This appendix offers guidance for use of LJK/Security by those complying with the US Federal Information Security Management Act (FISMA).

If you are new to LJK/Security the vast array of capabilities can seem daunting. To get some quick results, use the following steps.

L.1.1 Setting Up the Environment

1. Have the VMS system manager install LJK/Security as described in Section 2.2, Installation on the Master Node.
2. Have the person who grants privileges¹ issue the commands

   $ SET DEFAULT SYS$SYSTEM $ MCR AUTHORIZE GRANT/IDENTIFIER LJK$SECURITY_ALL <your-user-name>

3. Log into a fresh session with your user name (this is required)

4. Create a policy that describes FISMA controls

   $ LJK/SECURITY CREATE POLICY MY_FISMA_POLICY $ @LJK$SECURITY_EXAMPLES:POLICY_NIST_SP_800_53.COM MY_FISMA_POLICY

   Note If you are not a touch typist, you can open this document on screen and copy and paste many of the commands as you need them.

5. Use the DIRECTORY command to look at the list of policy modifications for particular VMS versions

   $ DIRECTORY LJK$SECURITY_EXAMPLES:POLICY_VMS_SHA1_*.COM; $ DIRECTORY LJK$SECURITY_EXAMPLES:POLICY_VMS_SIMPLE_*.COM;

   The names of those command procedures indication the version of VMS to which each one applies.
   The SIMPLE command procedures will provide the fastest initial test. Depending on your organization's rules, you may be required to switch to SHA-1 later.

6. Customize your policy for your version of VMS by invoking the chosen command procedure

   $ @LJK$SECURITY_EXAMPLES:POLICY_VMS_SIMPLE_AXP_07_3_2.COM MY_FISMA_POLICY

   
   You can Copy and Paste portions of that command line, but be sure to specify the proper command procedure name for your version of VMS.

7. Start LJK/Security in subsystem mode for easier typing

   $ LJK/SECURITY/NOSMG/INTERFACE=CHARACTER_CELL

   
   You may want to create a DCL symbol in your LOGIN.COM file if you are going to use command mode on a regular basis.

8. Create an assessment

   LJKS> CREATE ASSESSMENT MY_FISMA_ASSESSMENT LJKS> MODIFY ASSESSMENT MY_FISMA_ASSESSMENT/NODE=<this-node>/POLICY=MY_FISMA_POLICY

9. Run the assessment omitting resource-intensive facilities

   LJKS> RUN MY_FISMA_ASSESSMENT /METHODS=QUICK

10. Take a break
11. Come back and check results

    LJKS> REPORT MY_FISMA_ASSESSMENT/STATUS_ONLY

12. When that indicates the assessment has completed, extract a summary and a detailed report

    LJKS> REPORT MY_FISMA_ASSESSMENT/SUMMARY=COMMENTS/OUTPUT=FISMA_SUMMARY.TXT LJKS> REPORT MY_FISMA_ASSESSMENT/OUTPUT=FISMA_DETAILS.TXT

13. Start a full assessment running while you study the results of the quick assessment

    LJKS> RUN MY_FISMA_ASSESSMENT

14. Exit from LJK/Security subsystem mode

    LJKS> [Ctrl/Z]

You can specify which conditions are actually acceptable by customizing your policy. Then subsequent assessment runs will produce a proper "management by exception" report.

L.1.3 Choosing a User Interface

To customize your policy will take more interaction and be an ongoing activity as personnel and requirements change. You might want to use a different user interface. You have your choice of three

1. Window
   Described in Section 3.3.3, Adding an Exemption
2. Menu
   Described in Section 4.2.3, Adding an Exemption
3. Command
   Described in MODIFY POLICY within Chapter 5, Command Interface

