in step three, we're going to select the controls 136 136
that we want to use to protect our different assets. 137 137
Remember, step one, we prepared. Step two, we categorized. 138 138
Now, here in step three, 139 139
we're actually going to select controls to protect those assets 140 140
that we just categorize back in step two. 141 141
Now, at this point, 142 142
all we're doing is selecting the controls. 143 143
We're not actually going to install them or implement them. 144 144
We'll save that for later on. 145 145
But here in step three, 146 146
we are going to be selecting the controls 147 147
and we're going to be using reference controls that we can find 148 148
inside of the NIST Special Publication 800-53 revision 5. 149 149
This document is known as the security and privacy controls 150 150
for information systems and organizations, 151 151
and it's heavily used in both RMF, 152 152
the Risk Management Framework, 153 153
and CSF, the Cybersecurity Framework, 154 154
and both of those are published and created by NIST. 155 155
Now, when it comes to this document, 156 156
which we call the SP 800-53, 157 157
it really is just a big catalog 158 158
of all the different controls that you may choose to use 159 159
when you're trying to protect 160 160
some kind of an information system. 161 161
Now, when it comes to the 800-53, 162 162
I want you to remember that this is not a checklist 163 163
of all the things you need to do to a system. 164 164
Instead, this is just a list of of things 165 165
you can choose from and decide what you want. 166 166
Now, this means it's more like a dictionary 167 167
or an encyclopedia where you can look up what you need 168 168
and then select the particular articles that interest you 169 169
instead of a regular book 170 170
where you would read it from page one 171 171
all the way through to the end of the book. 172 172
Instead, you're going to go through this catalog 173 173
and pick out the things that are relevant to you, 174 174
and you're going to select those controls 175 175
based on the risk to your systems, 176 176
and the data you're trying to protect, 177 177
and the level that you've categorized that data to. 178 178
Again, the higher of the categorization you make, 179 179
the more controls and the more protections 180 180
you're likely going to be using. 181 181
So remember, when you're in this third step, 182 182
which we call the selection phase, we are going to select 183 183
an initial set of controls for our systems 184 184
and then we'll be able to tailor those controls 185 185
as we need to in order to mitigate or reduce the risk 186 186
down to an acceptable level based upon our risk assessment. 187 187
And we're going to keep doing this 188 188
as we go through our seven-step process to make sure 189 189
we get the system down to an acceptable level of risk 190 190
so that our authorizing official 191 191
will be able to accept that system 192 192
and allow us to install it and operate it 193 193
on the corporate network. 194 194
Next, we move into step four, 195 195
and step four is known as implement. 196 196
During step four, 197 197
we're actually going to implement the controls 198 198
that we've selected back in step three. 199 199
So let's say, for example, 200 200
that we want to implement two-factor authentication 201 201
for all of our websites. 202 202
This would be a control that we selected from the SP 800-53, 203 203
but now that we've selected that control 204 204
we have to figure out how we're going to implement it. 205 205
This is because you can do a lot of different methods 206 206
when you're implementing two-factor authentication, 207 207
and according to the Special Publication 800-53 208 208
they really don't care which method you use. 209 209
You could use a hardware token. 210 210
You could use a software token. 211 211
You could use text messaging to give you a one-time code 212 212
every time you try to log into the system. 213 213
All these are acceptable things you can use, but again, 214 214
depending on how you classified that system 215 215
that's processing the data, 216 216
you may have certain requirements 217 217
that you're going to want to meet 218 218
in order to make this more or less secure. 219 219
For example, a lot of corporate environments 220 220
will use a two-factor authentication system 221 221
based on SMS or text messaging, 222 222
but if you're working in the context of the US military 223 223
and the Department of Defense, 224 224
they don't allow you to take your smartphone with you 225 225
into the offices where you're doing your work. 226 226
So if I had to use a two-factor authentication 227 227
based on a text message, 228 228
it would not work for that environment. 229 229
And instead, I would use something 230 230
like a physical RSA key fob token 231 231
that rotates the code every 30 to 60 seconds, 232 232
and I can carry that into the building with me 233 233
and I'll be able to use that 234 234
anytime I'm trying to log into a system. 235 235
