Key Takeaways
- A compliant IT environment is hinged on strong adherence to and regular updates of baseline configurations and inventories; implementation of strong security configurations settings; and close tracking, review, and management of system changes to protect Controlled Unclassified Information (CUI) and to boost the organization’s cyber resilience.
- Aiming to minimize security risks, NIST SP 800-171 requirements emphasize the importance of thorough analysis, documentation, and enforcement of security measures prior to implementing changes; define access restrictions on who can make changes; and configure systems to provide only essential functions.
- Reducing the attack surface starts with restricting or uninstalling nonessential programs or functions, implementing effective policies, and controlling and monitoring those policies.
Exploring Configuration Management
In the dynamic landscape of cybersecurity, configuration management plays a pivotal role in safeguarding information systems. Aligned with NIST SP 800-171 requirements, the focus of this article is on the strategic yet imperative task of ensuring the integrity of information systems while safeguarding sensitive information.
NIST SP 800-171 Configuration Management: Requirements
3.4.1. Establish and maintain baseline configurations and inventories. In dynamic IT environments, baseline configuration and inventory of organizational systems provides the current state of authority for hardware, software, firmware, and documentation. This baseline information informs the system development life cycles and identifies variances that may impact security. For organizations preparing for NIST SP 800-171 compliance, it is imperative to review and update baselines regularly so that computing environment changes do not pose new data vulnerabilities on the integrity of CUI.
3.4.2. Establish and enforce security configuration settings. Establishing and enforcing security configuration settings is a process to ensure that IT products’ security configuration settings are in place, which hardens the operating systems, applications, and network devices to resist access and eliminate cybersecurity threats.
3.4.3. Track, review, approve or disapprove, and log changes. The IT environment changes constantly, so it is crucial for organizations to document change tracking, reviewing, approving or disapproving, and logging changes to be compliant with NIST SP 800-171.
With these processes in place, an organization can provide proper documentation and logging reports for audit purposes to meet compliance requirements ensuring their IT environment is secured and controlled.
Security Analysis and Enforcement
3.4.4. Analyze the security impact of changes prior to implementation. It is imperative for organizations to conduct a security impact analysis. Personnel conducting the impact analysis must have the necessary skills to analyze the changes and associated security risks to the system. Roles that conduct security impact analyses include system administrators, system security officers, system security managers, and systems security engineers. Security plans should be reviewed for understanding security requirements, as well as system design documentation to understand the implementation of controls and how a change could affect them. Risk assessments should also be used in the analysis to understand the impact of changes and if additional controls are needed.
3.4.5. Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. In order to protect the security of systems, organizations must monitor every change made to hardware, software, or firmware components within the system. Only qualified and authorized personnel should be permitted to access systems for purposes of initiating changes, including upgrades and modifications. Access restrictions are an essential part in effectively managing configurations. Access restrictions include physical and logical access control requirements, workflow automation, media libraries, abstract layers, and change windows.
3.4.6. Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. Organizations should regularly review their systems, software, ports, and services and eliminate/uninstall any that are not required for business continuity. By uninstalling unused applications and settings, organizations can significantly reduce the threat of a cyber attack. To identify and prevent the use of unnecessary functions, ports, protocols, and services, a number of tools can be used including, network scanning tools, intrusion detection and prevention systems, and end-point protections.
Reduce Attack Surface
3.4.7. Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. Restricting, disabling, or preventing the use of nonessential programs minimizes potential vulnerabilities and entry points where attackers can gain access. It is important to understand what functions are essential for completing tasks and conducting operations and what functions are unnecessary. Once that is established, it is a best practice to restrict the roles allowed to approve program execution and prohibit auto execution. Best practices also include configuring settings to limit specific functionalities such as preventing the use of, restricting, or disabling bluetooth, File Transfer Protocol (FTP), and peer-to-peer networking. The use of firewalls can block incoming and outgoing traffic on unused ports. By using security software, organizations can monitor and manage these running services.
3.4.8. Apply deny-by-exception (reject listing) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (allow listing) policy to allow the execution of authorized software. There are two approaches when deciding what software is allowed or not allowed on an organization’s systems. The first approach is reject listing. This identifies what software programs are not authorized to execute on systems. It is the easier and more flexible way for allowing exceptions on a needed basis. The drawbacks are it requires continuous maintenance to add new unauthorized applications to the list and this can be time consuming. Also, it is not as secure as allow listing, as new and unknown threats may not be blocked. This second approach, allow listing, is the stronger and more secure approach. It explicitly approves which applications can run, simultaneously reducing the risk of unauthorized software execution. The drawbacks of this approach are that it is more complex to set up and maintain and it can restrict users who need specific software who are not on the allow list.
3.4.9. Control and monitor user-installed software. Controlling and monitoring user-installed software helps maintain system security and compliance. Policies identify which actions regarding software installations are prohibited or permitted. Permitted software installations include updates and security patches to existing software from organization-approved “app stores.” Prohibited software installations include unknown or suspicious software or software that organizations consider potentially malicious.
The most effective approach combines multiple strategies tailored to the organization’s specific needs and environment. Regularly reviewing and updating policies and controls ensure systems remain effective in the ever-evolving threat landscape.
These are just a few examples of how to implement Configuration Management whether you are a DoD Contractor or part of the Defense Industrial Base (DIB). Look for our next blog on Identification and Authentication.
Stay Ahead of the Game: Ensure Your NIST SP 800-171 Compliance for DoD Contracts
IBSS will use our 20 years of corporate DoD cybersecurity experience to prepare you for NIST SP 800-171 compliance. We specialize in developing cybersecurity strategies that align with organizational business processes to detect or prevent cyber attacks. We identify threats and vulnerabilities, and we assist organizations with managing risks to critical data. We provide expert support to promote compliance with Defense Federal Acquisition Regulation Supplement (DFARS), Federal Information Security Modernization Act (FISMA), Federal Risk and Authorization Management Program (FedRAMP), NIST SP 800-171, and Privacy requirements.
Contact us now to get a free consultation on how to develop your company’s NIST SP 800-171 SSP.
