INFORMATION SYSTEMS SECURITY OFFICE (ISSO) SERVICES MAJ Carmine Cicalese CINC INFOSEC Support One...
-
Upload
isai-hopps -
Category
Documents
-
view
215 -
download
1
Transcript of INFORMATION SYSTEMS SECURITY OFFICE (ISSO) SERVICES MAJ Carmine Cicalese CINC INFOSEC Support One...
INFORMATION SYSTEMS SECURITY OFFICE (ISSO)
SERVICES
MAJ Carmine CicaleseCINC INFOSEC Support
INFORMATION SYSTEMS SECURITY OFFICE (ISSO)
SERVICES
MAJ Carmine CicaleseCINC INFOSEC Support
One Team, One MissionInformation Superiority for America
INFORMATION SYSTEMS SECURITY (INFOSEC)
INFORMATION SYSTEMS SECURITY (INFOSEC)
The protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users or the provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats
The protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users or the provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats
GROWING NEED FOR INFOSEC
GROWING NEED FOR INFOSEC
Nation has become highly dependent on networking for military ops, government, and commerce
Information infrastructure is at risk! Data and systems are highly vulnerable to unauthorized access
Information warfare could inflict massive disruption on military readiness and the economy
Nation has become highly dependent on networking for military ops, government, and commerce
Information infrastructure is at risk! Data and systems are highly vulnerable to unauthorized access
Information warfare could inflict massive disruption on military readiness and the economy
RACE AGAINST TIME:INFOSEC VS. INFOWARRACE AGAINST TIME:
INFOSEC VS. INFOWAR
Massive Use of Networking Makes U.S. the World’s Most Vulnerable Target for Information Warfare Intelligence Exploitation Disruption of Network Infrastructure
U.S. Has Orders of Magnitude More to Lose to Information Warfare Attacks Than Our Adversaries
Reliance on Unprotected Networks Carries Risk of Military Failure and Catastrophic Economic Loss
Massive Use of Networking Makes U.S. the World’s Most Vulnerable Target for Information Warfare Intelligence Exploitation Disruption of Network Infrastructure
U.S. Has Orders of Magnitude More to Lose to Information Warfare Attacks Than Our Adversaries
Reliance on Unprotected Networks Carries Risk of Military Failure and Catastrophic Economic Loss
INFORMATION WARFARE
INFORMATION WARFARE
“...the threat to our military and commercial information systems poses a significant risk to national security and must be addressed.”
“...the threat to our military and commercial information systems poses a significant risk to national security and must be addressed.”
William J. ClintonWilliam J. ClintonPresident of the United StatesPresident of the United States
1995 National Security Strategy1995 National Security Strategy
INFORMATION WARFARE
INFORMATION WARFARE
“Information in all its forms, information protection, and the increasingly prominent position of information in the attack have become central features in determining the outcome of modern and future conflicts.”
“Information in all its forms, information protection, and the increasingly prominent position of information in the attack have become central features in determining the outcome of modern and future conflicts.”
General John M. ShalikashviliGeneral John M. ShalikashviliChairman of the Joint Chiefs of StaffChairman of the Joint Chiefs of Staff
Memorandum, Memorandum, Information Warfare StatusInformation Warfare Status, 10 October 1995, 10 October 1995
SANCTUARY -- LOSTSANCTUARY -- LOST
U.S.U.S.
SOCIETYSOCIETYADVERSARYADVERSARYU.S.U.S.
MILITARYMILITARY
U.S.U.S.
SOCIETYSOCIETYADVERSARYADVERSARYU.S.U.S.
MILITARYMILITARY
PASTPASTPRESENTPRESENT
INFOSEC CHALLENGES
INFOSEC CHALLENGES
Keeping pace with technology National Information Infrastructure (NII) Support to military operations
Keeping pace with technology National Information Infrastructure (NII) Support to military operations
POTENTIAL ISSO CUSTOMERS
POTENTIAL ISSO CUSTOMERS
??PRIVATE INDUSTRYPRIVATE INDUSTRY
JOHN Q. PUBLICJOHN Q. PUBLIC
FINANCIAL COMMUNITYFINANCIAL COMMUNITYACADEMIAACADEMIA
HEALTH PROFESSIONHEALTH PROFESSION
WHAT ARE WE DOING ABOUT IT?
