3.11 Risk Assessment

Statement

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

Guidance

Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be likely that adversaries can successfully breach or compromise organizational systems. One of the techniques that organizations can use to address this concern is to share threat information. This can include the tactics, techniques, and procedures that organizations have experienced; mitigations that organizations have found to be effective against certain types of threats; and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing can include organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes negate) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.

Assessment method

• Information security program plan threat awareness program policy threat awareness program procedures risk assessment results relevant to threat awareness documentation about the cross-organization information-sharing capability other relevant documents or records

Assessment method

• Personnel with information security program planning and plan implementation responsibilities personnel responsible for the threat awareness program personnel responsible for the cross-organization information-sharing capability personnel with information security responsibilities external personnel with whom threat awareness information is shared by the organization

Assessment method

• Processes for implementing the threat awareness program processes for implementing the cross-organization information-sharing capability mechanisms supporting and/or implementing the threat awareness program mechanisms supporting and/or implementing the cross-organization information-sharing capability

Statement

• Establish and maintain a cyber threat-hunting capability to:

  • Search for indicators of compromise in organizational systems and

  • Detect, track, and disrupt threats that evade existing safeguards.

• Employ the threat-hunting capability {{ insert: param, A.03.11.02E.ODP.01 }}.

Guidance

Threat hunting is an active means of cyber defense in contrast to traditional protection measures, such as firewalls, intrusion detection and prevention systems, quarantining malicious code in sandboxes, and Security Information and Event Management (SIEM) technologies and systems. Cyber threat hunting involves proactively searching organizational systems, networks, and infrastructure for advanced threats. The objective is to track and disrupt adversaries as early as possible in the attack sequence and to measurably improve the speed and accuracy of responses. Indications of compromise include unusual network traffic, unusual file changes, and the presence of malicious code. Threat-hunting teams leverage existing threat intelligence and may create new threat intelligence that is shared with peer organizations, Information Sharing and Analysis Organizations (ISAO), Information Sharing and Analysis Centers (ISAC), and relevant government departments and agencies. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes expunge) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes shorten and reduce) Restrict the consequences of realized threat events by limiting the damage or effects they cause in terms of time, system resources, and/or mission or business impacts.

  • Reduce level of impact and reduce likelihood of impact of subsequent events in the same threat scenario.

  • The adversary’s effectiveness is restricted.

• (includes detect and scrutinize) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

a cyber threat-hunting capability is established to search for indicators of compromise in organizational systems.

Assessment objective

a cyber threat-hunting capability is maintained to search for indicators of compromise in organizational systems.

Assessment objective

a cyber threat-hunting capability is established to detect, track, and disrupt threats that evade existing safeguards.

Assessment objective

a cyber threat-hunting capability is maintained to detect, track, and disrupt threats that evade existing safeguards.

Assessment objective

the threat-hunting capability is employed{{ insert: param, A.03.11.02E.ODP.01 }}.

Assessment method

• Risk assessment policy assessment reports audit records and/or event logs threat-hunting capability system security plan other relevant documents or records

Assessment method

• Personnel with threat-hunting responsibilities system/network administrators personnel with information security responsibilities

Assessment method

• Processes for assessments and audits mechanisms or tools supporting and/or implementing threat-hunting capabilities

Statement

Employ the following advanced automation and analytics capabilities to predict and identify risks to {{ insert: param, A.03.11.03E.ODP.01 }}: {{ insert: param, A.03.11.03E.ODP.02 }}.

Guidance

A properly resourced security operations center (SOC) or computer incident response team (CIRT) may be overwhelmed by the volume of information generated by the proliferation of security tools and appliances unless it employs advanced automation and analytics to analyze the data. Advanced automation and predictive analytics capabilities are typically supported by artificial intelligence concepts and machine learning. Examples include automated threat discovery and response (which includes broad-based collection, context-based analysis, and adaptive response capabilities), automated workflow operations, and machine-assisted decision tools. However, sophisticated adversaries may be able to extract information related to analytic parameters and retrain the machine learning to classify malicious activity as benign. Accordingly, machine learning is augmented by human monitoring to help ensure that sophisticated adversaries are not able to conceal their activities. This requirement enhances SP 800-171 requirement 03.11.01.