Use your choice of interface to add exemptions to your policy as follows

• Add an exemption to the test (UAF, PRIVLEVEL, ABSOLUTHI) for username SYSTEM to have all privileges. Username SYSTEM must have full privileges for the proper operation of VMS.
• Add exemptions to the test (UAF, PRIVLEVEL, ABSOLUTHI) for usernames that have been properly authorized under the organization's policy for access to particular VMS privileges.
• Add exemptions to the test (DISK, INSTALLED, PROHIBITED) for files that have been properly authorized under the organization's policy to be installed as a part of the Trusted Computing Base (TCB).
• Add exemptions to the test (DISK, INSTPRIV, PRIVPROHIB) for files that have been properly authorized under the organization's policy to be installed as privileged in the Trusted Computing Base (TCB). Be sure those exemptions are only for the particular privileges the organization's policy allows.
• Add exemptions to the test (DISK, INSTPROT, PROHIBITED) for files that have been properly authorized under the organization's policy to be installed as protected in the Trusted Computing Base (TCB).
• Add exemptions to the test (DISK, CHECKSUM, SIMPLE) or (DISK, CHECKSUM, SHA1) for files given exemptions in the previous three steps. This will detect unauthorized changes in those files which have been installed in the Trusted Computing Base (TCB). Ideally the organization would publish the proper checksum value when authorizing the exemptions above, but if that does not happen it will take one assessment run to determine the proper value for the CHECKSUM exemption.
• Add other exemptions authorized under the organization's policy.

L.2 Saving Time on Annual FISMA Security Assessments

Organizations subject to NIST Special Publication 800-53 can save considerable effort if annual FISMA Security Assessments required for control CA-2 make use of data collected for Continuous Monitoring required for control CA-7. This is easily done when one can determine that assessments for CA-7 cover all 800-53 controls, since subsetting is allowed for CA-7 Continuous Monitoring but not for CA-2 Security Assessment.

In other cases it will be necessary to create a separate policy for CA-2 Security Assessment, but effort that has gone into CA-7 Continuous Monitoring can still be leveraged as shown below to minimize the work required for annual CA-2 Security Assessment. The technique described involves creating a LJK/Security policy for CA-2 Security Assessment using two different techniques:

• Limits
  determined without regard to CA-7 Continuous Monitoring
• Exemptions
  selected through careful review of exemptions already in use for CA-7 Continuous Monitoring

Use of LJK/Security varies according to each assessment method:

• /METHODS=([NO]AUTOMATIC_TESTING) (D)
  The original LJK/Security method of AUTOMATIC_TESTING measures those security controls that can be tested under a running copy of the VMS (OpenVMS) operating system. High speed scanning of protections on all disk files is handled in this fashion.
  In most cases, the measurements that LJK/Security makes correspond to what NIST 800-53 calls Technical Controls and violations that are reported will fall into those categories. But there are other cases: for instance, testing how recently files have been backed up, which NIST 800-53 tracks under Operational Controls, in particular CP-3. Of course in this case, LJK/Security is not measuring whether the system is configured (via command procedure design) to be backed up according to schedule, but whether that backup really happens.
• /METHODS=([NO]COMPENSATING_CONTROLS)
  The COMPENSATING_CONTROLS method is not a measurement at all. It is just a mechanism for noting exceptions to NIST 800-53 controls that have been fully planned and considered by the organization. In the case of predefined 800-53 command procedures from LJK Software, they represent aspects of VMS that are not well represented by NIST 800-53.
• /METHODS=([NO]INTERVIEWS)
  The INTERVIEWS method involved discussion with organizational people to investigate compliance with NIST 800-53 controls.
• /METHODS=([NO]INVASIVE_TESTING)
  The INVASIVE_TESTING method requires extensive work to verify the proper operation of particular activities or hardware/software mechanisms. In the case of software mechanisms that are part of VMS itself, a considerable reduction in the work required is afforded by using an evaluated version of VMS.
• /METHODS=([NO]MANUAL_EXAMINATION)
  The MANUAL_EXAMINATION method involves examination of items external to the computer system that cannot be accomplished automatically. Some examples are policy documents, fire alarm wiring and the way backup tape transfer to an offsite location is handled.

