For LJK/Security test (TERM, AUTOLOGIN, ENTRY)⁵ the value specified in the limit is True, meaning a violation will be reported for each terminal over which automatic logins are allowed by VMS. A typical policy will include exemptions for each terminal over which automatic logins are allowed by site rules. Questions that might be asked about such an exemption include:

• Does the organization's policy allow exemptions for this test ?
• Is the value specified for this exemption within a range allowed for exemptions to this test by the organization's policy ?
• Does the comment field of this exemption provide tracking information required to determine that the procedure for issuing exemptions under the organization's policy was followed ?
• Does following that tracking information show that the organization's policy was followed for this exemption and that the exemption still conforms to the organization's policy with the passage of time ?

For LJK/Security test (UAF, PRIVLEVEL, ABSOLUTHI)⁶ the value specified in the limit is Category-Normal, meaning a violation will be reported for each username that has privileges at a higher level. A typical policy will include an exemption allowing username SYSTEM to have privileges at the level Category-All. Separate exemptions would be present for individuals assigned to system management duties.

Questions that might be asked about such an exemption include:

• Does the organization's policy allow exemptions for this test ?
• Is the value specified for this exemption within a range allowed for exemptions to this test by the organization's policy ?
• Does the comment field of this exemption provide tracking information required to determine that the procedure for issuing exemptions under the organization's policy was followed ?
• Does following that tracking information show that the organization's policy was followed for this exemption and that the exemption still conforms to the organization's policy with the passage of time ?

This appendix offers guidance for use of LJK/Security in complying with the US Committee on National Security Systems (CNSS) Instruction 1253.

If you are new to LJK/Security the vast array of capabilities can seem daunting. To get some quick results, use the following steps.

P.1.1 Setting Up the Environment

1. Have the VMS system manager install LJK/Security as described in Section 2.2, Installation on the Master Node.
2. Have the person who grants privileges¹ issue the commands

   $ SET DEFAULT SYS$SYSTEM $ MCR AUTHORIZE GRANT/IDENTIFIER LJK$SECURITY_ALL <your-user-name>

3. Log into a fresh session with your user name (this is required)

4. Create a policy that describes your proper set of CNSS controls

   $ LJK/SECURITY CREATE POLICY MY_CNSS_POLICY $ @LJK$SECURITY_EXAMPLES:POLICY_CNSSI_1253A_CL_IM_AL.COM MY_CNSS_POLICY

   Note If you are not a touch typist, you can open this document on screen and copy and paste many of the commands as you need them.

5. Use the DIRECTORY command to look at the list of policy modifications for particular VMS versions

   $ DIRECTORY LJK$SECURITY_EXAMPLES:POLICY_VMS_SHA1_*.COM; $ DIRECTORY LJK$SECURITY_EXAMPLES:POLICY_VMS_SIMPLE_*.COM;

   The names of those command procedures indication the version of VMS to which each one applies.
   The SIMPLE command procedures will provide the fastest initial test, but if yours is a federal government organization you are likely required to use SHA-1.

6. Customize your policy for your version of VMS by invoking the chosen command procedure

   $ @LJK$SECURITY_EXAMPLES:POLICY_VMS_SHA1_AXP_07_3_2.COM MY_CNSS_POLICY

   
   You can Copy and Paste portions of that command line, but be sure to specify the proper command procedure name for your version of VMS.

7. Start LJK/Security in subsystem mode for easier typing

   $ LJK/SECURITY/NOSMG/INTERFACE=CHARACTER_CELL

   
   You may want to create a DCL symbol in your LOGIN.COM file if you are going to use command mode on a regular basis.

8. Create an assessment

   LJKS> CREATE ASSESSMENT MY_CNSS_ASSESSMENT LJKS> MODIFY ASSESSMENT MY_CNSS_ASSESSMENT/NODE=<this-node>/POLICY=MY_CNSS_POLICY

9. Run the assessment omitting resource-intensive facilities

   LJKS> RUN MY_CNSS_ASSESSMENT /METHODS=QUICK

10. Take a break
11. Come back and check results

    LJKS> REPORT MY_CNSS_ASSESSMENT/STATUS_ONLY

12. When that indicates the assessment has completed, extract a summary and a detailed report

    LJKS> REPORT MY_CNSS_ASSESSMENT/SUMMARY=COMMENTS/OUTPUT=CNSS_SUMMARY.TXT LJKS> REPORT MY_CNSS_ASSESSMENT/OUTPUT=CNSS_DETAILS.TXT

13. Start a full assessment running while you study the results of the quick assessment

    LJKS> RUN MY_CNSS_ASSESSMENT

14. Exit from LJK/Security subsystem mode

    LJKS> [Ctrl/Z]

You can specify which conditions are actually acceptable by customizing your policy. Then subsequent assessment runs will produce a proper "management by exception" report.

