-: In this lesson, 2 2
we're going to talk about authorization boundaries. 3 3
Now, authorization boundaries are really important in RMF 4 4
because they define what will be considered 5 5
in scope for the RMF process that you're undertaking. 6 6
An authorization boundary is the set of system elements, 7 7
comprising the system to be authorized 8 8
for operation or authorized for use 9 9
by an authorizing official. 10 10
For example, we refer to this as the scope of authorization. 11 11
Now, this authorization boundary is used to establish 12 12
the scope of protection for an information system. 13 13
So when this authorization boundary is being stated 14 14
in the RMF process all the way back in the prepare step 15 15
and once you get into step six 16 16
where you're going to the authorization step, 17 17
that authorization official is going 18 18
to be making their decision based on the scope 19 19
and the authorization boundary that you've set-up. 20 20
This authorization boundary is what the organization 21 21
is agreeing to protect under its direct management 22 22
or within the scope of its responsibilities. 23 23
Now, this authorization boundary can include a lot 24 24
of different things, including things 25 25
like people, processes, and information technologies, 26 26
such as system elements that are going to be considered part 27 27
of each system that's supporting the organization's missions 28 28
and business functions. 29 29
These authorization boundaries should be set 30 30
to the appropriate size. 31 31
If they're too small, this means you're going to have a lot 32 32
of little systems that you're going to have to connect together 33 33
because each little system is being considered 34 34
its own authorization boundary and can be approved 35 35
or denied based on its own individual merits. 36 36
On the other hand, if you have a really complex 37 37
or large system, this actually takes a lot more time 38 38
to get through the RMF process 39 39
because you have so many more systems there 40 40
which means there's a lot more risk. 41 41
So as you're determining what your authorization boundary 42 42
is going to be, you need to make sure you have it 43 43
at the right size, not too small and not too large. 44 44
So you may be wondering how do you determine 45 45
how large to make it? 46 46
Well, as I said, if you have it too large, 47 47
you're going to be spending a lot more time 48 48
and money going through the RMF process. 49 49
Conversely though, if you make it too small, 50 50
you're also going to be running up the cost 51 51
to your organization because now, 52 52
you may have 10 different RMF packages 53 53
for 10 different systems, instead of just having one 54 54
or maybe two or three for that same 10 systems. 55 55
To be able to figure out what the right size is, 56 56
you really have to figure out what should be included 57 57
inside of your authorization boundary. 58 58
When you put things inside of your authorization boundary, 59 59
this is basically going to refer to all the sets 60 60
of common controls that are going to be authorized 61 61
for inheritance purposes, and that can be shared 62 62
by all the systems inside of that single RMF package 63 63
or this one authorization boundary. 64 64
For example, if you look 65 65
in the NIST Special Publication 800-37, Revision 2 66 66
which is the guiding document 67 67
for the risk management framework for information systems 68 68
and organizations, that's put out by NIST. 69 69
It shows figure five, which is conceptual view of a system. 70 70
Now notice here, we have a system 71 71
with its authorization boundary inside of the triangle. 72 72
Inside of that system, 73 73
I have three different system elements. 74 74
For example, let's say I was building a web application 75 75
for Dion Training that's going to allow you 76 76
to take practice exams for certifications. 77 77
In my system, I may have three different components. 78 78
The first one might be a website that's going to be hosted 79 79
on a web server. 80 80
This would be my web front-end. 81 81
On the back-end, I might have two different databases, 82 82
one for all of my students and users 83 83
and another for all the exam questions that are being used. 84 84
And so, in this simple system, 85 85
I have a web front-end and two databases. 86 86
This is my three system elements. 87 87
All three of them are going to work together 88 88
and talk to each other during operation. 89 89
But in addition to that, I have a lot 90 90
of other enabling systems that are going to be used 91 91
as part of this web application too. 92 92
For example, if you're going to be taking one 93 93
of my practice exams, 94 94
I need to know which course you've signed up for. 95 95
So it may reach out 96 96
and talk to my learning management system 97 97
which is one of my enabling systems. 98 98
In addition to that, it may reach out and talk 99 99
to my e-commerce system to check, did you actually pay 100 100
