assess

What is a DIARMF assessment?

diarmf-assess

After DIARMF Step 3, Implement, the security controls must be assessed.  Assess a security control means to check it to see if it has been implemented to protect the system as it is suspected.  

To minimize risk that comes with vulnerabilities being exploited the organization cannot just assume that someone has implemented the security controls.  The organization cannot take an engineers or technicians or administrators or ANYONEs word for it that the security controls are implemented correctly.  

If you are familiar with DIACAP, Phase 3, Implement and Validate Controls then DIARMF Step 4 should be familiar because validating controls is the same as assessing controls.

Types of Assessments

Taken from Public Page DoD Compliance Inspections (MORE HERE):

There are actually several types of compliance inspections (assessments) your organization can be subject to.  

• Command Cyber Readiness Inspection (CCRI) – A formal inspection conducted under the direction of USCYBERCOM’s Enhanced Inspection Program.

• Security Assistance Visits (SAVs) – A process by which DISA FSO personnel will conduct an on-site assessment and validation of compliance with mandated IA, CND, certification and accreditation (C&A), or other focus areas either as a standalone effort or in preparation for a scheduled inspection or evaluation.

• CNDSP Level II Inspections – CNDSP evaluations are an on-site evaluation and validation of compliance with mandated CND Service requirements as outlined in DoD O-8530.1 and DoDI O-8530.2.

• CNDSP Level II Designation Assessments – CNDSP validations are a review and validation of alignment to an accredited CNDSP. A formal recommendation is provided upon completion of the on-site evaluation.

• IA Readiness Reviews (IARRs) – A formal review in 12 IA areas to determine a site’s current IA program status and provide formal recommendations for improvements in areas where deficiencies or non-compliance are discovered.

• Enclave and System Certification – Can provide on-site technical assessments and certifications recommendations to a Designated Approving Authority (DAA) in support of enclave accreditation, coalition enclave or systems.

• Combatant Command (COCOM) exercise support – DISA provides critical exercise support for the COCOMs in various theater and global exercises. This support can come from a variety of areas and include CND technology Subject Matter Experts (SMEs), CND Integrators, and CND analysts.

FUCK The CCRI?

I used to teach the DIACAP and DIARMF and everyone I met was stressed out about CCRI.. listen.. Fuck the CCRI!  AND here is why: the DoD and other federal organizations are constantly coming up with new names and new types of audits.  But the concept remains the same.  Risk = Threat * Vulnerability * Asset.

I am NOT SAYING don’t do your job.  I am saying do your job to the greatest of your ability.  And I am saying it will not help to stress about stuff you cannot change.  Do what is within your power to do.

Auditors are assessing controls to see if they have been implemented to their standard.  If your organization is informed of the risks and willing to document, take responsibility and take action then any new audit by new organizations will find you knowledge and prepared like Spartans.  Know their rules well enough that you can answer all questions and set their standard by knowing your systems risks intimately.  How can you be stressed if you have done all you can do?  What good will it do to stress out about stuff you cannot control?  You cannot control how the auditor will perceive your security.  But you can control how prepared you are and how informed your organization is of all risks that have been found.

Usually if you are straight up with the Assessors, they will give lots of leeway.  If you start lying and try to sweep known risks under the rug then they may find it and offer 0 leniency and go straight to your commander to humiliate you and question your integrity and skills.  You can lose your job and/or respec.

Who is involved with the DIARMF Assessment?

Assessment of the security controls involves all interested parties, all stakeholders:  Information system security officer & administrators who may have applied the security controls, the Information system owners who put forth the orders to conduct the security controls, the system engineers who want to make sure the system still works while security controls are implemented, and of course those conducting the security control assessments.   

All of these entities have a singular goal of security the system to minimize the risk while maintaining functionality.  The DIARMF assessment step is where this is to occur.

Ultimately its the responsibility of the Information System Owner.  It is his or her responsibility to know is supposed to be done, delegate someone or some group to get the system prepared, fund the outside organization to do it and see the process through.  Usually, they hire a Information Security professional or have some sort of system security officer that runs the operations of planning, implementation, assessment, getting the system authorized and continuous monitoring.  

Assessment Readiness Inspection

A very prepared and successful unit will do their OWN internal assessments and know all the systems shortcoming more intimately than any hacker or outside organization.  to be prepared they should do pentesting, continuous scans of the network and a robust change management program.

• The organization that wants to prepare will have a budget and schedule and a plan for the assessments (internal and external).  They will do the following to make sure the system is ready:

• Make sure security policies are in place.  The policies should be approved by the system owner in writing or signed and address the security controls.

• Choose an approved Security Control Assessor.  In the DoD they are called Auditors.  You should establish communication with them.  Be honest, upfront, and professional.  Give them as much information as they need to make their visit smooth with ZERO surprises

  • Establish who, what, when, where and how of their visit

  • Provide them with all policies, SSP, POA&M, SAR

• Know the scope of the assessment (are they only looking at code, process, the network or everything)

• Notify all stakeholders.  The information system owner should already know, but in some cases they are too busy to stay in the loop on intimate details.. they should know about this.  Or they could get blind sided.\

• Conduct a strict SELF assessment prior to any outside organization coming in.. I cannot stress this enough. So few organization take the time to do this