Bellevue University Administration Office

Version 1.0

2/5/2020

Controlled Unclassified Information

Operational Overview

Organization Name: Bellevue University

Building: Administration Office

Address: 123 Bellevue University Lane, Bellevue, Nebraska

This organization will handle admissions, supervision of academic affairs (evaluation, hiring, tenure, promotion), official records maintenance, financial flow/record maintenance, maintenance of campus buildings/grounds, security/safety of campus property/people, support/supervision of campus network and computers (with campus IT), private/foundation fundraising, research administration, public affairs (media, local/state/federal government), and student services (library, career counseling, disability programs). All assets will reside at 123 Bellevue University Lane, Bellevue Nebraska. The office will be secured by keycard access 24/7 and closed outside regular operating hours. The office will be operated by a combination of full-time and part-time staff, as well as student workers. Data used in the office is sensitive, consisting of student and staff IDs, names, emails, transcripts, health information, financial accounts, and official university leases, contracts, etc. The office will have visitors, which will include potential students and their families, as well as outside contractors and media.

System Overview

Hardware

Software

 Personnel

Assessment Methods

Security Assessment

Perimeter Router Security Technical Implementation Guide : : Release: 32 Benchmark Date: 25 Jan 2019

Firewall: Firewall Security Requirements Guide : : Release: 3 Benchmark Date: 25 Jan 2019

 Layer 2 Switch Security Technical Implementation Guide : : Release: 27 Benchmark Date: 25 Jan 2019

Other Hardware/Software Benchmark Date: 25 Jan 2019

 Asset Prioritization for Mitigation or Remediation

Risk Determination

Through my findings, I found most of the security policies, protocols, and procedures to be adequate at the Bellevue University Administration office, except for the following:

Perimeter Router

Per the STIG, the router had four vulnerabilities that required attention, ranging from CAT II-III. I chose Vul ID: V-3160 as the primary concern, as the lack of the last CAT III IAVM (information assurance vulnerability alert), indicates that the router is not running the most current and approved software version, thus significantly impacting the risk of threats and errors. The second most-critical vulnerability is Vul ID: V-3013, due to the confidentiality and legal implications of not having a DoD-approved logon banner; without the user being aware that they are not allowed access (unless authorized), an unsuspecting individual might proceed to enter the system and access sensitive data and/or damage critical configurations. Also, if the user is unaware of the fact that they are not authorized to enter the system and that they will be monitored while doing so, there can be plausible-deniability in the legal process if any legal actions are taken against the individual. Vul ID: 3072 is the next vulnerability of most-importance, as having varying running and boot configurations, in the event of an unexpected downtime, crash, or error, can delete any changes made to the system upon reboot (due to lack of synchronization). Finally, Vul ID: 3967, while being a higher severity level (CAT II) than the previous Vul ID: 3072 (CAT III), is of least importance, since the extra two minutes before a timeout can be avoided by merely logging out, and also, while any time the authorized user is not present and the system is open is dangerous, two additional minutes isn’t going to be a disaster (but it should still be set at ten minutes as soon as possible).

Firewall

Per the STIG, the firewall had three CAT III vulnerabilities that required attention. I chose Vul ID: V-79489 to be the greatest threat due to the importance of automated alerts in the monitoring process of attacks, errors, and maintenance tasks. Even if the administrator checked the system relentlessly, the probability of human error is too high. Firewalls need to be monitored 24/7 (preferably by multiple individuals), and the easiest way to achieve this is to merely set up an automatic notification system to be alerted of any changes, errors, configuration problems, or attacks (like DoS). Next, Vul ID: 79487 should be addressed, as in the audit process, being able to narrow down searches and minimize the sheer amount of data involved is vital to finding where errors occurred and attacks originated. With the changes of the previous Vul ID: V-79489 enabling automatic notifications, the systems administrator can then, once alerted, easily comb through the logs by creating a specific subset for the search; this will lead to enhanced troubleshooting, maintenance, and security. Finally, Vul ID: V-79441 is of least importance, yet still needs to be quickly fixed. During the enhanced audit procedures of the previous two vulnerabilities, V-79441 allows for the ability to identify nodes within log events; without this, even the most sophisticated alert and audit procedures will fail to recognize which devices the attack or errors occurred first and how to secure each node based on the node/device’s specific hardware/software.

Layer 2 Switch

Per the STIG, the switch has one vulnerability that needs to be addressed; however, it’s the only CAT I severity level of all the assets. Vul ID: V-15434 is critical to fix because in the event of an unexpected downtime or error, while the authorization server is down, the administrator will not be able to access the switch to perform (potentially disaster-preventing) emergency tasks needed to reconcile the situation.

Reasoning for Asset Prioritization

I chose the layer 2 switch as the primary concern of all other assets due to the STIG including the only CAT I vulnerability, and since in the event of the authorization server going offline, the system could be rendered unusable; this significantly puts this asset’s importance of mitigation and remediation at the top of the list. The next most critical asset is the firewall, due to the device’s protective nature on the entire network and the lack of alerts and weaknesses in the auditing/log process. If an attack happened, the administrator would only become aware if they looked at the logs (which could be several hours later due to operating hours), and even if they did catch it in time, they wouldn’t be able to quickly (due to not being able to use subsets) and accurately find where the attack originated (due to not being able to see individual nodes). Finally, the router would be the least-important asset in terms of vulnerability, as the lack of banner doesn’t block intruders (do warnings ever work?) and the additional two minutes of the timeout time, while still dangerous, doesn’t danger the entire system as much as some of the other asset’s vulnerabilities.

References

Whitman, M. & Mattord, H. (2016). Management of Information Security (6th ed.). Boston, MA: Cengage Learning.

Cyberex-Ma. (2020, January 7). cyberex-ma. Retrieved January 16, 2020, from https://public.cyber.mil/stigs/.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “AC-2 Account Management.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/AC-2.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “AU-1 Audit and Accountability Policies and Procedures.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/AU-1.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “AT-2 Security Awareness Training.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/AT-2.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “CM-4 Security Impact Analysis.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/CM-4.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “CP-3 Contingency Training.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/CP-3.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “IA-2 Identification and Authorization (Organizational users).” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/IA-2.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “IR-2 Incident Response Training.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/IR-2.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “MA-1 System Maintenance Policy and Procedures.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/MA-1.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “MP-2 Media Access.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/MP-2.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “PS-3 Personnel Screening.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/PS-3.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “PE-3 Physical Access Control.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/PE-3.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “PL-2 System Security Plan.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/PL-2.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “RA-3 Risk Assessment.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/RA-3.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “CA-3 System Interconnections.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/CA-3.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “SC-5 Denial of Service Protection.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/SC-5.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “SI-4 Information System Monitoring.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/SI-4.

NIST (n.d.). NIST Special Publication 800-53 (Rev. 4). Security and Privacy Controls for Federal Information Systems and Organizations. “SA-2 Allocation of Resources.” Retrieved from https://nvd.nist.gov/800-53/Rev4/control/SA-2.