InfoMagic Standards 1994 January/InfoMagic Standards - January 1994.iso/inet/scc/fips_169.txt

Text File | 1991-09-30 | 24KB | 506 lines

           Executive Guide to the Protection of Information
           Resources


NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

The National Institute of Standards and Technology (NIST), is
responsible for developing standards, providing technical assistance,
and conducting research for computers and related telecommunications
systems. These activities provide technical support to government and
industry in the effective, safe, and economical use of computers.
With the passage of the Computer Security Act of 1987 (P.L. 100-235),
NIST's activities also include the development of standards and
guidelines needed to assure the cost-effective security and privacy of
sensitive information in Federal computer systems.  This guide is just
one of three brochures designed for a specific audience.  The
"Managers Guide to the Protection of Information Resources" and the
"Computer User's Guide to the Protection of Information Resources"

complete the series.


ACKNOWLEDGMENTS

This guide was written by Cheryl Helsing of Deloitte, Haskins & Sells
in conjunction with Marianne Swanson and Mary Anne Todd, National
Institute of Standards and Technology.


                          Table of Contents

INTRODUCTION .............................................  1
EXECUTIVE RESPONSIBILITIES ...............................  3
EXECUTIVE GOALS ..........................................  5
INFORMATION PROTECTION PROGRAM ELEMENTS ..................  7
INFORMATION PROTECTION PROGRAM IMPLEMENTATION ............ 11
FOR ADDITIONAL INFORMATION ............................... 15


INTRODUCTION

Federal agencies are becoming increasingly dependent upon automated
information systems to carry out their missions.  While in the past,
executives have taken a hands-off approach in dealing with these
resources, essentially leaving the area to the computer technologist,
they are now recognizing that computers and computer-related problems
must be understood and managed, the same as any other resource.

The success of an information resources protection program depends on
the policy generated, and on the attitude of management toward
securing information on automated systems.  You, the policy maker, set
the tone and the emphasis on how important a role information security
will have within your agency.  Your primary responsibility is to set
the information resource security policy for the organization with the
objectives of reduced risk, compliance with laws and regulations and
assurance of operational continuity, information integrity, and
confidentiality.


Purpose of this Guide

This guide is designed to help you, the policy maker, address a host
of questions regarding the protection and safety of computer systems
and data processed within your agency.  It introduces information
systems security concerns, outlines the management issues that must be
addressed by agency policies and programs, and describes essential
components of an effective implementation process.

The Risks

The proliferation of personal computers, local-area networks, and
distributed processing has drastically changed the way we manage and
control information resources.  Internal controls and control points
that were present in the past when we were dealing with manual or
batch processes have not always been replaced with comparable controls
in many of today's automated systems.  Reliance upon inadequately
controlled information systems can have serious consequences,
including:

 o  Inability or impairment of the agency's ability to
    perform its mission

 o  Inability to provide needed services to the public

 o  Waste, loss, misuse, or misappropriation of funds

 o  Loss of credibility or embarrassment to an agency

To avoid these consequences, a broad set of information security
issues must be addressed effectively and comprehensively. Towards this
end, executives should take a traditional risk management approach,
recognizing that risks are taken in the day-to-day management of an
organization, and that there are alternatives to consider in managing
these risks. Risk is accepted as part of doing business or is reduced
or eliminated by modifying operations or by employing control
mechanisms.


EXECUTIVE RESPONSIBILITIES

Set the Security Policy of the Organization Protecting information
resources is an important goal for all organizations.  This goal is
met by establishing an information resource security program.  It will
require staff, funding and positive incentives to motivate employees
to participate in a program to protect these valuable assets.  This
information resource protection policy should state precisely:

 o  the value to the agency of data and information
    resources and the need to preserve their integrity, availability,
    and confidentiality

 o  the intent of the organization to protect the resources
    from accidental or deliberate unauthorized disclosure,
    modification, or destruction by employing cost-effective controls

 o  the assignment of responsibility for data security
    throughout the organization

 o  the requirement to provide computer security and
    awareness training to all employees having access to information
    resources

 o  the intent to hold employees personally accountable for
    information resources entrusted to them

 o  the requirement to monitor and assess data security via
    internal and external audit procedures

 o  the penalties for not adhering to the policy


EXECUTIVE GOALS

The policy established for securing information resources should meet
the basic goals of reducing the risk, complying with applicable laws
and regulations, and assuring operational continuity, integrity and
confidentiality.  This section briefly describes these objectives and
how they can be met.

