-: In this lesson, we're going to talk 2 2
about Step Four in the Real World. 3 3
Step four is the implement step. 4 4
Now, the purpose of the implement step 5 5
is to implement the controls in the security 6 6
and privacy plans for the system and organization. 7 7
As we work through the implement step, 8 8
we're focused on two main outcomes. 9 9
First, the control specified in the security 10 10
and privacy plans have been implemented, 11 11
and second, security and privacy plans have been updated 12 12
to reflect controls as implemented. 13 13
So, let's take a look 14 14
at what this looks like in the real world. 15 15
Now, previously we've talked about step two 16 16
being the categorized step 17 17
and step three being the selection step. 18 18
In step two, we were going through and categorizing 19 19
all of our information and information systems 20 20
based on their confidentiality, 21 21
integrity, and availability requirements, 22 22
as well as some other key factors. 23 23
Then we moved into step three 24 24
where we focused on the selection of the different controls 25 25
to be able to meet the levels that we set up 26 26
inside of our categorization step 27 27
based on our low, medium, or high categorization 28 28
for each of the different factors we were looking at. 29 29
Now, here in step four, we are going to be focused 30 30
on implementing all those different controls 31 31
that we selected back in step three. 32 32
Now, one of the important things to think about 33 33
when it comes to RMF 34 34
is that usually it's not going to be one person 35 35
doing all seven steps of this process. 36 36
Instead, RMF tends to be used by large organizations, 37 37
and each step or maybe a couple of steps 38 38
will be done by different people. 39 39
So, you may have somebody who does the categorization 40 40
and a different person doing the selection, 41 41
or you may have somebody who does the categorization 42 42
and the selection, 43 43
but those people are policy people 44 44
who work on RMF on a daily basis 45 45
and not the system administrators 46 46
who are actually going to have to do the implementation 47 47
of those controls in the physical system. 48 48
When we talk about step four, we are really talking about 49 49
this implementation step where we're actually putting 50 50
all these different controls into place. 51 51
If we're talking about a technical control, 52 52
that means we're doing some kind 53 53
of configuration in that system. 54 54
It may be installing software, 55 55
configuring a piece of hardware, 56 56
or setting up different things inside of your registry 57 57
if you're dealing with a Windows system. 58 58
On the other hand, if you're dealing 59 59
with an administrative or management control, 60 60
you may be creating some sort of a policy 61 61
and in those cases it may be the person 62 62
who categorized the information 63 63
and then did the selection of those controls. 64 64
Because we're dealing 65 65
with some sort of administrative policy 66 66
and a policy person who works RMF 67 67
will be well suited to creating that new policy 68 68
in order to achieve the outcomes that we're trying to do. 69 69
So, keep this in mind when it comes to implementation. 70 70
Oftentimes, this is going to be done by more than one person 71 71
across multiple disciplines 72 72
depending on what type of controls 73 73
you're trying to put in place. 74 74
Another big thing to think about 75 75
when it comes to the implementation step 76 76
is that oftentimes the controls that were selected 77 77
back in step three, the selection step, 78 78
tend to be more generic in nature 79 79
and they won't tell you exactly how to implement them. 80 80
This is why it's important to have specialists 81 81
that do the implementation. 82 82
For example, let's say that I wanted to create 83 83
a full disc encryption requirement as one of my controls. 84 84
Now, the control might say, 85 85
"All servers must utilize full disc encryption." 86 86
That's a pretty generic control statement, 87 87
but to do the implementation of it, 88 88
now my system administrators need to figure out 89 89
what is going to be the best solution 90 90
for that particular control. 91 91
So, if I'm running Windows Server 2019, 92 92
I might go ahead and select using BitLocker 93 93
as my full disc encryption system. 94 94
On the other hand, if I'm using a Mac OS system 95 95
I might use FileVault 2. 96 96
If I'm using a Linux system, 97 97
I may use something else entirely. 98 98
And that's really the idea here 99 99
of implementing the control is that it can be implemented 100 100
in numerous different technical ways 101 101
and it's really up to the implementer 102 102
to make sure they're meeting the intended outcome 103 103
that you're trying to achieve with that particular control. 104 104
Now, as we look at implementation, 105 105
we are going to be implementing all of the different controls 106 106
we've selected for our system. 107 107
If this is a large system, 108 108
we may have hundreds or even thousands of controls. 109 109
I've seen some systems that have over 3,000 controls 110 110
