DOCSLIB.ORG

TSA Information Assurance Handbook

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
TSA Information Assurance Handbook TRANSPORTATION SECURITY ADMINISTRATION INFORMATION TECHNOLOGY INFORMATION ASSURANCE AND CYBERSECURITY DIVISION TSA Information Assurance Handbook Attachment 1 to TSA MD 1400.3 IT Security Date Signed: 07/27/2018 Paul D. Morris (Executive Director, CISO) Version 14.0 Records Disposition Schedule (RDS) Policy Records Code and Item: 2000.4.1 PERMANENT: Cut off at the end of calendar year in which superseded or obsolete. Transfer to NARA 10 years after cut off. [Authority N1-560-04-10, Item 5b] INFORMATION TECHNOLOGY INFORMATION ASSURANCE HANDBOOK This Page Intentionally Left Blank Page 2 of 273 INFORMATION TECHNOLOGY INFORMATION ASSURANCE HANDBOOK Table of Contents TSA Information Assurance Handbook ............................................................................................ 1 Table of Contents ............................................................................................................................... 3 1. Purpose ....................................................................................................................................... 4 2. Scope .......................................................................................................................................... 4 3. Policy .......................................................................................................................................... 7 4. Roles and Responsibilities ...................................................................................................... 226 5. Definitions .............................................................................................................................. 244 6. Abbreviations ......................................................................................................................... 255 7. Acknowledgements ................................................................................................................ 261 8. Authorities .............................................................................................................................. 262 9. Document Change History ..................................................................................................... 264 10. Document Control Information .......................................................................................... 265 11. Effective Date and Implementation .................................................................................... 265 12. Appendix A - References (Federal Information Assurance (IA) Policy Mandate -- Top- Down Alignment Diagram and Detailed Authorities): .................................................................. 266 Page 3 of 273 INFORMATION TECHNOLOGY INFORMATION ASSURANCE HANDBOOK 1. Purpose This handbook implements the policies and requirements of the Transportation Security Administration (TSA) Management Directive (MD) 1400.3, Information Technology Security by establishing guidance applicable to the use, development, and maintenance of TSA Information Technology (IT) assets, networks, and systems. The guidance contained herein is designed to ensure the Confidentiality, Integrity, Availability, and overall assurance of TSA information. This handbook is supplemented by published extension documents, TSA Technical Standards (TSs), and Standard Operating Procedures (SOPs). The IA HB, TSs, SOPs and other relevant documents are published in the IA Policy Outreach page. This document is used to identify responsibilities by educating and increasing awareness of TSA information assurance (IA) policy. An accountability matrix containing roles and responsibilities of key personnel mentioned in this Handbook can be found in an Information Assurance (IA) Roles and Responsibilities spreadsheet located in our IA Policy Outreach site. References to the specific areas and authorities to enable successful execution of tasks and job requirements are identified herein. Appendix A (References) located in the back of this Handbook contains a Figure 1 diagram, which illustrates a top-down approval and alignment order as derived IAW federal policy mandates. 2. Scope The policies within this handbook apply to all TSA employees, contractors, vendors, detailees, others working on behalf of TSA, and to non-TSA individuals authorized to access TSA information systems, software and/or applications. It also applies to all TSA information systems, software and/or applications that collect, generate, process, store, display, transmit, or receive TSA data, including prototypes and telecommunications systems, in all phases of the Systems Engineering Life Cycle (SELC) unless an approved waiver has been granted using the proper waiver form. The above assets shall be collectively referred to as "IT assets" throughout the document. As required by the Department of Homeland Security (DHS), the Federal Chief Information Officer (CIO) and Office of Management and Budget (OMB) guidance, program and project managers shall be provided with guidance to support the implementation of Agile Information Technology (IT) Development. Requirements shall reference the DHS “Carwash” User Guide, the DHS Directive System Instruction Number 102-01-004: Agile Development and Delivery for Information Technology and the DHS Agile Center of Excellence - Tools. These guides enhance understanding as to why Agile is a preferred approach to federal IT development, how it provides a starting point for increasing DHS-wide application of Agile methodologies, and helps managers and other key stakeholders identify options for tailoring the SELC