Information Security Management
FISMA GUIDANCE Simulation 2005
In accordance with the Federal Information
Security Management Act (FISMA), government agencies are
being held accountable to ensure the protection of their
information and information systems. On top of current FISMA
requirements, an additional guideline will soon become a
mandatory standard as the National Institute for Standards
and Technology (NIST) publishes its Minimal Security
Requirement in 2005. In order to meet the requirements of
these important laws and mandates, agencies must take necessary
steps to implement key information security standards. Attend
this program to gain the management skills and standards
necessary to meet the requirements of these mandates.
Key Methodologies Covered
Attend this training to implement a seven-step management process necessary to
comply with key FISMA requirements. Utilizing NIST guidance and mandates
as a framework for implementing comprehensive security controls, apply key
countermeasures necessary to ensure the integrity of your agency’s information
systems. Next, implement the Government Performance Logic Model to
measure the performance of applied safeguards.
| SYMPOSIUM AGENDA |
| Day One Agenda: September 14, 2005 |
9:00 |
Updates on the Latest NIST Standards,
FISMA Requirements and GAO Guidelines
for Wireless Security
•Explore how the new FISMA guidance addresses wireless
network security
•Learn new GAO standards for improving wireless security
•Understand NIST SP 800-58 |
10:00 |
Trends Dialogue: Pay Now or Pay Later: Resolving
Critical Gaps in Wireless Security
• Hear from agency executives on practical steps needed in
tackling pressing challenges
•Understand the true scope of wireless security weaknesses in
government |
11:30 |
The Next Generation of Wireless Threats: Security for
Mobile and Handheld Technologies
•Examine new technologies that bring increased threats and
new vulnerabilities
•Keep pace with the emerging threats by analyzing the future
of cybercrime |
12:15 |
Luncheon & Peer Solution Exchange |
1:00 |
Privacy Concerns and Identity Theft: Developing
Effective Agency Procedures and Training Standards
•Acquire the latest agency best practices for developing
standards and procedures in addressing privacy concerns
•Learn valuable techniques for establishing a training and
awareness program in your agency |
2:00 |
Understanding the Wireless Security Audit Process:
Delivering Increased Transparency and Accountability
to Auditors
•Work with your inspector general to implement verifiable
security controls aligned with common auditing standards
•Discover key successes and pitfalls of automating the FIMSA
process in a wireless environment |
2:45 |
Securing Budget Funds: Building a Comprehensive
Business Case for Wireless Security
• Utilize the latest business case tools and strategies to achieve
full executive “buy in” for your wireless security initiatives
•Strengthen business cases with effective solutions, proven
project management skills and verifiable security controls |
3:30 |
Application Workshop: Step-by-step walkthrough of
NIST SP 800-48 Standards
• Implement key security controls using a step-by-step approach
for aligning with NIST standards
•Develop a wireless LAN and handheld device security checklist
•Explore key risk mitigation techniques described in
NIST SP 800-48 |
5:00 |
Adjourn |
|
* Certain topics follow guidance from the National Institute for Standards
and Technology |
| INFORMATION SECURITY MANAGEMENT MAIN SUMMIT |
| Day
One Agenda: September 15, 2005 |
9:00 |
Overview of Current Information Security Guidelines
and Requirements
•Federal Information Security Management Act (FISMA)
•Emerging Guidance from Office of Management and Budget
and the National Institute for Standards and Technology (NIST) |
10:00 |
Understand Security Terminology and Identify
Employee Roles
•Examine the use of key security controls including
cryptography, authentication, firewalls, enterprise system
monitoring and IT systems security posturing
•Identify key security safeguards and their relationship with
various business processes
•Assign security responsibilities for staff at the management and
operational level |
1:00 |
Information Security within a Performance
Framework
•Use the Government Performance Logic Model to determine
outcome-oriented performance measures for security controls
• Implement the Logic Model to align your budget with results
and integrate a strategic plan |
2:15 |
Step-By-Step Walk through of FISMA Requirements and
Supporting Guidance
Step 1: Categorization Standards
•Develop standards to categorize information and information
systems based on risk level and information sensitivity
•Use categories to determine appropriate information security
controls |
3:00 |
Step 2: Mapping Guidelines
•Identify information and information systems to be included in
each category
•Plan for specific security controls necessary for each category |
3:30 |
Step 3: Minimum Security Requirements
•Determine and implement minimum security requirements
that align with each part of the business process
• Utilize established requirements to select, implement and
manage various IT services |
|
Day Two Agenda: September 16, 2005 |
9:00 |
Step 4: Applying a Risk Management Framework
• Utilize NIST guidelines and publications to apply an integrated
risk assessment
• Implement eight steps to manage, track and minimize risk in IT
projects |
10:30 |
Step 5: Implement a System Security Plan
•Benchmark current security controls against mandatory
requirements
•Develop a plan for implementing controls necessary to close
remaining security gaps |
1:00 |
Step Six: Certification and Accreditation
•Conduct a thorough assessment of management, operational
and technical aspect of information systems
•Discover lessons learned from existing evaluation and
validations programs |
2:30 |
APPLICATION WORKSHOP: Develop a Security
Assessment Report
• Implement the six-step process to develop a complete security
assessment report in compliance with FISMA requirements
•Understand the key elements of a high scoring report |
4:30 |
Adjourn |