for a brand new server that's going through the RMF process. 111 111
So, this can be a very lengthy part of your RMF process 112 112
and if your system administrators 113 113
and implementers aren't working through their list quickly, 114 114
you can actually take several months 115 115
just trying to build up all of your controls 116 116
and getting them implemented. 117 117
Now, as I said, most of the time the implementer 118 118
is going to be a system administrator. 119 119
So, if you're a system administrator, 120 120
this is really where your part of RMF is going to take place. 121 121
On the other hand, if you're more of an RMF policy person, 122 122
you're really going to be focused 123 123
on getting this RMF package through the process 124 124
and working with those system administrators 125 125
to make sure they're implementing 126 126
all the controls you selected. 127 127
So, remember, when it comes to doing implementation, 128 128
we are looking at each individual security control 129 129
and then we're going to figure out 130 130
what the best solution is to meet that requirement. 131 131
The control itself will not say what vendor you have to use. 132 132
It will not say what tool 133 133
or technology or process you have to use. 134 134
Instead, they're going to say in generic terms 135 135
the outcome you're trying to achieve. 136 136
For example, I want to implement data 137 137
in transit security because I want to make sure data 138 138
going to or from my web server is being encrypted 139 139
before it's being sent over the internet. 140 140
Now, how would I do that? 141 141
I could use SSL version two or version three, 142 142
although I wouldn't recommend it 143 143
because those are old and antiquated, 144 144
or I could use something more modern like TLS 1.2 or 1.3, 145 145
or I could use a VPN 146 146
and that would also give me an encryption tunnel 147 147
between my client and the web server I'm connecting to. 148 148
As you can see, there are lots of different ways 149 149
to implement that control from a technical perspective, 150 150
but the way we're going to choose to do it 151 151
is going to be left up to the implementer, 152 152
which is one of our system administrators. 153 153
Now, sometimes you will have controls 154 154
that will say things that are very specific 155 155
and they might give you a time associated with it, 156 156
or a data transfer requirement, or something like that. 157 157
For example, one of the more specific controls I've seen 158 158
usually has to do with lock screens. 159 159
Generally, the lock screen should be enabled 160 160
anytime you walk away from the computer 161 161
for more than two minutes. 162 162
Sometimes your controls will say 163 163
exactly how long that has to be, 164 164
whether that's 30 seconds, 60 seconds, two minutes, 165 165
five minutes, or 15 minutes. 166 166
And again, this does depend on your organization. 167 167
But going back to step three, 168 168
the person who selected the controls 169 169
when they select this timeout 170 170
will usually indicate what that timeout value needs to be, 171 171
and that would be something that can be implemented 172 172
very quickly on a Windows, Linux, or Mac system 173 173
by a system administrator. 174 174
Now, there are lots of other types of things 175 175
that are going to be prescriptive in nature 176 176
when it comes from the highest levels of your organization. 177 177
And in those cases, 178 178
you're going to have to follow those rules 179 179
and implement the controls as they dictate. 180 180
For example, I used to work in the military, 181 181
which was part of the Department of Defense. 182 182
The Department of Defense 183 183
has these different controls set up 184 184
in what are called STIGs, 185 185
which is a Security Technical Implementation Guide. 186 186
Now, a STIG, or Security Technical Implementation Guide, 187 187
is created by the National Security Agency 188 188
and the Defense Information Security Agency, known as DISA. 189 189
These two organizations work together 190 190
to create a list of controls that should be implemented 191 191
on any given system. 192 192
For example, if you're going to be using a Windows Server 2019 193 193
as part of your system that's going through the RMF process, 194 194
you're going to go and first 195 195
download the Security Technical Implementation Guide, 196 196
known as the STIGs, for that particular server. 197 197
As of right now, when I'm recording this, 198 198
if you type in Windows Server 2019 STIG, 199 199
you'll be able to find this document very easily online 200 200
and it comes as an Excel file, a JSON file, or an XML file. 201 201
Inside of this, it has over 300 controls 202 202
that you're going to be able to use 203 203
to be able to protect your system, 204 204
and it tells you this at different levels 205 205
from high, medium, and low, 206 206
which are considered CAT I, 207 207
CAT II, or CAT III vulnerabilities 208 208
if you don't have these things implemented in your system. 209 209
Some of these controls inside of the STIG 210 210