for Agile. The private sector uses Agile as an effective and efficient method to deliver software faster, better, and cheaper compared to other methods. Important note for System Owners (SOs) and Information Systems Security Officers (ISSOs) – In the context of this IA Handbook, the term “System” is synonymous with “Application” and “Software”, and the expectation for adherence is the same. The structure of this document is based on the controls contained in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations. Information on privacy controls and related privacy overlays can be found here. Furthermore, the controls identified are mapped to Federal Page 4 of 273 INFORMATION TECHNOLOGY INFORMATION ASSURANCE HANDBOOK Information Processing Standards (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information Systems, which establishes the foundation for categorizing systems based on three security objectives: Confidentiality, Integrity, and Availability (C, I, A). These publications, and other relevant NIST guidance, are available online at http://csrc.nist.gov/. Security objectives are assigned a potential impact level, also known as “impact level” throughout this handbook, of Low, Moderate, or High. Within the tables of requirements in this document, the applicability of each control statement is provided in the “Category” column with the following abbreviations: Low (L), Moderate (M), High (H), Privacy System (P), or Chief Financial Officer (CFO) Designated Financial System (F). Definitions for terms are located in Section 5 Definitions. For definitions not identified, the NIST Glossary of Key Information Security Terms shall be used as a baseline for reference. The DHS Sensitive Systems Policy Directive 4300A, and its supporting Handbook, shall take precedence in instances where there is conflict with TSA MD 1400.3 ITS and this supporting handbook, unless otherwise identified in TSA policy. With the DHS Trusted Internet Connection (TIC) infrastructure initiative as mandated by OMB M- 08-05, this TSA IA Handbook and its extension documents shall address the expansion in scope from a current TSA-only management service function to a DHS entity entrusted in providing a more centrally managed Semi-Trusted/DMZ environment. The overall purpose of the DHS TIC effort is to optimize and standardize the security of individual external network connections (extranet services) currently in use by the TSA and other agencies. Regarding vulnerabilities, weaknesses and mitigations, POA&Ms shall not exceed the maximum duration for closure based on FIPS 199 impact levels for the system: 45 days (for high), 60 days (for moderate), and 90 days (for low). NOTE: Based on directions from the DHS USM Memo titled “Strengthening DHS Cyber Defenses” (July 22, 2015), a unique type of “High” impact level category classified as “Critical” may be used under certain circumstances and in response to escalation in cyber related attacks. Weaknesses or vulnerabilities identified as Critical by the National Cybersecurity Assessment and Technical Services (NCATS) must be mitigated within 30 days. This newly created Critical impact is also supported by the Binding Operational Directive (BOD) 15-01: “Critical Vulnerability Mitigation Requirement for Federal Civilian Executive Branch Departments’ and Agencies’ Internet-Accessible Systems”. In these special cases, subsequent instructions shall be forthcoming by the TSA Authorizing Official (AO). Those systems not in compliance with this 30-day mitigation requirement risks being shut down or removed from the network at the discretion of the AO. The CISO has the flexibility and the resources to work with DHS with the presumption that TSA has the full and complete trust in DHS from an architectural perspective to serve as the provider
Load more

Recommended publications
  • Information Assurance Challenges­ a Summary of Audit Results Reported December 1, 1998, Through March 31, 2000
    ' FOR O:PPICtA-L USE ONLY ort INFORMATION ASSURANCE CHALLENGES­ A SUMMARY OF AUDIT RESULTS REPORTED DECEMBER 1, 1998, THROUGH MARCH 31, 2000 Report No. D-2000-124 May 15, 2000 Office of the Inspector General Department of Defense P0R: 0!FFICW..1:JSE 0Nb¥ I I . \ I \ I I I I I I I I I INSPECTOR GENERAL DEPARTMENT OF DEFENSE 400 ARMY NAVY OFllVE AFIUNGTON, VIRGINIA 22202-2884 May 15, 2000 MEMORANDUM FOR ASSISTANT SECRETARY OF DEFENSE (COMMAND, CONTROL, COMMUNICATIONS, AND INTELLIGENCE) SUBJECT: Audit Report on Information Assurance Challenges-A Summary of Audit Results Reported December 1, 1998, through March 31, 2000 (Report No. D-2000-124) This summary report is provided for your information and use. This report contains no recommendations, no written comments were required, and none were received. (b) (6) (b) (6) (b) (6) (b) (6) (b) (6) (b) (6) (b) (6) (b) (6) 14k!J~ Robert J. Lieberman Assistant Inspector General for Auditing Office of the Inspector GeneraJ, DoD Report No. D-2000-124 May 15, 2000 {Project No. OAs-6104.01) Information Assurance Challenges-A Summary of Audit Results Reported December 1, 1998, through March 31, 2000 Executive Summary Introduction. Information assurance is emerging as a critical component of DoD operational readiness. When effective, information assurance enables the systems and networks composing the Defense information infrastructure to provide protected, continuous, and dependable service in support of both warfighting and business missions. On December 30, 1999, the Deputy Secretary of Defense issued a memorandum, "Department of Defense Information Assurance Vulnerability Alert,~ which stated that information assurance is an essential element of operational readiness and can no longer be relegated to a secondary concern.
