Project #3: System Security Plan Company Background & Operating Environment The assigned case study and attachments to this assignment provide information about “the company.” Use the Baltimore field office as the target for the System Security Plan Use Verizon FiOS as the Internet Services Provider (see http://www.verizonenterprise.com/terms/us/products/internet/sla/ ) Policy Issue & Plan of Action A recent risk assessment highlighted the need to formalize the security measures required to protect information, information systems, and the information infrastructures for the company’s field offices. This requirement has been incorporated into the company’s risk management plan and the company’s CISO has been tasked with developing, documenting, and implementing the required security measures. The IT Governance board also has a role to play since it must review and approve all changes which affect IT systems under its purview. The CISO has proposed a plan of action which includes developing system security plans using guidance from NIST SP-800-18 Guide for Developing Security Plans for Federal Information Systems. The IT Governance board, after reviewing the CISO’s proposed plan of action, voted and accepted this recommendation. In its discussions prior to the vote, the CISO explained why the best practices information for security plans from NIST SP 800-18 was suitable for the company’s use. The board also accepted the CISO’s recommendation for creating a single System Security Plan for a General Support System since, in the CISO’s professional judgement, this type of plan would best meet the “formalization” requirement from the company’s recently adopted risk management strategy. Your Task Assignment As a staff member supporting the CISO, you have been asked to research and then draft the required system security plan for a General Support System. In your research so far, you have learned that: A general support system is defined as “an interconnected set of information resources under the same direct management control that shares common functionality.” (See NIST SP 800-18) The Field Office manager is the designated system owner for the IT support systems in his or her field office. The system boundaries for the field office General Support System have already been documented in the company’s enterprise architecture (see the case study). The security controls required for the field office IT systems have been documented in a security controls baseline (see the controls baseline attached to this assignment). Research: Review the information provided in the case study and in this assignment, especially the information about the field offices and the IT systems and networks used in their day to day business affairs. Review NIST’s guidance for developing a System Security Plan for a general support IT System. This information is presented in NIST SP 800-18. http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf Pay special attention to the Sample Information System Security Plan template provided in Appendix A. Review the definitions for IT Security control families as documented in Federal Information Processing Standard (FIPS) 200: Minimum Security Requirements for Federal Information and Information Systems (see section 3). Review the definitions for individual controls as listed in Appendix F Security Control Catalog in NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf You should focus on those controls listed in the security controls baseline provided with this assignment. Write: Use the following guidance to complete the System Security Plan using the template from Appendix A of NIST SP 800-18. Sections 1 through 10 will contain information provided in the assigned case study. You may need to “interpret” that information when writing the descriptions. “Fill in the blanks” for information about the company or its managers which is not provided in the case study, i.e. names, email addresses, phone numbers, etc.). Make sure that your fictional information is consistent with information provided in the case study (name of company, locations, etc.). Section 11 should contain information about the field office’s Internet connection Do not include the table. Use the business Internet Services Provider listed at the top of this assignment file. Describe the system interconnection type in this section and service level agreement. Section 12 should contain information derived from the case study. You will need to identify the types of information processed in the field office and then list the laws and regulations which apply. For example, if the case study company processes or stores Protected Health Information, then this section must include information about HIPAA. If the company processes or stores credit card payment information, then this section must include information about the PCI-DSS requirements. Section 13 of the SSP will take the most editing time. Use the information about required security controls as provided security controls baseline. Create 3 sub sections (13.1 Management Controls, 13.2 Operational Controls, and 13.3 Technical Controls). You must provide a description for each category (see the definitions provided in Annex 11.B Minimum Security Controls in NIST SP 800-100 Information Security Handbook: A Guide for Managers). Using the information provided in the security controls baseline, place the required control families and controls under the correct sub section. Use the exact names and designators for the security control families and individual security controls. BUT, you MUST paraphrase any and all descriptions. Do NOT cut and paste from NIST documents. Section 14: use the due date for this assignment as the plan complete date. Section 15: leave the approval date blank. You will not have any other text in this section (since the plan is not yet approved). Use a professional format for your System Security Plan. Your document should be consistently formatted throughout and easy to read. Common phrases do not require citations. If there is doubt as to whether or not information requires attribution, provide a footnote with publication information or use APA format citations and references. You are expected to write grammatically correct English in every assignment that you submit for grading. Do not turn in any work without (a) using spell check, (b) using grammar check, (c) verifying that your punctuation is correct and (d) reviewing your work for correct word usage and correctly structured sentences and paragraphs. Submit For Grading Submit your System Security Plan in MS Word format (.docx or .doc file) for grading using your assignment folder. (Attach the file.)