Statement

• (includes expunge) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes shorten and reduce) Restrict the consequences of realized threat events by limiting the damage or effects they cause in terms of time, system resources, and/or mission or business impacts.

  • Reduce level of impact and reduce likelihood of impact of subsequent events in the same threat scenario.

  • The adversary’s effectiveness is restricted.

• (includes detect and scrutinize) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

{{ insert: param, A.03.11.03E.ODP.01 }} are employed to predict and identify risks to {{ insert: param, A.03.11.03E.ODP.02 }}.

Assessment objective

{{ insert: param, A.03.11.03E.ODP.03 }} are employed to predict and identify risks to {{ insert: param, A.03.11.03E.ODP.02 }}.

Assessment method

• Risk assessment policy security planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates risk reports system security plan other relevant documents or records

Assessment method

• Personnel with risk assessment responsibilities personnel with information security responsibilities

Assessment method

• Processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment

Statement

Determine the current cyber threat environment on an ongoing basis using {{ insert: param, A.03.11.08E.ODP.01 }}.

Guidance

The threat awareness information that is gathered feeds into the organization’s security operations to ensure that procedures are updated in response to the changing threat environment. For example, at higher threat levels, organizations may change the privilege or authentication thresholds required to perform certain operations. This requirement enhances SP 800-171 requirement 03.11.01.

Statement

• (includes detect and reveal) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

the current cyber threat environment is determined on an ongoing basis using {{ insert: param, A.03.11.08E.ODP.01 }}.

Assessment method

• Risk assessment policy security planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates risk reports system security plan other relevant documents or records

Assessment method

• Personnel with risk assessment responsibilities personnel with information security responsibilities

Assessment method

• Processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment

Statement

Discover, collect, and distribute to {{ insert: param, A.03.11.09E.ODP.01 }}, indicators of compromise provided by {{ insert: param, A.03.11.09E.ODP.02 }}.

Guidance

Indicators of compromise (IOCs) are forensic artifacts from intrusions that are identified on organizational systems at the host or network level. IOCs provide valuable information on systems that have been compromised. IOCs can include the creation of registry key values. IOCs for network traffic include universal resource locator (URL) or protocol elements that indicate malicious code command and control servers. The rapid distribution and adoption of IOCs can improve information security by reducing the time that systems and organizations are vulnerable to the same exploit or attack. Threat indicators, signatures, tactics, techniques, procedures, and other IOCs may be available via government and non-government cooperatives, including the Forum of Incident Response and Security Teams (FIRST), the Computer Emergency Response Team Coordination Center (CERT/CC), the United States Computer Emergency Readiness Team (US-CERT), and the Defense Industrial Base (DIB) Cybersecurity Information Sharing Program. This requirement enhances SP 800-171 requirement 03.14.06.

Statement

• (includes detect and reveal) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

indicators of compromise provided by {{ insert: param, A.03.11.09E.ODP.01 }} are discovered.

Assessment objective

indicators of compromise provided by {{ insert: param, A.03.11.09E.ODP.01 }} are collected.

Assessment objective

indicators of compromise provided by {{ insert: param, A.03.11.09E.ODP.01 }} are distributed to {{ insert: param, A.03.11.09E.ODP.02 }}.

Assessment method

• System and information integrity policy system and information integrity procedures procedures addressing system monitoring system design documentation system monitoring tools and techniques documentation system configuration settings and associated documentation system monitoring logs or records system audit records system security plan other relevant documents or records

Assessment method

• System/network administrators personnel with information security responsibilities system developers personnel installing, configuring, and/or maintaining the system personnel responsible for monitoring system hosts

Assessment method

• Processes for system monitoring processes for the discovery, collection, distribution, and use of indicators of compromise mechanisms supporting and/or implementing a system monitoring capability mechanisms supporting and/or implementing the discovery, collection, distribution, and use of indicators of compromise

Statement

Identify critical system components and functions by performing a criticality analysis for {{ insert: param, A.03.11.10E.ODP.01 }} at {{ insert: param, A.03.11.10E.ODP.02 }}.

