Federal Cloud Computing

Front Cover......Page 0
Half Tile......Page 2
Title page......Page 4
Copyright......Page 5
Dedication 1......Page 6
Dedication 2......Page 8
Contents......Page 10
About the Author......Page 16
About the Technical Editor......Page 18
Foreword by William Corrington......Page 20
Foreword by Jim Reavis......Page 22
Introduction......Page 24
The Early Years and the Mainframe Era......Page 28
Shifting to Minicomputer......Page 30
Decentralization: The Microcomputer (“Personal Computer”)......Page 31
Transitioning to Mobility......Page 33
Evolution of Federal IT Policy......Page 34
Cloud Computing: Drivers in Federal IT Transformation......Page 42
Drivers for Adoption......Page 43
Cloud Benefits......Page 46
Decision Framework for Cloud Migration......Page 48
Selecting Services to Move to the Cloud......Page 49
Provisioning Cloud Services Effectively......Page 50
References......Page 51
Introduction......Page 54
Standards Development Primer......Page 57
Trade Agreements Act (TAA)......Page 59
Adoption Barriers......Page 60
Identifying Standards for Federal Cloud Computing Adoption......Page 62
Standards Inventory......Page 63
References......Page 73
Introduction......Page 76
Open Source and the Federal Government......Page 78
OSS Adoption Challenges: Acquisition and Security......Page 83
Acquisition Challenges......Page 84
Security Challenges......Page 85
OSS and Federal Cloud Computing......Page 88
References......Page 91
Introduction......Page 94
Security and Privacy in the Context of the Public Cloud......Page 96
Federal Privacy Laws and Policies......Page 98
Privacy Act of 1974......Page 100
E-Government Act of 2002, Federal Information Security Management Act (FISMA)......Page 102
OMB Memorandum Policies......Page 104
Safeguarding Privacy Information......Page 105
Privacy Controls......Page 107
Accountability, Audit, and Risk Management (AR)......Page 109
Data Quality and Integrity (DI)......Page 113
Data Minimization and Retention (DM)......Page 114
Individual Participation and Redress (IP)......Page 115
Security (SE)......Page 117
Transparency (TR)......Page 118
Use Limitation (UL)......Page 119
Data Breaches, Impacts, and Consequences......Page 120
Security and Privacy Issues......Page 122
References......Page 124
Purpose......Page 126
Role and Responsibilities......Page 127
Director of OMB......Page 128
Federal Agencies......Page 129
Head of Agency or Equivalent......Page 130
Federal Agency Independent Evaluations and Reporting......Page 131
Risk Management Framework Overview......Page 132
The NIST RMF and the System Development Life Cycle......Page 133
NIST RMF Process......Page 135
Information System Categorization......Page 138
Relationship Between the NIST RMF and the Federal Enterprise Architecture......Page 140
Shared Responsibility and the Chain of Trust......Page 142
Overview of the Security Categorization Process......Page 143
Identify Information Types......Page 145
Select Provisional Impact Values for Each Information Type......Page 147
Adjust the Information Type’s Provisioning Impact Value and Security Category......Page 149
Determine the System Security Impact Level......Page 150
Security Control Selection......Page 152
Applying Scoping Considerations......Page 157
Selecting Compensating Security Controls......Page 158
Supplementing the Tailored Baseline......Page 159
Documenting the Tailoring and Supplementation Process......Page 160
Allocating Security Controls......Page 161
Decomposition......Page 163
Security Controls Implementation......Page 164
Implementing and Documenting Security Controls......Page 165
Security Controls Assessment......Page 166
Assessment Preparation......Page 167
Security Assessment Plan......Page 169
Reporting Assessment Results......Page 170
Corrective Action Planning......Page 171
Developing a Risk Mitigation Strategy......Page 172
Documenting POA&Ms......Page 173
Security Authorization Approaches......Page 174
Security Authorization Process......Page 175
Security Controls Monitoring......Page 180
Determining Security Impact......Page 182
Ongoing Security Controls Assessments......Page 183
Key Updates and Status Reporting......Page 185
References......Page 188
Introduction to Risk Management......Page 192
Federal Information Security Risk Management Practices......Page 195
Components of the NIST Risk Management Process......Page 198
Risk Framing......Page 199
Risk Assessment......Page 200
Risk Response......Page 201
Multi-Tiered Risk Management......Page 202
