Cybersecurity/Goverment

This is the one page "cheat sheet" for goverment regulation in the US and how it relates to cybersecurity.

SSP

SSP - System Security plan

Think of this as the master bluprint for the system.

• It's a living document
• Describes autntoszation boundaires / data flows / protocols ect

The SSP requires:

• WHAT: A clear definition of what is protected
• HOW: How it is protected and isolated

Without a What and How it is not protected!!!

How it relates to NIST 800-53:

• Describes how every 800-53 control is technically implemented.

How SSP relates to AWS Gov Cloud

Multi account governance:

• Don't trust other accounts
• Use AWS control tower to implement service control policies / lock down account boundaries.

Data protection:

• Data at rest and in transit
  • S3 Bucket polcies and encryption
  • TLS Enforcement
    • TLS 1.3 is a mandotary baseline
    • TLS 1.2 can be used with approval
    • TLS 1.0 and 1.1 Should not be used

More about TLS

Enabling TLS 1.3 is not enough - the underlying software / hardware must be approved.

The cypher suite must also be enforced.

Protocol Version	NIST Priority	Standard RFC Cipher Name	Key Exchange / Encryption Details
TLS 1.3	🌟 Preferred	TLS_AES_128_GCM_SHA256	AEAD / 128-bit AES-GCM (Mandatory baseline)
TLS 1.3	🌟 Preferred	TLS_AES_256_GCM_SHA384	AEAD / 256-bit AES-GCM (Mandatory baseline)
TLS 1.3	✅ Acceptable	TLS_AES_128_CCM_SHA256	AEAD / 128-bit AES-CCM
TLS 1.2	🌟 Preferred	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256	ECDH Exchange + ECDSA Auth + 128-bit AES-GCM
TLS 1.2	🌟 Preferred	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384	ECDH Exchange + ECDSA Auth + 256-bit AES-GCM
TLS 1.2	🌟 Preferred	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	ECDH Exchange + RSA Auth + 128-bit AES-GCM
TLS 1.2	🌟 Preferred	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	ECDH Exchange + RSA Auth + 256-bit AES-GCM
TLS 1.2	⚠️ Legacy Fallback	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256	ECDH Exchange + ECDSA Auth + 128-bit AES-CBC
TLS 1.2	⚠️ Legacy Fallback	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384	ECDH Exchange + ECDSA Auth + 256-bit AES-CBC
TLS 1.2	⚠️ Legacy Fallback	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	ECDH Exchange + RSA Auth + 128-bit AES-CBC
TLS 1.2	⚠️ Legacy Fallback	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384	ECDH Exchange + RSA Auth + 256-bit AES-CBC
TLS 1.2	⚠️ Legacy Fallback	TLS_DHE_RSA_WITH_AES_128_GCM_SHA256	Finite Field DH + RSA Auth + 128-bit AES-GCM
TLS 1.2	⚠️ Legacy Fallback	TLS_DHE_RSA_WITH_AES_256_GCM_SHA384	Finite Field DH + RSA Auth + 256-bit AES-GCM