WHAT ARE WE DOING ABOUT IT?
Key INFOSEC Goal:Keep Pace with Network Technology and
Security Needs
Criteria for Success:Solutions that are Secure, Affordable, and Easy to Use, as Defined by Our Customers
Key INFOSEC Goal:Keep Pace with Network Technology and
Security Needs
Criteria for Success:Solutions that are Secure, Affordable, and Easy to Use, as Defined by Our Customers
GOALSGOALS
Enhance Network Security Meet All Requirements for Unique, High
Assurance Solutions Advance INFOSEC Technology Champion Information Security for the Nation Forge an Innovative Customer-Driven
Corporate Culture
Enhance Network Security Meet All Requirements for Unique, High
Assurance Solutions Advance INFOSEC Technology Champion Information Security for the Nation Forge an Innovative Customer-Driven
Corporate Culture
ISSO MISSIONISSO MISSION
Provide leadership, products, and services necessary to enable customers to protect national security and sensitive information in information systems pursuant to Federal law and national policies; and...
Provide technical support to the government’s efforts to incorporate information systems security into the National Information Infrastructure (NII)
Provide leadership, products, and services necessary to enable customers to protect national security and sensitive information in information systems pursuant to Federal law and national policies; and...
Provide technical support to the government’s efforts to incorporate information systems security into the National Information Infrastructure (NII)
SECURITY TERMSSECURITY TERMS
DATA INTEGRITY -
AUTHENTICATION -
NON-REPUDIATION -
CONFIDENTIALITY -
AVAILABILITY -
DATA INTEGRITY -
AUTHENTICATION -
NON-REPUDIATION -
CONFIDENTIALITY -
AVAILABILITY -
Absolute verification data has not been modified (Detection of a single bit change)
Verification of originator (Signature on check)
Undeniable proof-of-participation (Sender/receiver in bank transaction)
Privacy with encryption (Scrambled text)
Assurance of service on demand (Guaranteed dial tone)
Absolute verification data has not been modified (Detection of a single bit change)
Verification of originator (Signature on check)
Undeniable proof-of-participation (Sender/receiver in bank transaction)
Privacy with encryption (Scrambled text)
Assurance of service on demand (Guaranteed dial tone)
INFOSEC BUSINESSINFOSEC BUSINESS
The business of information security comprises a cycle of critical activities designed to meet constantly changing customer needs in the emerging information age.
The business of information security comprises a cycle of critical activities designed to meet constantly changing customer needs in the emerging information age. Assess NeedsAssess Needs
Customer education, threat awareness, vulnerability assessment, Customer education, threat awareness, vulnerability assessment, impact on business, leading national advocacy role.impact on business, leading national advocacy role.
Deliver SolutionsDeliver SolutionsProduct and systems evaluations, risk management, system Product and systems evaluations, risk management, system security engineering consultancy, new solutions, implementation security engineering consultancy, new solutions, implementation assistance, security management infrastructure, life cycle assistance, security management infrastructure, life cycle support, policies and guidelines.support, policies and guidelines.
Create Advanced TechnologiesCreate Advanced TechnologiesAnticipate and enable emerging technologies, conduct and Anticipate and enable emerging technologies, conduct and coordinate research and development, rapid prototyping.coordinate research and development, rapid prototyping.
