Instructor: One of the things about eMASS 2 2
is it holds all its data in a centralized location. 3 3
With centralized data comes benefits 4 4
like better reporting and analysis, 5 5
but also there's increased risk, 6 6
and to make the situation more challenging, 7 7
eMASS is also web-based, 8 8
and it's available over the open internet. 9 9
From a cyber risk manager's perspective, 10 10
you might be thinking, "Okay, eMASS has a list 11 11
of all my systems, all of the software, their versions, 12 12
IP addresses, boundary diagrams, ports, protocols, services, 13 13
how I'm authenticating my users, which encryption I'm using, 14 14
and on and on and on." 15 15
In fact, all of us, eMASS users, 16 16
are putting every single design 17 17
and system security engineering aspect 18 18
into one web-based application, 19 19
which in itself creates some vulnerabilities. 20 20
You possibly now have all your DOD systems located 21 21
in one place, identifying the hardware, software, 22 22
and vulnerabilities that you identified 23 23
throughout the RMF process. 24 24
It becomes an adversary's treasure chest. 25 25
The nature of the eMASS systems architecture 26 26
also suggests it could suffer downtime 27 27
should a centralized component fail, 28 28
and that would stop you in your tracks, 29 29
in terms of getting your ATO done on time and on budget. 30 30
We think it's reasonable for you to ask, 31 31
"How do we know eMASS is secure for our use?" 32 32
For all these reasons, the very question of using eMASS 33 33
becomes a risk-based decision for organizations. 34 34
Are the risks worth using it or not? 35 35
We can't make that decision for you 36 36
nor do we have a recommendation. 37 37
In part, this is because we have no visibility 38 38
into how the cybersecurity of eMASS is managed. 39 39
We also don't know anything about your specific situation, 40 40
but we do want to encourage you 41 41
to speak with your approving official 42 42
if you have any security concerns about using eMASS 43 43
or any other automated system 44 44
with the risk management framework.