are going to include things like installing security patches, 211 211
while others will require you to make changes 212 212
inside of your registry 213 213
or to set up different configurations. 214 214
For example, one of the STIGs known as V-93539 215 215
is considered a high vulnerability in terms of severity, 216 216
and it's called the Windows Server 2019 217 217
must restrict anonymous access to named pipes and shares 218 218
as its title inside of the STIG. 219 219
Now, what does that mean? 220 220
It means that allowing anonymous access 221 221
to named pipes or shares provides the potential 222 222
for unauthorized system access, 223 223
and therefore, that access needs to be restricted 224 224
to people with a valid username and password 225 225
to protect your system and lower the risk. 226 226
Now, my goal here is not to make you an expert on STIGs, 227 227
but just to make sure I'm introducing you to this concept 228 228
because if you're doing the implementation, 229 229
STIGs are going to be a big part of your day 230 230
as the system administrator. 231 231
Now, in addition to having the STIG, 232 232
it's going to tell you what the vulnerability is, 233 233
what the solution is, and how you can implement it. 234 234
So, it really does give you a lot of great instructions 235 235
for how you can implement all these different controls 236 236
on your various systems based on the different types 237 237
of hardware or software that you may be using. 238 238
Now, the next thing we need to consider 239 239
when it comes to implementing step four in the real world, 240 240
which is our implementation of the controls, 241 241
is that we need to make sure we're having our project 242 242
management skills up-to-date 243 243
so we're ready to tackle all of this information. 244 244
If you're the person who's responsible 245 245
for getting this RMF package through the process, 246 246
one of the hardest steps you're going to go through 247 247
is step four because we have to follow-up 248 248
with different system administrators 249 249
for each of the different systems 250 250
that are part of our package. 251 251
For example, many RMF packages 252 252
aren't for a single system or a single application, 253 253
but it may be an entire collection of systems, 254 254
whether those are servers, 255 255
or workstations, or a combination of both. 256 256
And so, if you have multiple different systems, 257 257
you're also going to have multiple different STIGs 258 258
and controls that are going to be applied across those systems, 259 259
and those different systems have different implementers, 260 260
which we call system administrators. 261 261
So, it's going to be your job 262 262
to work with all those different system administrators 263 263
across all those different systems to get the changes made 264 264
that you need in order to minimize the risk 265 265
of your system and get it through the RMF process. 266 266
For this reason, your project management skills 267 267
are going to be critically important here 268 268
and you're going to be spending a lot of time 269 269
tracking down all the different controls 270 270
that were selected back in step three 271 271
that are now going to have to be implemented 272 272
in step four by these different people across your team. 273 273
When you're building out your plans, 274 274
this includes your implementation plans, 275 275
you need to make sure you're giving dates 276 276
for each of those things. 277 277
In the DO or military context, we usually call this a POA&M 278 278
a plan of action and milestones, or P-O-A-&-M. 279 279
Now, a POA&M is going to be essentially a plan 280 280
for all the things we're going to do 281 281
to get these controls done. 282 282
Let's say you looked at your entire package for RMF 283 283
and you combine all the different systems 284 284
and all the different STIGs and all the different controls, 285 285
you now have about 3,000 changes that need to be tracked 286 286
and implemented across all these different servers, 287 287
and clients, and workstations. 288 288
How are you going to get all that done? 289 289
Well, you're going to list them all out 290 290
probably in a spreadsheet 291 291
or some kind of project management tracking software 292 292
that says control number one, system number one, 293 293
here's the thing we need to do, 294 294
here's the person responsible, 295 295
and here's when it's going to be done. 296 296
Control number two, system number one, 297 297
and you're going to list all those things out 298 298
for all 3,000 controls, all 20 or 30 systems you have, 299 299
and all 15 or 20 implementers that you have, 300 300
and you're going to be following up with those people 301 301
to ensure all that work is being done. 302 302
Now, in most organizations, 303 303
you can't just make changes to servers and systems. 304 304
Instead, you're going to have to go 305 305
through the change management process, 306 306
and that's also going to happen here in step four. 307 307
And usually, your system administrators 308 308