INFOSEC SOLUTIONSINFOSEC SOLUTIONS
INFOSECSOLUTIONS
INFOSECSOLUTIONSPRODUCTSPRODUCTS
TECHNOLOGIESTECHNOLOGIES
SERVICESSERVICES
PRODUCTSPRODUCTS
MISSI/Fortezza STU-III KG-84 KG-194 KG-95 CONDOR
MISSI/Fortezza STU-III KG-84 KG-194 KG-95 CONDOR
Key Management System (EKMS)
Embedded Modules Chips Algorithms Secure Terminal
Equipment
Key Management System (EKMS)
Embedded Modules Chips Algorithms Secure Terminal
Equipment
DISNDISN DMSDMS GCCSGCCS EC/EDIEC/EDI CINCMLSCINCMLSDFASDFAS
NETWORK SECURITY MANAGEMENTNETWORK SECURITY MANAGEMENTElectronic KeyElectronic Key
Management SystemManagement SystemCertification AuthorityCertification Authority
Workstation (CAW) Workstation (CAW) DOD Directory Service DOD Directory Service
DIIDII
Non - RepudiationNon - Repudiation
ConfidentialityConfidentialityIntegrityIntegrity
AvailabilityAvailability
Identification & AuthenticationIdentification & Authentication
MISSI BUILDING BLOCK PRODUCTSMISSI BUILDING BLOCK PRODUCTS
SECURITYSECURITY SERVICESSERVICES
SecureComputing
High Assurance
Guards
Firewalls
In-Line Network
Encryptors
********
Fortezza +Fortezza
DEFENSE INFORMATION INFRASTRUCTURE SECURITY
DEFENSE INFORMATION INFRASTRUCTURE SECURITY
Workstation Products FORTEZZA
High Assurance Guards Secure Network Server (SNS)
» Standard Mail Guard (SMG) Secret unclassified e-mail
In-Line Network Encryptors Network Encryption System (NES) (current) Tactical End-to-End Device (TEED) (emerging) Fastlane (multimedia ATM) (emerging) KG-189 (Synchronous Optical Network (SONET))
Workstation Products FORTEZZA
High Assurance Guards Secure Network Server (SNS)
» Standard Mail Guard (SMG) Secret unclassified e-mail
In-Line Network Encryptors Network Encryption System (NES) (current) Tactical End-to-End Device (TEED) (emerging) Fastlane (multimedia ATM) (emerging) KG-189 (Synchronous Optical Network (SONET))
MISSIMISSI
Mulitlevel Information Systems Security Initiaitive
ISSO SERVICESISSO SERVICES
ISSO services is the intellectual set of activities that assist customers in protecting the mission information
ISSO services is the intellectual set of activities that assist customers in protecting the mission information
ISSO SERVICESISSO SERVICES
System Security Assessments Information System Security Education, Training
and Awareness (ISSETA) Security Engineering and Consulting Product Evaluation Clearinghouse for Security Technical Information Security Infrastructure
System Security Assessments Information System Security Education, Training
and Awareness (ISSETA) Security Engineering and Consulting Product Evaluation Clearinghouse for Security Technical Information Security Infrastructure
SYSTEM SECURITY ASSESSMENTS
SYSTEM SECURITY ASSESSMENTS
Threat Assessment
OPSEC Assessment
INFOSEC Assessment
Network Vulnerability Assessments
Technical Security And Facilities Evaluation
Threat Assessment
OPSEC Assessment
INFOSEC Assessment
Network Vulnerability Assessments
Technical Security And Facilities Evaluation
COMSEC Monitoring
System Security Profiles
System Certification Assistance
System Accreditation Assistance
Risk Assessment
COMSEC Monitoring
System Security Profiles
System Certification Assistance
System Accreditation Assistance
Risk Assessment
SYSTEM SECURITY ASSESSMENTS
SYSTEM SECURITY ASSESSMENTS
THREAT ASSESSMENTTHREAT ASSESSMENT
All source intelligence via SIGINT, HUMINT, and IMINT
Analytic interface to intel community Assessments tailored to customer
requirements Special studies, briefings, and video Assist in resource and countermeasure
allocations
All source intelligence via SIGINT, HUMINT, and IMINT
Analytic interface to intel community Assessments tailored to customer
requirements Special studies, briefings, and video Assist in resource and countermeasure
allocations
OPSEC ASSESSMENTOPSEC ASSESSMENT
Identify vulnerabilities Information on
Operations Supporting operations Competitors or adversaries
Basis for risk management decisions
Identify vulnerabilities Information on
Operations Supporting operations Competitors or adversaries
Basis for risk management decisions
INFOSEC ASSESSMENTINFOSEC ASSESSMENT
