Trustworthy Smart Cities through Risk Management - Revision history

Pinfold at 18:39, March 14, 2022

2022-03-14T18:39:07Z

← Older revision		Revision as of 18:39, March 14, 2022
Line 1:		Line 1:
	{{Chapter		{{Chapter
			\| image = risk-management.jpg
	\| blueprint = Cybersecurity and Privacy		\| blueprint = Cybersecurity and Privacy
	\| sectors = Cybersecurity and Privacy		\| sectors = Cybersecurity and Privacy
Line 7:		Line 8:
	\| document = 2019_GCTC-SC3_Cybersecurity_and_Privacy_Advisory_Committee_Guidebook_July_2019.pdf		\| document = 2019_GCTC-SC3_Cybersecurity_and_Privacy_Advisory_Committee_Guidebook_July_2019.pdf
	\| chapter = 2002		\| chapter = 2002
			\| summary = Organizations participating in the Smart City environment – whether as municipalities, critical infrastructure operators, product or service providers, or citizens – already consider at least some aspects of risk (e.g., business risk, reputational risk) in the development and deployment of Smart City capabilities and solutions. And one growing area of risk is cybersecurity and privacy risk.
	}}		}}
	~~__TOC__~~
	Organizations participating in the Smart City environment – whether as municipalities, critical infrastructure operators, product or service providers, or citizens – already consider at least some aspects of risk (e.g., business risk, reputational risk) in the development and deployment of Smart City capabilities and solutions. And one growing area of risk is cybersecurity and privacy risk.

	Many of the cybersecurity- and privacy-related vulnerabilities and threats that could affect Smart City environments are similar to those commonly found in the traditional enterprise IT environment. The cyber-physical aspects of Smart Cities as well as the interconnections and interdependencies that are characteristic of Smart City solutions could potentially result in more complex and catastrophic consequences (e.g., disruption of government services to citizens; terrorist event; danger to public health or safety). The recognition of these vulnerabilities, threats, and consequences necessitates the consideration and adoption of risk management processes and practices that can help Smart City organizations make risk-based business decisions, such as identifying what levels of risk are acceptable and where investments need to be made to mitigate risk.		Many of the cybersecurity- and privacy-related vulnerabilities and threats that could affect Smart City environments are similar to those commonly found in the traditional enterprise IT environment. The cyber-physical aspects of Smart Cities as well as the interconnections and interdependencies that are characteristic of Smart City solutions could potentially result in more complex and catastrophic consequences (e.g., disruption of government services to citizens; terrorist event; danger to public health or safety). The recognition of these vulnerabilities, threats, and consequences necessitates the consideration and adoption of risk management processes and practices that can help Smart City organizations make risk-based business decisions, such as identifying what levels of risk are acceptable and where investments need to be made to mitigate risk.

Pinfold at 03:19, January 11, 2022

2022-01-11T03:19:15Z

← Older revision		Revision as of 03:19, January 11, 2022
Line 2:		Line 2:
	\| blueprint = Cybersecurity and Privacy		\| blueprint = Cybersecurity and Privacy
	\| sectors = Cybersecurity and Privacy		\| sectors = Cybersecurity and Privacy
	\| authors = Lan Jenson, David Balenson, Adnan Baykal, Gary Dennis, Wayne Dennis~~, Alex Huppenthal~~, Damon Kachur, Benny Lee, Carmen Marsh, Aleta Nye, Carmen Parada, Renil Paramel, Bill Pugh, Maryam Rahmani, Carter Schoenberg, Sushmita Senmajumdar, Deborah Shands, Dean Skidmore, Scott Tousley, Ed Walker, Ruwan Welaratna, Paul Wertz, Peter Wong		\| authors = Lan Jenson, David Balenson, Adnan Baykal, Gary Dennis, Wayne Dennis, Damon Kachur, Benny Lee, Carmen Marsh, Aleta Nye, Carmen Parada, Renil Paramel, Bill Pugh, Maryam Rahmani, Carter Schoenberg, Sushmita Senmajumdar, Deborah Shands, Dean Skidmore, Scott Tousley, Edward Walker, Ruwan Welaratna, Paul Wertz, Peter Wong
	\| poc = Lan Jenson		\| poc = Lan Jenson
	\| email = lan@cybertrustamerica.org		\| email = lan@cybertrustamerica.org

Pinfold at 21:03, December 19, 2021

2021-12-19T21:03:50Z

← Older revision		Revision as of 21:03, December 19, 2021
Line 203:		Line 203:
	Preparation is also necessary at the lower, tactical levels – i.e., system level. These activities are similar in nature and scope to the organizational preparation tasks. This includes identifying key system stakeholders, identifying and prioritizing assets and information types, and in general, determining the risk management status quo (i.e., the current state of risk management practices and posture) and intended risk objectives for the system of interest.		Preparation is also necessary at the lower, tactical levels – i.e., system level. These activities are similar in nature and scope to the organizational preparation tasks. This includes identifying key system stakeholders, identifying and prioritizing assets and information types, and in general, determining the risk management status quo (i.e., the current state of risk management practices and posture) and intended risk objectives for the system of interest.