So again, remember, when it comes to step four, 236 236
we're really focused on implementation 237 237
and how we're going to take the controls we selected 238 238
and how we're going to document how those controls 239 239
are going to be employed within the systems 240 240
and in the environment of operations 241 241
that we're going to be using. 242 242
Another good example of this might be a control that says 243 243
you have to use data at rest 244 244
for any data that's being put on an external hard drive 245 245
or external solid state device. 246 246
Well, there's again, 247 247
lots of different ways you could do this. 248 248
You could use full disc encryption 249 249
using something like BitLocker on Windows, 250 250
or FileVault if you're using a Mac system, 251 251
or you could use individual file level encryption as well. 252 252
It really does depend 253 253
on how you want to configure these controls, 254 254
and that's really what we're focused on in implement 255 255
is how we're going to take those controls we selected 256 256
and then implement them in the real world. 257 257
This brings us to step five, which is assess. 258 258
The assess step is where we've now implemented our controls 259 259
and we need to assess are those controls 260 260
doing what we want them to do 261 261
now that I've implemented some kind of a control, 262 262
like two-factor authentication or data rest encryption. 263 263
Now, how are those controls actually working 264 264
after you've implemented them? 265 265
For example, you might say that you're going to use 266 266
a third party encryption tool. 267 267
Well, if you use a third party encryption tool 268 268
and people are able to crack that tool and access your data, 269 269
that control is not doing what you expected it to do 270 270
and that would be something you'd figure out 271 271
during the assess process. 272 272
Another great example of this 273 273
is that there's a lot of controls you can do 274 274
that are considered administrative controls. 275 275
For example, you might make a policy that says 276 276
nobody can bring their smartphone into your building 277 277
to be able to use in their offices. 278 278
Well, if you do an assessment 279 279
and somebody's able to walk in the front door, 280 280
and they have their smartphone on them 281 281
and nobody catches it, 282 282
that means that control is not effective. 283 283
And so that's what we're talking about 284 284
when we talk about assess in step five of the RMF process. 285 285
We want to make sure those controls 286 286
we selected and implemented are actually doing 287 287
what we thought they were going to do. 288 288
And that's really what we're focused on 289 289
to ensure they're satisfying the controls 290 290
that we're implementing 291 291
as part of our security and privacy requirements. 292 292
This brings us to step number six, 293 293
which is the authorize step. 294 294
In the authorize step, 295 295
this is where you're going to go to your senior official 296 296
and they're going to be able to make a risk-based decision 297 297
to authorize the system to operate 298 298
or tell you that the risk is too high 299 299
and they want you to go back 300 300
and do additional categorization, selection, implementation, 301 301
and assessment to get that risk level back down. 302 302
Now, in every organization, 303 303
whether you're working in a government organization, 304 304
like the military, 305 305
or if you're working in a commercial sector organization, 306 306
like a bank or an insurance company, 307 307
there is going to be somebody 308 308
who's considered that senior official 309 309
who gets to make the decision 310 310
of when you can hook up something to the corporate network. 311 311
Now, the reason for this 312 312
is anytime you attach something to your network, 313 313
you're adding risk to that network 314 314
because every additional workstation, client, smartphone, 315 315
router, or switch does bring some vulnerabilities with it. 316 316
So when we're working on the authorize step, 317 317
we're really focused on saying to that senior official, 318 318
whoever that is, 319 319
"You're going to be responsible for all the risks 320 320
that are now going to be accepted by the organization 321 321
when we go and connect this thing to the network. 322 322
Are you willing to do that? 323 323
Do you understand what the risk level is, 324 324
and is it low enough 325 325
that you feel comfortable accepting that?" 326 326
Now, every organization is going to be different 327 327
in terms of how much risk they're willing to accept. 328 328
For example, if you're working 329 329
in a small startup in Silicon Valley, 330 330
they usually have a very high risk tolerance, 331 331
which means they'll take a lot more risk 332 332
because usually it's not a life and death situation. 333 333
On the other hand, if you're building software 334 334
that's going to be used by nuclear reactors, 335 335
or by a fighter jet, or something like that, 336 336