$ LJK/Security MODIFY ASSESSMENT <policy-1>/EXPORT=<filespec> $ LJK/Security MODIFY ASSESSMENT <policy-2>/IMPORT=<filespec>

to propagate those assessment results for use with other nodes.

Examples of groups where common controls are appropriate would be:

• Organization-wide propagation of results for assessing organization security policy documents.
• Site-wide propagation of results for assessing visitor access controls and fire alarms systems.

The ALL and QUICK methods are derivatives of the other methods.

L.2.2 The Multi-faceted Nature of FISMA Assessment

• CA-2 Security Assessment
• CA-4 Security Certification
• CA-7 Continuous Monitoring

NIST 800-53 Control CA-2 says in part "The organization conducts an assessment of the security controls in the information system [Assignment: organization-defined frequency, at least annually]". This appendix will use the term "annual" for what in some cases might actually be "quarterly" or some other period, but the interaction issues below are the same.

L.2.2.2 800-53 CA-7 Continuous Monitoring

NIST 800-53 Control CA-7 says in part "The organization monitors the security controls in the information system on an ongoing basis", and also "selects a subset of the security controls employed within the information system for purposes of continuous monitoring". It says continuous monitoring activities include "ongoing assessment of security controls".

As one considers the question of which controls should be subjected to that ongoing assessment, an ancillary question will arise about what effort is required for this continuous monitoring. There is no good reason to avoid continuous monitoring of a control if the effort required is minimal. By definition testing those controls that LJK/Security can test takes minimal effort, because the testing is automated. So for most VMS systems, testing controls related to the protection of every file on every disk once a week and other controls daily or hourly is quite reasonable. For special situations like process control it might be preferable to run that continuous monitoring only during a designated maintenance period, particularly if a realtime device must be manipulated by the VMS system with millisecond response times.

L.2.2.3 Are CA-7 Assessments Adequate For CA-2 ?

In some cases agency Inspector General staff or independent outsiders will be charged with conducting the annual CA-2 Security Assessment, while regular Information Security personnel will handle the CA-7 Continuous Monitoring. In such cases, one question that immediately arises is whether a separate CA-2 Security Assessment must be conducted or whether results from the ongoing CA-7 Continuous Monitoring will suffice.

In the context of LJK/Security assessment of NIST 800-53 controls, the answer to that question involves several issues:

1. Is CA-7 Continuous Monitoring being conducted ?
   Control CA-7 calls for ongoing assessment of security controls, but there is a possibility that requirement is not being met. Those responsible for conducting CA-2 Security Assessment must always determine whether there is a program of ongoing assessment in order to determine what separate CA-2 Security Assessment work is required.
2. Is the CA-7 Continuous Monitoring policy complete ?
   Control CA-7 says that an organization selects a subset of security controls for continuous monitoring, but control CA-2 requires that the complete set of NIST 800-53 controls be evaluated. So depending on CA-7 Continuous Monitoring to fulfill the requirements for CA-2 Security Assessment requires that the "subset" chosen includes the full set of NIST 800-53 controls, such as suggested in Section L.2.2.2.
3. Are the CA-7 Continuous Monitoring limits accurate ?
   It is possible that after the policy used for CA-7 Continuous Monitoring was created, the organization has changed its view of appropriate limits to implement the controls of NIST 800-53.
   Those responsible for CA-2 Security Assessment can readily extract a text file of limits from the policy used for CA-7 Continuous Monitoring. Using the VMS command DIFFERENCES, it is easy to see if that policy conforms to a master file of the organization's current approved policy.
4. Are the CA-7 Continuous Monitoring exemptions reasonable ?
   At a minimum, a quick visual review of the exemptions used for CA-7 Continuous Monitoring is in order. The rest of this appendix discusses how to perform a more exhaustive check of the exemptions being used for CA-7 Continuous Monitoring.

