CMU5XX-INFOSEC
Information Security for Industry
Session 10: Developing Security Plans
Learning Objectives
- Deconstruct the anatomy of a System Security Plan (SSP).
- Define clear authorization boundaries for IT systems.
- Apply standard data categorization frameworks (e.g., FIPS 199) to system data.
- Select and tailor Security Control Baselines to mitigate specific risks.
- Manage remediation efforts using a Plan of Action and Milestones (POA&M).
Seminar Structure (3 Hours)
Part 1: The System Security Plan (1.5 hrs)
- What is an SSP?
- Defining the Authorization Boundary
- Task 1: Drafting an SSP Boundary
Part 2: Controls and Remediation (1.5 hrs)
- Control Baselines and Tailoring
- The Plan of Action and Milestones (POA&M)
- Task 2: Managing a POA&M
Part 1: The System Security Plan
Duration: 1.5 Hours
The System Security Plan (SSP)
The foundational document for securing any complex IT environment.
- An SSP is a living document that describes the system, its operational environment, and the security controls implemented (or planned) to protect it.
- Audience: Auditors, System Owners, and Authorizing Officials.
- Without an SSP, a security audit is impossible, because the auditor has no baseline of what the system *should* look like.
Defining the Boundary
You cannot secure the entire internet. You must draw a line.
- The Authorization Boundary explicitly defines exactly what hardware, software, and data are covered by the SSP, and what is considered an "External System."
- If a web server is inside the boundary, you must patch it. If the payment gateway is outside the boundary (e.g., Stripe), you don't patch it, but you must secure the *connection* to it.
- Poor boundary definition leads to "Scope Creep" and failed audits.
Categorization (FIPS 199)
How do we know how much security to apply?
- Before selecting controls, we must rate the potential impact (Low, Moderate, High) if the system's Confidentiality, Integrity, or Availability is breached.
- High Impact: The loss of CIA would have a *severe or catastrophic* adverse effect on organizational operations, assets, or individuals.
- The highest rating among the three (C, I, A) becomes the overall System Security Category, driving the control baseline.
Introduction to Task 1
Drawing the Authorization Boundary is often a political negotiation. Business owners want a small boundary to reduce audit costs; security wants a large boundary to ensure oversight.
We will define the boundary for a cloud-hosted e-commerce platform.
Task 1: Drafting an SSP Boundary
Timing: 45 minutes
Your company is launching a new "Customer Loyalty Portal." It consists of a Web Frontend hosted on AWS EC2, a Backend Database on AWS RDS, and relies on an external API (Twilio) to send SMS verification codes to users.
- Define the Authorization Boundary. Explicitly list the components that are INSIDE the boundary.
- Is the Twilio SMS service inside or outside the boundary? Explain your reasoning.
- How does the classification of the Twilio service change the way you write the Security Controls regarding "Authentication"?
15 Minute Break
Please return promptly for Part 2.
Part 2: Controls and Remediation
Duration: 1.5 Hours
Security Control Baselines
You don't need to invent security rules from scratch.
- Organizations use standard catalogs (like NIST SP 800-53 or ISO 27002) which contain hundreds of pre-written controls.
- If a system is categorized as "Moderate" impact, the framework provides a "Moderate Baseline"—a recommended starting list of ~150 controls.
- Tailoring: You don't have to use every baseline control. If a control requires biometric scanners, but your system is entirely in the cloud, you tailor the baseline by documenting that the control is "Not Applicable."
The Plan of Action and Milestones (POA&M)
No system is perfectly secure. The POA&M is how you manage the flaws.
- When an audit reveals that a required control (e.g., "All admin access requires MFA") is currently failing, it is added to the POA&M.
- A POA&M entry is a formal contract between Security and IT stating: "We acknowledge this vulnerability. Here is our exact plan, budget, and timeline (milestones) to fix it by December 1st."
- Authorizing Officials will allow a system with known flaws to operate, only if those flaws are actively tracked on a POA&M.
Continuous Monitoring
The SSP is not a "write it once and forget it" document.
- Systems change constantly. New features are added, new threats emerge.
- Continuous Monitoring (ConMon): A strategy to automatically assess a subset of security controls every month, rather than doing a massive manual audit once every three years.
- If a major change occurs (e.g., migrating the database from AWS to Azure), the SSP must be immediately updated and the system re-authorized.
Introduction to Task 2
Managing a POA&M requires balancing security risk against resource availability. You cannot fix everything immediately.
We will prioritize a list of audit findings and construct a remediation plan.
Task 2: Managing a POA&M
Timing: 50 minutes
An audit of your "Moderate" system revealed three failed controls:
- Finding A: The guest Wi-Fi in the lobby uses a weak password. (Cost to fix: £0, Time: 1 hour).
- Finding B: The primary database containing PII is not encrypted at rest. (Cost: £50k, Time: 3 months).
- Finding C: Employees have not completed their annual awareness training. (Cost: £5k, Time: 1 month).
- Prioritize these three findings in order of remediation urgency. Justify your order based on Risk (Impact x Likelihood).
- Draft the POA&M entry for Finding B. Include a clear mitigation strategy, required resources, and three specific milestones.
Summary & Next Steps
- An SSP defines the reality of your security posture. It forces management to formally accept or remediate known risks.
- The POA&M is the engine of continuous improvement. It turns audit failures into actionable project plans.
Next Week: Incident Response & Business Continuity (Disaster Recovery)