-: In this lesson, we'll talk 2 2
about step five in the real world. 3 3
Now, step five is the assess step. 4 4
Now, when it comes to the assess step 5 5
our purpose is to determine 6 6
if the controls are implemented correctly, 7 7
operating as intended, and producing the desired outcome 8 8
with respect to meeting the security 9 9
and privacy requirements for the system 10 10
and the organization. 11 11
As we look at our assess step 12 12
we really have eight main outcomes. 13 13
First, we want the assessor 14 14
or assessment team to be selected. 15 15
Second, we need to develop our security 16 16
and privacy assessment plans. 17 17
Third, we need to review and approve those assessment plans. 18 18
Fourth, our control assessments are going to be conducted 19 19
in accordance with the assessment plans. 20 20
Fifth, security and privacy assessment reports 21 21
are going to be developed. 22 22
Sixth, remediation actions to address deficiencies 23 23
in the controls are undertaken. 24 24
Seventh, security and privacy plans are updated 25 25
to reflect control implementation changes 26 26
based on the assessment and remediation actions we took. 27 27
And eighth, our plan of action and milestones 28 28
has been developed and is ready for action. 29 29
So as we look at the assess step 30 30
we are really now going to be focused on going through 31 31
and determining if our controls have been put 32 32
in place properly from our implementation standpoint. 33 33
This means we've prepared, we've categorized, 34 34
we've selected controls 35 35
and we've implemented those controls, 36 36
but now we're verifying 37 37
that we actually implemented them properly 38 38
and we're getting the outcome 39 39
that we expected from those controls. 40 40
Now, in general, I find the assess step to be one 41 41
of the easiest steps inside of the risk management process. 42 42
The reason I say this is because the assess phase 43 43
is really an open book exam. 44 44
Generally, you're not going to be assessing yourself 45 45
and instead you're going to have a third party assessor 46 46
or an assessment team come in 47 47
and do this type of assessment for you. 48 48
Now, that team may not be an external third party, 49 49
but generally speaking, the assessment of your system 50 50
against the risk management framework controls 51 51
is going to be done by some kind of person 52 52
who doesn't report to you through the same reporting chain. 53 53
For example, it might be that I'm working 54 54
on one ship inside the US Navy 55 55
and you're working on another ship in the US Navy. 56 56
So when I need a system looked at, you can assess my system 57 57
and conversely, when you need a system assessed 58 58
I can go and look at your system. 59 59
That type of assessment trade happens all the time 60 60
inside the Department of Defense, 61 61
and this is a way that allows you to be able 62 62
to have some autonomy when you're assessing a system 63 63
because you don't work for that person 64 64
and they're not the person who's signing your paycheck 65 65
or signing your annual evaluation report. 66 66
And so you as an assessor really do have the ability 67 67
to tell them what is wrong 68 68
with the controls as they've implemented them 69 69
so we can have a more secure system. 70 70
Essentially, when it comes time to do an assessment 71 71
the assessor is going to follow a guide 72 72
and that guide is going to contain 73 73
all of the assessment procedures 74 74
for the controls you selected. 75 75
Those controls will come from 76 76
the (indistinct) special publication 800-53 77 77
which is part of our risk management framework 78 78
and specifically it is that 500 page document 79 79
that contains all of the different categories 80 80
and controls that we can use inside of RMF. 81 81
Now, my secret to being successful during this project 82 82
actually is by reading the checklist. 83 83
That's what I like to do first. 84 84
I like to go in there in advance and see exactly 85 85
if they have all the right documentation in place, 86 86
because if I see that somebody doesn't 87 87
have their documentation in place, 88 88
this usually means they didn't also 89 89
implement their controls properly either. 90 90
And so this is a quick way to see 91 91
are they ready for you to come in as an assessor? 92 92
Because if they can't provide you 93 93
with all the documentation you're expecting, 94 94
that can be a case where they're not ready 95 95
for you to actually come in as an assessor 96 96
and they're just going to be wasting your time. 97 97
So you may want to tell them, 98 98
"Hey, here's what I need from you. 99 99
