Supporting Contractors with NIST SP 800-171 Compliance
•Download as PPTX, PDF•
2 likes•734 views
This document summarizes a webinar presented by SolarWinds on supporting contractors with NIST SP 800-171 compliance. The webinar covered an overview of SolarWinds and its security and compliance products, a review of the NIST SP 800-171 security controls, and demonstrations of the Log & Event Manager and Network Configuration Manager products for compliance.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Supporting Contractors with NIST SP 800-171 Compliance
Similar to Supporting Contractors with NIST SP 800-171 Compliance (20)
More from SolarWinds
More from SolarWinds (20)
Recently uploaded
Recently uploaded (20)
Supporting Contractors with NIST SP 800-171 Compliance
- 1. Supporting Contractors with NIST SP 800-171 Compliance Federal Webinar June 20, 2017
- 2. • Carlos Ortiz, Federal Account Executive carlos.ortiz@solarwinds.com 703.386.2613 (office) • Jamie Hynds, Senior Product Manager jamie.hynds@solarwinds.com 512.498.6272 (office) SolarWinds Introductions © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 3. Agenda • SolarWinds Overview • Compliance and SolarWinds® Solution Overviews • 800-171 Security Controls and Compliance Review • Security and Compliance Product Demonstrations • Questions and Answers © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 4. SolarWinds Overview • Over 250,000 customers in 170 countries; SMB to Fortune 500® • More than 425 of the Fortune 500 are customers • Every branch of DOD and virtually every civilian and intelligence agency • Recognized as the global market share leader in Network Management Software in the IDC Worldwide Semi-Annual Software Tracker 1H 2016 • Headquarters in Austin, TX • Federal Office in Herndon, VA • 2,200+ employees worldwide User Experience © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 5. Market Leader in Network Management Software SolarWinds leads in market share in 1H 2016 IDC Worldwide Semi-Annual Software Tracker © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 6. Our Vision Manage all things in a hybrid world • Regardless of where the applications and underlying infrastructure are deployed • Regardless of where our management products need to be deployed • While continuing to take a user-centric approach – only buy what you need, when you need it Manage All Things IT © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 7. Security Management Log & Event Patch Product Mission: Enable IT & DevOps pros to proactively and reactively monitor, alert, troubleshoot and resolve infrastructure issues What We Offer Today Building towards our future Network Management Performance Configuration IP Address VoIP Systems and App Management Servers & Apps Virtualization Storage Database Management Database Performance Tools Remote Troubleshooting Web Help Desk® Topology Mapping Configuration • MySQL® • Oracle® • SQL Server® • DB2® • SAP® ASE Device Tracking Secure File Transfer Web Performance Product Principles: Fast (accessible immediately), Easy (best in class UX) and Affordable (starting price for agencies of all sizes) © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 8. How We Deliver Our Vision SolarWinds Orion Platform © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 9. SolarWinds Federal Partial Systems Integrator Client List © 2017 SolarWinds Worldwide, LLC. All Rights Reserved. • Accenture Federal Services • AIRINC • AT&T • BAE Systems • Bechtel • Boeing • Booz Allen Hamilton • CACI International • CGI Federal • Computer Science Corporation (CSC) • CSRA • DXC (HPE) • DynCorp International • Engility • General Dynamics • Harris • IBM Federal • Jacobs Federal • L-3 Technologies • Leidos • Lockheed Martin • ManTech International • MITRE • Northrop Grumman • Raytheon • SAIC • Serco • Verizon Federal • World Wide Technology
- 10. Compliance and SolarWinds Solution Overviews © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 11. Compliance Overview © 2017 SolarWinds Worldwide, LLC. All Rights Reserved. • Designed to protect the nation’s critical infrastructure • Standardization for categorizing IT systems by mission impact (FIPS 199) • Security standards for data and IT systems (FIPS 200) • Establishes baseline security controls and provides general guidance (SP 800-53) • Requires protection of sensitive data on contractor information systems (SP 800-171) Federal Information Security Management Act (FISMA) NIST: FISMA Background • Risk Management Framework (RMF) supports the implementation of FISMA, is mandatory for federal agencies, and has been widely adopted by the DOD (SP 800-37) • The Framework for Improving Critical Infrastructure Cybersecurity (aka the Cybersecurity Framework or NIST CSF) was developed, enhanced, and recently mandated for executive departments and agencies by Presidential Executive Orders Risk Management and Cybersecurity Frameworks
