1. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 1 ISO 21827 System Security Engineering Capability Maturity Model Presented By John W. Lindquist Founding Member of the HIPAA Alliance, LLC and President and CEO EWA Information & Infrastructure Technologies, Inc. 13873 Park Center Rd., Ste. 200, Herndon VA 20171 703 478 7600 6th Annual HIPAA Summit Session: 5.06 On-Going HIPAA Compliance: Securing Tracked Data - March 28, 2003 Presented By John W. Lindquist Founding Member of the HIPAA Alliance, LLC and President and CEO EWA Information & Infrastructure Technologies, Inc. 13873 Park Center Rd., Ste. 200, Herndon VA 20171 703 478 7600 6th Annual HIPAA Summit Session: 5.06 On-Going HIPAA Compliance: Securing Tracked Data - March 28, 2003

2. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 2 Problem How does management establish and track an information security program when: Risks are real Risks are nearly infinite The information environment is highly dynamic Resources are finite

3. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 3 The Need to Protect Information assets against damage and unauthorized disclosure is critical to your organization. 29% 28% 11% 6% 5% 4% 3% 2% Laptop Theft Virus Insider Abuse of Net Telecomm Fraud Financial Fraud System Penetration Theft of Proprietary Info Unauthorized Insider Sabotage Denial of Service Telecom Eavesdrop Active Wiretap

4. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 4 Information Assurance Technology alone won’t make you safe. “Get rid of the techno-babble. This is a management problem.” Steve Katz, CISO, Citibank Solutions Must Address: v People v Process v Technology

5. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 5 Security Aversion (Ostrich) Risk Aversion (Paranoia) Risk Management Decisions (Acceptance, Mitigation, Transference, Avoidance) $ Cost of Not Securing Cost of Securing SSE-CMM Process Maturity Level 5 Level 0 (Focused investment in IT Security) Process Maturity and the Risk Management Cost Continuum

6. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 6 SYSTEM SECURITY ENGINEERING CAPABILITY MATURITY MODEL SSE - CMM is both a Model and a Process A Community-owned Model (50 companies / agencies led by the US National Security Agency (NSA) and Canadian Communications Security Establishment (CSE)) Model Presents Security Engineering as a Defined, Mature and Measurable Discipline Model and Appraisal Method Enable: –Capability-based assurance i.e.. Security/trustworthiness inferred from the maturity of processes –Focused investment in security engineering tools, training, process definition, management practices and improvements based on risk assessment and available resources –Qualifying vendors, suppliers, and organizations connecting to a system

7. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 7 1 Performed Informally 2 Planned & Tracked 3 Well Defined 4 Quantitatively Controlled 5 Continuously Improving CAPABILITY LEVELS

8. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 8 PA01 PA02PA03 PA04a PA04b PA05PA06PA07PA08PA09PA10PA11PA12PA13PA14PA15PA16PA17PA18PA19PA20PA21 0 1 2 3 4 5 Baseline, Minimum & Target Profile Maturity Level Process Area

9. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 9 System Security Process Areas PA 17 Improve Organization's Security Engineering Processes PA 01 Specify Security Needs PA 02 Provide Security Input PA 03 Verify and Validate Security PA 04a Threat Assessment PA 04b Impact Assessment PA 05 Assess Security Risk PA 06 Build Assurance Argument PA 08 Administer Security Controls PA 09 Coordinate Security PA 10 Vulnerability Assessment PA 07 Monitor System Security Posture PA 11 Ensure Quality PA 12 Manage Configurations PA 13 Manage Program Risk PA 14 Monitor and Control Technical Effort PA 15 Plan Technical Effort PA 16 Define Organization's Security Engineering Process PA 18 Manage Security Product Line Evolution PA 19 Manage Security Engineering Support Environment PA 20 Provide Ongoing Skills and Knowledge PA 21 Coordinate With Suppliers

10. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 10 SSE-CMM Usage Scenarios Security Assessment Information Operations SW Vendor Services HW Vendor Trust Relationships Business Partners/other units Qualified Suppliers Operational Information Assurance ITS Business Processes/Military Information Systems Applies to all system types and all classifications levels

11. Copyright © EWA IIT, Inc. June 17, 2002 © 2002  IIT, Inc. EWA Information & Infrastructure Technologies, Inc. 3 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 FOR OFFICIAL USE ONLY June 17, 2002 © 2002  All rights reserved EWA Information & Infrastructure Technologies, Inc2 FOR OFFICIAL USE ONLY June 17, 2002© 2002 IIT, Inc. All rights reserved EWA Information & Infrastructure Technologies, Inc. 4 11 Summary Can’t Protect Everything All The Time The Dynamic Environment Requires a Flexible Response Effective Information Assurance Must Address People, Process and Technology Information Assurance is Risk Management not Risk Avoidance (There is No Silver Bullet) The SSE-CMM is an IA Tool Developed in Consideration the Above