Agreement reached on security controls for IT systems

A coalition of public and private organizations, including U.S. military and intelligence agencies, today will release a preliminary set of baseline IT security controls intended to become a foundation for a standardized approach to securing the nation’s critical information infrastructure.

The Consensus Audit Guidelines (CAG) are being released initially for public comment, but plans call for them to be piloted in several agencies later this year. Eventually the federal Chief Information Officers Council will evaluate the recommendations to decide whether it makes sense to adopt them as a standard throughout government.

The value of the guidelines is not so much in providing new security controls for systems administrators, but in standardizing the priority security efforts. The project is headed by former Air Force and Energy Department CIO John Gilligan, who called the approach a “no brainer.”

“If you know that attacks are being carried out, you have a responsibility to prioritize your security investments to stop those attacks,” Gilligan said in announcing the guidelines.

Although the primary audiences for the guidelines are government agencies and their contractors, the controls are intended to be applicable to private industry as well, particularly the financial-services sector.

“It almost certainly will revolutionize federal cybersecurity practice and will spill over to the defense industrial base, and banks and commercial organizations almost immediately,” said Alan Paller, director of research at the SANS Institute, one of the member organizations in the project.

The guidelines contain 20 security controls deemed by consensus to be a critical baseline for IT systems. Fifteen of them are subject to automated measurement and validation, and five require more manual effort. They are:

Critical controls subject to automated measurement and validation include:

• Inventory of authorized and unauthorized hardware.
• Inventory of authorized and unauthorized software.
• Secure configurations for hardware and software for which such configurations are available.
• Secure configurations of network devices, such as firewalls and routers.
• Boundary defense.
• Maintenance and analysis of complete security audit logs.
• Application software security.
• Controlled use of administrative privileges.
• Controlled access based on need to know.
• Continuous vulnerability testing and remediation.
• Dormant account monitoring and control.
• Anti-malware defenses.
• Limitation and control of ports, protocols and services.
• Wireless device control.
• Data-leakage protection.
  

Controls not directly supported by automated measurement and validation include:

• Secure network engineering.
• Red-team exercises.
• Incident-response capability.
• Assured data backups.
• Security-skills assessment and training to fill gaps.

The CAG project began in 2008 as way to develop a risk-based standard of due care in response to data breaches detected in defense contractors. Because the vulnerabilities in, threats to and attacks against government IT systems essentially are the same for contractors, the target of the program was expanded to include government as well.

The security controls contained in the guidelines do not exist in a vacuum. The National Institute of Standards and Technology has published a set of Recommended Security Controls for Federal Information Systems and Organizations as part of its guidance to agencies for compliance with the Federal Information Security Management Act. The NIST document, Special Publication 800-53, has recently been updated and released for public comment.

The updated NIST document is part of an effort to harmonize security requirements across government. NIST guidance typically does not apply to government information systems identified as national-security systems. For two years, NIST has been cooperating with the Defense Department and the Office of the Director of National Intelligence on the Committee on National Security Systems, which is trying to bring both sides closer together.

SP 800-53 also is an effort to bridge the gap between security requirements for government and nongovernmental systems. Recommendations in that document now are mapped to international standards in ISO/IEC 2701, which are used by many contractors.

Plans for the CAG include a multistep process toward widescale implementation. It begins with a 30-day public-review period and then will move to pilot implementations in several agencies, in which consensus guideline controls will be compared with what would have been done under current practices.

A federal CIO Council security committee will review the results to determine whiter the guidelines could be used on a broader basis to focus federal security expenditures. A team from the Federal Audit Executive Council also will review the CAG to determine how they might allow auditors to provide reviews that more accurately measure the security of federal systems.

A series of workshops also will be held in to present the lessons learned in using the guidelines. These will produce requirements documents for government procurement programs such as the General Services Administration’s SmartBuy program and DOD’s Enterprise Systems and Solutions Group.

Government participants in the CAG program include the National Security Agency Red Team and Blue Team, the Homeland Security Department, the U.S. Computer Emergency Readiness Team, the DOD Computer Network Defense Architecture Group, DOD Joint Task Force–Global Network Operations, the DOD Defense Cyber Crime Center, the Energy Department’s Los Alamos National Laboratory, the Army Research Laboratory, the Transportation Department, the Health and Human Services Department, and the Government Accountability Office.

Private sector participants include MITRE Corp., the SANS Institute, and commercial penetration testing and forensics experts at InGuardians and Mandiant.