P.1.3 Choosing a User Interface

To customize your policy will take more interaction and be an ongoing activity as personnel and requirements change. You might want to use a different user interface. You have your choice of three

1. Window
   Described in Section 3.3.3, Adding an Exemption
2. Menu
   Described in Section 4.2.3, Adding an Exemption
3. Command
   Described in MODIFY POLICY within Chapter 5, Command Interface

Use your choice of interface to add exemptions to your policy as follows

• Add an exemption to the test (UAF, PRIVLEVEL, ABSOLUTHI) for username SYSTEM to have all privileges. Username SYSTEM must have full privileges for the proper operation of VMS.
• Add exemptions to the test (UAF, PRIVLEVEL, ABSOLUTHI) for usernames that have been properly authorized under the organization's policy for access to particular VMS privileges.
• Add exemptions to the test (DISK, INSTALLED, PROHIBITED) for files that have been properly authorized under the organization's policy to be installed as a part of the Trusted Computing Base (TCB).
• Add exemptions to the test (DISK, INSTPRIV, PRIVPROHIB) for files that have been properly authorized under the organization's policy to be installed as privileged in the Trusted Computing Base (TCB). Be sure those exemptions are only for the particular privileges the organization's policy allows.
• Add exemptions to the test (DISK, INSTPROT, PROHIBITED) for files that have been properly authorized under the organization's policy to be installed as protected in the Trusted Computing Base (TCB).
• Add exemptions to the test (DISK, CHECKSUM, SIMPLE) or (DISK, CHECKSUM, SHA1) for files given exemptions in the previous three steps. This will detect unauthorized changes in those files which have been installed in the Trusted Computing Base (TCB). Ideally the organization would publish the proper checksum value when authorizing the exemptions above, but if that does not happen it will take one assessment run to determine the proper value for the CHECKSUM exemption.
• Add other exemptions authorized under the organization's policy.

P.2 Saving Time on Annual CNSS Security Assessments

Organizations subject to CNSS Instruction 1253 can save considerable effort if annual CNSS Security Assessments required for control CA-2 make use of data collected for Continuous Monitoring required for control CA-7. This is easily done when one can determine that assessments for CA-7 cover all 800-53 controls, since subsetting is allowed for CA-7 Continuous Monitoring but not for CA-2 Security Assessment.

In other cases it will be necessary to create a separate policy for CA-2 Security Assessment, but effort that has gone into CA-7 Continuous Monitoring can still be leveraged as shown below to minimize the work required for annual CA-2 Security Assessment. The technique described involves creating a LJK/Security policy for CA-2 Security Assessment using two different techniques:

• Limits
  determined without regard to CA-7 Continuous Monitoring
• Exemptions
  selected through careful review of exemptions already in use for CA-7 Continuous Monitoring

Use of LJK/Security varies according to each assessment method chosen in the MODIFY ASSESSMENT or RUN command:

• /METHODS=(AUTOMATIC_TESTING) (D)
  The original LJK/Security method of Automatic Testing measures those security controls that can be tested under a running copy of the VMS (OpenVMS) operating system. High speed scanning of protections on all disk files is handled in this fashion.
  In most cases, the measurements that LJK/Security makes correspond to what NIST SP 800-53 calls Technical Controls and violations that are reported will fall into those categories. But there are other cases: for instance, testing how recently files have been backed up, which CNSSI 1253 tracks under Operational Controls, in particular CP-3. Of course in this case, LJK/Security is not measuring whether the system is configured (via command procedure design) to be backed up according to schedule, but whether that backup really happens.
• /METHODS=(COMPENSATING_CONTROLS)
  The COMPENSATING_CONTROLS method is not a measurement at all. It is just a mechanism for noting exceptions to CNSSI 1253 controls that have been fully planned and considered by the organization. In the case of predefined command procedures from LJK Software, they represent aspects of VMS that are not well represented by CNSSI 1253.
• /METHODS=(INTERVIEWS)
  The INTERVIEWS method involved discussion with organizational people to investigate compliance with CNSSI 1253 controls.
• /METHODS=(INVASIVE_TESTING)
  The INVASIVE_TESTING method requires extensive work to verify the proper operation of particular activities or hardware/software mechanisms. In the case of software mechanisms that are part of VMS itself, a considerable reduction in the work required is afforded by using an evaluated version of VMS. But in cases where the INVASIVE_TESTING method is still needed, generally the testing should be on a separate test machine running the same software, rather than directly on the production machine.
• /METHODS=(MANUAL_EXAMINATION)
  The MANUAL_EXAMINATION method involves examination of items external to the computer system that cannot be accomplished automatically. Some examples are policy documents, fire alarm wiring and the way backup tape transfer to an offsite location is handled.