will help you with that process 309 309
because it is going to be specific to your organization. 310 310
Now, when you're doing your implementation, 311 311
it's always important to talk to the people 312 312
who are actually doing the work. 313 313
Now, in our case, that's going to be our system administrators 314 314
who are responsible for implementing all these changes. 315 315
So, if you're working essentially as the project manager 316 316
and trying to get this RMF package 317 317
through from step one to step seven, 318 318
when you're here in step four 319 319
you're going to be working with a lot of different people 320 320
across the organization. 321 321
Always work with those people, 322 322
be friendly and ask them the question, 323 323
"What is your estimate for the timeline 324 324
and what are the big blockers 325 325
that are preventing you from getting this done?" 326 326
Once you identify what those blockers are, 327 327
you're going to need to work with them 328 328
to make sure you can eliminate those blockers 329 329
and allow them to get their work done. 330 330
If somebody tells you it's going to take them 331 331
three months to implement a control, 332 332
which sometimes it can take three, 333 333
six, or nine months to implement a control, 334 334
then you might want to work with them 335 335
and say, "How can we get this 336 336
from six months down to three months? 337 337
How can we get this from three months down to two months? 338 338
What are the things that are holding you up? 339 339
Is it money? 340 340
Is it time? 341 341
Is it that their boss has different priorities than you do?" 342 342
Because this system administrator has a lot of work to do 343 343
beyond just doing the implementation 344 344
for the controls in your RMF package. 345 345
So, it's important that you work with them 346 346
and you don't get angry or frustrated with them 347 347
when things start slowing down. 348 348
Remember, if they tell you it's going to take six months 349 349
then you should say, "Okay, 350 350
I'm going to check up with them again in three months 351 351
and make sure it's still getting done." 352 352
Anything you can do to start compressing that timeline 353 353
and getting this thing through the process faster 354 354
is going to be a good thing. 355 355
But adding more people 356 356
isn't necessarily going to make things go faster. 357 357
There's an old saying, 358 358
"Nine women can't make a baby in one month." 359 359
That's because some things just take time. 360 360
Making a baby takes about nine months 361 361
and so if somebody says, 362 362
"It's going to take me nine months to make this baby," 363 363
you can't tell them, "Well, I need it done in three months," 364 364
there's no way to get it done quicker. 365 365
But when it comes to controls, 366 366
sometimes you can make things go faster 367 367
by adding money, adding resources, 368 368
or eliminating other priorities from their pile. 369 369
For example, I was working on one RMF package 370 370
and there was only one person who had access 371 371
to a particular server that we needed to add controls to. 372 372
Now, we only had five controls 373 373
that needed to be added to that server, 374 374
but the person told me they had a backlog of work 375 375
and that they couldn't get to my stuff 376 376
for at least six months. 377 377
So, I approached them and asked them, 378 378
"What kind of things I could do to help speed this up?" 379 379
And essentially they told me, "Look, I'm just one person. 380 380
I only have 40 hours a week to work, 381 381
and therefore I can't get it done 382 382
'cause right now my backlog 383 383
is about five months worth of work." 384 384
So, I went to their boss and I said, "Hey, 385 385
is there anything we can do to reprioritize 386 386
some of this work 387 387
so that we can get these controls implemented faster?" 388 388
Because we were at the point 389 389
where everything else in my RMF package was going to be done 390 390
at about four months 391 391
and this person was telling me it was going to take six months. 392 392
So, after some negotiation and working with their boss 393 393
we were able to reprioritize some of their work 394 394
and get our stuff done at the four month mark 395 395
instead of waiting to the six month mark. 396 396
In this case, it was just a matter of reprioritization 397 397
and not a matter of needing additional resources 398 398
or additional time or additional money, 399 399
but all those are things that you may need to bring 400 400
into that situation in order to resolve 401 401
some of those blockers and get your controls implemented. 402 402
Now, the final thing we want to talk about 403 403
is when you're implementing these different controls, 404 404
it's important to consider the real world circumstances 405 405
surrounding that control. 406 406
For example, you might have a system 407 407
that is labeled as high, 408 408
and therefore requires multifactor authentication 409 409
for people to log in. 410 410
Now, there's lots of different ways 411 411
to implement multifactor authentication. 412 412