	==Key Organizational/Strategic “Prepare” Tasks and Steps==		<u>Key Organizational/Strategic “Prepare” Tasks and Steps</u>
	*Identify and assign key risk management roles and responsibilities' See NIST Special Publication 800-37 Rev. 2, “Risk Management Framework for Information Systems and Organizations: Appendix D” for descriptions of example roles and responsibilities that may be important for a risk management process.		*Identify and assign key risk management roles and responsibilities' See NIST Special Publication 800-37 Rev. 2, “Risk Management Framework for Information Systems and Organizations: Appendix D” for descriptions of example roles and responsibilities that may be important for a risk management process.
	*Establish and communicate organization risk management strategy		*Establish and communicate organization risk management strategy

Pinfold at 21:03, December 19, 2021

2021-12-19T21:03:01Z

← Older revision		Revision as of 21:03, December 19, 2021
Line 8:		Line 8:
	\| chapter = 2002		\| chapter = 2002
	}}		}}
	~~__NOTOC__~~		__TOC__
	Organizations participating in the Smart City environment – whether as municipalities, critical infrastructure operators, product or service providers, or citizens – already consider at least some aspects of risk (e.g., business risk, reputational risk) in the development and deployment of Smart City capabilities and solutions. And one growing area of risk is cybersecurity and privacy risk.		Organizations participating in the Smart City environment – whether as municipalities, critical infrastructure operators, product or service providers, or citizens – already consider at least some aspects of risk (e.g., business risk, reputational risk) in the development and deployment of Smart City capabilities and solutions. And one growing area of risk is cybersecurity and privacy risk.

Pinfold at 21:02, December 19, 2021

2021-12-19T21:02:43Z

← Older revision		Revision as of 21:02, December 19, 2021
Line 319:		Line 319:
	*Implement initial remediation actions, reassess remediated controls, and update system security and privacy plans		*Implement initial remediation actions, reassess remediated controls, and update system security and privacy plans
	*Develop a plan of action and milestones (POA&M) for remediation of remaining deficiencies		*Develop a plan of action and milestones (POA&M) for remediation of remaining deficiencies

			=Step 5: Authorize =
			The authorize step of the RMF evaluates whether the level of cybersecurity and privacy risk of operating an information system is acceptable to the organization and the mission. This determination takes into account the outputs from the previous steps of the RMF process, including system security and privacy plans; the system-specific, common, and hybrid controls specified therein; and the findings from the assessment step (i.e., step 4). The authorization decision is typically made by a senior management official internal to the organization. This authorizing official, in collaboration with other security, privacy, and risk personnel, takes the available information (e.g., system security and privacy plans, assessment reports, organizational risk management strategy) to analyze and determine the amount of risk associated with operating a given system. This step ultimately determines whether systems are authorized to operate or not authorized to operate, along with the associated terms and conditions (e.g., authorization duration).

			<u>Key “Authorize” Tasks and Steps </u>
			*Generate authorization package, including outputs from previous steps such as system security and privacy plans, supply chain risk management plans, security and privacy assessment reports, and POA&Ms
			*Conduct risk analysis and risk determination (by authorizing official)
			*Provide risk response (e.g., risk acceptance, risk mitigation)
			*Approve or deny system authorization
			*Report authorization to the organization for purposes of aggregated organization-wide security and privacy risk awareness


			=Step 6: Monitor =
			Continuous monitoring enables organizations to conduct the risk management process in a continuous, near real-time manner rather than as a rigid process with a pre-determined schedule. Changes in system configurations, hardware, software, interdependent systems and connections, threat environment, etc. are inevitable over the life of the system. As such changes occur, organizations need to be able to continuously evaluate system-specific and organizational risk posture and to adjust accordingly (e.g., re-categorize systems, select and implement additional controls, remove obsolete controls). While system owners may initially need to designate a frequency at which these monitoring tasks are performed, the objective is to continually mature to a more frequent, more continuous risk management process, especially for prioritized and high-impact systems and controls. For example, common controls may be of higher priority to be continuously monitored due to their broad application across enterprise information systems. The transition from periodic monitoring to more continuous monitoring can also be facilitated through the use of automated tools.

