1. NCI-CBIIT Security in the System/Services Development Life Cycle Presenter: Braulio J. Cabral CBIIT Enterprise Security Coordinator

2. The Path to Security and Compliance Security and Compliance through the SDLC Software Security Requirements ECCF Validating Security (Certification and Accreditation) Roles and Responsibilities Current caBIG Security Infrastructure Future Security as Service Content

3. The Path to a Secure/Compliant System

4. Security Requirements Software security requirements Leverage certification tools for security requirements gathering. Prepare for FISMA certification through the SDLC phases. Let’s get the security requirements. Application security requirements (ECCF templates, security conformance statements, security assertions (QA) PIA, E-Auth. Assessment, System Categorization (C&A process) System Security Plan

5. CIM (CFSS) Conformance Example Conformance No. AE-CP2 Security Pre-Conditions [M] Access control mechanism needs to be in place to ensure that the user is logged in and has valid privileges of a Study Administrator to initiate an Adverse Event

6. Compliance & Conformance Statements NameTypeViewpointDescriptionTest Method Secured AccessObligationEngineeringThe AE service should 1. Design review have access control 2. Security test case mechanism in place to restricts access to sensitive data

7. Platform Independent Model (PIM) and Service Specification Operation Behavior Description Security Conditions Describe in detail the security constraints which the user needs to fulfill in order to successful execute this operation. Provide the following details List all the Group / Role / Attribute which the user need to have in order to execute the operation List any specific access control which the user needs to have on the particular instance of the input parameter in order to gain access (Eg. User needs to be a study co-ordinator for the Study id passed) Any additional security requirements (eg. Authentication Required or Anonymous call allowed for the operation )

8. PIM Conformance Statements Security Conformance Statements Security as conformance statements Security as mandatory constrains or pre- conditions Security as a full conformance profile Deployment considerations Jurisdictional Domains

9. Platform Specific Model and Service Specification (PSM) Security Standards and Technology Assumptions and Dependencies for Security Operations Details Security Controls Implementation Considerations Access Control Application (service) Security (Access Policy) Cryptography

10. Platform Specific Model and Service Specification (PSM) Information Security and Risk Management Legal, Regulations, Compliance and Investigations Telecommunications and Network Security Auditing Privacy

11. Conformance Assertions Quality Control Test Cases

12. Validating Security FISMA Certification Process PIA e-Authentication assessment System Categorization Appscan Request C&A through security team (ISSO: Bruce Woodcock, Blaise Czkalski, coordinator Braulio J. Cabral Security Plan, Contingency plan, etc.

13. Security roles & responsibilities Who does what? System Owner: PIA, E-Authentication Assessment, System Categorization, system diagram, request appscan, etc. ISSO: C&A process, appscan CIO: Authorization letter NCI Privacy Office (PIA) POC: Suzanne Millard (suzanne.millard@nih.gov)

14. Current caBIG Security Infrastructure The Grid Authentication and Authorization with Reliably Distributed Services (GAARDS)

16. Authentication Dorian Authentication Service (SAML and Grid Certificate) CSM Authentication (user name/password) CSM authentication with NCI-LDAP Single Sign on (SSO)

17. Authorization CSM Authorization (Application Level) (moving towards Service Level) CSM Authorization (Service Level) GRID Grouper Authorization Combined CSM/GRID Grouper

18. Authorization Service Level with CSM Example (CCTS Suite) C3PR CS M API CS M API caAERS CS M API CS M API PSC CSM API CS M API Lab Viewer C3D Connecto r CS M API CS M API

19. Future Security As Services Infrastructure

20. Useful Links Enterprise Security Program : https://wiki.nci.nih.gov/pages/viewpage.action? pageId=24276546 System Categorization form (FIPS-199) - http://ocio.nih.gov/nihsecurity/InventoryandCate gorization/NIH_System_Categorization_form.d oc http://ocio.nih.gov/nihsecurity/InventoryandCate gorization/NIH_System_Categorization_form.d oc Authentication Risk Assessment Report - http://ocio.nih.gov/nihsecurity/HHS_E- Authentication_Report_Template.doc http://ocio.nih.gov/nihsecurity/HHS_E- Authentication_Report_Template.doc

21. Useful Links System Security Plan - http://ocio.nih.gov/nihsecurity/FIPS-200-SSP- Basic-Outline.doc http://ocio.nih.gov/nihsecurity/FIPS-200-SSP- Basic-Outline.doc Contingency plan (if available, part of the system security plan) - http://ocio.nih.gov/nihsecurity/NIH-CP- Template.doc http://ocio.nih.gov/nihsecurity/NIH-CP- Template.doc ECCF Templates: http://gforge.nci.nih.gov/svnroot/candc/trunk/docu ments/artifact_templates/