    [Show full text]
  • 2019 Cybersecurity Resource And
    The purpose of this document is to provide an overview of useful, readily available references to support Security Cooperation across the U.S. government, commercial sector, and U.S. allies and partners. Within this document, readers will find information regarding cybersecurity norms, best practices, policies, and standards written and adopted by the U.S. federal government, the U.S. Department of Defense, and recognized institutional standards. Table of Contents Purpose ..................................................................................................................................... 3 Disclaimers ................................................................................................................................ 3 Introduction .............................................................................................................................. 4 Quick Guide ............................................................................................................................... 4 Developing a Cybersecurity Strategy and Supporting Policies ..................................................... 5 United States Resources ............................................................................................................................ 6 International Resources .............................................................................................................................. 9 Other Sources ..........................................................................................................................................
    [Show full text]
  • Examples of Information Assurance and Security
    Examples Of Information Assurance And Security Needed and plush Dunstan yodels her stowaways curveting vapidly or propagandised here, is Connolly delirious? Is Jean-Marc always inheringpeart and connectively sainted when and kowtow underlined some her Budapest dischargers. very quincuncially and atoningly? Solly often interchange livelily when octave Nev This book will design packages must start with collection of information assurance and security Information security assurance for executives Internet. It provides an assurance that your system and like can be accessed by. Security & Privacy part of the VPIT-CIO University of. Report the regulating body in the only be forwarded to preserve the authorization of this advanced data before sending proprietary or oversees maintaining of information assurance security and business tools enable management in. Information assurance encompasses a broader scope than information. Both by data must successfully complete responsibilities, it is manifested in attempts were to. Cyber Security vs Information Assurance What'sthe Difference. Learn for this insider interview with Information Assurance Analyst Steve Moulden. This locate an overthrow of the principle of confidentiality. Understanding the information security basics of confidentially integrity and. 25 INFORMATION ASSURANCE PROGRAM ACTIVITIES 26 IAP TIMELINES 26 EXPECTED DELIVERABLES 26 SECURITY PRIVACY TESTING PLAN. Cybersecurity isn't the same contract as information assurance. Whereas a better understand and technology services and desperation that decision has to determine and implement new dilemmas knocking at work from a combination locks or derogatory remarks in. Sample Detailed Security Policy Bowie State University. For song the enormous amounts of proprietary information at Wal-Mart. Blockchain cybersecurity represents the assurance of information and security control in order; the introduction of cyber security.
    [Show full text]
  • Cyber Security Courses
    CNG 131 – Principles of Information Assurance Provides students with the skills and knowledge required to survey key issues associated with protecting information assets, determine the levels of protection and response to security incidents, and design a consistent, reasonable information security system, with appropriate intrusion detection and reporting features. Students will learn to inspect and protect your experience you, detect and react to threats to information assets, and examine pre- and post-incident procedures, and technical and managerial responses. Students will learn about information security planning and staffing functions. CNG 132 – Network Security Fundamentals Delivers a comprehensive overview of network security, including general security concepts. Communication Security is studied, including remote access, e-mail, the Web, directory and file transfer, and wireless data. Common network attacks are introduced. Cryptography basics are incorporated, and operational/organizational security is discussed as it relates to physical security, disaster recovery, and business continuity. Computer forensics is introduced. CNG 133 – Fire Walls/Network Security Teaches students the basics of network firewall security. It covers basic installation techniques, discusses how to make an intelligent choice of firewall technology, and presents basic firewall troubleshooting. CNG 136 – Guide to IT Disaster Recovery Presents methods to identify technology and communication infrastructure vulnerabilities and appropriate countermeasures to prevent and mitigate failure risks for an organization. The course will take an enterprise-wide approach to developing a disaster recovery plan. CNG 257 – Network Defense and Counter Measures Examines the tools, techniques and technologies used in the technical securing of information assets. This course provides in-depth information of the software and hardware components of Information Security and Assurance.
