United States Agency for International Development (USAID), Bureau for Management, Information Resources Management (M/IRM), Information Systems Security Team

Security Process Framework:

• 1.6.3.2, Monitor Effectiveness and Compliance of Organizational Technical Security Program
• 2.6.3.4.4, Review Security Posture
• 2.8.2.2.1, Assess Vulnerability

SSE CMM Framework:

• PA-05, Assess Vulnerability

OMB Circular A-130, Appendix III, Section A:

• 3.a.3, Review of Security Controls

Government BSP Owner:
Yes, post this contact information with the publicly accessible BSP.

• James P. Craft, CISSP
  USAID Information Systems Security Officer
  Ronald Reagan Building
  1300 Pennsylvania Ave.
  Suite 2.12-032
  Washington DC 20523-2120
  Telephone No. 202-712-5460
  Fax No. 202-712-3053
  E-mail: jcraft@usaid.gov
  Also: cassistance@usaid.gov

Vendor Pa rtner:

Yes, post this contact information with the publicly accessible BSP.

• William R. Cleveland
  USAID PRIME Security Program Manager
  Computer Sciences Corporation
  Suite 1100
  1100 Wilson Blvd.
  Arlington, VA 22209
  Telephone No. 703-465-7054
  Fax No. 703-465-7193
  E-mail: wclevela@csc.com

Subject:  COMPUTER SECURITY TEAM VISIT
Source: David Bayer, USAID Peru Executive Office
If you have the opportunity to have the Information Systems Security Officer (ISSO) Jim Craft and his [Security Vulnerability] Assessment Program Area Manager, Rodney Murphy, visit your Mission with their team of computer security experts, then take advantage of it. They did one hell of a job during their February [1999] visit with us at USAID/Peru in getting us up to speed and raising our level of consciousness about security issues. This is not to say that our dedicated IRM staff, led by Systems Manager, Lucho Figueroa, have not been working their hearts out to get us into shape, but it is a real injection of energy to have professional people like Jim, Rodney, John Zoble, Mike Reiter and Steve Bui come in and sit down to review your Computer Security Program and Computer Contingency Plan with you.

And last but not least, they have given us some key advice and methods for closing out some computer security audit issues which are not only USAID/Peru exposures but endemic to all Missions worldwide.

Computer security is becoming an important issue in for USAID and all organizations. In this environment, new security standards and having a formal security program in each overseas Mission is very important.
USAID/Peru was selected as a Beta site....

The Information Security Vulnerability Assessment (VA) process is performed at USAID Mission locations whenever a Triggering Event happens. This trigger usually occurs routinely, activated by scheduled system changes at a Mission or expiration of the OMB-specified three-year interval since the last VA. These assessments assure that a Mission’s systems are installed and maintained according to current Agency policies and specifications. Occasionally, the trigger is activated by a security relevant event of sufficient magnitude to disrupt normal processing somewhere in the USAID network, which reveals an unexpected weakness in the standard system configuration.  Assessments responding to these events assure that the new information gained has been applied at each Mission most effectively for that site’s configuration.

Information Security Vulnerability Assessment is a repetitive process.  Each cycle begins with the Triggering Event and ends with the Final Report step, which resets the Trigger in anticipation of the next assessment.  Figure 3.1-1 illustrates the process.  The names of the steps are in the boxes forming the inner circle.  The products of the steps are beside the arrows forming the outer circle.  This BSP shows the sequence of tasks comprising the VA Process cycle, indicates where more details may be found for each task, and illustrates the main points of coordination between USAID management officials and the VA team.  Each of these major actors has a role in the successful completion of the process.

Figure 3.1-1 USAID Mission Security Vulnerability Assessment Cycle

Note: This list suggests the information that may be available to the VA team. Not every document may be available to every VA visit, but the more that are available, the better focused and more efficient the visit becomes. Improved team focus results in more useful information for the Mission Director, Executive Officer (EXO), System Administrators and users.  The list is compiled during the Visit Coordination phase, through an exchange of questionnaires and other correspondence between the VA team and cognizant Mission officials. These inputs are:

a. Approved Mission Security Plan;
b. USAID Automated Directive System (ADS);
c. VA Team Visit Schedule;
d. Action Items from last VA Team visit;
e. Current Threats List published by CERT, SANS and system-specific authoritative sources such as NTBUGTRAQ;
f. Intrusion Detector Alarm logs;
g. Firewall Incident logs;
h. Current system hardware and software configuration details.