There can be only one copy of the LJK/Security software installed on a particular running instance of the VMS operating system. There is a single name space for policy documents which must be shared by all those who have been authorized to run LJK/Security. Organization-specific naming conventions provide an easy way to distinguish between documents used for CA-7 Continuous Monitoring on a day-to-day basis and documents used for the annual CA-2 Security Assessment. For instance, in an organization where a team from the Office of the Inspector General conducts the annual CA-2 Security Assessment, files they create could all have names starting with a particular string of characters, like "OIG_". A different scheme might use "OIG_FY06_" one year and "OIG_FY07_" the next year.

L.2.4 What is a "System" ?

The basis of FISMA reporting is on a per-system basis, and that definition of each system is something on which the CA-2 and CA-7 teams should be in agreement. A FISMA system can be much larger than a single running copy of VMS, and even larger than a single running VMScluster. It may even mix VMS and non-VMS machines. It is important to agree on a definition of where boundaries of each FISMA system start and end, and then stick to it.

Typically at least the VMS portion of any FISMA system will be assessed from a single LJK/Security master node, but a single master node might be used for assessing the VMS portion of more than one FISMA system. In the case of a single master node used to assess two FISMA systems named Castor and Pollux, the policy file name prefixes on an LJK/Security master node might be OIG_FY06_CASTOR_ and OIG_FY06_POLLUX_ for the CA-2 Security Assessment team vs. CASTOR_ and POLLUX_ for the CA-7 Continuous Monitoring team.

L.2.5 Using CA-7 Exemptions for CA-2 Assessments

In setting limits within a policy, those conducting a separate CA-2 Security Assessment will want to create a policy from scratch, perhaps carrying in policy settings prepared in advance or used for CA-2 Security Assessment on some other system operated by the organization. Another option would be to take the default NIST 800-53 policy settings that ship with LJK/Security and just make particular changes for those controls where the policy of the organization mandates a different value in the policy from that shipped with LJK/Security. It would be a mistake to just make a wholesale copy of the policy used for CA-7 Continuous Monitoring, since that might not have been kept current with the organization's policy.

But the situation is different in the case of exemptions in the new policy. Exemptions are used in LJK/Security to indicate special cases where abnormal values are permitted based on management approval. For instance a typical limit says that no individuals should have privileges assigned to their VMS username. Then exemptions are entered for the VMS usernames of those assigned to system management duties, so that violation reports are not generated for those usernames authorized to have privilege. To recreate the exemptions appropriate to a system would be time consuming, so a better tactic is:

1. Extract the exemptions (but not the limits) from the appropriate CA-7 policy (or policies) with a command like

   $ LJK/Security SHOW POLICY ca7policyname - /EXEMPTIONS /NOLIMITS /COMMAND_PROCEDURE - /OUTPUT=REVIEW.TXT

   creating a command procedure for applying those exemptions to some other policy. Each line in the command procedure contains an entire command for establishing one exemption, so some of those lines will be quite long.

2. Use a text editor to inspect each exemption in the resulting command procedure and decide whether it was properly granted. On lines where the exemption is not appropriate, comment out the line with an initial exclamation point (!). This has the same effect as deleting the line, but leaves a better record of what actions are taken. For an even better record, one can follow that exclamation point with brief text (on a single line) indicating the reason for the decision.
3. Apply the resulting batch of exemptions to the CA-2 policy with a command like

   $ @REVIEW.TXT ca2policyname

   where ca2policyname is the name of the policy created earlier with the current limits for the organization.

4. Use the resulting policy for the Annual CA-2 Security Assessment.

Depending on the organization's policy some manual reporting of inappropriate exemptions found in step 2 above might be in order.

In the following sections, we discuss various considerations for proposed exemptions, depending on the LJK/Security facility in which the exemptions are located. The examples are based on limits specified in the POLICY_NIST_SP_800_53.COM file provided in directory LJK$SECURITY_EXAMPLES. Your own organization's limits may be different.