Presenter: Mohammed Jalaluddin Managing Security of your UI Data using NIST Presenter: Mohammed Jalaluddin

Who are they? National Institute of Standards and Technology Established 1901 1901 -1988 National Bureau of Standards Non Regulatory Agency 18 control families each family has

What they do? Develop standards and metrics for various areas Promote innovation and industrial competitiveness 18 control families each family has

Areas of Focus NIST sets the standard for these areas Advanced Communications Cybersecurity Energy & Environment Health & Bioscience Advanced Manufacturing Forensic Science Disaster Resilience Quantum Science Areas of Focus NIST sets the standard for these areas

Security Control Families AC - Access Control 25 AU - Audit & Accountability 16 AT - Awareness & Training 05 CM - Configuration Management 11 CP - Contingency Planning 12 IA - Identification & Authentication 11 IR - Incident Response 10 MA - Maintenance 06 MP - Media Protection 08 PS - Personnel Security 08 PE - Physical & Environmental 20 PL - Planning 09 PM - Program Management 16 RA - Risk Assessment 06 CA - Security Assessment & Authorization 09 SC - System & Communication Protection 44 SI - System and Information Integrity 17 SA - System and Services Acquisition 22 Controls 255 800+ controls & enhancements

Figure 1.

Money Staff Challenges

COMPLIANCE

What’s Needed Cultural Change Maturity Resources Focus on the basics Invest in Awareness Training Get Senior Management Buy in Policies & Procedures Implementation and Testing Integration Properly Maintained Equipment Knowledgeable Staff Budget Cultural Change Maturity Resources

How ???????? Figure 2

WHY NIST? Improves overall organizational security Helps to ensure a secure infrastructure Lays a foundation to follow to achieve compliance with specific regulations

Pub 1075 largely based on NIST NIST & Pub 1075 Pub 1075 largely based on NIST Pub 1075 has additional requirements such as: Two factor authentication FTI not allowed to be printed, emailed or faxed FTI can not be used in a test environment Special requirements for cloud computing

Build it right Continuously monitor Rev 4 What’s New? NIST PUB1075 • New security controls and control enhancements • New privacy controls and implementation guidance • Updated security control baselines • New summary tables for security controls to facilitate ease-of-use • Background investigations minimum requirements • Table for 45 Day notification reporting requirements • Guidance for use of consolidated data centers • All contractor and shared sites to be included in Safeguard reviews Build it right Continuously monitor

MDES’ APPROACH

Cloud Off site data storage Productivity anywhere Low cost of ownership & maintenance Scalable Resiliency and Redundancy Productivity anywhere Off site data storage

Unauthorized access prevention Tools Unauthorized access prevention Data Protection Encryption PUB 1075 Monitoring Vormetric Guardium

A good set of tools for improving information cyber security; A good guide for industry best practices; and Agencies such as the FTC, SSA, and IRS are increasingly expecting NIST-level safeguards. TAKE-AWAYS

References: Figure 1 Figure 2 http://corpgov.law.harvard.edu/wp-content/uploads/2014/08/140496_NIST-Cybersecurity-Framework-Alert-Aug-14_v3_Chart_02.jpg Figure 2 http://csrc.nist.gov/publications/nistpubs/800-53-rev4/sp800-53r4_summary.pdf