- 12. Compliance Overview (cont’d) © 2017 SolarWinds Worldwide, LLC. All Rights Reserved. • Technical guidelines for infrastructure installation and maintenance developed by DISA to reduce vulnerability • Create an inventory of all systems and software to determine which DISA STIGs to apply • Monitor configurations and produce compliance reports • Manage configurations to achieve and maintain compliance Security Technical Implementation Guides (STIGs) • Preparing for an audit requires considerable documentation and reporting • Audits require detailed knowledge of networked hardware and applications (including asset inventories, locations, configurations, access privileges, and vulnerabilities) • Which systems are being attacked, and are any still compromised? • Staff need to respond quickly to auditor inquiries and provide accurate details Compliance Audits
- 13. SolarWinds Security Products overview A SIEM that makes it easy to use logs for security, compliance, and troubleshooting Log & Event Manager Automated patching of Microsoft® servers and third- party applications Patch Manager Eliminate IP conflicts and save time managing DHCP, DNS and IP addresses IP Address Manager Automated device detection, tracking and switch port management User Device Tracker Easy to use and secure file transfer management Serv-U® Secure File Transfer Automated network configuration and change management software Network Configuration Manager © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 14. SolarWinds Compliance Features • Inventory network device configurations, assess configurations for compliance, and automate change and configuration management • Implement configuration of security controls and help assure effectiveness • Produce FISMA and DISA STIGs reports from configuration templates • Produce audit documentation and reports Network Configuration Manager © 2017 SolarWinds Worldwide, LLC. All Rights Reserved. • Configure correlation rules to help assure effectiveness of security controls • Real-time and continuous monitoring of security controls • Produce FISMA and DISA STIGs compliance reports from templates • Supports DISA STIGs requirements for configuration auditing, log analysis, and broader network security • Tracks and report suspicious activities/attacks to provide auditing support Log & Event Manager
- 15. SolarWinds Compliance Features • Trend utilization for capacity planning • Monitor network health and availability • Identify protocol latency delays • Produce audit documentation and reports Network Performance Monitor © 2017 SolarWinds Worldwide, LLC. All Rights Reserved. • Automate patching of Microsoft and third-party applications to help improve compliance • Schedule patches for minimum downtime • Inventory software and physical components per server or workstation Patch Manager
- 16. 800-171 Security Controls and Compliance Review © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 17. • Log & Event Manager (LEM) can help audit and monitor for potential changes—for example: • 3.1.5: LEM can assist with auditing deviations from least privilege (real-time or via reports) and by monitoring Active Directory® for unexpected privileges being assigned to a user • 3.1.6: LEM monitors and audits privileged account usage for non-security functions • 3.1.7: LEM audits the use of privileged functions in real-time or via reports • 3.1.7: Network Configuration Manager (NCM) change approval features help ensure that non-privileged users cannot use NCM to execute privileged functions without approval • 3.1.8: LEM reports on unsuccessful logon attempts, as well as automatically locking user accounts via the Active Response feature • 3.1.12: LEM monitors and reports on remote logons; correlation rules can be configured to alert and respond to unexpected remote access (e.g., after hours); NCM audits how remote access is configured on your network devices, identifying configuration violations, and remediating them • 3.1.21: LEM can audit and restrict usage of portable storage devices with USB Defender® Supporting 800-171 Security Compliance © 2017 SolarWinds Worldwide, LLC. All Rights Reserved. Access Controls (3.1)
- 18. • LEM can help satisfy some controls directly—for example: • 3.3.3: LEM helps with the review of audited events • 3.3.4: LEM can generate alerts when agents go offline, the log storage database is low on space, or when audit logs are cleared • 3.3.5: LEM’s correlation engine and reporting assist with audit log reviews and help ensure that administrators are alerted to indications of inappropriate, suspicious, or unusual activity • 3.3.6: LEM analyzes event logs and generates scheduled or on-demand analysis reports • 3.3.7: LEM helps synchronize system clocks through NTP server synchronization • 3.3.8: LEM protects audit information and audit tools from unauthorized access and modification • 3.3.9: LEM provides role-based access control, which limits access and functionality to a subset of privileged users Supporting 800-171 Security Compliance (cont’d) © 2017 SolarWinds Worldwide, LLC. All Rights Reserved. Audit and Accountability (3.3)
