Simple Secure Configuration Management
Configuration Management (CM) has some key controls and processes concentrated in the middle of the SDLC where configuration settings and the configuration baseline are recorded, but the entire process has…
Computer Security
Continuous Monitoring Misunderstood
Network security monitoring includes intrusion detection, audit log correlation and analysis and other methods of detecting failures of our network protections. Continuous monitoring is not the same thing. Continuous monitoring…
Wireless Restrictions
AC-18 WIRELESS RESTRICTIONS (NIST SP 800-53) The organization: (i) establishes usage restrictions and implementation guidance for wireless technologies; and (ii) authorizes, monitors, controls wireless access to the information system. NIST…
Contingency Plan
Policy Business Impact Assessment (BIA) The BIA is a critical piece of the CP that establishes requirements for the strategy and procedures in the rest of the CP. Preventative Controls…
Incident Response
Federal agencies are required by law to report incidents to the US Computer Readiness Team (CERT) office in DHS and must have a formal incident response capability. Incident Response Methodology…
Plan of Action and Milestones POAMs
A POAM is a plan that describes specific measures to be taken to correct deficiencies found during a security control assessment. The POAM should identify: An organizational strategy for developing…
Rules of Behavior
Any information security policy and Site Security Plan (SSP) should contain a section known as “Rules of Behavior” that establishes appropriate use and behavior of system users and the consequences…
Policy and Procedure
Each of the seventeen families of security controls found in 800-53 contain a first control that requires the development of policy and procedures for that specific family of controls. Here…
Awareness and Training
KEY NIST DOCS:800-50
Site Security Plan SSP Overview
The security planning process eventually produces a Site Security Plan, known as the “Security Plan” or SSP. The security plan provides an overview of the security requirements of the system…