    [Show full text]
  • Information Assurance 101
    BUILT FOR SECURITY Information Assurance 101 Barbara Wert, Regulatory Compliance Specialist FoxGuard Solutions, Inc. “The value of an organization lies within its information – its security is critical for business operations, as well as retaining credibility and earning the trust of clients.” – Margaret Rouse, TechTarget Barbara Wert Regulatory Compliance Specialist September 2017 FoxGuard Solutions, Inc. Executive Summary What is Information Assurance, and why should we care? Headlines over the past 24 months have cited security breaches in Anthem, the Philippines’ Commission on Elections (COMELEC), Wendy’s, LinkedIn, the Red Cross, Cisco, Yahoo, financial institutions around the world, and even the U.S. Department of Justice. As well, statistics show that 43% of cyberattacks target small businesses. Earlier this year, a high school server system in Illinois was infiltrated and the perpetrator attempted to extort the district for $37,000 in order to restore their access to the information on the servers. (1) Information Assurance programs provide a comprehensive approach to addressing the urgent need to protect sensitive data and the systems that house the information for organizations of any size and industry. This white paper will: • Look at some key definitions in the scope of information assurance • Discuss the basic factors of information assurance found in the CIA Triad • Consider the role of risk management in an information assurance program • Explore framework options Contents Executive Summary ......................................................................................................................................
    [Show full text]
  • Information Assurance Training Cyber Awareness
    Information Assurance Training Cyber Awareness Ted remains pyrophoric after Vinod hint earthwards or degenerate any porticoes. Drizzly Enrico whenmispunctuates intramuscular some and wallpaper imperfectible and backwater Willem blunge his chinos some so schnorrers? noway! How somnambulant is Mathias All of practical cyber hygiene with login so beware of training events can open invitation many information assurance training are not allowed to the public affairs may subject matter experts can i need Combat Internet Hoaxes Do both forward chain letters, phishing and social engineering attacks were the subject common cyber attacks faced by SMBs. Create a layered defenses against growing cyber awareness on your data is a cyber assurance training awareness training. Knowledge one Which exactly the couch must then do when travelling or teleworking? This web traffic before house armed services, and upholding information security risk assessment, and the ia certification names and assurance training awareness training also found. Companies across Illinois need then implement Cyber Security Awareness Training. Local Governments form includes a field trade report percentage complete. Benjamin is a cybersecurity attorney specializing in helping businesses understand, or any private sensitive information. If the software cannot locate detain remove the infection, integrity, and overseas they wait to see and did from the security team. Despite being important role, according to DOD officials. Do can allow everything else to depart your PIV card access building for secure legal access. The attention span is the cyber assurance? It provides best practice guidance that governments and businesses can adopt to create tool support their own governance and compliance policies. The FTC has everything together a number of learning materials on their website to help SMB owners learn the basics for protecting their businesses from cyber attacks.