- 19. • Configuration Management (3.4) • 3.4.3: NCM’s real-time change detection, change approval management and tracking reports can be used to detect, validate, and document changes to network devices; LEM can monitor and audit changes to information systems • 3.4.8: LEM can monitor for the use of unauthorized software, and can be configured to automatically kill programs and services • 3.4.9: LEM can audit and alert on software installations; Patch Manager (Patch) can inventory machines and report on the software and patches installed • Incident Response (3.6) • LEM can help when it comes to incident generation, investigation, response, and reporting • Maintenance (3.7) • 3.7.6: LEM can report and audit the activities performed by maintenance personnel • When it comes to network devices, NCM helps with controlling and managing configuration approvals, and keeps a history of past configurations, noting when the change occurred Supporting 800-171 Security Compliance (cont’d) © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 20. • Media Protection (3.8) • 3.8.7: LEM's USB Defender feature can help with automated controls of removable devices • Personnel Security (3.9) • 3.9.2: LEM can audit usage of credentials of terminated personnel, validate that accounts are disabled in a timely manner, and validate group/permission changes after a transfer • Risk Assessment (3.11) • 3.11.2: Patch can identify missing application patches on your Windows® machines; NCM identifies risks to network security based on device configuration and leverages NIST NVD to identify emerging threats in Cisco® ASA and IOS® devices • 3.11.3: Patch can remediate software vulnerabilities on Windows machines via Microsoft and third-party updates Supporting 800-171 Security Compliance (cont’d) © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 21. • Security Assessment (3.12) • 3.12.3: LEM can monitor event logs relating to information system security and perform correlation, alerting, reporting, and more • SolarWinds also has several other modules that support monitoring the health and performance of your information systems and networks • System and Communication Protection (3.13) • 3.13.6: LEM can validate that traffic is being appropriated denied/permitted; NPM and NTA can also be used to monitor traffic NCM can provide reports to help with compliance and helps configure devices to policy • 3.13.14: NPM, NTA and SolarWinds VoIP & Network Quality Manager can be used to monitor VoIP traffic and ports • System and Information Integrity (3.14) • 3.14.4: Patch provides the ability to patch and update your systems • 3.14.6: LEM can monitor inbound/outbound traffic, although NPM/NTA could be used to detect unusual traffic patterns Supporting 800-171 Security Compliance (cont’d) © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 22. • DISA STIGs and NIST FISMA reports ship with NCM to help IT pros improve compliance • LEM has a range of features to support DISA STIGs compliance • Supports DISA STIGs compliance via our real-time monitoring of related events across systems, network devices, applications, and security tools • Supports configuration auditing, including logs of relevant STIGs best practices, configuration changes, installation of unapproved software, and more • Many of LEM’s out-of-the-box rules can be used to address STIGSs • LEM also includes DISA STIGs and FISMA compliance reports DISA STIGs Compliance and Where We Can Help © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 23. Security and Compliance Product Demonstrations © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 24. • Review a blog on how SolarWinds software can help with NIST 800-171 compliance: https://thwack.solarwinds.com/community/solarwinds-community/product- blog/blog/2017/06/07/nist-sp-800-171-compliance-with-solarwinds-products • Review a blog on how SolarWinds software can help with NIST FISMA/RMF compliance: https://thwack.solarwinds.com/community/solarwinds-community/product- blog/blog/2015/08/01/fisma-nist-800-53-compliance-with-solarwinds-products • Review a blog on how SolarWinds software can help with DISA STIGS compliance: https://thwack.solarwinds.com/community/solarwinds-community/product- blog/blog/2011/09/07/disa-stig-compliance-with-log-event-manager • Watch a federal security compliance video: http://www.solarwinds.com/resources/videos/solarwinds-federal-security-compliance.html • Download a SIEM white paper: http://www.solarwinds.com/resources/whitepaper/siem-speeds-time-to-resolution.html • Download a continuous monitoring white paper: http://go.solarwinds.com/fedcyberWP?=70150000000Plgf Compliance Resources © 2017 SolarWinds Worldwide, LLC. All Rights Reserved.