Tier 1 Risk Management Activities......Page 203
Tier 3 Risk Management Activities......Page 204
NIST Risk Management Process......Page 205
Framing Risk......Page 206
Risk Assessment......Page 208
Responding to Risk......Page 209
Monitoring Risk......Page 211
Comparing the NIST and ISO/IEC Risk Management Processes......Page 212
Summary......Page 216
References......Page 217
Introduction......Page 218
Overview of Certification and Accreditation......Page 219
Civilian Agencies......Page 222
Department of Defense (DoD)......Page 224
Committee on National Security Systems (CNSS)......Page 225
Towards a Unified Approach to C&A......Page 227
NIST and ISO/IEC Information Security Standards......Page 228
Boundary and Scope Definition......Page 229
Security Policy......Page 232
Risk Management Process......Page 233
Security Objectives and Controls......Page 234
References......Page 238
Introduction to FedRAMP......Page 240
FedRAMP Policy Memo......Page 242
DHS......Page 244
JAB......Page 246
Federal Agencies......Page 247
FedRAMP Concept of Operations......Page 248
Operational Processes......Page 249
Initiating a Request......Page 251
Documenting the Security Controls......Page 253
Performing the Security Assessment......Page 255
Finalizing the Security Assessment......Page 256
Leveraging the ATO......Page 257
Operational Visibility......Page 258
Incident Response......Page 259
Third Party Assessment Organization Program......Page 260
Summary......Page 261
References......Page 262
Security Control Selection Process......Page 264
Tailoring and Supplementing Security Control Baseline......Page 265
FedRAMP Cloud Computing Security Requirements......Page 266
Policy and Procedures......Page 268
Harmonizing FedRAMP Requirements......Page 270
Assurance of External Service Providers Compliance......Page 272
Approaches to Implementing FedRAMP Security Controls......Page 273
FedRAMP Security Control Requirements......Page 276
Awareness and Training (AT)......Page 286
Audit and Accountability (AU)......Page 287
Security Assessment and Authorization (CA)......Page 291
Configuration Management (CM)......Page 294
Contingency Planning (CP)......Page 299
Identification and Authentication (IA)......Page 304
Incident Response (IR)......Page 309
Maintenance (MA)......Page 312
Media Protection (MP)......Page 315
Physical and Environmental Protection (PE)......Page 318
Planning (PL)......Page 323
Personnel Security (PS)......Page 325
Risk Assessment (RA)......Page 327
System and Services Acquisition (SA)......Page 330
System and Communications Protection (SC)......Page 335
System and Information Integrity (SI)......Page 343
References......Page 349
Introduction to the Security Assessment Process......Page 352
Governance in the Security Assessment......Page 354
Preparing for the Security Assessment......Page 357
Selecting a Security Assessment Provider......Page 359
Security Assessment Planning......Page 361
Security Assessment Provider Responsibilities......Page 362
Developing the Security Assessment Plan (SAP)......Page 363
Identify In-Scope Security Controls......Page 364
Select Assessment Procedures......Page 365
Tailor Assessment Procedures......Page 367
Supplementing Assessment Procedures......Page 368
Executing the Security Assessment Plan......Page 369
References......Page 371
Introduction to Continuous Monitoring......Page 372
Organizational Governance......Page 374
CM Strategy......Page 377
The Continuous Monitoring Process......Page 379
Defining a CM Strategy......Page 380
Implementing a CM Program......Page 381
Review and Update CM Strategy and Program......Page 386
Continuous Monitoring within FedRAMP......Page 387
References......Page 396
Introduction......Page 398
CM Reference Architectures......Page 400
CAESARS Framework Extension Reference Architecture......Page 401
Subsystems and Components......Page 405
Specifications: Workflows, Subsystems, and Interfaces......Page 407
Workflows......Page 408
Interfaces......Page 410
Security Automation Standards and Specifications......Page 411
Cybersecurity Information Exchange Framework......Page 412
Operational Visibility and Continuous Monitoring......Page 413
Summary......Page 416
References......Page 417
Case Study Scenario: “Healthcare Exchange”......Page 418
Categorize Information System......Page 419
Select Security Controls......Page 435
Defining the Boundary......Page 436
Tailoring and Supplementing......Page 437
Assessing Security Controls......Page 438
References......Page 442
Index......Page 444