Once you have it, then I'll schedule your assessment." 100 100
In addition to this, 101 101
once you start performing the assessment 102 102
I want you to remember three key words, 103 103
observe, interview and test. 104 104
These are the three things we do as part of our assessment. 105 105
Now, when I talk about observe 106 106
I'm talking about going and watching something happening. 107 107
For example, let's say that you said the screen lock 108 108
was one of your controls and that it should be turned on 109 109
if somebody walks away from the computer 110 110
for more than two minutes. 111 111
Well, what should you do? 112 112
I would go up behind somebody as part of my assessment 113 113
and say, "Don't touch your master keyboard" 114 114
and start a stopwatch. 115 115
And we would wait for two minutes. 116 116
After two minutes, does that system lock itself? 117 117
If it does, they pass that test because you've observed 118 118
that it's doing what it was supposed to do. 119 119
Now, I know that's kind of a simple example, 120 120
but it is one of those controls 121 121
that you're going to see all of the time as an assessor. 122 122
Now, in addition to observing something happening like that 123 123
we can also go to our second thing, which is interview. 124 124
Now with interview, we're going to go and talk to people. 125 125
So I might go around their office and say, 126 126
"Hey, if you get up from the computer 127 127
and it's been two minutes, does your computer lock?" 128 128
If they say yes, that tells me yes, 129 129
that control is effective. 130 130
They are seeing it in action. 131 131
Now, with that example, I would probably just observe it 132 132
because it's a more efficient way of doing it 133 133
but some things you can't directly observe. 134 134
For example, let's say there was some kind 135 135
of an administrative or management policy 136 136
that everybody was supposed to be following. 137 137
Well, if I go in and interview their staff 138 138
and ask them about that policy, 139 139
and their staff says 140 140
"I don't know what policy you're talking about," 141 141
that policy is not effective 142 142
and therefore it's not meeting the outcomes that we desire 143 143
from that control, and therefore we can mark that down 144 144
as part of our assessment based on the interview 145 145
that we know they're not following that policy. 146 146
Now, the third thing we can do is we can test something. 147 147
For example, let's say that they said 148 148
they've enabled multifactor authentication 149 149
on everybody's accounts 150 150
because that's one of their controls. 151 151
As the assessor, how can I test that? 152 152
Well, one way would be for me to go 153 153
and look at a couple of people as they're trying to log in. 154 154
That could be an observation 155 155
where I watch somebody log in 156 156
and see if they actually log in 157 157
using multifactor authentication. 158 158
Another way that I can actually test that though 159 159
would be for me to say, 160 160
"Hey, I need a user account to use during my assessment. 161 161
Go and provision me a user account called Jason." 162 162
So they go off and create an account. 163 163
They give me the username and password 164 164
and I try logging in the system. 165 165
If I can log in the system using just a username 166 166
and password, guess what? 167 167
They failed the test 168 168
because that's not multifactor authentication. 169 169
That is a single factor. 170 170
Both of those are considered knowledge factors 171 171
because I know my username and I know my password. 172 172
Alternatively, if they provision my accountant said, 173 173
"Now when you log in, you're going to get a text message 174 174
to your cell phone that's going to give you 175 175
that second factor authentication as a one time used code." 176 176
That means they're meeting MFA 177 177
or multifactor authentication. 178 178
Or maybe they tied it to an RSA key fob 179 179
or they tied it to a smart card with a pin number. 180 180
Any of these would work to meet the MFA 181 181
or multifactor authentication requirement. 182 182
The idea here is we can test these things 183 183
by asking them to create an account 184 184
and then try to log in with that account 185 185
to see if that works. 186 186
If it does and I only use a single factor, 187 187
they failed the test. 188 188
If that login required me to use two factors, 189 189
then they pass that test. 190 190
And we can do this 191 191
for all of the different controls we have. 192 192
Now, a lot of your controls are going to be based 193 193
on things like verifying 194 194
that security patches have been enabled. 195 195