- 25. Thank You Questions? © 2017 SolarWinds Worldwide, LLC. All Rights Reserved. Contact Us: SolarWinds Federal Call– 877.946.3751 Email– federalsales@solarwinds.com
- 26. • Watch short demo videos: http://demo.solarwinds.com/sedemo/ • Download a free trial: http://www.solarwinds.com/downloads/ • Visit our Federal website: http://www.solarwinds.com/federal • Call the SolarWinds Federal sales team: 877.946.3751 • Email federal sales: federalsales@solarwinds.com • Visit our Success Center: https://support.solarwinds.com/Success_Center • Visit our THWACK® government group: http://thwack.com/federal-and-government • Follow us on LinkedIn®: https://www.linkedin.com/company/solarwinds-government Additional Resources Let us know how we can help you © 2017 SolarWinds Worldwide, LLC. All rights reserved. 26
- 27. The SolarWinds, SolarWinds & Design, Orion, and THWACK trademarks are the exclusive property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be common law marks or are registered or pending registration. All other trademarks mentioned herein are used for identification purposes only and are trademarks of (and may be registered trademarks) of their respective companies. Trademark Notice
Editor's Notes
- MacDill
- Introduction (10) Slides (20) Demo (20) Wrap-up and Q&A (10)
- When presenting Database pillar, please refer back to “vision” slide and discuss deployment options- We monitor and optimize these databases on physical servers, on VMware® virtual servers, and in the Cloud, including Amazon AWS® EC2®, RDS, and Azure™.
- (optional) primarily for new channel partners
- 800-171 is based on FIPS 200 and 800-53, with narrowed scope and derived details Note from lisa- We just need to be sure in the voice over here we factor in that the audience is integrators – they signed up to hear about 800-171, but it’s good for them to know about all else that we do as they support government customers
- 3.1.5 – Employ the principle of least privilege, including for specific security functions and privileged accounts. SolarWinds Log & Event Manger (LEM) can audit deviations from least privilege—e.g., unauthorized file access and unexpected system access. Auditing can be done in real-time or via reports. LEM can also monitor Microsoft® Active Directory® (AD) for unexpected escalated privileges being assigned to a user. 3.1.6 – Use of non-privileged accounts when accessing non-security functions. SolarWinds LEM can monitor privileged account usage and audit the use of privileged accounts for non-security functions. 3.1.7 – Prevent non-privileged users from executing privileged functions and audit the execution of such functions. Execution of privileged functions such as creating and modifying registry keys and editing system files can be audited in real-time or via reports in LEM. On the network device side, SolarWinds Network Configuration Manager (NCM) includes a change approval system which helps ensure that non-privileged users cannot execute privileged functions without approval from a privileged user. 3.1.8 – Limit unsuccessful logon attempts. The number of logon attempts before lockout are generally set at the domain/system policy level, but LEM can confirm if the lockout policy is being enforced via reports/nDepth. LEM can also be used to report on unsuccessful logon attempts, as well as automatically lock a user account via the Active Response feature. 3.1.12 – Monitor and control remote access sessions. LEM can monitor and report on remote logons. Correlation rules can be configured to alert and respond to unexpected remote access (e.g., access outside normal business hours). SolarWinds NCM can audit how remote access is configured on your network device, identify any configuration violations, and remediate accordingly. 3.1.21 – Limit use of organizational portable storage devices on external information systems. LEM can audit and restrict usage of portable storage devices with its USB Defender feature.
