Assignment: NIST REPORT
Purpose
The purpose of this assignment is twofold.
First, I want you to get familiar with reading official documents related to information security. Security professionals need to be able to read documents like the NIST Security Publications to understand best practices. They also provide weight to recommendations when talking with executives about security decision making.
Second, I want you to be able to teach yourself new things. You may read about things in NIST 800-53 that you don't already know about. Take time to do some research and learn more. Google is your friend.
Instructions
• Look at NIST SP 800-53, Appendix F: Security Control Catalog
• Identify one family of controls you would like to learn more about
o Review controls within that family
o Identify 2 controls you will research
o GRAD STUDENTS: 2 families, 2 controls per family.
• For the 2 controls you choose: write at least 800 words (total), grad students 1500 words.
o List control titles
o Describe what the control entails
o Describe at least one way an organization could implement that control (each control)
o Do some research and include at least one external source per control (properly cited) to support what you say
o You don't have to cite NIST SP 800-53 unless you are quoting directly, but cite any external sources
Very basic example
I chose the family Identification and Authentication (starts on page F-90), and the controls IA-1, IA-3, and IA-5.
IA-1 Identification and Authentication Policy and Procedures
Identification and Authentication policy and procedures refers to an organization's need to have specified policies related to these two important concepts. The policy needs to address who should be authenticated, and what types of activities require authentication. The policy can also outline how authentication will work across organizations, for example, how contractors can obtain authentication credentials for their work on internal systems. A good authentication policy will define the scope of the policy, too.
One good component of an authentication policy is the Acceptable Use policy. Requiring that all users accept some terms and conditions before accessing a network can be set as a prerequisite (Jackson Hole, n.d.).
The IA-1 requirement also specifies that the organization should review and update the policies and procedures on a regular basis. Such reviews could be a part of the policy itself, and should be carried out regularly to ensure that they are (a) being followed, and (b) serving the needs of the business.
Sources:
Jackson Hole Mountain Resort Network Access and Authentication Policy.
Format your assignment according to the following formatting requirements:
1. The answer should be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides.
2. The response also include a cover page containing the title of the assignment, the student's name, the course title, and the date. The cover page is not included in the required page length.
3. Also Include a reference page. The Citations and references should follow APA format. The reference page is not included in the required page length.