Presentation is loading. Please wait.

Presentation is loading. Please wait.

Defense Security Service. DSS Update DSS Changing With A Changing Security Environment.

Similar presentations

Presentation on theme: "Defense Security Service. DSS Update DSS Changing With A Changing Security Environment."— Presentation transcript:

1 Defense Security Service

2 DSS Update DSS Changing With A Changing Security Environment

3 DSS Update FY12 in Review: Conducted 8,162 security vulnerability assessments Identified 12,700 security vulnerabilities, tracked all through mitigation 3,150 FCL requests processed vice 2,500 in FY11  Issued 1,968 facility security clearances (1,558 final, 410 interims) Issued 6,574 accreditations  2,397 ATOs, average 83 days  2,479 IATOs, average 15 days  1,698 Straight to ATO, average 14 days 234,686 Adjudication actions  IRTPA - average 8 days Made 355 cyber notifications

4 FY12 in Review Changed vernacular:  Assessments vs Inspections  Vulnerabilities vs Deficiencies and Findings New Workload Prioritization – “Right Facility at the Right Time”  Focus on identification and mitigation of security vulnerabilities Security Rating Matrix Implemented Cyber Notification Process Initiated pre-CCRI visits and continued preparation to assume mission from DISA DISCO merged into the DoDCAF  Stand-up of Personnel Security Management and Oversight for Industry (PSMO-I) DSS Update

5 FY12 in Review VOI Survey Results  94% satisfied/somewhat satisfied with DSS guidance and support  87% agree that their facility has a strong partnership with DSS  90% rated DSS as excellent/good in the area of industrial security program vulnerability identification and mitigation Two New Regional Directors Selected – Southern Region and Capital Region Partnership with Industry  17 exchanges  17 active industry partners  25 exchanges planned for FY13 DSS Update

6 f Threat, Vulnerability Assessments IT Accreditations CCRIs Security Clearance Process Vulnerability, Suspicious Contact Reports IIRs Referrals for Action Cyber\Threat Notifications Risk Based Prioritization Company Assessments Program Assessments FOCI Analysis CFIUS Reviews Risk Consequence Value Managing Risk … Cleared Industry = { { Security Education Security Training Security Professionalization

7 THREAT Vulnerability Assessments

8 Assessment Ratings FY12 vs FY13 Vulnerability Assessments

9 Top Ten Vulnerabilities (49% of total): Personnel Security Clearances - General (incl B Deny Access for Deny Revoke or Suspension PCLs) Procedures for Completing the Electronic Version of the SF 86 (incl A SF86 Data Protection and Official Use, B SF86 Data Retention and Destruction) Refresher Training Audit Capability (incl A 1 Automated Audit Trail, A 3 Audit Trail Analysis) FSO Training Individual Culpability Reports Security Reviews (incl B Contractor Reviews) Reports to be Submitted to the CSA (incl G Change Conditions Affecting the FCL) Consultants NATO Briefings Vulnerability Assessments

10 Top Ten Acute/Critical Vulnerabilities (59% of total): Audit Capability (incl A 3 Audit Trail Analysis) PERSONNEL SECURITY CLEARANCES - General (incl B Deny Access for Deny Revoke or Suspension PCLs) Accreditation Reports to be Submitted to the CSA (incl G Change Conditions Affecting the FCL) PCLs Required in Connection with the FCL Investigative Requirements Malicious Code Reports of Loss, Compromise, or Suspected Compromise Configuration Management Changing Combinations (incl B Employee with Knowledge Combination Change) Vulnerability Assessments

11 Top five deficiencies we’re seeing in System Security Plans: SSP was incomplete or missing attachments Inaccurate or incomplete configuration diagram Sections in general procedures contradict protection profile Integrity & availability not properly addressed SSP was not tailored to the system Top five vulnerabilities we’re seeing during visits: Inadequate auditing controls Security Relevant Objects not protected Inadequate configuration management Improper session controls Identification & authentication controls IT Vulnerabilities

12 CI Award 20% of industry is reporting – Only 10% reporting “actionable” SCRs  Goal is 40% of industry reporting “actionable” SCRs Cyber Incident reporting has doubled, still ~ three (3) percent New CI awareness and analytical products Better define the threat More timely, focused products -- individual company assessments Expanded distribution of products Pushing classified threat, including cyber Deeper look into supply chain and unclassified subcontract vulnerabilities New CI course, Thwarting the Enemy 40,000 course completions in first year CI Integration

13 Training Initiatives Two curriculum tracks for FSOs American Council on Education (ACE) Credit Equivalency recommendations for several courses Two new awareness courses available outside of STEPP Professionalization Education and Training

14 Looking ahead Continuous Evaluation Pilot New CI Resources FSO Toolkit Call Center Transition Rating Matrix II Technology  OBMS  CAC/PKI  254 database Electronic Fingerprint

15 Like Us on facebook 15

16 16 Questions?

Download ppt "Defense Security Service. DSS Update DSS Changing With A Changing Security Environment."

Similar presentations

Ads by Google