- 3.3.3 – Review and update audited events. LEM helps with the review of audited events, provided the appropriate logs are sent to LEM. 3.3.4 – Alert in the event of an audit process failure. LEM can generate alerts when agents go offline or the log storage database is running low on space. LEM can also alert on behalf of systems when audit logs are cleared—e.g., if a user clears the Windows® event log. 3.3.5 – Correlate audit review, analysis and reporting processes for investigation and response to indications of inappropriate, suspicious, or unusual activity. LEM’s correlation engine and reporting can assist with audit log reviews and help ensure that administrators are alerted to indications of inappropriate, suspicious, or unusual activity. 3.3.6 – Provide audit reduction and report generation to support on-demand analysis and reporting. Audit logs can generate a huge amount of information. LEM can analyze event logs and generate scheduled or on-demand reports to assist with analysis. However, you will need to ensure that your audit policies and logging levels are appropriately configured. 3.3.7 – Provide an information system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. LEM satisfies this requirement through Network Time Protocol server synchronization. LEM also includes a predefined correlation rule that monitors for time synchronization failures. 3.3.8 – Protect audit information and audit tools from unauthorized access, modification, and deletion. LEM helps satisfy this requirement through the various mechanisms outlined in this post: Log & Event Manager Appliance Security and Data Protection. 3.3.9 – Limit management of audit functionality to a subset of privileged users. As per the response to 3.3.8, LEM provides role-based access control, which limits access and functionality to a subset of privileged users.
- 3.4.3 – Track, review, approve/disapprove, and audit changes to information systems. NCM’s real-time change detection, change approval management and tracking reports can be used to detect, validate, and document changes to network devices. LEM can monitor and audit changes to information systems, provided the appropriate logs are sent to LEM. 3.4.8 – Apply deny-by-exception (blacklist) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. LEM can monitor for the use of unauthorized software. Thanks to Active Response, you can configure LEM to automatically kill nonessential programs and services. 3.4.9 – Control and monitor user-installed software. LEM can audit software installations and alert accordingly. Patch Manager can inventory machines on your network and report on the software and patches installed. 3.6.3 – Test the organizational incident response capability. LEM can play a role in the incident generation and the subsequent investigation. LEM can generate an incident based on a defined correlation trigger and respond to an incident via the Active Responses. Reports can be produced based on detected incidents. 3.7.6 – LEM can assist with the 3.7.6 requirement that states “Supervise the maintenance activities of maintenance personnel without required access authorization.” Provided the appropriate logs are being generated and sent to LEM, reports can be used to audit the activity performed by maintenance personnel. NCM also comes into play, allowing you to compare configurations before and after maintenance windows.
- 3.8.7 – Control the use of removable media on information system components. LEM’s USB Defender feature can monitor for usage of USB removable media and can automatically detach USB devices when unauthorized usage is detected. 3.9.2 – Ensure that CUI and information systems containing CUI are protected during and after personnel actions such as terminations and transfers LEM can assist with 3.9.2 by auditing usage of credentials of terminated personnel, validating that accounts are disabled in a timely manner, and validating group/permission changes after a personnel transfer. 3.11.2 – Scan for vulnerabilities in the information system and applications periodically and when new vulnerabilities affecting the system are identified. Patch Manager cannot perform vulnerability scans, but it can be used to identify missing application patches on your Windows machines. NCM identifies risks to network security based on device configuration. NCM also accesses the NIST National Vulnerability Database to get updates on potential emerging vulnerabilities in Cisco® ASA and IOS® based devices. 3.11.3 – Remediate vulnerabilities in accordance with assessments of risk. Patch Manager can remediate software vulnerabilities on your Windows machines via Microsoft® and third-party updates. Patch Manager can be used to install updates on a scheduled basis or on demand. On the network device side, NCM performs Cisco IOS® firmware upgrades to potentially mitigate identified vulnerabilities.
- https://support.solarwinds.com/Success_Center