    IT Assurance Plan restrain Baltimore Room Employment

    1. Counsel Rule Name/Title:

    Red Clay Renovation’s Baltimore Room Employment

    2. Counsel Rule Categorization:

    Moderate

    3. Counsel Rule Owner:

    Name: Erica Kniesel

    Designation: Employment Manager & ISSO

    Location: Baltimore Room Employment

    Agency: Red Clay Renovations

    Address: 200 Commerce Street

                   Suite 450Baltimore, MD 21201

    Email: Erica@balt.redclayrenovations.com

    Phone: 443-555-2900

    4. Authorizing Official:

    Name: Erwin Carrington

    Designation: CIO & Director IT Employments

    Agency: Red Clay Renovations

    Address: 12209 Red Clay PlaceOwings Mills, MD 1117 Email: Erwin_Carrington@hq.redclayrenovations.com

    Phone: 667-555-6260

    5. Other Designated Contacts:

    Name:Eric Carpenter

    Designation:  CISO / Deputy CIO

    Agency: Red Clay Renovations

    Address: 12209 Red Clay PlaceOwings Mills, MD 21117

    email: Eric_Carpenter@hq.redclayrenovations.com

    Phone: 667-555-6370

    Name: Charles Kniesel

    Designation: Manager &Architect inCharge

    Location:  Baltimore room EmploymentBaltimore

    Phone:443-555-2900

    Email: Charles@balt.redclayrenovations.com

    6. Ordinance of Assurance Responsibility:

    Name: Erica Kniesel

    Designation: Employment Manager & ISSO

    Location: Baltimore Room Employment

    Agency: Red Clay Renovations

    Address: 200 Commerce Street

                   Suite 450Baltimore, MD 21201

    Email: Erica@balt.redclayrenovations.com

    Phone: 443-555-2900

    7. Counsel Rule Operational Status:

    Rule Status is operational

    8.0 Counsel Rule Type:

    General Support Rule

    9.0 General Rule Description/Purpose

    Red Clay renovation’s Baltimore employment furnishs “Internet of Things” and “Smadroitness Home solutions, architectural frameworks, and designs. The network environment is then alike to the operations nucleus at Red Clay Employment via internet connectivity supposing by Verizon FiOS. Indirect network connectivity links indirect employments and other room sites to the ocean operations nucleus at the crisis employment. Internal relationship is by wired and wireless connections.

    10. Rule Environment

    • 100BASE-T Ethernet cable
    • Alcatel Private Branch Exchange rule
    • Cat 5 cable
    • CISCO Router
    • CISCO Switch
    • CISCO Wireless router
    • Dell laptops and desktops (Windows 10 Enterprise)
    • Dell servers (Windows server 2012)
    • RJ-45 glacis jacks
    • Symantec Endpoint Shelter

    11. Rule Relationships/Counsel Sharing

    Transmission latency hasten restrain Verizon’s’ regional hub routers that are build among the United States borders is supposing by Verizon FiOS, at an medium of 45 milliseconds. Hasten restrain counsel and basis being catching despite the borders is abundant slower averaging 90 milliseconds. Internet connectivity and persomal network employment conquer be at magnitude at total times.

    12. Related Laws/Regulations/Policies

    • Computer Fraud and Abuse Act of 1984
    • Federal Counsel Waying Standards Publication(FIPS) 199
    • Federal Counsel Assurance Skillful-treatment Act of 2002
    • Payment Card Industry Basis Assurance Standard
    • Sarbanes-Oxley, Minority 404

    13. Minimum Assurance Restrains

    Use the assurance restrains baseline as supposing restrain this ordinance. Include feeling paragraphs restrain each minority. Cut and paste the tables from the supposing assurance restrains baseline to infer the specific assurance restrains underneathneath each minority. Use the minoritys and sub-sections as listed beneath.

    13.1 Skillful-treatment Restrains

    The ocean concrete of Skillful-treatment Restrains id to shelter and enclose basis and counsel among the counsel technology environment of the texture,  focused on arrange skillful-treatment restrain potential issues that may assume the rule. Skillful-treatment restrains families are as follows.

    13.1.1: Assurance Toll and Authorization

    Assurance toll restrains conquer demand to be created at Red Clay renovations as before-long as potential to determine to be efficient to assess the capability if the rule precedent. Restrainmulate renewal plans restrain commerce with vulnerabilities. Conduct an plaudit way restrain total participating devices and unoccupied rules. It is so relevant to adviser the restrains to determine that they furnish a gentleman and absolved inspection of the rule’s capability.

    13.1.2 Planning

    As per the assurance plan, the texture shtotal restrainmulate copious assurance plans restrain its Counsel Technology environment. The plans furnish a absolved highway map and rule details as polite-mannered-mannered conditions restrain equitable custom of the rule and texture’s internet connectivity runtime.