you need to make sure that the quality assurance is high 337 337
and the risk is low. 338 338
So in those cases, it is a matter of life and death 339 339
because if you're working on a project 340 340
for the software that's going to run an airline 341 341
and that software doesn't work right, 342 342
it can actually cause that plane to crash 343 343
and kill everybody on board 344 344
if the program is not doing what it's supposed to do 345 345
and some kind of threat actor 346 346
has been able to hack that system 347 347
and take control of the plane remotely. 348 348
That would really be a bad day. 349 349
So the authorizing official 350 350
for somebody who's running the airplanes for an airline 351 351
would probably have a much lower risk tolerance 352 352
than somebody at a Silicon Valley startup. 353 353
And that's really what we're talking about 354 354
when we talk about authorization 355 355
as step six of the RMF process. 356 356
The final step we have is step seven, which is monitor. 357 357
Now, during the monitor step, 358 358
we're going to be continuously monitoring 359 359
all of our systems and all of our controls 360 360
to make sure they're working 361 361
and doing what they're supposed to do 362 362
and to make sure the risk level 363 363
is the level we thought it was. 364 364
For example, let's say that you had a system 365 365
that was authorized and you've connected it to the network. 366 366
That system was running something 367 367
like Windows 2016 as its server. 368 368
Now, over time, that's going to become more and more vulnerable 369 369
because, over time, more vulnerabilities are discovered 370 370
and there are going to be more security patches 371 371
that need to be installed to mitigate those vulnerabilities. 372 372
Part of our monitoring process is to ensure 373 373
that we are doing the proper work 374 374
of being able to download, install, and validate 375 375
those security patches are occurring on that given system. 376 376
Now, that sounds like a no-brainer to most people, 377 377
but there are some systems 378 378
where you can't simply update them on the fly 379 379
like you would in a corporate network. 380 380
For example, let's say I had a server 381 381
that was running an ICS/SCADA plant 382 382
for a manufacturing organization. 383 383
I can't always just install another security patch there 384 384
because that could break some of those complex SCADA systems 385 385
that are being operated by that server. 386 386
And so in this case, 387 387
we would have to monitor and see what that risk level is. 388 388
And every time a new patch is coming out 389 389
if we're not installing it, 390 390
we're actually increasing the risk level on that system. 391 391
So over time, we're going to have to go back 392 392
and iterate again and start categorizing, selecting, 393 393
implementing, assessing, authorizing, and monitoring 394 394
over and over again to make sure those systems 395 395
are at the right level of risk 396 396
and a risk level that we're willing to accept. 397 397
Again, this all goes back 398 398
to how you're going to categorize things 399 399
all the way back in step two 400 400
because that's going to determine what level you need to meet. 401 401
And if we have something like an airplane, 402 402
that's kind of a very high level associated with it, 403 403
whereas if I have something 404 404
like a network printer in my office, 405 405
that would have a very low level associated with it. 406 406
And based on that, we'll assign the appropriate resources, 407 407
whether that's people, systems, or technologies 408 408
to make sure we can mitigate that risk level 409 409
down to an acceptable level 410 410
so that we can get the authorization 411 411
to connect it in step six, 412 412
and then moving into monitoring those systems over time 413 413
to ensure the risk level stays where we think it should. 414 414
So remember, during this seventh step, 415 415
when we're doing monitoring of the systems and the controls, 416 416
this is an ongoing process 417 417
and we're going to be assessing the controls effectiveness 418 418
through regular testing and analysis, 419 419
such as doing vulnerability analysis 420 420
or a penetration test against our systems, 421 421
as well as being able to document changes to the systems 422 422
and the environment of operation, 423 423
such as the installation of other patches 424 424
or new versions of the software 425 425
because that will also change your risk risk baseline. 426 426
Also, we want to ensure we're conducting risk assessments 427 427
and impact analysis of these systems, 428 428
and we want to make sure we're reporting 429 429
on the security and privacy posture of the system 430 430
back up to our authorizing official on a regular basis 431 431
so they can keep track of the level of risk 432 432
across the entire organization for your system 433 433
and all the other systems 434 434
that are connected to the corporate network.