TDI has spent nearly two decades supporting Monster’s cybersecurity needs. From top to bottom, we have been their trusted cyber advisor.
Monster embarked on the process of Assessment & Authorization (A&A) in an effort to become compliant with government regulations, while paying particular attention to those of the U.S. Office of Personnel Management (OPM). To meet this goal, TDI offered services to provide Monster with a System Security Plan, Systems Security Authorization Agreement and the core set of artifacts needed to adhere to this process.
To proactively prepare for the various A&A efforts that are required of Monster by different U.S. government agencies, TDI assisted Monster in developing a base set of deliverables that meet the requirements for going through the A&A process. TDI tailored this core set to Monster such that the end-product satisfies most agency requirements into which Monster integrates their IT systems. For example, the OPM uses USAJobs, a Monster-developed application. Consequently, this application must undergo a A&A process to ensure that it meets with the regulations and guidelines set forth in FISMA.
TDI also developed a Configuration Management (CM) Plan for Monster which identified CM processes and procedures for the Monster System and its related applications. TDI also assisted OPM and the IRS in drafting and finalizing an Interconnection Security Agreement between the two organizations as well as a Memorandum of Understanding. Among the other tasks that TDI undertook included creating and re-engineering the Monster Contingency Plan and performing a Security Test and Evaluation on the USAJOBS System.
Other agencies that use the Monster application also have FISMA A&A requirements to fulfill.
We then developed a Secure Configuration Management (SCM) methodology and plan for Monster.com. We helped implement SCM at Monster.com to apply change control as a discipline that enforces security, technical, and administrative directions and surveillance in order to: identify and document functional and physical characteristics of configuration items (CIs); control changes to CIs and their related documentation; record and report information needed to manage CIs effectively; and audit CIs to verify their conformance to security policy, specifications, interface control documents, and other requirements. TDI worked with Monster.com to emphasize the purpose of SCM is to maintain the confidentiality and integrity of products as they evolve through the product development life cycle from requirements specifications through design, development, testing, and production.
TDI used SCM to help Monster identify the configuration its network systems at given points in time, systematically and securely controlling changes to the configuration, and maintaining the integrity and traceability of the configuration throughout the lifecycle. Monster assets that are currently placed under SCM include the software and hardware products that comprise the network as well as items required to create or maintain these products. TDI was instrumental in defining the SCM Plan that describes some of the SCM practices that have been implemented to manage the development and maintenance for Monster systems and related applications.
TDI was able to help with the implementation and design of the Monster Secure Configuration Management Plan. Our efforts resulted in proper configuration management at Monster, enabling them to answer the following questions:
- What is the process for making changes to the network?
- Who made a change to the network?
- What changes were made to the network?
- When were the changes made?
- Why were the changes made?
- Who authorized the changes?
- What was the impact on Monster’s security posture?
As part of the many cybersecurity tasks TDI performed for Monster, we helped establish this SCM methodology so that Monster’s cybersecurity processes tied together from their system lifecycle’s beginning to end.