DOE’s Office of Science relies on TDI’s A&A expertise to ensure its general support system remained operational.
TDI performed a Security Test and Evaluation (ST&E) effort, a critical element of the Certification and Accreditation (C&A) process, for the Department of Energy (DOE) Office of Science Headquarters (SC HQ). Our ST&E assessed the technical and non-technical implementation of the SC HQ IT General Support System (GSS) security design. The components of this GSS provide integrated support for the DOE Science major government-owned, contractor-operated laboratories and other facilities (multi-program and single purpose); service support for DOE Science government-owned, government-operated laboratory; and management of programs and projects, including assignments in high energy physics, environmental restoration and waste management, nuclear physics, basic energy sciences, reactor technology, conservation and energy efficiency, fusion energy science, and solar and alternate energy. TDI’s ST&E effort examined and analyzed security features of this operational environment to determine its security posture. TDI ascertained the effectiveness and proper performance of the security features affecting confidentiality, integrity, and availability that were designed and implemented by SC in accordance with DOE CIO Guidance CS-1, Management, Operational, and Technical Controls Guidance.
TDI determined SC HQ compliance with security requirements by examining technical, general and administrative controls that were in place as part of the system security design. As a starting point, we used the moderate baseline of controls in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53A: Guide for Assessing the Security Controls in Federal Information Systems, and NIST SP 800-53 Revision 1: Recommended Security Controls for Federal Information Systems. Additionally, DOE, Federal Information Processing Standards Publications (FIPS), and other NIST documents were used for both general process guidance and for interpreting the correct implementation of controls.
TDI developed our ST&E Procedures based on guidance provided by NIST SP 800-53A to govern the proper execution of the various tests we performed to validate the security controls in place at SC HQ. Adhering to the assessment procedures, we gathered information through documentation review, DOE employee/contractor interviews, hands-on systems demonstrations, screen captures, technical testing, and physical observation. Each test was methodically and carefully conducted, with the intent of revealing whether or not the controls specified in the planning task were instituted and effective. TDI relied on substantive evidence for ensuring a successful test. We compiled and analyzed data regarding each specification to determine if SC HQ met requirements for appropriate security measures. Finally, TDI assigned a status to each specification and provided recommendations that explain how to mitigate the identified security vulnerabilities. Recommendations were provided for all “Failed” and “Partial” findings. In some cases, even if the test case earned “Pass”, “N/A”, or “Incomplete” status, TDI provided recommendations on how to improve the security posture or strengthen the security control.
TDI’s ST&E efforts were part of a larger effort in support of the DOE. In concert, our work there provided the instrument through which the DOE SC HQ was able to push its full General Support System through the C&A process, ultimately obtaining an Authority to Operate (ATO). The DOE heavily relied upon our ST&E Report which included: the specification for the control as expressed in NIST SP 800-53; the expected results to meet this control as expressed in NIST SP 800-53; a description of TDI’s findings; a list of evidence collected to justify the results statements; the grade/status for the control and additional information as to how that grade was derived, if necessary; and any suggestions or recommendations TDI may have had regarding this control. Our deliverable for this effort provided the DOE with valuable insight into areas of focus they were able to address and remedy.