and did your credit card payment go through successfully. 101 101
All these are enabling systems that are outside 102 102
of my system authorization boundary 103 103
because I'm only concerned 104 104
with the web application that runs this exam software. 105 105
But I do need to talk to those other components 106 106
outside of this system boundary to get some information. 107 107
And so this is where we're drawing our line and saying, 108 108
"These are the three components I'm going to be looking at 109 109
for this RMF package." 110 110
Those other systems may already be online 111 111
because they've gone 112 112
through their own RMF package previously, 113 113
such as my learning management system 114 114
and my e-commerce system. 115 115
But for this new system I'm going to be doing, I can then say 116 116
this new system is these three system elements, 117 117
I put them together and that is what makes up 118 118
this exam software that I'm going 119 119
through The RMF process for. 120 120
This is a good example of how you can set-up 121 121
your authorization boundary. 122 122
And you do this based on all the systems working together 123 123
for a single operation. 124 124
And in my case, that's delivering practice exams. 125 125
Now, if you're looking at a simple system like this, 126 126
this type of a layout works really well, but 127 127
there's other systems out there that are much more complex. 128 128
Let's use the example of a more complex version 129 129
of a learning management system. 130 130
Now, the learning management system 131 131
might be the authorization boundary, 132 132
but inside that learning management system 133 133
I have multiple different components or subsystems involved. 134 134
For example, I might have one that is dealing 135 135
with all of the hands-on labs that I offer on my website. 136 136
In this case, I have multiple system elements 137 137
associated with that including virtual machines, 138 138
hypervisors, and a lot of different code 139 139
that ties all those things together. 140 140
So, we'll call that subsystem one. 141 141
Then we have subsystem two. 142 142
Subsystem two is focused on our ability 143 143
to give you the right video and play those videos back. 144 144
This is going to have additional system elements 145 145
as part of subsystem two, which includes a web front-end, 146 146
the code that allows you to play videos, 147 147
and the video hosting service underlying all of that. 148 148
Then we might have subsystem three 149 149
and subsystem three might be a reporting engine 150 150
as part of this learning management system. 151 151
So every time you finish a lab 152 152
or every time you finish a video, 153 153
I need to be able to mark that as complete in the the system 154 154
so that if I or one of my other instructors 155 155
want to look up your progress, 156 156
we could do that by using subsystem three, 157 157
which is the reporting part 158 158
of our learning management system. 159 159
But you'll notice how all three 160 160
of these components work together 161 161
inside of this more complex learning management system. 162 162
And over time, we can add a lot of other features 163 163
by adding additional systems and then going through 164 164
the RMF process to be able to get approval to get them added 165 165
into this larger learning management system. 166 166
So we might have labs and videos and reports, but now, 167 167
we might also add the ability to have a textbook online 168 168
or to take a quiz online or things like that. 169 169
All of this allows us to figure out 170 170
where this authorization is going to be. 171 171
And it doesn't mean that these systems 172 172
aren't going to communicate with things 173 173
outside of their authorization boundary 174 174
but instead, we are just saying this is the line 175 175
in the sand that says all the things inside 176 176
of this line are part of this authorization boundary 177 177
and therefore, they're going to be part of my RMF package. 178 178
Now, as I went through this simple example 179 179
of an authorization boundary, 180 180
you saw me use a couple of key terms here. 181 181
First, we talked about authorization boundary 182 182
and then we talked about having three system elements 183 183
that make up a single system in our more simplified version 184 184
of a system, which was going to be used 185 185
for our practice exam web application. 186 186
Now, on the other hand, if we are going 187 187
to the more complex view of a system, 188 188
we had those same three system elements 189 189
making up one subsystem 190 190
and then we had multiple subsystems all working together 191 191
in order to create a larger and more complex system. 192 192
Now, in addition to those elements, 193 193
we also had these enabling systems 194 194
outside of the system authorization boundary. 195 195
And you may be wondering, what is an enabling system? 196 196
Well, an enabling system can provide you 197 197
with common controls, which we call inherited controls 198 198
