Security Assessment: Case Studies for Implementing the NSA IAM

Everything You Need to Know to Conduct a Security Audit of Your Organization

In 1998, the National Security Agency (NSA) Information Assurance Methodology (IAM) was developed to meet the demand for information security (INFOSEC) assessments-a demand that was increasing due to Presidential Decision Directive 63 (PDD-63) while at the same time NSA was downsizing. NSA sought a way to maximize its resources to assist as many customers as possible and so they created a list of organizations that could perform the same service as the NSA. NSA quickly realized that this system would not only provide valuable information to consumers-it would also provide a vehicle for standardization of INFOSEC assessments.

• Define What Composes an Assessment
  Learn about the NSA's three-phases: Assessment, Evaluation, and Red teaming
• Understand Industry Concerns for the Assessment Site
  Review the items that affect your client: Health Insurance Portability and Accounting Act of 1996 (HIPAA), Sarbanes-Oxley, Financial Management and Accountability (FMA) Act, Family Education Rights and Privacy Act (FERPA), and others.
• Create the Organizational Information Criticality Matrix (OICM)
  Create the OICM, which provides a basis for everything else in the methodology and clarifies the intentions and goals of the assessment process for the customer.
• Handle Documentation Identification and Collection
  Work with the client to gather and define documents such as policy, guidelines, plans, SOPs, user documentation and see what happens when no documentation exists.
• Understand the Technical Assessment Plan (TAP)
  Use the TAP to define all dates and scheduling, personnel involvement, understood boundaries, deliverables, priority concerns, and priority constraints.
• Review the 18 NSA INFOSEC Baseline Classes and Categories
  Use these 18 categories to address the customer's security posture and determine what questions should be asked during the interview process.
• Create a Recommendation Road Map
  Provide the customer with a road map to the best way to address or implement the corrective measures for negative findings.
• Understand the Findings
  Assess the overall risk to a customer by looking at the threats, vulnerabilities, and asset value and analyze both negative and positive findings to create a true picture of the customer's security posture.
• Register for Your 1 Year Upgrade
  The Syngress Solutions upgrade plan protects you from content obsolescence and provides monthly mailings, whitepapers, and more!

了解如何進行組織安全審計的一切

1998年，國家安全局（NSA）開發了信息保安方法論（IAM）以滿足對信息安全（INFOSEC）評估的需求，這種需求由於總統決策指令63號（PDD-63）的增加而不斷增加，同時NSA正在縮小規模。NSA尋求一種方法來最大化其資源，以協助盡可能多的客戶，因此他們創建了一個能夠提供與NSA相同服務的組織清單。NSA很快意識到，這個系統不僅可以為消費者提供有價值的信息，還可以為INFOSEC評估的標準化提供一個平台。

• 
  定義評估的組成部分
  了解NSA的三個階段：評估、評價和紅隊測試
  


• 
  了解評估場所的行業關注點
  審查影響客戶的項目：1996年健康保險可攜性和會計法案（HIPAA）、薩班斯-奧克斯利法案、財務管理和責任法案（FMA）、家庭教育權利和隱私法案（FERPA）等。
  


• 
  創建組織信息重要性矩陣（OICM）
  創建OICM，為方法論中的所有其他內容提供基礎，並澄清評估過程的意圖和目標。
  


• 
  處理文件識別和收集
  與客戶合作收集和定義文件，如政策、指南、計劃、標準操作程序（SOP）、用戶文檔，並查看在沒有文件的情況下會發生什麼。
  


• 
  了解技術評估計劃（TAP）
  使用TAP定義所有日期和排程、人員參與、理解的邊界、可交付成果、優先關注點和優先限制。
  


• 
  審查18個NSA INFOSEC基線類別
  使用這18個類別來解決客戶的安全狀態並確定在面試過程中應該提出哪些問題。
  


• 
  創建建議路線圖
  為客戶提供一個解決負面發現的最佳方法或實施措施的路線圖。
  


• 
  了解發現結果
  通過查看威脅、漏洞和資產價值來評估客戶的整體風險，並分析負面和正面的發現，以獲得客戶的真實安全狀態。
  


• 
  註冊1年升級計劃
  Syngress Solutions的升級計劃可保護您免受內容過時的影響，並提供每月郵件、白皮書等。

案例研究包括
為最佳電源供應組織（OOPS）進行範圍努力
公開冗余局
組織重要性