Talk:Industry:Project Review/NIST SP 800-37r1 FPD Chapter 2 - Revision history

Eric D. Silberman: /* Footnotes */

2009-12-24T01:09:13Z

‎Footnotes

Eric D. Silberman: /* 2.2 SYSTEM DEVELOPMENT LIFE CYCLE */

2009-12-24T01:08:56Z

‎2.2 SYSTEM DEVELOPMENT LIFE CYCLE

Eric D. Silberman: /* Footnotes */

2009-12-24T01:08:09Z

‎Footnotes

Eric D. Silberman: /* 2.3.2 Boundaries for Complex Information Systems (System of Systems) */

2009-12-24T01:08:00Z

‎2.3.2 Boundaries for Complex Information Systems (System of Systems)

Eric D. Silberman: /* 2.3.2 Boundaries for Complex Information Systems (System of Systems) */

2009-12-24T01:04:26Z

‎2.3.2 Boundaries for Complex Information Systems (System of Systems)

Eric D. Silberman: /* 2.3.1 Establishing Information System Boundaries */

2009-12-24T00:52:42Z

‎2.3.1 Establishing Information System Boundaries

Eric D. Silberman: /* 2.3.1 Establishing Information System Boundaries */

2009-12-24T00:51:41Z

‎2.3.1 Establishing Information System Boundaries

Eric D. Silberman: /* 2.3.1 Establishing Information System Boundaries */

2009-12-23T23:44:49Z

‎2.3.1 Establishing Information System Boundaries

Eric D. Silberman: /* 2.2 SYSTEM DEVELOPMENT LIFE CYCLE */

2009-12-23T23:37:29Z

‎2.2 SYSTEM DEVELOPMENT LIFE CYCLE

Eric D. Silberman: /* 2.2 SYSTEM DEVELOPMENT LIFE CYCLE */

2009-12-23T23:33:14Z

‎2.2 SYSTEM DEVELOPMENT LIFE CYCLE

← Older revision		Revision as of 01:09, 24 December 2009
Line 124:		Line 124:

	==Footnotes==		==Footnotes==
		+
		+
		+	Footnote 27:
		+	As-is: "Integrated project teams are multidisciplinary entities consisting of individuals with appropriate skills and expertise to help facilitate the development of information systems that meet the requirements of the organization."
		+
		+	Suggested change: "Integrated project teams are multidisciplinary entities consisting of a number of individuals with a range of skills and roles to help facilitate the development of information systems that meet the requirements of the organization." [[User:Eric D. Silberman\|Eric D. Silberman]] 23:37, 23 December 2009 (UTC)

@@ Line 54: / Line 54: @@
 As-is: "Resource allocation includes both funding to carry out the risk management tasks and assigning the personnel needed to accomplish the tasks."
 Suggested change: "Resource allocation includes both funding to carry out the risk management tasks as well as assigning the personnel needed to accomplish the tasks." [[User:Eric D. Silberman|Eric D. Silberman]] 23:33, 23 December 2009 (UTC)
 == 2.3 INFORMATION SYSTEM BOUNDARIES ==

← Older revision		Revision as of 01:08, 24 December 2009
Line 132:		Line 132:


−		+	Footnote 33, Section 2.3.2
		+	As-is: "vector of attack against the intranet by requiring security controls commensurate with a lower impact level"
		+	Suggested change: "vector of attack against the intranet by erroneously suggesting security controls commensurate with a lower impact level" [[User:Eric D. Silberman\|Eric D. Silberman]] 01:04, 24 December 2009 (UTC)
		+	Similarly, my comment about footnote 33 is that this is another good place to reiterate the High-Water Mark concept. [[User:Eric D. Silberman\|Eric D. Silberman]] 01:04, 24 December 2009 (UTC)

	[[Category:GIC-NISTSP80037r1FPD]]		[[Category:GIC-NISTSP80037r1FPD]]

@@ Line 115: / Line 115: @@
 Suggested change: this appears to be a genuine typographical error which needs to be corrected by adding the letter 's' to pluralize: "Common controls provided by different organizations often require such boundary protection interface controls. [[User:Eric D. Silberman|Eric D. Silberman]] 01:04, 24 December 2009 (UTC)
-Footnote 33, Section 2.3.2
 Paragraph 4, Section 2.3.2