Step 1, Trigger: Determine from Input data that a triggering event has happened.
Step 2, Coordinate: Determine details of a visit from the VA team home location:

a. Initiate survey questionnaires, to determine user/manager knowledge of security-relevant features of on-site systems and networks;
b. Obtain access permissions for sites;
c. Select assessment tools matched to site configurations; build detailed assessment plan, prepare assessment checklist;
d. Designate team members from USAID and VA contractor, with skills matched as closely as possible to site system components;
e. Obtain USAID management approval.
f. Make travel arrangements, 30 days in advance of departure date;
g. Using Input documents, preconfigure and pack assessment tool kit.

a. Travel to the Mission, execute pre-assessment steps, which include:

• Introduce team in an initial briefing to Mission Director, EXO, System Administrators and other interested parties;
• Evaluate assessment checklist against actual configuration status at the Mission; update the checklist as required;

b. Run tools appropriate for the system being reviewed to determine where configuration problems exist. (Tools are described in Section 4.4 of BSP 0001 and BSP 0003)
c. Update the checklist as each item is verified/corrected.
d. Mark items not found on the checklist for analysis;

1. BSP 0001, Detecting Unauthorized Modem Connections at USAID Missions, explains the dial-up line security process followed during a cyber-assistance visit.  This process evaluates the security Vulnerability of a Mission’s communications facilities outside the Internet.
2. BSP 0002, Developing Security Plans at USAID Missions, explains the process of building and obtaining official approval for the security plan document which governs all subsequent security-related efforts at a Mission location.
3. BSP 0003, Configuring Technical Safeguards, shows details of the system attributes being examined during a cyber-assistance visit, explains the processes used in the assessment steps, and gives reasons for selecting the recommended IT system configuration values.
4. BSP 0004, Training, often accompanies the cyber-assistance visit, to familiarize Mission staff with the latest practices being introduced into USAID and to demonstrate corrections being made to the Mission’s information processing facilities.

1. National Institute of Standards and Technology (NIST) Special Publication 800-14, September 1996, Generally Accepted Principles and Practices for Securing Information Technology Systems. Guides organizations on the types of controls, objectives, and procedures that comprise an effective security program.
2. National Institute of Standards and Technology (NIST) Special Publication 800-18, December 1998, Guide for Developing Security Plans for Information Technology Systems.  Details the specific controls that should be documented in a security plan.
3. National Institute of Standards and Technology (NIST) Federal Information Processing Standards Publication 191, November 1994, Guideline for the Analysis of Local Area Network Security.
4. National Security Agency (NSA), National Security Telecommunications and Information Systems Security Instruction (NSTISSI) No. 1000, April 2000, National Information Assurance Certification and Accreditation Process (NIACAP).
5. National Security Agency (NSA), National Security Telecommunications and Information Systems Security Instruction (NSTISSI) No. 4013 and 4014, August 1997, National Training Standard for System Administrators and Information Systems Security officers (ISSO) in Information Systems Security (INFOSEC).
6. Office of Management and Budget (OMB) Circular A-130, Appendix III, February 8^th, 1996, requires Risk Assessment every three years or sooner when changes take place in Information Technology systems and major applications.
7. USAID Automated Directives System (ADS), Section ADS-545, Security Policies.  (available on the USAID Internal Network.)
8. System Administration, Networking, and Security (SANS) Institute 5401 Westbard Ave. Suite 1501, Bethesda, MD 20816, is a cooperative research and education organization for system administrators, security professionals, and network administrators.
9. The Computer Emergency Reaction Team (CERT®) Coordination Center (CERT/CC) is a center of Internet security expertise. It is located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University, Pittsburgh, PA. The CERT^®/CC, studies Internet security vulnerabilities, handles computer security incidents, publishes a variety of security alerts, does research for long-term changes in networked systems, and develops information and training to help improve security at information processing sites.