One of the cheapest ways 413 413
is to implement two factor authentication 414 414
through the use of a text message. 415 415
Now, this might work great for a lot of organizations, 416 416
but I can tell you 417 417
if you work in a top secret or secret facility, 418 418
this is a horrible system for you to try to use. 419 419
The reason is when you have a secret 420 420
or top secret environment, 421 421
you're not allowed to bring a mobile phone into your office. 422 422
So, I had one system that was fielded 423 423
by the Department of Defense, 424 424
and I was working in a top secret environment at the time. 425 425
Anytime I wanted to log into that website, 426 426
I had had to have a two factor authentication code 427 427
sent to my cell phone. 428 428
Well, that meant I would go and log in on my work computer, 429 429
run upstairs, go to the phone locker, 430 430
get my phone out, walk to the parking lot, 431 431
turn on my phone, get the six digit code, 432 432
write it down on a piece of paper, 433 433
put my phone away, run back to my office, 434 434
and try to enter that six digit code 435 435
all within five minutes before the timeout occurred. 436 436
Now, is this a great working environment for most people? 437 437
No, this is a horrible way of doing it. 438 438
So, instead, we shouldn't use text messages 439 439
if we're going to be operating in a secure environment. 440 440
Instead, we should use an RSA key fob 441 441
or we're going to have to use some other form 442 442
of two-factor authentication like a smart card and pin 443 443
instead of using a text message 444 444
going to my personal cell phone. 445 445
Again, this is just a case 446 446
where people didn't consider the real world circumstances 447 447
of a lot of the end users 448 448
who were in the military using the system. 449 449
Instead, they were thinking about 70% 450 450
of the military folks who work 451 451
in an unclassified environment, 452 452
but the 30% that were operating in a secret 453 453
or top secret environment could not use the system 454 454
in an effective way because of this five minute timeout 455 455
and sometimes it would take you more than five minutes 456 456
just to get from your office 457 457
to where your cell phone was stored, 458 458
out by the front doors of the building, 459 459
or over in the parking lot. 460 460
So, these are the things we have to think about 461 461
when we start thinking about the implementation 462 462
of these controls and will they work in the real world? 463 463
So, this goes back to step one 464 464
in your preparation stage 465 465
and understanding what type of environment 466 466
your system is going to be used in. 467 467
Based on that, you'll then categorize the system 468 468
and select appropriate controls to meet the requirements 469 469
that you have based on the categorization of the system. 470 470
If you're trying to implement something 471 471
using multifactor authentication, 472 472
there are lots of ways of doing that, 473 473
but you have to pick the one 474 474
that is right for your operating environment. 475 475
For example, if I'm working with the Navy 476 476
and building a system that's going to be used by a submarine, 477 477
I can't expect them to get cell phone coverage 478 478
because a submarine is underwater. 479 479
Instead, that submarine would have to use a different way 480 480
of doing two-factor authentication, 481 481
such as using a smart card and a pin. 482 482
In addition to that, 483 483
I might have people who are working in a top secret skiff. 484 484
Again, in this environment, 485 485
they're not going to have access to a cell phone 486 486
or an authenticator app on their cell phone. 487 487
So, neither of those options would work for us 488 488
by sending a text message or using an authenticator app. 489 489
And so instead, we're going to have to rely 490 490
on something that can meet the control 491 491
of multifactor authentication 492 492
while still meeting the environment 493 493
of being in a classified space, 494 494
an underwater space, or something like that. 495 495
Keep these things in mind 496 496
as you work through your implementations 497 497
because they're going to be many times 498 498
where you're not able to meet the control as written 499 499
because of the environment that you're operating within. 500 500
Based on that, 501 501
you're going to have to tailor those controls 502 502
and this should be done as a negotiation 503 503
between your system administrators, 504 504
who are implementing those controls, 505 505
and the person who wrote the control. 506 506
If the control was written very specifically 507 507
and it says specifically that you must use text messaging 508 508
as your form of multifactor authentication 509 509
then you're going to have to go back to that person 510 510
who selected that control 511 511
and explain to them why you cannot meet 512 512
that technical control 513 513
and come up with an exception to that control 514 514
that you'll be able to meet 515 515
based on the operating environment.