High level technical analysis of the security posture of an organization’s communications and automated information systems Determine potential vulnerabilities and identify
countermeasures Based on known and perceived threats
Present day snapshot of implemented security Baseline of current security assets
High level technical analysis of the security posture of an organization’s communications and automated information systems Determine potential vulnerabilities and identify
countermeasures Based on known and perceived threats
Present day snapshot of implemented security Baseline of current security assets
NETWORK VULNERABILITY ANALYSIS
NETWORK VULNERABILITY ANALYSIS
TECHNICAL SECURITY AND FACILITIES EVALUATION
TECHNICAL SECURITY AND FACILITIES EVALUATION
COMSEC MONITORINGCOMSEC MONITORING
Support customer’s risk management process by providing information needed to make informed trade-offs between systems security risk, cost, schedule, and mission requirements
Provide timely mission and configuration specific analysis
Support certification and accreditation Document secure system design efforts
Support customer’s risk management process by providing information needed to make informed trade-offs between systems security risk, cost, schedule, and mission requirements
Provide timely mission and configuration specific analysis
Support certification and accreditation Document secure system design efforts
SYSTEM SECURITY PROFILES
SYSTEM SECURITY PROFILES
Provide future efforts design guidance Inject security into early design phases
Lower costs
Minimal impact
Improve commercial secure products Feed lessons learned to vendors
Provide feedback to profiling process
Provide future efforts design guidance Inject security into early design phases
Lower costs
Minimal impact
Improve commercial secure products Feed lessons learned to vendors
Provide feedback to profiling process
SYSTEM SECURITY PROFILES
SYSTEM SECURITY PROFILES
SYSTEM SECURITY PROFILES
SYSTEM SECURITY PROFILES
Focuses on developmental systems or those being upgraded
A system profile: Presents non-judgemental technical facts Is not a NSA endorsement Is a structured presentation of engineering
documentation Delivers report to customer who controls it Is time constrained vulnerability search
Focuses on developmental systems or those being upgraded
A system profile: Presents non-judgemental technical facts Is not a NSA endorsement Is a structured presentation of engineering
documentation Delivers report to customer who controls it Is time constrained vulnerability search
SYSTEM CERTIFICATION ASSISTANCE
SYSTEM CERTIFICATION ASSISTANCE
Make Recommendations Regarding the Technical and Economic Feasibility of Additional Countermeasures Which Should Be Used (or Are Planned to Be Used) to Further Minimize Risks to the System
Make Recommendations Regarding the Technical and Economic Feasibility of Additional Countermeasures Which Should Be Used (or Are Planned to Be Used) to Further Minimize Risks to the System
SYSTEM ACCREDITATION ASSISTANCE
SYSTEM ACCREDITATION ASSISTANCE
The Cost-Effective Approach to Security Requires DAAs to Lower Risks to Acceptable Levels While Minimizing Costs
The Cost-Effective Approach to Security Requires DAAs to Lower Risks to Acceptable Levels While Minimizing Costs
Conferences Training Classes Standards Development Policy Committees Doctrine, Policy, and Procedures Foreign Policy and Relations Security Awareness INFOSEC OUTREACH Program Technology Transfer
Conferences Training Classes Standards Development Policy Committees Doctrine, Policy, and Procedures Foreign Policy and Relations Security Awareness INFOSEC OUTREACH Program Technology Transfer
INFORMATION SYSTEMS SECURITY EDUCATION, TRAINING, AND
AWARENESS (ISSETA)
INFORMATION SYSTEMS SECURITY EDUCATION, TRAINING, AND
AWARENESS (ISSETA)
CONFERENCESCONFERENCES
National Information Systems Security Conference
AFCEA IEEE
National Information Systems Security Conference
AFCEA IEEE
TRAINING CLASSESTRAINING CLASSES
Train-The-Trainer Teach, Train, and Assist (TTA)