    PL-1 Assurance Planning Plan and Procedures PL-1 PL-2 Rule Assurance Plan PL-2 (3) PL-4 Rules of Behavior PL-4 (1) PL-8 Counsel Assurance Architecture PL-8

    13.2 Operational Restrains

    These are assurance protocols that are usually implemented by the counsel technology rules by themselves externally the mediation of the user. They are polite-mannered-mannered inferential and documented in the FIPS 200.

    13.2.1 Awareness and Grafting Restrains

    Equitable and withhold awareness and grafting programs conquer be instituted (Wilson & Hash, 2003). These programs conquer be aimed at ensuring that users are equipped with the fair skills restrain interacting with the rule.  Counsel encircling assurance arranges conquer be supposing and fast to perfect workstation.

    AT-1 Assurance Awareness and Grafting Plan and Procedures AT-1 AT-2 Assurance Awareness Grafting AT-2 (2) AT-3 Role-Based Assurance Grafting AT-3 AT-4 Assurance Grafting Records AT-4

    13.2.2 Conformation skillful-treatment

    Conformation skillful-treatment is the adroitness of ensuring that rules assurance protocols are polite-mannered-mannered inferior in the way of rules engineering (Kloesterboer, 2007). It determines that the conformation tools restrain the rule are polite-mannered-mannered accounted restrain as polite-mannered-mannered as facilitating relationship with the operational environment of the rule.

    CM-1 Conformation Skillful-treatment Plan and Procedures CM-1 CM-2 Baseline Conformation CM-2 (1) (3) (7) CM-3 Conformation Change Restrain CM-3 (2) CM-4 Assurance Impact Analysis CM-4 CM-5 Advance Restrictions restrain Change CM-5 CM-6 Conformation Settings CM-6 CM-7 Least Functionality CM-7 (1) (2) (4) CM-8 Counsel Rule Component Inventory CM-8 (1) (3) (5) CM-9 Conformation Skillful-treatment Plan CM-9 CM-10 Software Custom Restrictions CM-10

    13.3 Technical Restrains

    These are assurance measures that are aimed at achieving the required shelter standards restrain the rule. The computer rule may enact these protocols by itself in an automated admittance so that unacknowledged advance and perversion of the rule are poor uniform where there is no cosmical warrant to determine assurance. It so arranges challenge of unwanted exchange and sustaining assurance applications such as anti-virus protocols.

    13.3.1 Advance restrains

    These are limitations to unacknowledged advance. They arrange the fabrication of password rules. Encryptions, pursing and patching (Kuhn et al., 2010). They pre--crit)e password diffusiveness and texture, biometrics and encrypting techniques.  Most procedures are self-shelter procedures.

    AC-1 Advance Restrain Plan and Procedures AC-1 AC-2 Account Skillful-treatment AC-2 (1) (2) (3) (4) AC-3 Advance Enforcement AC-3 AC-4 Counsel Flow Enforcement AC-4 AC-5 Separation of Duties AC-5 AC-6 Least Privilege AC-6 (1) (2) (5) (9) (10) AC-7 Unsuccessful Logon Attempts AC-7 AC-8 Rule Use Notification AC-8 AC-11 Session Lock AC-11 (1) AC-12 Session Termination AC-12 AC-14 Permitted Renewals externally Identification or Authentication AC-14

    13.3.2 Audit and Accountability

    These are assurance restrains that determine the single-mindedness of the rule they are aimed at advisering the rule and ensuring it is popular as per concern requirements and that the trustworthy counsel of the texture, as polite-mannered-mannered as concern negotiation, are protected. It so checks the custom of the rule and helps breed reports that are used restrain the conclusion making way.

    AU-1 Audit and Accountability Plan and Procedures AU-1 AU-2 Audit Uniformts AU-2 (3) AU-3 Content of Audit Records AU-3 (1) AU-4 Audit Storage Magnitude AU-4 AU-5 Response to Audit Waying Failures AU-5 AU-6 Audit Review, Analysis, and Reporting AU-6 (1) (3) AU-7 Audit Reduction and Report Generation AU-7 (1) AU-8 Time Stamps AU-8 (1) AU-9 Shelter of Audit Counsel AU-9 (4) AU-10 Non-repudiation Not Selected AU-11 Audit Record Retention AU-11 AU-12 Audit Generation AU-12

    …………

    14. Counsel Rule Assurance Plan Completion Date: ________29.11.2017_____________

    15. Counsel Rule Assurance Plan Plaudit Date: _____29.11.2017__________________

    References

    Klosterboer, L. (2007). Implementing itil® conformation skillful-treatment. IBM Press.

    Kuhn, D. R., Coyne, E. J., & Weil, T. R. (2010). Infering attributes to role-based advance restrain. Computer43(6), 79-81.

    Wilson, M., & Hash, J. (2003). Building an counsel technology assurance awareness and grafting program. NIST Special Publication800(50), 1-39.