NIST SP800-53A：联邦信息系统安全控制评估指南

需积分: 21 127 浏览量更新于2024-07-16 收藏 2.31MB PDF 举报

NIST SP800-53A.pdf，即《联邦信息安全系统安全控制评估指南》，是由美国国家标准与技术研究院（NIST）发布的官方文档。这份重要的技术指导文件旨在为联邦政府机构的信息系统提供构建有效安全评估计划的准则，并设计一套全面的程序，以评估这些系统中所采用的安全控制措施的有效性。该指南适用于NIST SP800-53（修订版）中的推荐信息安全控制，以及组织自定义开发的额外安全控制。 NIST SP800-53A的主要目标包括： 1. 一致性、可比性和可重复性：通过标准化的评估流程，确保对信息安全控制的评估具有可预测性和可靠性，使得不同组织之间可以进行有效的横向比较，从而提高整个行业的安全水平。 2. 成本效益：通过更有效的评估方法，帮助组织确定哪些安全控制是最有价值的，减少冗余和无效投入，降低整体评估成本，使资源得到更好的利用。 3. 风险管理：提升对组织运营、资产、个人、其他组织以及国家的风险理解，通过对信息安全系统的操作和使用进行深入分析，有助于识别潜在威胁并制定相应的应对策略。 4. 决策支持：为组织官员提供更完整、可靠和值得信赖的信息，用于支持安全认证决定、信息共享以及联邦信息安全管理法案（FISMA）的合规性。这有助于提高决策的准确性和透明度。此外，该指南是NIST计算机安全分部和信息技术实验室的一部分，其工作旨在促进美国经济和公共福祉，通过提供技术领导力来加强国家的测量和标准基础设施。NIST SP800-53A包含了测试方法、参考数据、概念验证实施以及技术文档，为评估人员提供了全面的工具和框架，以便他们能够根据指南有效地执行安全评估任务。 NIST SP800-53A是联邦政府机构信息安全实践中的重要参考资料，它不仅规范了评估过程，还促进了整个行业的标准化和风险管理，对于维护国家信息安全具有深远的影响。组织在实施和遵循这一指南时，可以显著提升其信息系统安全性，符合法规要求，并优化资源分配。

Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems

________________________________________________________________________________________________

CHAPTER 1 PAGE 5

1.4 ORGANIZATION OF THIS SPECIAL PUBLICATION

The remainder of this special publication is organized as follows:

• Chapter Two describes the fundamental concepts associated with security control

assessments including: (i) the integration of assessments into the system development life

cycle; (ii) the importance of an organization-wide strategy for conducting security control

assessments; (iii) the development of effective assurance cases; (iv) the format and content of

assessment procedures; and (v) the use of an extended assessment procedure to help increase

the grounds for confidence in the effectiveness of the security controls being assessed.

• Chapter Three describes the process of assessing the security controls in organizational

information systems including: (i) the activities carried out by organizations and assessors to

prepare for security control assessments; (ii) the development of security assessment plans;

(iii) the conduct of security control assessments and the analysis, documentation, and

reporting of assessment results; and (iv) post-assessment report analysis and follow-on

activities carried out by organizations.

• Supporting appendices provide detailed assessment-related information including: (i)

general references; (ii) definitions and terms; (iii) acronyms; (iv) a description of assessment

methods; (v) assessment expectations for low-impact, moderate-impact, and high-impact

information systems; (vi) a master catalog of assessment procedures that can be used to

develop plans for assessing security controls; (vii) penetration testing guidelines; (viii) an

assessment procedure work sheet; (ix) a sample format for security assessment reports; and

(x) the definition, format, and use of assessment cases.

Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems

________________________________________________________________________________________________

CHAPTER TWO

THE FUNDAMENTALS

BASIC CONCEPTS ASSOCIATED WITH SECURITY CONTROL ASSESSMENTS

his chapter describes the basic concepts associated with assessing the security controls in

organizational information systems including: (i) the integration of assessments into the

system development life cycle; (ii) the importance of an organization-wide strategy for

conducting security control assessments; (iii) the development of effective assurance cases; (iv)

the format and content of assessment procedures; and (v) the use of an extended assessment

procedure to help increase the grounds for confidence in the effectiveness of the security controls

being assessed.

2.1 ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE

Security assessments can be effectively carried out at various stages in the system development

life cycle

to increase the grounds for confidence or assurance that the security controls

employed with an information system are effective in their application. This publication provides

a comprehensive set of assessment procedures to support security assessment activities during the

system development life cycle. For example, security assessments should be conducted by

information system developers and system integrators during the system development and

acquisition phase of the life cycle to help ensure that required security controls for the system are

properly designed, developed, and implemented. This assessment process is often referred to as

developmental security testing and evaluation (ST&E). The assessment procedures described in

Appendix F can assist in developing ST&E procedures that can be employed during the initial

stages of the system development life cycle. Security assessments should also be conducted by

information system owners, security officers, independent certification agents, auditors, and

inspectors general during the operations and maintenance phase of the life cycle to help ensure

that the security controls are effective in the operational environment where the system is

deployed. Finally, at the end of the life cycle, security assessments should be conducted as part

of ensuring, for example, that important organizational information is purged from the

information system prior to disposal.

