NIST 800-171 Compliance - Audit and Accountability

Audit and Accountability

Threat vectors will always innovate new ideas to circumvent security measures in an organization. This indicates that audit of security measure is needed in an institution to test their effectiveness. Auditing ensures that both users and administrators are in compliance with security policies. Auditing builds accountability and prevents concerned security incidents.

NIST 800-171

A guideline from NIST provides following security requirements for awareness and training (including basic and derived requirements) for protecting the confidentiality of CUI (Controlled Unclassified Information) in nonfederal information systems and organizations. The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53.

Basic Security Requirements:

3.3.1 Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity.

3.3.2 Ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.

Derived Security Requirements:

3.3.3 Review and update audited events.

3.3.4 Alert in the event of an audit process failure.

3.3.5 Correlate audit review, analysis, and reporting processes for investigation and response to indications of inappropriate, suspicious, or unusual activity.

3.3.6 Provide audit reduction and report generation to support on-demand analysis and reporting.

3.3.7 Provide an information system capability that compares and synchronizes internal system clocks

with an authoritative source to generate time stamps for audit records.

3.3.8 Protect audit information and audit tools from unauthorized access, modification, and deletion.

3.3.9 Limit management of audit functionality to a subset of privileged users.

SIEM and Compliance

Keeping up with compliance and reporting is a daunting tasks. SIEM solutions can help us here by providing holistic visibility into the network and improving detection and response capabilities. However, not everything mentioned by NIST is realizable through SIEM. Here's what you can implement with your SIEM to create a compliance reporting.

Basic Security Requirements:

3.3.1 Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity.

• Summary of what types of audit records are being analyzed, where it is stored, earliest event timestamp, latest event timestamp, size of storage, retention policy etc.

3.3.2 Ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions. (Audit users action)

• Top Users making any changes
• Top actions by users
• Summary of the change

Derived Security Requirements:

3.3.4 Alert in the event of an audit process failure.

• Any audit failure events (like Missing data streams, truncated datas, missing timestamp, data received with future timestamp etc.)

3.3.5 Correlate audit review, analysis, and reporting processes for investigation and response to indications of inappropriate, suspicious, or unusual activity.

• Define and track anomalous behavior
• user logging from multiple sources
• multiple users logging from same source
• access attempt to blocked ports/services
• IDS/IPS detected sources and destinations
• Antivirus signature update fail or same host affected with more than 20 known malwares

3.3.7 Provide an information system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

• check if system time is changed
• time synchronization failure

Log Source Requirements for SIEM

• Host logs (Windows, Unix etc)
• IDS/IPS logs
• Firewall logs

NIST 800-171 Compliance - Awareness and Training

One of the greatest threats to information security comes from within an organization. Insider threats have been noted as one of the most dangerous since these people are already quite familiar with the infrastructure. It not always concerns disgruntled employees and corporate spies who are a threat but often, the non-malicious, uninformed employee.

Uninformed users can do harm to a network by visiting websites infected with malware, responding to phishing e-mails, storing their login information in an unsecured location, or even giving out sensitive information over the phone when exposed to social engineering.

Thus, one of the best ways to make sure employees will not make costly errors in regard to information security is to institute company-wide security-awareness training initiatives that include, but are not limited to classroom style training sessions, security awareness website(s), helpful hints via e-mail, or even posters. These methods can help ensure employees have a solid understanding of company security policy, procedure and best practices.

NIST 800-171

A guideline from NIST provides following security requirements for awareness and training (including basic and derived requirements) for protecting the confidentiality of CUI (Controlled Unclassified Information) in nonfederal information systems and organizations. The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53.

Basic Security Requirements:

3.2.1 Ensure that managers, systems administrators, and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of organizational information systems.

