Slides for RSA 2009 talk on GAO's Technical Approach to Assessing Computer Security at Federal Agencies by Naba Barkakati, Lon Chin, and West Coile

1. GAO's Technical Approach to Assessing Computer Security at Federal Agencies Naba Barkakati Lon Chin West Coile US GAO 4/24/09 | Session ID: GPG-401

2. Agenda FISCAM Overview Challenges of Computer Security Audits Logical Access Control Assessment Approach Sample Results, Summary Points, and Q&A

3. Challenges of Computer Security Audits

4. Computer Security Audit Challenges Lumeta Corporation’s Internet Map Patent(s) Pending & Copyright (c) Lumeta Corporation 2009. All Rights Reserved

6. FISCAM Overview Federal Information System Controls Audit Manual

7. Presents a methodology for conducting audits of information system controls FISCAM Originally issued January 1999 Updated February 2009 http://www.gao.gov/new.items/d09232g.pdf

8. FISCAM – General Controls

9. Logical Access Controls Assessment Approach

10. Trust but verify

11. Methodology Iterative and Holistic Assessment Approach

12. Network Control Points Controlling and securing network traffic Inbound Outbound

13. Host Control Points Access Path Access Path Access Path

14. Logical Access: Control Areas

15. Consider Trust Relationships

16. Putting the Pieces Together Vulnerabilities should be assessed in context to the network and the impact on the organization’s mission.

17. Sample Results

18. Sample Result 1: Rogue Internet Printer

19. Sample Result 2: Layered Insecurity

20. Sample Result 3: Mail Attack

21. Sample Result 4: Application Password Reset

24. Questions & Comments