			<u>Key Organizational/Strategic “Monitor” Tasks and Steps </u>
			*Monitor system and environment changes
			*Conduct ongoing assessment of security and privacy control effectiveness and ongoing risk analysis and response
			*Update authorization status and related documents
			*Report security and privacy posture
			*Conduct ongoing system authorizations
			*Dispose of systems, as necessary (i.e., when systems are removed from operation)

			<u>Key System-/Tactical-Level “Monitor” Tasks and Steps </u>
			*Prepare and develop a continuous monitoring plan
			*Document changes to system or environment and determine potential impact
			*Assess a subset of security and privacy controls
			*Conduct remediation activities
			*Update selected security and privacy controls and related documentation
			*Report security status to organization
			*Conduct risk analysis and determination
			*Implement decommissioning plan, as necessary

			A more detailed and succinct description and resource for this step of the RMF is available in the form of a [https://csrc.nist.gov/projects/risk-management/about-rmf/monitor-step Quick Start Guide on the NIST website].

Pinfold at 20:56, December 19, 2021

2021-12-19T20:56:55Z

← Older revision		Revision as of 20:56, December 19, 2021
Line 258:		Line 258:
	\|The disruption of access to or use of information or an information system could be expected to have a '''severe or catastrophic''' adverse effect on organizational operations, organizational assets, or individuals.		\|The disruption of access to or use of information or an information system could be expected to have a '''severe or catastrophic''' adverse effect on organizational operations, organizational assets, or individuals.
	\|}		\|}

			[[File:nist.fips.199.pdf\|300px\|FIPS PUB 199, FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATION Standards for Security Categorization of Federal Information and Information Systems]]

			The highest potential impact identified for a given system can then be used to determine the security impact level of the information system as a whole (e.g., a system that processes a high-impact information type should be categorized as a high-impact information system). The system security category can prescribe, at a minimum, a predetermined security control baseline (e.g., baseline for high-impact information systems). Adjustments to information type impact values and system security categories may be necessary to account for specific risk considerations that are not evident in standard organizational guidance and security control baselines.

			<u>Key “Categorize” Tasks and Steps</u>
			*Prepare for system categorization, Note that there is some overlap between these “Categorize” steps and the system-level steps delineated in the “Prepare” phase.
			*Identify information types
			*Select the provisional impact values for each type of information
			*Adjust the information type’s provisional impact values and system security category based on organization risk management strategy and guidance
			*Determine, approve, and maintain the system security impact level (e.g., low/moderate/high)

			A more detailed and succinct description and resource for this step of the RMF is available in the form of a [https://csrc.nist.gov/projects/risk-management/about-rmf/categorize-step Quick Start Guide on the NIST website].

			Step 2: Select
			The selection of security controls – including, but not limited to, management, (Refer to Appendix A. Smart Cities Use Cases for more detailed examples of selection and implementation of specific security and privacy controls.) operational, and technical risk mitigations – is essential for protecting an organization’s systems and information and enables the execution of the organizational mission. Selection of security controls involves identifying the set of controls that can appropriately and adequately mitigate risk in a cost effective manner while also maintaining compliance with any applicable policies, standards, laws, or regulations. The security categorization process determines the set of baseline security controls from which the selection process begins (e.g., high-impact systems start with the high-impact baseline). The standardization of sets of baseline security controls can also enable organizations to convey security requirements to external vendors and service providers. Organizations and information system owners will need to make adjustments to the security controls to account for considerations such as organization-specific requirements; operating environment needs; targeted threats; and legal and regulatory compliance standards.

			It is also important to note that there are three types of security controls that differ based on their scope and applicability: system-specific; common; and hybrid.
			#System-specific: security capability for a specific information system
			#Common: security capabilities for multiple information systems (or organization-wide)
			#Hybrid: security capabilities that have both system-specific and common attributes
			Taking a holistic view of an organization’s information systems, their security categories, and the organization’s risk profile can enable organizations to select a set of common controls to protect multiple information systems. This practice can prove to be more cost effective and can result in more consistency in technology, architecture, and process across the organization.