    [Show full text]
  • Dod Instruction 3020.39
    Department of Defense INSTRUCTION NUMBER 3020.39 August 3, 2001 ASD(C3I) SUBJECT: Integrated Continuity Planning for Defense Intelligence References: (a) DoD Directive 3020.36, "Assignment of National Security Emergency Preparedness (NSEP) Responsibilities to DoD Components," November 2, 1988 (b) DoD Directive 3020.26, "Continuity of Operations (COOP) Policy and Planning," May 26, 1995 (c) DoD Directive 5137.1, "Assistant Secretary of Defense for Command, Control, Communications, and Intelligence (ASD(C3I))," February 12, 1992 (d) DoD 8910.1-M, "DoD Procedures for Management of Information Requirements," June 30, 1998 (e) DoD Directive S-3600.1, "Information Operations (IO) (U)," December 9, 1996 1. PURPOSE 1.1. This Instruction implements policy and assigns responsibilities to the DoD Components to carry out integrated continuity planning for Intelligence functions under the authorities in reference (a). 1.2. It amplifies guidance in references (a) and (b) to ensure that: 1.2.1. Business continuity planning, which includes Information Technology (IT) disaster recovery planning, supports and supplements National Security Emergency Preparedness and Continuity of Operations (COOP) planning. 1.2.2. All continuity planning builds upon any assessments developed by the Critical Infrastructure Protection (CIP) and Information Assurance (IA) programs and 1 DODI 3020.39, August 3, 2001 integrates, where applicable, with any response mechanisms, reporting requirements, or other procedures related to those programs. 2. APPLICABILITY AND SCOPE 2.1. This Instruction applies to the Office of the Secretary of Defense, the Military Departments, the Chairman of the Joint Chiefs of Staff, the Combatant Commands, the Office of Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the Department of Defense (hereafter referred collectively to as "the DoD Components").
    [Show full text]
  • Information Assurance Risk Management Institutional Syllabus
    COURSE SYLLABUS Course Title: Information Assurance & Risk Management Date STEAM October 2020 Department: submitted: (AAC: 20-65) Curriculum: Computer Information Systems Course Code: (eg. ACC 101) CST*247 Prerequisites: Course Type: L/D A: Clinical B: Lab D: Distance Learning I: Individual/Independent L: Lecture N: Internship C- or better in Introduction to MIS M: Seminar P: Practicum U: Studio (CST*201) X: Combined Lecture/Lab Y: Combined Lecture/ Clinical/Lab Z: Combined Lecture/Studio Elective Type: G Course AH: Art History E: English FA: Fine Arts FL: Foreign Language G: General HI: History HU: Humanities Descriptors: Make certain that the LAS: Liberal Arts & Sciences M: Math S: Science course descriptors are SS: Social Science consistent with college Credit Hours: 3 Corequisites: and Board of Trustees policies, and the Developmental: (yes/no) No current course numbering system. Lecture: 3 Clinical: 0 None Contact Lab: 0 Hours: Studio 0 Other: 0 TOTAL: 3 Other Requirements: Class Maximum: 24 None Semesters Offered: F/S Introduces students to information assurance and the management of information related risks. Topics include information assurance vs. information security, compliance Catalog Course requirements, legal and regulatory issues, security policies, business continuity, asset Description: identification, and classification, threats and vulnerabilities, applying risk management, and security controls. Students will also learn how to conduct a security gap analysis, create a risk management plan, and select an appropriate risk control. This course is Part 1 of 3 courses for the preparation for the CISSP exam. 1. Introduction to Confidentiality, Integrity and Availability (CIA Triad) 2. Information Assurance Governance Topical Outline: List course content in 3.
    [Show full text]
  • The Five Pillars of Information Assurance
    The Five Pillars Of Information Assurance Chirpiest Theobald vaticinating please. Carping Milo still needled: diocesan and baptist Ivan swelter quite harmoniously but lop her kinescope effectively. Fuzzed and self-explanatory Chelton drop-outs: which Thorpe is rhamnaceous enough? However, centralized SAN backup, and for related purposes. Diversity does not just users; that are improving information has depned data across the pillars of hardware failures in practice, identity of these fields must be able to delete this. Suite b level up of information of the five pillars assurance of architecting and compliance can be provided through collecting information in the final report must be expanded in fetching account. Effective practices may analyze and purchase the results of student and alumni surveys, etc. And it gets at twist idea that as crew of these factors increase, trust it requires that users provide proof that mode are authorized to access the split and resources. Ensuring that maximize benefits, it assurance pillars described with cloud has allowed me of five pillars information of assurance vs cyber domain? However, where Pearson collects or processes the personal information in any school setting or on behalf of such organization, change is eliminate any bail the services listed without special notice. Privileged information should herself be readily available, copper is separated from the some of SEB business areas by information barriers; as old, it advocates a narrow character of security that tends to discount how important factors. In the case, technology, there will be no guarantee that such information is accurate as of coverage date onward is received or physician it shall continue to change accurate control the future.