← Older revision		Revision as of 01:04, 24 December 2009
Line 104:		Line 104:

	In the case where the C&A process has failed to identify a high risk application as a system, then the focus prescribed by this chapter leaves only server logs (i.e. little to no evidence at an application layer) to identify security and functional shortcomings of the system as a whole. This is not sufficient. --[[User:Frank Ervin\|Frank Ervin]] 21:04, 23 December 2009 (UTC)		In the case where the C&A process has failed to identify a high risk application as a system, then the focus prescribed by this chapter leaves only server logs (i.e. little to no evidence at an application layer) to identify security and functional shortcomings of the system as a whole. This is not sufficient. --[[User:Frank Ervin\|Frank Ervin]] 21:04, 23 December 2009 (UTC)
		+
		+	paragraph 2, Section 2.3.2
		+	1. general comment about this paragraph: I feel that this is an important place for the document to remind readers about the "High-Water Mark" concept. I don't have any suggested text about the best way to do that, just that I think this concept should be reiterated here. [[User:Eric D. Silberman\|Eric D. Silberman]] 01:04, 24 December 2009 (UTC)
		+
		+	As-is: "While subsystems of complex information systems may sometimes exist as full systems, for complex systems, these portions"
		+	Suggested change: remove the second comma in this sentence: "While subsystems of complex information systems may sometimes exist as full systems, for complex systems these portions" [[User:Eric D. Silberman\|Eric D. Silberman]] 01:04, 24 December 2009 (UTC)
		+
		+	Paragraph 4, Section 2.3.2
		+	As-is: "Common controls provided by different organization often require such boundary protection interface controls."
		+	Suggested change: this appears to be a genuine typographical error which needs to be corrected by adding the letter 's' to pluralize: "Common controls provided by different organizations often require such boundary protection interface controls. [[User:Eric D. Silberman\|Eric D. Silberman]] 01:04, 24 December 2009 (UTC)
		+
		+	Footnote 33, Section 2.3.2
		+	As-is: "vector of attack against the intranet by requiring security controls commensurate with a lower impact level"
		+	Suggested change: "vector of attack against the intranet by erroneously suggesting security controls commensurate with a lower impact level" [[User:Eric D. Silberman\|Eric D. Silberman]] 01:04, 24 December 2009 (UTC)
		+	Similarly, my comment about footnote 33 is that this is another good place to reiterate the High-Water Mark concept. [[User:Eric D. Silberman\|Eric D. Silberman]] 01:04, 24 December 2009 (UTC)
		+
		+	Paragraph 4, Section 2.3.2
		+	As-is: "approach facilitates a more targeted and cost-effective risk management process by scaling the level of effort in accordance with"
		+	Suggested change: "approach facilitates a more targeted and cost-effective risk management process by scaling the level of effort of the assessment in accordance with" [[User:Eric D. Silberman\|Eric D. Silberman]] 01:04, 24 December 2009 (UTC)

	=== 2.3.3 Dynamic Subsystems ===		=== 2.3.3 Dynamic Subsystems ===

@@ Line 91: / Line 91: @@
 As-is: "Security controls provided by the hosted software application are documented in the security plan for the hosting information system and assessed for effectiveness"
-Suggested change: "Security controls provided by the hosted software application shall be documented in the security plan for the hosting information system shall be assessed for effectiveness" [[User:Eric D. Silberman|Eric D. Silberman]] 00:51, 24 December 2009 (UTC)
+Suggested change: "Security controls provided by the hosted software application shall be documented in the security plan for the hosting information system and shall be assessed for effectiveness" [[User:Eric D. Silberman|Eric D. Silberman]] 00:51, 24 December 2009 (UTC)
 As-is: "Organizations ensure that all security controls,"

← Older revision		Revision as of 00:51, 24 December 2009
Line 81:		Line 81:

	Note that the assertion that applications “do not require a separate risk management process (including a separate security authorization)” has been omitted. This is important, because I think an application is itself a subsystem which warrants its own risk management process, with technical attention placed on proactive vulnerability discovery and mitigation. --[[User:Frank Ervin\|Frank Ervin]] 20:10, 23 December 2009 (UTC)		Note that the assertion that applications “do not require a separate risk management process (including a separate security authorization)” has been omitted. This is important, because I think an application is itself a subsystem which warrants its own risk management process, with technical attention placed on proactive vulnerability discovery and mitigation. --[[User:Frank Ervin\|Frank Ervin]] 20:10, 23 December 2009 (UTC)
		+
		+
		+	Paragraph immediately before 2.3.2:
		+	As-is: "Rather, software applications take advantage of the security controls"
		+	Suggested change: "Rather, software applications leverage the security controls" [[User:Eric D. Silberman\|Eric D. Silberman]] 00:51, 24 December 2009 (UTC)
		+
		+	As-is: "Additional application-level security controls are provided by"
		+	Suggested change: "Additional application-level security controls shall be provided by" [[User:Eric D. Silberman\|Eric D. Silberman]] 00:51, 24 December 2009 (UTC)
		+
		+	As-is: "Security controls provided by the hosted software application are documented in the security plan for the hosting information system and assessed for effectiveness"
		+	Suggested change: "Security controls provided by the hosted software application shall be documented in the security plan for the hosting information system shall be assessed for effectiveness" [[User:Eric D. Silberman\|Eric D. Silberman]] 00:51, 24 December 2009 (UTC)
		+
		+	As-is: "Organizations ensure that all security controls,"
		+	Suggested change: "Organizations shall ensure that all security controls," [[User:Eric D. Silberman\|Eric D. Silberman]] 00:51, 24 December 2009 (UTC)
		+
		+	As-is: "Information system owners ensure that hosted applications do not"
		+	Suggested change: "Information system owners shall ensure that hosted applications do not" [[User:Eric D. Silberman\|Eric D. Silberman]] 00:51, 24 December 2009 (UTC)

	=== 2.3.2 Boundaries for Complex Information Systems (System of Systems) ===		=== 2.3.2 Boundaries for Complex Information Systems (System of Systems) ===

← Older revision		Revision as of 23:44, 23 December 2009
Line 66:		Line 66:

	=== 2.3.1 Establishing Information System Boundaries ===		=== 2.3.1 Establishing Information System Boundaries ===
		+	Paragraph 1 of Section 2.3.1:
		+	As-is: "The allocation of information resources<ref>Information resources consist of information and related resources including personnel, equipment, funds, and information technology.</ref> to an information system defines the boundary for that system. Organizations have significant flexibility in determining what constitutes an information system."
		+
		+	Suggested change: "The set of information resources<ref>Information resources consist of information and related resources including personnel, equipment, funds, and information technology.</ref> allocated to an information system defines the boundary for that system. Organizations have significant flexibility in determining what constitutes an information system and what its boundaries are." [[User:Eric D. Silberman\|Eric D. Silberman]] 23:44, 23 December 2009 (UTC)
		+

	Final chapter of this section is very concerning to me. Seems to imply that security of the Operating System is the paramount concern without regard to the fact that applications are where the majority of government data is held. [[User:Dan Philpott\|Dan Philpott]] 03:26, 8 December 2009 (UTC)		Final chapter of this section is very concerning to me. Seems to imply that security of the Operating System is the paramount concern without regard to the fact that applications are where the majority of government data is held. [[User:Dan Philpott\|Dan Philpott]] 03:26, 8 December 2009 (UTC)

@@ Line 38: / Line 38: @@
 Suggested change: "subset of the overall functional requirements asked of an information system" [[User:Eric D. Silberman|Eric D. Silberman]] 23:27, 23 December 2009 (UTC)
+Paragraph 1 of Section 2.2:
 As-is: "Organizations prioritize information system requirements, both functional and security-related,"
 Suggested change: "Organizations shall prioritize information system requirements, both functional and security-related," [[User:Eric D. Silberman|Eric D. Silberman]] 23:27, 23 December 2009 (UTC)
 == 2.3 INFORMATION SYSTEM BOUNDARIES ==