To do that, you can run a vulnerability scan 196 196
using something like Nmap or Nessus or OpenVAS 197 197
or Qualys or any of these different tools. 198 198
All of those would be a way for you to test that 199 199
that system is up to date 200 200
with the latest security patches 201 201
based on all known vulnerabilities that are out there. 202 202
Now remember, money and time are not infinite. 203 203
So as an assessor and the organization 204 204
that's hiring the assessor, 205 205
you have to determine exactly what the priorities 206 206
are going to be. 207 207
For example, you're going to have communications 208 208
with the authorizing official 209 209
at the beginning of your assessment 210 210
to determine what things they really care about. 211 211
One assessment I did in the past when I arrived, 212 212
I first met with the authorizing official, 213 213
and I asked them, 214 214
"What are the things that keep you up at night? 215 215
What are the things that really worry you?" 216 216
And based on their responses, 217 217
I then tailored my assessment and my test plan 218 218
based on those things because those are the things 219 219
that the authorizing official was really focused on. 220 220
And so since I knew I was only going to be at that facility 221 221
for one week, I wanted to make sure the things 222 222
I was really spending all my time on were the things 223 223
that that authorizing official cared about. 224 224
In that particular case 225 225
the authorizing official was really focused 226 226
on things like, data and rest encryption, 227 227
data and transit encryption, data and process encryption, 228 228
ensuring their security patches 229 229
were being done on a timely basis, 230 230
making sure multifactor authentication was being used 231 231
and things like that. 232 232
And knowing that those were the things 233 233
that were at the top of their list, 234 234
I could then prioritize those 235 235
and make sure I did those on days one, two, and three 236 236
and then any extra time I had on days four and five 237 237
I could then focus on the rest of my checklist. 238 238
This is the idea of making sure you're taking into account 239 239
because your time and money are not going to be infinite 240 240
you really do need to have a good scoping 241 241
of your assessment plan 242 242
and the way to do this most effectively 243 243
is going to be by meeting with 244 244
that authorizing official up front. 245 245
Because at the end of the day 246 246
our goal as an assessor is to validate 247 247
if they've met the requirements 248 248
and implemented their controls properly, 249 249
so they can get an ATO an authorization to operate 250 250
from that authorizing official. 251 251
To help with that, 252 252
we as assessors need to help ensure 253 253
that we're giving the authorizing official 254 254
the information they need, 255 255
specifically the information they care about 256 256
in order to make a good risk based decision 257 257
based on this seven step RMF process. 258 258
Now, another example I've had in the past as an assessor 259 259
is when I went and checked on if people were doing logging. 260 260
Now, logging is one of those controls that you should have 261 261
as a detective control on all of your systems. 262 262
Now, when I asked, "Do you do logging?" 263 263
They said, "Yes." 264 264
I said, "Okay, check, move on." 265 265
That's as far as I needed to go 266 266
if I was doing an interview based assessment. 267 267
But in addition to that, I might say, 268 268
"Well, show me your logs." 269 269
Now I'm testing them and verifying they actually did it 270 270
and not just taking their word for it. 271 271
In this case, they can go into the system 272 272
and show me their logs, and in this case they did. 273 273
Now, I said, "Okay, how often do you rotate your logs?" 274 274
They said, "Oh, we rotate them every seven days." 275 275
And I said, "Well, that's a problem 276 276
because according to your controls 277 277
you need to have at least 30 days worth of logs on site 278 278
and another six months offsite. 279 279
How are you meeting that requirement 280 280
if you're rotating your logs every seven days?" 281 281
And based on that they weren't meeting 282 282
the control as implemented. 283 283
Now, they could have been doing everything else 284 284
with logging right. 285 285
For example, they were encrypting the logs 286 286
and they were sending them offsite 287 287
after that seven day period as part of the rotation 288 288
and all of the other things, and they showed me all of that. 289 289
But the problem is the control said they needed 30 days 290 290