2.2 STRATEGY FOR CONDUCTING SECURITY CONTROL ASSESSMENTS

Organizations are encouraged to develop a broad-based, organization-wide strategy for

conducting security assessments, facilitating more cost-effective and consistent assessments

across the inventory of information systems. An organization-wide strategy begins by applying

the initial steps of the Risk Management Framework to all information systems within the

organization, with an organizational view of the security categorization process, the security

control selection process, and the identification of common (inherited) security controls.

Maximizing the number of common controls employed within an organization: (i) significantly

reduces the cost of development, implementation, and assessment of security controls; (ii) allows

organizations to centralize security control assessments and to amortize the cost of those

assessments across all information systems organization-wide; and (iii) increases overall security

There are five phases in the system development life cycle: (i) system initiation; (ii) system acquisition/development;

(iii) system implementation; (iv) system operations and maintenance; and (v) system disposition (disposal). NIST

Special Publications 800-64 and 800-100 provide guidance on integrating information security activities into the

specific phases of the system development life cycle.

CHAPTER 2 PAGE 6

Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems

________________________________________________________________________________________________

control consistency. An aggressive, organization-wide approach to identifying common controls

early in the Risk Management Framework process facilitates a more global strategy for assessing

those controls and sharing essential assessment results with information system owners and

authorizing officials. The sharing of assessment results among key officials across information

system boundaries has many important benefits including:

• Providing the capability to review assessment results for all information systems and to make

organization-wide, mission/business-related decisions on risk mitigation activities according

to organizational priorities, organizational assessments of risk, and the impact levels of the

information systems supporting the organization;

• Providing a more global view of systemic weaknesses and deficiencies occurring in

information systems across the organization;

• Providing an opportunity to develop organization-wide solutions to information security

problems; and

• Increasing the organization’s knowledge base regarding threats, vulnerabilities, and strategies

for more cost-effective solutions to common information security problems.

Figure 1 illustrates the relationship among the independent information system assessments and

the overall determination and acceptance of mission/business risk.

FIGURE 1: INFORMATION SYSTEM ASSESSMENTS AND MISSION / BUSINESS RISK

While the conduct of the security control assessment is the primary responsibility of the

information system owner

with oversight by the authorizing official, there should be significant

involvement in the assessment process by other parties within the organization who have a vested

interest in the outcome of the assessment. Other interested parties include, for example, mission

and information owners (when those roles are filled by someone other than the information

system owner) and information security officials. It is imperative that the information system

owner coordinate with the other parties in the organization having an interest in the security

control assessment to ensure that the organization’s core missions and business functions are

adequately addressed in the selection of security controls to be assessed.

The information system owner is the organizational official responsible for the overall procurement, development,

integration, modification, or operation and maintenance of an information system.

MISSION / BUSINESS RIS

Organization-wide View

OPERATIONS, ASSETS, INDIVIDUALS

Organization-wide

view of security

with respect to

core mission

requirements and

key operational

responsibilities.

Identification of

systemic security

weaknesses or

vulnerabilities;

development of

organization-wide

security solutions.

Local View

INFORMATION

SYSTEM #1

Local View

INFORMATION

SYSTEM #2

INFORMATION

SYSTEM #3

CHAPTER 2 PAGE 7

Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems

________________________________________________________________________________________________

2.3 BUILDING AN EFFECTIVE ASSURANCE CASE

Building an effective assurance case

for security control effectiveness is a process that involves:

(i) compiling evidence that the controls employed in the information system are implemented

correctly, operating as intended, and producing the desired outcome with respect to meeting the

security requirements of the system; and (ii) presenting this evidence in a manner that decision

makers are able to use effectively in making credible, risk-based decisions about the operation or

use of the system. The evidence described above comes from both the implementation of the

security controls in the information system and from the assessments of that implementation.

Ideally, the assessor is adding to an existing assurance case that started with the specification of

the organization’s information security needs and was further developed during the design,

development, and implementation of the information system.

Assessors obtain the evidence needed during the assessment process to allow the appropriate

organizational officials to make objective determinations about the effectiveness of the security

controls and the security of the information system. The assessment evidence needed to make

such determinations can be obtained from a variety of sources including, but not limited to,

information technology product and system assessments. Product assessments (also known as

product testing and evaluation) are typically conducted by independent, third-party testing

organizations and examine the security functions of products and established configuration

settings. Assessments can be conducted against industry, national, and international information

security standards as well as developer and vendor claims. Since many information technology

products are assessed by commercial testing organizations and then subsequently deployed in

millions of information systems, these types of assessments can be carried out at a greater level of

depth and provide deeper insights into the security capabilities of the particular products.