For the INTERVIEW, INVASIVE_TESTING and MANUAL_EXAMINATION methods an organization with multiple VMS systems will typically designate many of the groups within each method as "Common Controls". For each such groups the organization will conduct the assessment on one node and then use the commands:

$ LJK/Security ASSIGN <target-assessment> <source-assessment-1> /INTERVIEW /GROUP=PA17 $ LJK/Security ASSIGN <target-assessment> <source-assessment-2> /INTERVIEW /GROUP=QUIZ* $ LJK/Security ASSIGN <target-assessment> <source-assessment-3> /INVASIVE_TESTING /GROUP=*

to propagate those assessment results for use in other assessments.

Examples of groups where common controls are appropriate would be:

• Organization-wide propagation of results for assessing organization security policy documents.
• Site-wide propagation of results for assessing visitor access controls and fire alarms systems.

The ALL and QUICK methods are derivatives of the other methods.

P.2.2 The Multi-faceted Nature of CNSS Assessment

• CA-2 Security Assessment
• CA-7 Continuous Monitoring

NIST SP 800-53 Control CA-2 says in part "The organization conducts an assessment of the security controls in the information system [Assignment: organization-defined frequency, at least annually]". This appendix will use the term "annual" for what in some cases might actually be "quarterly" or some other period, but the interaction issues below are the same.

P.2.2.2 800-53 CA-7 Continuous Monitoring

NIST SP 800-53 Control CA-7 says in part "The organization monitors the security controls in the information system on an ongoing basis", and also "selects a subset of the security controls employed within the information system for purposes of continuous monitoring". It says continuous monitoring activities include "ongoing assessment of security controls".

As one considers the question of which controls should be subjected to that ongoing assessment, an ancillary question will arise about what effort is required for this continuous monitoring. There is no good reason to avoid continuous monitoring of a control if the effort required is minimal. By definition using the LJK/Security Automatic Testing method to test controls takes minimal effort, because the testing is automated. So for most VMS systems, testing controls related to the protection of every file on every disk once a week and other controls daily or hourly is quite reasonable. For special situations like process control it might be preferable to run that continuous monitoring only during a designated maintenance period, particularly if a realtime device must be manipulated by the VMS system with millisecond response times. ljkljk

P.2.2.3 Are CA-7 Assessments Adequate For CA-2 ?

In some cases agency Inspector General staff or independent outsiders will be charged with conducting the annual CA-2 Security Assessment as specified by control enhancement CA-2 (1), while regular Information Security personnel will handle the CA-7 Continuous Monitoring. In such cases, one question that immediately arises is whether a separate CA-2 Security Assessment must be conducted or whether results from the ongoing CA-7 Continuous Monitoring will suffice.

In the context of LJK/Security assessment of CNSSI 1253 controls, the answer to that question involves several issues:

1. Is CA-7 Continuous Monitoring being conducted ?
   Control CA-7 calls for ongoing assessment of security controls, but there is a possibility that requirement is not being met. Those responsible for conducting CA-2 Security Assessment must always determine whether there is a program of ongoing assessment in order to determine what separate CA-2 Security Assessment work is required.
2. Is the CA-7 Continuous Monitoring policy complete ?
   Control CA-7 says that an organization selects a subset of security controls for continuous monitoring, but control CA-2 requires that the complete set of CNSSI 1253 controls be evaluated. So depending on CA-7 Continuous Monitoring to fulfill the requirements for CA-2 Security Assessment requires that the "subset" chosen includes the full set of CNSSI 1253 controls, such as suggested in Section P.2.2.2.
3. Are the CA-7 Continuous Monitoring limits accurate ?
   It is possible that after the policy used for CA-7 Continuous Monitoring was created, the organization has changed its view of appropriate limits to implement the controls of CNSSI 1253.
   Those responsible for CA-2 Security Assessment can readily extract a text file of limits from the policy used for CA-7 Continuous Monitoring. Using the VMS command DIFFERENCES, it is easy to see if that policy conforms to a master file of the organization's current approved policy.
4. Are the CA-7 Continuous Monitoring exemptions reasonable ?
   At a minimum, a quick visual review of the exemptions used for CA-7 Continuous Monitoring is in order. The rest of this appendix discusses how to perform a more exhaustive check of the exemptions being used for CA-7 Continuous Monitoring.

There can be only one copy of the LJK/Security software installed on a particular running instance of the VMS operating system. There is a single name space for policy documents which must be shared by all those who have been authorized to run LJK/Security. Organization-specific naming conventions provide an easy way to distinguish between documents used for CA-7 Continuous Monitoring on a day-to-day basis and documents used for the annual CA-2 Security Assessment. For instance, in an organization where a team from the Office of the Inspector General conducts the annual CA-2 Security Assessment, files they create could all have names starting with a particular string of characters, like "OIG_". A different scheme might use "OIG_FY06_" one year and "OIG_FY07_" the next year.