Train-The-Trainer Teach, Train, and Assist (TTA)
STANDARDS DEVELOPMENT
STANDARDS DEVELOPMENT
ISO ANSII
ISO ANSII
POLICY COMMITTEESPOLICY COMMITTEES
NSTISSC National policies, directives, guidance, etc.,
according to NSD-42 NII DoD Military Services
NSTISSC National policies, directives, guidance, etc.,
according to NSD-42 NII DoD Military Services
DOCTRINE, POLICY, AND PROCEDURES
DOCTRINE, POLICY, AND PROCEDURES
Over-the-air rekeying Advanced concepts and modeling for
INFOSEC doctrine and risk management Manages National COMSEC Insecurity
Reporting System Trended analysis and reports
Over-the-air rekeying Advanced concepts and modeling for
INFOSEC doctrine and risk management Manages National COMSEC Insecurity
Reporting System Trended analysis and reports
INFOSEC OUTREACH PROGRAM
INFOSEC OUTREACH PROGRAM
Certified Module Embedment (CME) Program
Certified Module Embedment (CME) Program
SECURITY ENGINEERING AND CONSULTING
SECURITY ENGINEERING AND CONSULTING
Information Systems Security Engineering (ISSE)
System Design Guidance Security Architecture and Frameworks System Acquisition Life Cycle Consulting
Information Systems Security Engineering (ISSE)
System Design Guidance Security Architecture and Frameworks System Acquisition Life Cycle Consulting
INFORMATION SYSTEMS SECURITY ENGINEERINGINFORMATION SYSTEMS SECURITY ENGINEERING
ISSE Handbook System Security Engineering Model
(SSEM)
ISSE Handbook System Security Engineering Model
(SSEM)
LIFE CYCLE CONSULTINGLIFE CYCLE
CONSULTING
Key Management Privilege Management Product Installation and Support Training Design Methodology Rainbow Series
Key Management Privilege Management Product Installation and Support Training Design Methodology Rainbow Series
PRODUCT EVALUATION
PRODUCT EVALUATION
Product Profiles TEMPEST Endorsement Program (TEP) Trusted Product Evaluation Program
(TPEP) Evaluated INFOSEC (COMSEC)
Product Listing
Product Profiles TEMPEST Endorsement Program (TEP) Trusted Product Evaluation Program
(TPEP) Evaluated INFOSEC (COMSEC)
Product Listing
EVALUATED INFOSEC (COMSEC) PRODUCT LISTING
EVALUATED INFOSEC (COMSEC) PRODUCT LISTING
Commercial COMSEC Endorsement Program (CCEP)
Authorized Vendor Program (AVP)
Commercial COMSEC Endorsement Program (CCEP)
Authorized Vendor Program (AVP)
CLEARINGHOUSE FOR INFORMATION
CLEARINGHOUSE FOR INFORMATION
Commercial Product Data Base Vulnerability Data Base Information (DOCKMASTER,
TEMPEST Info Center) Help Desk
Commercial Product Data Base Vulnerability Data Base Information (DOCKMASTER,
TEMPEST Info Center) Help Desk
INFORMATIONINFORMATION
DOCKMASTER TEMPEST Info Center
DOCKMASTER TEMPEST Info Center
SECURITY INFRASTRUCTURE
SECURITY INFRASTRUCTURE
Key Management and Provisioning Doctrine, Policy, and Standards MISSI Network Security Management
Certification Authentication Workstation (CAW) Directory System Agent (DSA) Mail List Agent (MLA) Rekey Manager (with EKMS) Audit Manager
Key Management and Provisioning Doctrine, Policy, and Standards MISSI Network Security Management
Certification Authentication Workstation (CAW) Directory System Agent (DSA) Mail List Agent (MLA) Rekey Manager (with EKMS) Audit Manager
STRATEGY FOR PROVIDING CUSTOMER SUPPORT
STRATEGY FOR PROVIDING CUSTOMER SUPPORT
V11V11
DISADISADISADISAVENDORSVENDORSVENDORSVENDORS
ISSOISSOISSOISSO
ARMYARMYARMYARMY
NAVY/MARINESNAVY/MARINESNAVY/MARINESNAVY/MARINES
AIR FORCEAIR FORCEAIR FORCEAIR FORCE
WHO ARE YOU GOING TO CALL
WHO ARE YOU GOING TO CALL
CONTRACTOR SUPPORT(410) 859-4524 (STU-III)
CINCS, JOINT COMMANDS & DEFENSE AGENCIES(410) 859-4711 (STU-III)
MILITARY DEPARTMENTS(410) 859-4391 (STU-III)
CIVIL AGENCIES(410) 859-4790 (STU-III)
DSN Prefix: 644-0111, Ask Operator for DesiredFAX: (410) 859-6651STU-III FAX: (410) 859-6665TOLL FREE: 1-800-688-6115
CONTRACTOR SUPPORT(410) 859-4524 (STU-III)
CINCS, JOINT COMMANDS & DEFENSE AGENCIES(410) 859-4711 (STU-III)
MILITARY DEPARTMENTS(410) 859-4391 (STU-III)
CIVIL AGENCIES(410) 859-4790 (STU-III)
DSN Prefix: 644-0111, Ask Operator for DesiredFAX: (410) 859-6651STU-III FAX: (410) 859-6665TOLL FREE: 1-800-688-6115