Implications of Aggregated DoD Information Systems for Information Assurance Certification and Accreditation

by Landree, Eric; Gonzales, Daniel; Ohlandt, Chad; Wong, Carolyn

• ISBN13: 9780833049483
• ISBN10: 0833049488
• Format: Paperback
• Copyright: 2010-05-16
• Publisher: RAND Corporation

Summary

The challenges associated with securing U.S. Department of Defense (DoD) information systems have grown as the department's information infrastructure has become more complex and interconnected. At the same time, the potential negative consequences associated with cyber intrusions have become more severe. Are current information assurance (IA) policies and procedures sufficient to address this growing threat, and are they able to address vulnerability issues associated with highly networked information systems? The current IA certification and accreditation (CA) process focuses on individual, discrete systems or components of larger, aggregated information systems and networks that are colocated or operate on the same platform (such as a Navy ship). An examination of current policy shows that a new approach is needed to effectively extend the IA CA process to aggregations of information systems and improve the security of DoD information systems. A number of recommendations are put forth to improve current IA policy and to enable the IA CA of aggregations of DoD information systems that reside on a common platform. Book jacket.

Table of Contents

Preface	p. iii
Figures	p. vii
Tables	p. ix
Summary	p. xi
Acknowledgments	p. xvii
Abbreviations	p. xix
Background and Objective	p. 1
Background	p. 1
Objective	p. 4
Organization of This Monograph	p. 5
Growing Challenges for the Information Assurance Certification and Accreditation of DoD Information Systems	p. 7
Software Complexity	p. 7
Increasing Software Vulnerabilities and Malware Population	p. 9
Limitations of Automated Software Review Tools	p. 11
Challenge of Incremental Program Development	p. 11
Increasing Scrutiny of Programs	p. 12
System Interdependence and Interconnectedness	p. 12
Configuration Management and System Administration	p. 13
Overview of the Current DoD Information Assurance Certification and Accreditation Process	p. 15
DIACAP Activities and Scope	p. 15
Definition of a DoD Information System	p. 16
DIACAP Validation Activities and Results	p. 17
Aggregation Approach to DoD Information Assurance Certification and Accreditation	p. 19
Degrees of Aggregation	p. 19
Potential DIACAP Policy Issues	p. 23
Initiate and Plan Information Assurance Certification and Accreditation	p. 23
Implement and Validate Information Assurance Controls	p. 24
Decommission	p. 27
Potential DIACAP Implementation Difficulties for Aggregate Information Systems	p. 28
Initiate and Plan Information Assurance Certification and Accreditation	p. 28
Implement and Validate Information Assurance Controls	p. 28
Make Certification Determination and Accreditation Decisions	p. 29
Maintain Authorization to Operate and Conduct Reviews	p. 36
Balancing Transparency and Reporting Requirements	p. 36
Information System Information Assurance Pedigree	p. 37
Observations and Recommended Changes to DoD and Federal Policy	p. 41
Policy Recommendations	p. 42
Implementation Recommendations	p. 44
A Suggested Partial IA Aggregation Approach	p. 45
Appendixes
DIACAP System Identification Profile	p. 47
Definitions of MAC, CL, and MC	p. 53
References	p. 57
Table of Contents provided by Ingram. All Rights Reserved.