Reduce Risk To An Acceptable Level

The dollars spent for security measures to control or contain losses
should never be more than the projected dollar loss if something
adverse happened to the information resource.  Cost-effective security
results when reduction in risk is balanced with the cost of
implementing safeguards.  The greater the value of information
processed, or the more severe the consequences if something happens to
it, the greater the need for control measures to protect it.  It is
important that these trade-offs of cost versus risk reduction be
explicitly considered, and that executives understand the degree of
risk remaining after selected controls are implemented.

Assure Operational Continuity

With ever-increasing demands for timely information and greater
volumes of information being processed, availability of essential
systems, networks, and data is a major protection issue.  In some
cases, service disruptions of just a few hours are unacceptable.
Agency reliance on essential computer systems requires that advance
planning be done to allow timely restoration of processing
capabilities in the event of severe service disruption. The impact due
to inability to process data should be assessed, and action taken to
assure availability of those systems considered essential to agency
operation.

Comply with Applicable Laws and Regulations

As the pervasiveness of computer systems increases and the risks and
vulnerabilities associated with information systems become better
understood, the body of law and regulations compelling positive action
to protect information resources grows. OMB Circular No. A-130,
"Management of Federal Information Systems," and Public Law 100-235,
"Computer Security Act of 1987" are two documents where the knowledge
of these laws provide a baseline for an information resources security
program.

Assure Integrity and Confidentiality

An important objective of an information resource management program
is to ensure that the information is accurate.  Integrity of
information means you can trust the data and the processes that
manipulate it.  A system has integrity when it provides sufficient
accuracy and completeness to meet the needs of the user(s).  It should
be properly designed to automate all functional requirements, include
appropriate accounting and integrity controls, and accommodate the
full range of potential conditions that might be encountered in its
operation.

Agency information should also be protected from intruders, as well as
from employees with authorized computer access privileges who attempt
to perform unauthorized actions.  Assured confidentiality of sensitive
data is often, but not always, a requirement of agency systems.
Privacy requirements for personal information are generally dictated
by statute, while protection requirements for other agency information
are a function of the nature of that information.  Determination of
requirements in the latter case is made by the official responsible
for that information.  The impact of wrongful disclosure should be
considered in understanding confidentiality requirements.


INFORMATION PROTECTION PROGRAM ELEMENTS

Need for Policies and Procedures

Successful execution of the responsibilities previously outlined
requires establishing agency policies and practices regarding
information protection.  The security policy directive facilitates
consistent protection of information resources.  Supporting procedures
are most effectively implemented with top management support, through
a program focused on areas of highest risk.  A compliance assessment
process ensures ongoing effectiveness of the information protection
program throughout the agency.

Scope

Although the protection of automated information resources is
emphasized in this publication, protection requirements will usually
extend to information on all forms of media.  Agency programs should
apply safeguards to all information requiring protection, regardless
of its form or location.  Comprehensive information resource
protection procedures will address: accountability for information,
vulnerability assessment, data access, hardware/software control,
systems development, and operational controls.  Protection should be
afforded throughout the life cycle of information, from creation
through ultimate disposition.

Accountability for Information

An effective information resource protection program identifies the
information used by the agency and assigns primary responsibility for
information protection to the managers of the respective functional
areas supported by the data.  These managers know the importance of
the data to the organization and are able to quantify the economic
consequences of undesirable happenings.  They are also able to detect
deficiencies in data and know definitively who must have access to the
data supporting their operations. A fundamental information protection
issue is assignment of accountability.  Information flows throughout
the organization and can be shared by many individuals.  This tends to
blur accountability and disperse decision-making regarding information
protection.  Accountability should be explicitly assigned for
determining and monitoring security for appropriate agency
information.

