Cybersecurity/Goverment

This is the one page "cheat sheet" for goverment regulation in the US and how it relates to cybersecurity.

SSP

SSP - System Security plan

Think of this as the master bluprint for the system.

• It's a living document
• Describes autntoszation boundaires / data flows / protocols ect

The SSP requires:

• WHAT: A clear definition of what is protected
• HOW: How it is protected and isolated

Without a What and How it is not protected!!!

How it relates to NIST 800-53:

• Describes how every 800-53 control is technically implemented.

How SSP relates to AWS Gov Cloud

Multi account governance

• Don't trust other accounts
• Use AWS control tower to implement service control policies / lock down account boundaries.

Data protection

• Data at rest and in transit
  • S3 Bucket polcies and encryption
  • TLS Enforcement
    • TLS 1.3 is a mandotary baseline
    • TLS 1.2 can be used with approval
    • TLS 1.0 and 1.1 Should not be used

🤔More about TLS

Infrastrcutre as code

• Maintaining baselines by intergrating polcies in to cloud formation and terraform
• Automated pre-comit code analysis

IAC has many major advantages:

• Can be scanned for security issues - just like the scan of application code.

How it works:

• Tools scan the code acting as a security gate
• Violations are caught: Buckets not encrypted / * actions / Open security groups
• The violations causes the comit to fail.

This is a "Shift left" approach, catching issues before they make it to production.

An important caveat: This does not catch CVE's in code!

best approach is Trust but Verify:

• Trust IAC code has been scanned
• Verify the implementation

DoD IL4/IL5

These are "Impact Levels"

• IL2
  • Non-sensative public data
  • Must meet FedRAMP moderate baseline

• IL4
  • Controlled unvlassified infomration
  • Can run in commeical cloud regious but must meet FedRAMP+ controls & Logical VPC seperation
  • Requies background checks
  • An example could be a NASA system

• IL5
  • High sensitivitity / Mission critical unlcassified data / National security systems
  • Must be isolated from non federal tenants / use of GovCloud
  • US person only

• IL6
  • Data classified to the secret level
  • Personel must hold secret clearance

Where is Top Secret in this? - Top Secret is goverened by ICD 503 instead of a SRG and operate on dedicated air gapped networks.

FedRAMP High

This is for IL4 and below - designed for cloud systems.

Used in situations where a data breach would cause "castastropic effects" in national security or human life.

NIST SP 800-53 is used for this

Continues monitoring (3PAO) is reqired.