System assessments are typically conducted by information systems developers, systems

integrators, certification agents, information system owners, auditors, inspectors general, and the

information security staffs of organizations. These assessors or assessment teams bring together

available information about the information system such as the results from product-level

assessments, if available, and conduct additional system-level assessments using a variety of

methods and techniques. System assessments are used to compile and evaluate the evidence

needed by organizational officials to determine how effective the security controls employed in

the information system are likely to be in mitigating risks to organizational operations and assets,

to individuals, to other organizations, and to the Nation. The results from assessments conducted

using information system-specific and organization-specific assessment procedures derived from

the guidelines in NIST Special Publication 800-53A contribute to compiling the necessary

evidence to determine security control effectiveness in accordance with the stated assurance

requirements in the security plan (see NIST Special Publication 800-53, Appendix E, Minimum

Assurance Requirements).

2.4 ASSESSMENT PROCEDURES

An assessment procedure consists of a set of assessment objectives, each with an associated set of

potential assessment methods and assessment objects. An assessment objective includes a set of

determination statements related to the particular security control

under assessment. The

An assurance case is a body of evidence organized into an argument demonstrating that some claim about an

information system holds (i.e., is assured). An assurance case is needed when it is important to show that a system

exhibits some complex property such as safety, security, or reliability. Additional information can be obtained at

https://buildsecurityin.us-cert.gov/daisy/bsi/articles/knowledge/assurance/643.html.

References to security controls under assessment also include control enhancements.

CHAPTER 2 PAGE 8

Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems

________________________________________________________________________________________________

determination statements are closely linked to the content of the security control (i.e., the security

control functionality) and the assurance requirements in NIST Special Publication 800-53 to

ensure traceability of assessment results back to the fundamental control requirements. The

application of an assessment procedure to a security control produces assessment findings. These

assessment findings are subsequently used in helping to determine the overall effectiveness of the

security control.

The assessment objects identify the specific items being assessed and include specifications,

mechanisms, activities, and individuals. Specifications are the document-based artifacts (e.g.,

policies, procedures, plans, system security requirements, functional specifications, and

architectural designs) associated with an information system. Mechanisms are the specific

hardware, software, or firmware safeguards and countermeasures employed within an information

system.

Activities are the specific protection-related pursuits or actions supporting an

information system that involve people (e.g., conducting system backup operations, monitoring

network traffic, exercising a contingency plan). Individuals, or groups of individuals, are people

applying the specifications, mechanisms, or activities described above.

The assessment methods define the nature of the assessor actions and include examine, interview,

and test. The examine method is the process of reviewing, inspecting, observing, studying, or

analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities). The

purpose of the examine method is to facilitate assessor understanding, achieve clarification, or

obtain evidence. The interview method is the process of conducting discussions with individuals

or groups of individuals within an organization to once again, facilitate assessor understanding,

achieve clarification, or obtain evidence. The test method is the process of exercising one or

more assessment objects (i.e., activities or mechanisms) under specified conditions to compare

actual with expected behavior. In all three assessment methods, the results are used in making

specific determinations called for in the determination statements and thereby achieving the

objectives for the assessment procedure.

Each of the assessment methods described above has a set of associated attributes, depth and

coverage, which help define the expected level of effort for the assessment. These attributes are

hierarchical in nature, providing the means to define the rigor and scope of the assessment for the

increased assurance needed for higher impact level information systems. The depth attribute

addresses the rigor of and level of detail in the examination, interview, and testing processes.

Values for the depth attribute include generalized, focused, and detailed. The coverage attribute

addresses the scope or breadth of the examination, interview, and testing processes including the

number and type of specifications, mechanisms, and activities to be examined or tested and the

number and types of individuals to be interviewed. Values for the coverage attribute include

representative, specific, and comprehensive. Appendix D provides attribute definitions and

descriptions of each assessment method. The appropriate depth and coverage attribute values for

a particular assessment method are the values needed to achieve the assessment expectations

defined in Appendix E (described further below) based upon the characteristics of the information

system being assessed (including impact level) and the specific determinations to be made.

Each of the information system impact levels (i.e., low, moderate, high) has an associated set of

minimum assurance requirements defined in NIST Special Publication 800-53. The assurance

requirements are directed at security control developers and implementers. Based on the

assurance requirements, security control developers and implementers carry out required

Mechanisms also include physical protection devices associated with an information system (e.g., locks, keypads,

security cameras, fire protection devices, fireproof safes, etc.).

CHAPTER 2 PAGE 9

剩余380页未读，继续阅读

艾米的爸爸

粉丝: 800
资源: 314

NIST SP800-53A：联邦信息系统安全控制评估指南

NIST SP 800-53A: 联邦信息系统中安全控制评价指南

关于NIST 800 53 2013版 北京大学

NIST SP 800-193(中文)

NIST SP800-53A rev1.pdf

NIST SP800-53 AppendicesDEF.pdf

NIST SP800-131A.pdf

NIST SP800-175A.pdf

NIST SP800-53-rev2-final.pdf

NIST SP800-170.pdf

NIST SP800-176.pdf

最新资源

关于NIST 800 53 2013版北京大学