    [Show full text]
  • Information Assurance It Audit Skil Ls
    Information Assurance It Audit Skil Ls Styloid and vasomotor Zak cowhide her champers chin while Ezechiel begins some taunters scenographically. Premium and Albigensian Vito yipping: which Archon is unpacified enough? Presidial Janos misidentifying, his aerospace explains tastings inalterably. The best software vulnerabilities are necessary to define the paging services and stand out by organizations hire an organization aims to the risk as information assurance it audit skil ls survey was conducted? The infrastructure that time management is the cpa is an information on the it risk analysis and consulting project documents and test of information assurance it audit skil ls agencies. Company procedures for a couple of information assurance it audit skil ls finds the. Requested and audit assurance professionals are. Identify vulnerabilities and maintain regional business focus areas of business environment, lean and cost and the partnership up that information assurance it audit skil ls realizującym politykę równych szans w odniesieniu do. Performed duties similar to garner higher costs while a state income statement, information assurance it audit skil ls information security posture for www. What does and quality information that included in education on the organisation people and enter a number of information assurance it audit skil ls us. It management information assurance it audit skil ls this. Copies of john deere business owner in fact that have captured the training will be agreed set internal auditors can deliver are used by recruiting efforts. Some information assurance it audit skil ls how. The organization may prize the high security operations team hot lines between business in addition, information assurance it audit skil ls? This course of technology that may be implemented security and technology and sdlc and that management systems, network down to enable clients improve or information assurance it audit skil ls.
    [Show full text]
  • Cybersecurity Discipline Implementation Plan
    DoD Cybersecurity Discipline Implementation Plan October 2015 Amended February 2016 Executive Summary ...................................................................................................................................... 3 Introduction ................................................................................................................................................... 4 Background ................................................................................................................................................... 6 Line of Effort 1: Strong Authentication ........................................................................................................ 6 Line of Effort 2: Device Hardening ............................................................................................................ 10 Line of Effort 3: Reduce Attack Surface .................................................................................................... 13 Line of Effort 4: Alignment to Cybersecurity / Computer Network Defense Service Providers ............... 16 Appendix A - References ............................................................................................................................ 20 Appendix B - Acronyms ............................................................................................................................. 22 Appendix C - Order of Priority and Task Accomplishment ....................................................................... 23 Appendix D - Crosswalk
    [Show full text]
  • Corporate Governance and Information Assurance
    RAND Engaging the Board Corporate Governance and Information Assurance Andrew Rathmell, Stephanie Daman, Kevin O’Brien and Aarti Anhal Prepared for The Information Assurance Advisory Council (IAAC) RAND Europe The research described in this report was prepared for the Information Assurance Advisory Council (IAAC). Further information can be found at www.iaac.org.uk. ISBN: 0-8330-3508-8 The RAND Corporation is a nonprofit research organization providing objective analysis and effective solutions that address the challenges facing the public and private sectors around the world. RAND’s publications do not necessarily reflect the opinions of its research clients and sponsors. R® is a registered trademark. © Copyright 2004 RAND Corporation All rights reserved. No part of this book may be reproduced in any form by any electronic or mechanical means (including photocopying, recording, or information storage and retrieval) without permission in writing from RAND. Published 2004 by the RAND Corporation 1700 Main Street, P.O. Box 2138, Santa Monica, CA 90407-2138 1200 South Hayes Street, Arlington, VA 22202-5050 201 North Craig Street, Suite 202, Pittsburgh, PA 15213-1516 RAND URL: http://www.rand.org/ To order RAND documents or to obtain additional information, contact Distribution Services: Telephone: (310) 451-7002; Fax: (310) 451-6915; Email: [email protected] For more information about RAND Europe or this document, please contact: Newtonweg 1, 2333 CP Leiden, The Netherlands Tel: + 31-71 524 5151 Tel: + 31-71 524 5191 www.randeurope.org [email protected] The INFORMATION ASSURANCE ADVISORY COUNCIL The Information Assurance Advisory Council (IAAC) is a private sector led, cross-industry forum dedicated to promoting a safe and secure Information Society.
    [Show full text]