Water Resources Discipline ITAC Activities

------------------------------------
Kevin T Gallagher
Chief Technology Officer
U.S. Geological Survey (USGS)
National Center
Reston, VA 20192
Voice: 703-648-6828
------------------------------------

----- Forwarded by Kevin T Gallagher/GIO/USGS/DOI on 06/24/2004 12:00 PM -----

___________________________________________

See Blue...
Kevin T Gallagher

___________________________________________

Kip,

I could use some clarification on the incident response training FISMA action item.

I am at ITAC this week and they are asking for potential impacts to the field due to FISMA. They saw the action item "train all employees in incident response". There is an impact that will effect the security points-of-contact and the end-users in alerting, correction, and reporting of security incidents.. The present points-of-contact l(SPOC) contact information been distributed to update the list and identify those individuals serving as local point of contact for their LAN segments.

They wanted to know what that meant. So I said:

1) All employees received incident response training as part of the overall security training. YES.. The All Employees Security Awareness Training completed the general requirement for incident response.

2) All CCERT members will be trained this month ( at the end of the month ). Yes -- In Portland, using the Department of Interior's training program.. The session will also include "tabletop drills" in handling of incidents and review the documents and procedures used in incident response.

So the question is: Are there any folks in water that need this training or any other training (like a cyber seminar?) SPOCs? SAs?
Yes.. The local-points-of-contact (SPOC, SA, ...) are instrumental in working with local users and CSIRT to identify, correct, and report security incidents. The Department guidance require this specialized training for all involved in security incidents. There will be a training session at the ITEM conference next-spring to provide this training for those who did not participate in the training sessions offered by the Department this year. Additionally, a package containing the manual and training CD is being prepared as part of the FISMA response for distribution to these local security point of contact.

This FY-05 ITEM training will be that provided by the Department to employees in Washington, Denver, and Portland (next week) earlier this year.. I have attached the original notification of the training.

The other question is: Who determined who are the members of CCERT? Why is it that there is no water representative? (maybe that question is better directed to Lester). The CSIRT consists of incident handlers who will manage the events and work with the points-of-contact. They are security team members, network, and Lotus specialists who additionally can effect the placement of security controls (filters, blocks, ...) at the access points from the Internet, at local firewalls, and the SMTP gateways.

The CSIRT process is not designed to exclude individuals or groups in the incident response process. It is intended to provide a structured incident response organization with defined roles and responsibilities for employees, point-of-contact, and incident response handlers. The weakness in our incident response capabilities has not been the willingness for incident response at all levels but rather, the absence of a structure ensuring security incidents were handled and reported. The use of an incident handler with specific responsibilities for managing the incident will improve the overall process.

I'd appreciate any clarification that you could provide.

Attachment -- 2004 IT Security Workshop Flyer

---------------------------------------------------
Kevin T. Gallagher
Chief Technology Officer
U.S. Geological Survey (USGS)
National Center
Reston, VA 20192
Voice: 703-648-6828
----------------------------------------------------

----- Forwarded by Marilyn A Billone/WRD/USGS/DOI on 07/07/2004 05:08 PM -----

---------------------------------------------------
Kevin T. Gallagher
Chief Technology Officer
U.S. Geological Survey (USGS)
National Center
Reston, VA 20192
Voice: 703-648-6828
----------------------------------------------------
----- Forwarded by Kevin T Gallagher/GIO/USGS/DOI on 06/24/2004 12:00 PM -----

Hi Kevin -

You're correct: according to the Department, FISMA Action Item #15 related to training all employees on incident response is covered by the mandatory annual security awareness training and the DOI CSIRT training that will be completed next week.

In addition, the ITSOT will be providing a formal "Roles and Responsibilities" document for every SPOC that clearly defines the steps to be taken when responding to IT security events and incidents. Based upon the drills that we'll be conducting next week, we'll have a better understanding of any addition training that may be warranted.

The CSIRT members are listed at http://internal.usgs.gov/gio/security/csirt_members.html . While Tim Brown will be coming to the RGIO's office in Denver as RITSOO, he has served as the Water Resources representative.

Sufficient?

Kip McCarty
Chief Technology Officer, Central Region
Regional Geographic Information Office
DFC, Bldg 53, MS-801
Denver, CO 80225
(303) 236-4940
kmccarty@usgs.gov

Kip,

I could use some clarification on the incident response training FISMA action item.

I am at ITAC this week and they are asking for potential impacts to the field due to FISMA. They saw the action item "train all employees in incident response".

They wanted to know what that meant. So I said:

1) All employees received incident reponse training as part of the overall security training.

2) All CCERT members will be trained this month ( at the end of the month ).

So the question is: Are there any folks in water that need this training or any other training (like a cyber seminar?) SPOCs? SAs?

The other question is: Who determined who are the members of CCERT? Why is it that there is no water representative? (maybe that question is better directed to Lester).

I'd appreciate any clarification that you could provide.

---------------------------------------------------
Kevin T. Gallagher
Chief Technology Officer
U.S. Geological Survey (USGS)
National Center
Reston, VA 20192
Voice: 703-648-6828
----------------------------------------------------