ArcGIS Security Authorization Advancements

57 Pages·2015·4.89 MB·English

Federal GIS Conference
February 9–10, 2015 | Washington, DC
ArcGIS Security
Authorization Advancements
Michael Young & Erin Ross
Overview
• Authorization Past & Present
• Products
- ArcGIS Server
- ArcGIS Desktop
• Solutions
- ArcGIS Online
- Esri Managed Cloud Services
- New FedRAMP Moderate Option
• Summary
Authorization
Historical Issues
• Every implementation undergoes separate security authorization processes
• Federal and Defense utilized different frameworks
- Authorization (based on risk) vs. certification
• Standard geospatial system security configurations not agreed upon by government
• Above items drive deployment delays, stability, and issue reproduction problems
- E.g. Mitigating measures, waivers, policy refresh outages, and unable to reproduce issues
Authorization
FISMA
• Federal Information Security Management Act (FISMA) 2002
- All production US Federal government systems must be compliant/authorized
- Enforced by the inspector general’s office of each agency
- References NIST 800-53 Security Controls spanning 17 families including:

- Access Control, Training, Auditing, Maintenance, Integrity, Acquisition, Personnel
Step 1 –Categorize
Step 3
Information Step 2 –Select Concurrency
Review Step 4
• Three categorization levels Collect Security Controls Step 3 –Implement Concurrency
Review
System Security Controls
Information Identify Step 4 –Assess
- Low – Non-sensitive information (100+) CCoomntmroolsn Implement Security Controls
Perform Security Step 5 –Authorize
- Moderate – Sensitive information (300+) PArnivaalycsyi s Select Controls Develop Security Controls Step 6 –Monitor
Remaining Test Plan Security Controls
Controls Update the Develop
- High – Most sensitive information (350+) Categorize SSP ATO
System Tailor and Assess Package Monitor
Document in Security for Major
SSP Develop CP, Controls AO Reviews Changes
CMP and IRP POA&M and
Develop Risk Remediate
• Solutions are authorized, not individual products Reports and POA&M
Items
POA&Ms AO Signs
ATO / Denial
- Datasets and workflows are part of the accreditation of Operation Continuous
Monitoring
of Controls
ArcGIS Online’s Low Accreditation Aligns Well with Hybrid Deployments
Authorization
FedRAMP
• Relatively new authorization process aligning
with FISMA law
• Provides a stronger foundation of reciprocity
for cloud based offerings
• Same NIST 800-53 security controls with
additional ones added for cloud
• Security control baselines in place now for Low and
Moderate, draft of High released Jan 2015
Cloud.CIO.gov – Excellent Resource for FedRAMP Details
Authorization
Federal and Defense Security Strategy is Evolving
• Federal
- FISMA -> FedRAMP
- Drives improved efficiency of Federal security authorization process for cloud offerings
• Defense
- DIACAP -> Risk Management Framework
- Drives improved efficiency of defense and federal departments operating off a common
framework and set of baseline security controls
Authorization
Esri’s Security Strategy is Evolving
Solution
Enterprise
Product
ArcGIS
Isolated Systems Integrated Systems Cloud
3rd Party Security Embedded Security Managed Security
Authorization
Levels of authorization across software and systems
• Product Based Initiatives
- ArcGIS Server
- ArcGIS Desktop
• Solution/Service Based Initiatives
- ArcGIS Online
- Esri Managed Cloud Services
Product Based Security
Initiatives
ArcGIS Server & Desktop
Product Based Security Initiatives
ArcGIS Server – DISA STIG
• Sponsored by government to work with DISA
- Create a Security Technical Implementation Guides (STIGs)
- Non-FOUO therefore information will be publically accessible
- First STIG will be Windows based ArcGIS Server 10.3
- Other STIGs will be performed based on demand
• Expected completion by Esri International User Conference – July 2015
• Post STIG completion
- STIG will be an input for an ArcGIS Server Security Hardening guide for general distribution
- Enterprise component integration testing and best practice recommendations incorporated