for your system, or it can include any type of service 199 199
or functionality used by your system that is going to be given 200 200
to you from some kind of an outside environment 201 201
such as having identification and authentication services, 202 202
network services, monitoring functionality, and much more. 203 203
So when you see the term enabling system, 204 204
just remember this is something that is 205 205
outside your authorization boundary 206 206
but it's already been approved to be able to be used 207 207
through the RMF process. 208 208
And so, you're able to take that thing 209 209
and use it as a connection to your system, and it's already 210 210
outside of your boundary, so you don't have to get 211 211
that approved because somebody else is responsible 212 212
for the controls over that system. 213 213
But you're still going to be able to get the benefits 214 214
of using that system 215 215
because it's already been properly authorized 216 216
for use on the overall network. 217 217
And this is one of the really good things 218 218
about using RMF in a larger organization 219 219
because a lot of things have already been approved 220 220
through the RMF process and you could take advantage 221 221
of those things and then implement their controls 222 222
as your own. 223 223
And these become inherited controls. 224 224
For example, in one of my previous organizations, 225 225
we had a very large unclassified network. 226 226
Now I was responsible for that unclassified network 227 227
but a lot of my customers would want us 228 228
to host their own services inside of our network too. 229 229
And the way we did this was we broke up our network 230 230
into multiple different network segments 231 231
and each segment had a series 232 232
of controls that we placed upon them. 233 233
For example, let's say I had one zone 234 234
in my network that was set-up 235 235
for all of my internet of things devices. 236 236
So if I had things like smart speakers 237 237
and TVs and security cameras and all that stuff, 238 238
it was all placed into this IoT area of the network. 239 239
Now, all the people who wanted to bring a system 240 240
that was some sort of an IoT thing, 241 241
they can get approval for their own system through RFM. 242 242
And once they did, we would allow them to then connect 243 243
into our IoT area of our network 244 244
because that area already had a bunch of controls 245 245
that we put in place so that their systems 246 246
can essentially go out to the internet 247 247
and not into any of the other areas of our network. 248 248
Now, we had another part of our network that was used 249 249
for our internet, and it had all of our workstations 250 250
and tablets and phones and things like that. 251 251
And then we had a third part of our network 252 252
that was a DMZ or screen subnet. 253 253
And so if you wanted to host a web server 254 254
or an email server or something like that, 255 255
it would get placed into that DMZ or screen subnet. 256 256
And as you're going through your RMF process, you would know 257 257
that you are being connected to one of those three areas. 258 258
And based on that, I could give you a list 259 259
of all the controls that we do on those areas 260 260
that you now are able to inherit 261 261
because you're connecting into our secure, trusted, 262 262
and already approved network for those areas. 263 263
For example, if you're going to take a web server 264 264
and connect it into my network and you're going to host it 265 265
in my data center, you're not going to be responsible 266 266
for all the physical security 267 267
because it's not your building, it's mine. 268 268
I already have the security guards 269 269
I already have the security cameras. 270 270
I already have the two-factor authentication 271 271
for badging into or out of a room. 272 272
I have the locks on the server cabinets 273 273
and all of that stuff. 274 274
And all of those would be inherited controls 275 275
for you because you're now, as part of my data center 276 276
inside of my screen subnet and my DMZ, 277 277
because we're going to host your web server 278 278
inside of our data center 279 279
and therefore, you're going to inherit all of those controls. 280 280
And so as you're building out 281 281
your system authorization boundary, 282 282
you're going to be able to say, 283 283
I'm not responsible for physical controls 284 284
because those are all handled by Jason and his team. 285 285
Instead, I'm only focused on the logical controls. 286 286
So I'm focused on how people log into my system, 287 287
how people are going to upgrade security patches on my systems, 288 288
how we're going to do vulnerability scans 289 289
on the systems and things like that. 290 290
Because all those logical controls are inside 291 291
of your authorization boundary and they're not part 292 292
of the inherited controls you're getting 293 293
by being a part of my screen subnet or my DMZ.