When security violations occur, management must be accountable for
responding and investigating.  Security violations should trigger a
re-evaluation of access authorizations, protection decisions, and
control techniques.  All apparent violations should be resolved; since
absolute protection will never be achieved, some losses are
inevitable.  It is important, however, that the degree of risk assumed
be commensurate with the sensitivity or importance of the information
resource to be protected.

Vulnerability Assessment

A risk assessment program ensures management that periodic reviews of
information resources have considered the degree of vulnerability to
threats causing destruction, modification, disclosure, and delay of
information availability, in making protection decisions and
investments in safeguards.  The official responsible for a specific
information resource determines protection requirements.
Less-sensitive, less-essential information will require minimal
safeguards, while highly sensitive or critical information might merit
strict protective measures.  Assessment of vulnerability is essential
in specifying cost-effective safeguards; overprotection can be
needlessly costly and add unacceptable operational overhead.

Once cost-effective safeguards are selected, residual risk remains and
is accepted by management.  Risk status should be periodically
re-examined to identify new threats, vulnerabilities, or other changes
that affect the degree of risk that management has previously
accepted.

Data Access

Access to information should be delegated according to the principles
of need-to-know and least possible privilege.  For a multi-user
application system, only individuals with authorized need to view or
use data are granted access authority, and they are allowed only the
minimum privileges needed to carry out their duties.  For personal
computers with one operator, data should be protected from
unauthorized viewing or use.  It is the individual's responsibility to
ensure that the data is secure.

Systems Development

All information systems software should be developed in a controlled
and systematic manner according to agency standards.  Agency policy
should require that appropriate controls for accuracy, security, and
availability are identified during system design, approved by the
responsible official, and implemented.  Users who design their own
systems, whether on a personal computer or on a mainframe, must adhere
to the systems development requirements.

Systems should be thoroughly tested according to accepted standards
and moved into a secure production environment through a controlled
process.  Adequate documentation should be considered an integral part
of the information system and be completed before the system can be
considered ready for use.

Hardware/Software Configuration Control

Protection of hardware and resources of computer systems and networks
greatly contributes to the overall level of control and protection of
information.  The information protection policies should provide
substantial direction concerning the management and control of
computer hardware and software.

Agency information should be protected from the potentially
destructive impact of unauthorized hardware and software.  For
example, software "viruses" have been inserted into computers through
games and apparently useful software acquired via public access
bulletin boards; viruses can spread from system to system before being
detected.  Also, unauthorized hardware additions to personal computers
can introduce unknown dial-in access paths.  Accurate records of
hardware/software inventory, configurations, and locations should be
maintained, and control mechanisms should provide assurance that
unauthorized changes have not occurred.

To avoid legal liability, no unauthorized copying of software should
be permitted.  Agencies should also address the issue of personal use
of Federal computer systems, giving employees specific direction about
allowable use and providing consistent enforcement.

Operational Controls

Agency standards should clearly communicate minimum expected controls
to be present in all computer facilities, computer operations,
input/output handling, network management, technical support, and user
liaison.  More stringent controls would apply to those areas that
process very sensitive or critical information.

Protection of these areas would include:

 o  Security management
 o  Physical security
 o  Security of system/application software and data
 o  Network security
 o  Contingency planning

The final section of this guide describes the organizational process
of developing, implementing, and managing the ongoing information
protection program.


INFORMATION PROTECTION PROGRAM IMPLEMENTATION

Information Protection Management

In most cases, agency executive management is not directly involved in
the details of achieving a controlled information processing
environment.  Instead, executive action should focus on effective
planning, implementation, and an ongoing review structure.  Usually,
an explicit group or organization is assigned specific responsibility
for providing day-to-day guidance and direction of this process.
Within this group an information security manager (ISM) should be
identified as a permanent focal point for information protection
issues within the agency.

The ISM must be thoroughly familiar with the agency mission,
organization, and operation.  The manager should have sufficient
authority to influence the organization and have access to agency
executives when issues require escalation.

Independence

In determining the reporting relationship of the ISM, independence of
functional areas within the agency is desirable.  Plans and budget for
the ISM function should be approved by agency management, rather than
being part of any functional area budget.  This approach avoids
conflicts of interest and facilitates development and maintenance of a
comprehensive and consistent protection program that serves the needs
of agency management.