			<u>Key “Select” Tasks and Steps </u>
			*Choose a set of baseline security controls
			*Tailor and supplement the baseline security controls to meet organization-, environment-, and system-specific needs
			*Specify minimum assurance requirements, as necessary, to determine proper implementation and efficacy of security and privacy controls
			*Complete system security and privacy plans
			*Develop continuous monitoring strategy
			*Review and approve system security and privacy plans

			There is a multitude of existing reference material for selecting security and privacy controls and for establishing baseline sets of controls. The following are examples of existing resources:
			*NIST SP 800-53 Rev. 5 – Security and Privacy Controls for Information Systems and Organizations
			*Center for Internet Security (CIS) [“Top 20”] Controls V7.1 and the CIS Controls Internet of Things Companion Guide
			*NIST SP 800-66 Rev. 1 – An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule (This guidance can help organizations subject to HIPAA map NIST SP 800-53 security controls to HIPAA rule requirements.)
			*NIST Cybersecurity Framework v1.1 - Framework for Improving Critical Infrastructure Cybersecurity
			*NISTIR 8170 – The Cybersecurity Framework: Implementation Guidance for Federal Agencies and supplemental materials
			*ISO/IEC 27002:2013 – Code of Practice for Information Security Controls
			*CTIA Cybersecurity Certification Test Plan for IoT Devices, August 2018 Establishing and communicating the security and privacy control baselines is an important task in the “Prepare” phase of the RMF, and these baselines will need to be updated and re-disseminated to reflect changes in the risk and technology environment.

			A more detailed and succinct description and resource for this step of the RMF is available in the form of a [https://csrc.nist.gov/projects/risk-management/about-rmf/select-step Quick Start Guide on the NIST website].

			=Step 3: Implement =
			Conceptually, the implement step of the RMF may be the most straightforward. The focus of this step is to implement the controls specified in the select step and to document the baseline configurations of these security controls. In circumstances where organizations or system owners may not be able to directly affect the implementation of a control – for example, in an external system or a specific COTS component – it may be necessary to test, evaluate, and validate prior to implementation to ascertain the presence and efficacy of an embedded security control.

			<u>Key “Implement” Tasks and Steps </u>
			*Implement controls specified in approved system security and privacy plans
			*Establish baseline configurations for security and privacy controls
			*Update system security and privacy plans to reflect control implementation outcomes


			=Step 4: Assess =
			The assessment step of the RMF focuses on assuring that implemented security controls – including system-specific, common, and hybrid – are implemented in a correct manner; operating as intended; and producing the intended security, privacy, or risk mitigation outcome. This generally requires identifying an experienced assessor or assessor team with the appropriate levels of technical and policy expertise as well as independence from the organization and system owners. This step – similar to the other steps and the entire RMF process – must be iterated as systems mature and as the organization’s risk posture evolves.

			<u>Key “Assess” Tasks and Steps </u>
			*Select independent assessor or assessor team
			*Develop assessment plan
			*Conduct security and privacy control assessment
			*Report findings and recommendations
			*Implement initial remediation actions, reassess remediated controls, and update system security and privacy plans
			*Develop a plan of action and milestones (POA&M) for remediation of remaining deficiencies

Pinfold at 20:41, December 19, 2021

2021-12-19T20:41:41Z

← Older revision		Revision as of 20:41, December 19, 2021
Line 233:		Line 233:
	\|'''''Confidentiality'''''		\|'''''Confidentiality'''''

	Preserving authorized		Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
	restrictions on information
	access and disclosure,
	including means for
	protecting personal
	privacy and proprietary
	information.

	[44 U.S.C., SEC. 3542]		[44 U.S.C., SEC. 3542]
	\|The unauthorized		\|The unauthorized disclosure of information could be expected to have a '''limited''' adverse effect on organizational operations, organizational assets, or individuals.
	disclosure of information		\|The unauthorized disclosure of information could be expected to have a '''serious''' adverse effect on organizational operations, organizational assets, or individuals.
	could be expected to have		\|The unauthorized disclosure of information could be expected to have a '''severe or catastrophic''' adverse effect on organizational operations, organizational assets, or individuals.
	a '''limited''' adverse effect on
	organizational operations,
	organizational assets, or
	individuals.
	\|The unauthorized
	disclosure of information
	could be expected to have
	a '''serious''' adverse effect on
	organizational operations,
	organizational assets, or
	individuals.
	\|The unauthorized
	disclosure of information
	could be expected to have
	a '''severe or catastrophic'''
	adverse effect on
	organizational operations,
	organizational assets, or
	individuals.
	\|-		\|-
	\|Integrity		\|'''''Integrity'''''
	\|
	\|		Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.
	\|
			[44 U.S.C., SEC. 3542]
			\|The unauthorized modification or destruction of information could be expected to have a '''limited''' adverse effect on organizational operations, organizational assets, or individuals.
			\|The unauthorized modification or destruction of information could be expected to have a '''serious''' adverse effect on organizational operations, organizational assets, or individuals.
			\|The unauthorized modification or destruction of information could be expected to have a '''severe or catastrophic''' adverse effect on organizational operations, organizational assets, or individuals.
	\|-		\|-
	\|Availability		\|'''''Availability'''''
	\|
	\|		Availability Ensuring timely and reliable access to and use of information.
	\|
			[44 U.S.C., SEC. 3542]
			\|The disruption of access to or use of information or an information system could be expected to have a '''limited''' adverse effect on organizational operations, organizational assets, or individuals.
			\|The disruption of access to or use of information or an information system could be expected to have a '''serious''' adverse effect on organizational operations, organizational assets, or individuals.
			\|The disruption of access to or use of information or an information system could be expected to have a '''severe or catastrophic''' adverse effect on organizational operations, organizational assets, or individuals.
	\|}		\|}