3.2.2 Ensure that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

Derived Security Requirements:

3.2.3 Provide security awareness training on recognizing and reporting potential indicators of insider threat.

NIST 800-171 Compliance - Access Control

"Almost all physical and logical entry points to the organization and its information system need some type of access control"

Access Controls specifies following four:

• which users can access a system or facility
• what resources those users can access
• what operations those users can perform
• Enforce accountability for those users' actions

Access control is the process of allowing only authorized users, programs, or other computer systems (i.e. networks) to observe, modify, or otherwise take possession of the resources of a computer system. It is also a mechanism for limiting the use of some resources to authorized users.

In short, access controls are the collection of mechanisms, processes, or techniques that work together to protect the assets of an organization. They help protect against threats and mitigate vulnerabilities by reducing exposure to unauthorized activities and providing access to information and systems to only authorized people, processes, or systems.

Access controls incorporates all operational levels of an organizations:

• Facilities: Protects entry to, and movement around, organization's physical location. This protects personnel, equipment, information and other assets inside that facility.
• Support Systems: Systems like power, heating, ventilation, AC, fire suppression controls must be carefully controlled.
• Information Systems: Multilayer of access controls needs to be applied in information systems and networks. This protect those systems from harm or misuse.
• Personnel: Ensure right people have access right access and they do not interfere with people with whom they do not have any legitimate business.

NIST 800-171

A guideline from NIST provides following security requirements for access control (including basic and derived requirements) for protecting the confidentiality of CUI (Controlled Unclassified Information) in nonfederal information systems and organizations. The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53.

Basic Security Requirements:

• 3.1.1  Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
• 3.1.2  Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Derived Security Requirements:

• 3.1.3  Control the flow of CUI in accordance with approved authorizations.
• 3.1.4  Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
• 3.1.5  Employ the principle of least privilege, including for specific security functions and privileged accounts.
• 3.1.6  Use non-privileged accounts or roles when accessing nonsecurity functions.
• 3.1.7  Prevent non-privileged users from executing privileged functions and audit the execution of such functions.
• 3.1.8  Limit unsuccessful logon attempts.
• 3.1.9  Provide privacy and security notices consistent with applicable CUI rules.
• 3.1.10  Use session lock with pattern-hiding displays to prevent access/viewing of data after period of inactivity.
• 3.1.11  Terminate (automatically) a user session after a defined condition.
• 3.1.12  Monitor and control remote access sessions.
• 3.1.13  Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
• 3.1.14  Route remote access via managed access control points.
• 3.1.15  Authorize remote execution of privileged commands and remote access to security-relevant information.
• 3.1.16  Authorize wireless access prior to allowing such connections.
• 3.1.17  Protect wireless access using authentication and encryption.
• 3.1.18  Control connection of mobile devices.
• 3.1.19  Encrypt CUI on mobile devices.
• 3.1.20  Verify and control/limit connections to and use of external information systems.
• 3.1.21  Limit use of organizational portable storage devices on external information systems.
• 3.1.22  Control information posted or processed on publicly accessible information systems.

SIEM and Compliance

Keeping up with compliance and reporting is a daunting tasks. SIEM solutions can help us here by providing holistic visibility into the network and improving detection and response capabilities. However, not everything mentioned by NIST is realizable through SIEM. Here's what you can implement with your SIEM to create a compliance reporting.

Basic Security Requirements:

3.1.1  Limit information system access to authorized users and process.

• Check user authentication and their actions. Source and destination of authentication

Derived Security Requirements:

3.1.5  Principle of least privilege

• Track activities by privileged accounts

3.1.6  Use non-privileged accounts or roles

• Privilege authentication by user, source, destination, application etc.

3.1.7  Prevent non-privileged users from executing privileged functions and audit the execution of such functions.

• Check for privilege escalation and associated events

3.1.8  Limit unsuccessful logon attempts.

• Account lockout, failed logins, failed privileged logins, 3+ failed login within 1 minute, failed login from multiple location etc.

3.1.12  Monitor remote access sessions.

• Remote login, vpn sessions by users. Summary and Time-trend analysis

3.1.18  Control connection of mobile devices.

• track mobile device usage and users

Log Source Requirements

• Hosts Logs (Windows, Unix etc.)