Degree of Centralization

The desirability of centralized versus decentralized security is
heavily debated and largely depends on size, organizational structure,
and management approach at the individual agency.  A centralized
approach to security has the advantages of being directly responsive
to executive direction and specifically accountable for progress and
status.  A decentralized approach to security has the advantages of
being close to the functional area involved.  In the long term,
decentralization may provide better integration of security with other
entity functions.

An effective combined approach offers advantages.  A small dedicated
resource at the agency level can direct the information protection
program, while additional resources are utilized at the functional
area level to implement the program in each area.

Dedicated Staff

The common practice of assigning responsibility for information
security to existing staff with other major responsibilities is often
unsuccessful.  At least one dedicated staff member is recommended at
the program management level.  The need for additional full-time
resources depends on the agency's computer environment.  The number of
information systems, their technical complexity, the degree of
networking, the importance of information processed, adequacy of
existing controls, and extent of agency dependence on information
systems affect the resources needed.

Implementation Stages

Development of a comprehensive information protection program that is
practiced and observed widely throughout a Federal agency occurs in
stages and requires ongoing monitoring and maintenance to remain
viable.

First, organizational requirements for information protection are
identified.  Different agencies have varying levels of need for
security, and the information protection program should be structured
to most effectively meet those needs.

Next, organizational policies are developed that provide a security
architecture for agency operations, taking into consideration the
information protection program elements discussed in the previous
section of this guide.  The policies undergo normal review procedures,
then are approved by agency management for implementation.

Activities are then initiated to bring the agency into compliance with
the policies.  Depending on the degree of centralization, this might
require development of further plans and budgets within functional
entities of the agency to implement the necessary logical and physical
controls.

Training

Training is a major activity in the implementation process.  Security
violations are the result of human action, and problems can usually be
identified in their earliest stages by people.  Developing and
maintaining personnel awareness of information security issues can
yield large benefits in prevention and early detection of problems and
losses.

Target audiences for this training are executives and policy makers,
program and functional managers, IRM security and audit personnel,
computer management and operations, and end users. Training can be
delivered through existing policy and procedures manuals, written
materials, presentations and classes, and audio-visual training
programs.

The training provided should create an awareness of risks and the
importance of safeguards, underscoring the specific responsibilities
of each of the individuals being trained.

Monitoring and Enforcement

An ongoing monitoring and enforcement program assures continued
effectiveness of information protection measures.  Compliance may be
measured in a number of ways, including audits, management reviews or
self-assessments, surveys, and other informal indicators.  A
combination of monitoring mechanisms provides greater reliability of
results.

Variances from policy requirements should be accepted only in cases
where the responsible official has evaluated, documented, and accepted
the risk of noncompliance.  Enforcement of agency policies and
practices is important to the overall success of an information
protection program.  Inconsistent or lax enforcement quickly results
in deterioration of internal controls over information resources.

A positive benefit of an effective monitoring and enforcement process
is an increased understanding of the degree of information-related
risk in agency operations.  Without such a feedback process,
management unknowingly accepts too much risk.  An effective
information protection program allows the agency to continue to rely
upon and expand the use of information technology while maintaining an
acceptable level of risk.

Maintenance

As agency initiatives and operations change, and as the computer
environment evolves, some elements of the information protection
program will require change as well.  Information protection cannot be
viewed as a project with a distinct end; rather, it is a process that
should be maintained to be realistic and useful to the agency.
Procedures for review and update of policies and other program
elements should be developed and followed.


FOR ADDITIONAL INFORMATION

National Institute Of Standards and Technology
Computer Security Program Office
A-216 Technology
Gaithersburg, MD 20899
[phone]

For further information on the management of information resources,
NIST publishes Federal Information Processing Standards Publications
(FIPS PUBS).  These publications deal with many aspects of computer
security, including password usage, data encryption, ADP risk
management and contingency planning, and computer system security
certification and accreditation.  A list of current publications is
available from:

                Standards Processing Coordinator (ADP)
                National Computer Systems Laboratory
                National Institute of Standards and technology
                Technology Building, B-64
                Gaithersburg, MD 20899
                Phone:   (301)  975-2817