Guidance

Organizations conduct a functional decomposition of a system to identify mission-critical functions and system components. The functional decomposition includes the identification of organizational missions supported by the system, the specific functions to perform those missions, and traceability to the hardware, software, and firmware components that implement those functions, including when the functions are shared by components within and external to the system. The operational environment of a system or a system component may impact its criticality, including the connections to and dependencies on other systems, devices, system-of-systems, and outsourced IT services. System components that allow unmediated access to critical system components or functions are considered critical due to the inherent vulnerabilities that such components create. Criticality analysis is performed when an architecture or design is being developed, modified, or upgraded. If such analysis is performed early and throughout the system development life cycle, organizations may be able to modify the system design to reduce the critical nature of these functions and components, such as by adding redundancy or alternate paths into the system design. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

Assessment objective

critical system components and functions are identified by performing a criticality analysis for {{ insert: param, A.03.11.10E.ODP.01 }} at {{ insert: param, A.03.11.10E.ODP.02 }}.

Assessment method

• Risk assessment policy assessment reports criticality analysis and/or finalized criticality for each component and/or subcomponent audit records and/or event logs analysis reports system security plan other relevant documents or records

Assessment method

• Personnel with assessment and auditing responsibilities personnel with criticality analysis responsibilities system/network administrators personnel with information security responsibilities

Assessment method

• Processes for assessments and audits mechanisms and/or tools supporting and/or implementing assessments and auditing

Statement

Determine information about the system that is discoverable and take {{ insert: param, A.03.11.11E.ODP.01 }}.

Guidance

Discoverable information includes information that adversaries could obtain without compromising or breaching the system, such as by collecting information that the system is exposing or by conducting extensive web searches. Corrective actions include notifying organizational personnel, removing designated information, or changing the system to make the designated information less relevant or attractive to adversaries. This requirement excludes intentionally discoverable information that may be part of a decoy capability (e.g., honeypots, honeynets, or deception nets) implemented by the organization. This requirement enhances SP 800-171 requirement 03.11.02.

Statement

• (includes reveal) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

discoverable information about the system is identified.

Assessment objective

{{ insert: param, A.03.11.11E.ODP.01 }} are taken when information about the system is confirmed as discoverable.

Assessment method

• Procedures addressing vulnerability scanning assessment report penetration test results vulnerability scanning results risk assessment report records of corrective actions taken on discoverable information incident response records audit records system security plan other relevant documents or records

Assessment method

• Personnel with vulnerability scanning and/or penetration testing responsibilities personnel with vulnerability scan analysis responsibilities personnel responsible for risk response personnel responsible for incident management and response personnel with information security responsibilities

Assessment method

• Processes for vulnerability scanning processes for risk response processes for incident management and response mechanisms and/or tools supporting and/or implementing vulnerability scanning mechanisms supporting and/or implementing risk response mechanisms supporting and/or implementing incident management and response

Statement

Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.

Guidance

To maximize the effectiveness of monitoring and sharing threat intelligence information, it is important to know what threat observables and indicators the sensors need to be searching for. By using well-established frameworks, services, and automated tools, organizations improve their ability to rapidly share and feed the relevant threat detection signatures into monitoring tools. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes negate) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.

Assessment method

• Information security program plan threat awareness program policy threat awareness program procedures risk assessment results related to threat awareness documentation about the cross-organization information-sharing capability other relevant documents or records

Assessment method

• Personnel with information security program planning and plan implementation responsibilities personnel responsible for the threat awareness program personnel responsible for the cross-organization information-sharing capability personnel with information security responsibilities external personnel with whom threat awareness information is shared by the organization

Assessment method

• Processes for implementing the threat awareness program processes for implementing the cross-organization information-sharing capability automated mechanisms supporting and/or implementing the threat awareness program automated mechanisms supporting and/or implementing the cross-organization information-sharing capability