Pinfold at 20:34, December 19, 2021

2021-12-19T20:34:37Z

← Older revision		Revision as of 20:34, December 19, 2021
Line 231:		Line 231:
	!High		!High
	\|-		\|-
	\|''''Confidentiality''''		\|'''''Confidentiality'''''

	Preserving authorized		Preserving authorized
Line 242:		Line 242:

	[44 U.S.C., SEC. 3542]		[44 U.S.C., SEC. 3542]
	\|		\|The unauthorized
	\|		disclosure of information
	\|		could be expected to have
			a '''limited''' adverse effect on
			organizational operations,
			organizational assets, or
			individuals.
			\|The unauthorized
			disclosure of information
			could be expected to have
			a '''serious''' adverse effect on
			organizational operations,
			organizational assets, or
			individuals.
			\|The unauthorized
			disclosure of information
			could be expected to have
			a '''severe or catastrophic'''
			adverse effect on
			organizational operations,
			organizational assets, or
			individuals.
	\|-		\|-
	\|Integrity		\|Integrity

Pinfold at 20:32, December 19, 2021

2021-12-19T20:32:33Z

← Older revision		Revision as of 20:32, December 19, 2021
Line 231:		Line 231:
	!High		!High
	\|-		\|-
	\|Confidentiality		\|''''Confidentiality''''

			Preserving authorized
			restrictions on information
			access and disclosure,
			including means for
			protecting personal
			privacy and proprietary
			information.

			[44 U.S.C., SEC. 3542]
	\|		\|
	\|		\|

Pinfold at 20:30, December 19, 2021

2021-12-19T20:30:54Z

← Older revision		Revision as of 20:30, December 19, 2021
Line 213:		Line 213:

	[[File:NIST.SP.800-37r2.pdf\|300px\|NIST Special Publication 800-37 Rev. 2]] [[File:2019-NCSR-Summary-Report.pdf\|300px\|Center for Internet Security’s (CIS) Nationwide Cybersecurity Review (NCSR)]]		[[File:NIST.SP.800-37r2.pdf\|300px\|NIST Special Publication 800-37 Rev. 2]] [[File:2019-NCSR-Summary-Report.pdf\|300px\|Center for Internet Security’s (CIS) Nationwide Cybersecurity Review (NCSR)]]

			=Step 1: Categorize =
			The security categorization step of the NIST RMF is critical for informing the subsequent steps of the RMF process. The primary focus is for organizations and system owners to determine the potential consequences (e.g., mission, legal, continuity of operations) associated with each information type (e.g., personally identifiable information (PII), accounting data, traffic information, energy production data) processed, stored, or transmitted by an information system in a systematic and consistent manner across the organization. This provides a structured process for prioritizing assets.

			For each system, information types will need to be identified and categorized. The information types can be categorized based on potential impact values (i.e., low, moderate, high) for each security objective (i.e., confidentiality, integrity, availability). For example, the confidentiality impact value of PII is generally considered to be moderate by NIST. The figure below depicts NIST’s approach, which results in each information type being assigned one of nine possible “security objective-potential impact” combinations.

			''FIPS 199 Potential Impact Definitions for Security Objectives''

			{\| class="wikitable"
			\|-
			!
			!colspan="3"\|NIST Cybersecurity Framework Core
			\|-
			!Security Objective
			!Low
			!Moderate
			!High
			\|-
			\|Confidentiality
			\|
			\|
			\|
			\|-
			\|Integrity
			\|
			\|
			\|
			\|-
			\|Availability
			\|
			\|
			\|
			\|}