and they were only using seven days. 291 291
So they failed that check 292 292
and that was something that got added 293 293
to their plan of action and milestones 294 294
for them to go back and increase their storage base 295 295
for logs so they can hold 30 days worth of logs on site. 296 296
And that's the idea here when we talk about observing, 297 297
interviewing and testing 298 298
as are three different actions that we take as an assessor. 299 299
Now, the final piece of advice I have 300 300
when it comes to the assessment piece in the real world 301 301
is that it's important that you give grace to other people 302 302
that you're working with during this process. 303 303
As you're going through and testing 304 304
all of these different controls, 305 305
one of the things you're going to be doing is working a lot 306 306
with both those people who selected the controls 307 307
and the people who implemented those controls. 308 308
Now, often those two people may not get along 309 309
and they can be pointing fingers at each other 310 310
about whose fault it is. 311 311
As the assessor, you really don't care whose fault it is, 312 312
you care whether or not that system is going to be secure. 313 313
Now, I will tell you, 314 314
no system you assess is going to pass 100% of your checks. 315 315
Instead, you're going to find a laundry list of things 316 316
that could be improved, and that's okay. 317 317
As you're going through the systems, 318 318
it's important to document everything you find 319 319
that is not optimal 320 320
and those things can be recommendations for improvement 321 321
and things that'll get added to their (indistinct) 322 322
to increase the security of that system 323 323
and minimize its risk. 324 324
In addition to this, as you're working with these folks 325 325
you're going to be asking a lot of questions, 326 326
and sometimes those people you're asking 327 327
may not have the answer. 328 328
Oftentimes, they've implemented something 329 329
because they were told to do it 330 330
by somebody higher up in the organization. 331 331
For example, one of the controls might be 332 332
to do file integrity monitoring. 333 333
Now, there's lots of different tools out there 334 334
that you can use to be able to perform 335 335
file integrity monitoring. 336 336
And as you're going through this checklist 337 337
and you ask them questions about it 338 338
as part of your interview, 339 339
you may find out that the person you're talking to 340 340
doesn't really know how file integrity monitoring works 341 341
on that particular system. 342 342
They were just told as a system administrator 343 343
to install XYZ tool. 344 344
Now, XYZ product vendor knows exactly how that tool works 345 345
and why it provides that ability. 346 346
But if you're asking that system administrator how it works 347 347
they may look at you like you have a third eye 348 348
in the middle of your forehead 349 349
because they just don't know the answer. 350 350
In these cases, they may feel like you're asking ridiculous 351 351
or silly questions or trying to make them look stupid 352 352
and that's not really your goal as an assessor. 353 353
Your goal is to make sure the organization is well protected 354 354
and that the system has a reasonable level 355 355
of risk associated with it 356 356
before the authorizing official gives you an ATO 357 357
or authority to operate for that system. 358 358
In order to help with this, 359 359
it's important that you use your soft skills 360 360
and understand that these people are not your enemies. 361 361
Your job as a assessor is not to beat up the staff, 362 362
but it's to get this package 363 363
through the risk management framework process 364 364
and going through all seven steps 365 365
until we can get that authorization to operate 366 366
and get that system online. 367 367
Now, sometimes it may feel like a battle or a war 368 368
and that they're adversarial, but don't treat 'em that way 369 369
because if you do, their defenses will go up 370 370
and they will just be harder to work with 371 371
and it's going to make your job 372 372
as an assessor much more difficult. 373 373
So remember, soft skills are really important in this world, 374 374
especially when you're coming into the organization 375 375
as an outsider, because you're this assessor, 376 376
this third party who's coming in from the outside 377 377
and you're going through all the work they've already done 378 378
to validate all their controls are properly implemented 379 379
and that they're providing the security 380 380
they think they are.