DSS Overview and UpdatesPresentationDecember2013

Defense Security Service
DSS Update
DSS Changing With A Changing

Security Environment
DSS Update
FY13 in Review
• Conducted 7,300 security vulnerability assessments
• 1,565 new Interim and Final Facility Clearances granted
• Over 14,000 Accredited Systems in Industry
• 26 Federal Partners
• >1 Million active cleared contractors
DSS Update
FY13 in Review
• DMDC assumed call center activities (JPAS, DCII, iIRR, and SWFT) on June 1, 2013
• Updates to Security Vulnerability Assessment Matrix being implemented

September 2013 (Rating.Matrix@dss.mil)
• Release ISFO Process Manual --- Fall 2013 (15 May 2014 requirement)
• Web-based ISFD going to CAC/PKI enabling --- ready for 2014 deployment
• Initiate full DSS CCRI team reviews --- late 2013
• DISCO merged into the DoDCAF

 Stand-up of Personnel Security Management and Oversight for Industry
(PSMO-I)
DSS Update
FY13 in Review
• Just launched new Voice of Industry survey
 Over 10,000 FSO responses
 Initial feedback cites Cyber and Insider Threats as the biggest concerns
 Opportunity to provide feedback
 Feedback currently being analyzed for avenues to enhance industry partnerships
• Partnership with Industry

 18 exchanges in FY13
 17 active industry partners
 Program was suspended due to sequestration
 Anticipate re-launching in CY14
 (DSSOutreach@dss.mil)
Managing Risk … Cleared Industry
Risk =
f { Threat,
Suspicious Contact Reports
IIRs
Referrals for Action
Cyber\Threat Notifications
Vulnerability,
Vulnerability Assessments
IT Accreditations
CCRIs
Security Clearance Process
Consequence
Value
Risk Based Prioritization
Company Assessments
Program Assessments
FOCI Analysis
{
CFIUS Reviews
Security Education
Security Training
Security Professionalization
THREAT
• Closed Areas • SIPRNet
• Personnel Security • Accredited WAN/LAN
• Secure Storage • Trusted Download
• Security Violations • Electronic Control Plans
• Classified Visits
• Acquisitions & Mergers
Traditional / Information
Physical Systems
Security FOCI
Education International
• Foreign Intelligence • FOCI Mitigation

• Potential Espionage Indicators • Transmission
• Insider Threat Awareness • Export Control
• Classified Management • Technology Control Plans
• Security Awareness
• Reporting Requirements
Assessment Ratings FY12 vs FY13
0.2% 0.2%
0.2%
8.4% 0.2%
7.5%
16.8%
16.0%
FY12 FY13
74.4%
76.1%
Top Ten Acute/Critical Vulnerabilities (59% of total):
• 08-602 Audit Capability (incl. 08-602A 3 Audit Trail Analysis)
• 02-200 - PERSONNEL SECURITY CLEARANCES - General (incl. 02-200B Deny Access for Deny Revoke
or Suspension PCLs)
• 08-202 Accreditation
• 01-302 Reports to be Submitted to the CSA (incl. 01-302G Change Conditions Affecting the FCL)
• 02-104 PCLs Required in Connection with the FCL
• 02-201 Investigative Requirements
• 08-305 Malicious Code
• 01-303 Reports of Loss, Compromise, or Suspected Compromise
• 08-311 Configuration Management
• 05-309 Changing Combinations (incl. 05-309B Employee with Knowledge Combination Change)
IT Vulnerabilities
Top five deficiencies we’re seeing in System Security Plans:
• SSP was incomplete or missing attachments
• Inaccurate or incomplete configuration diagram
• Sections in general procedures contradict protection profile
• Integrity & availability not properly addressed
• SSP was not tailored to the system
Top five vulnerabilities we’re seeing during visits:

• Inadequate auditing controls
• Security Relevant Objects not protected
• Inadequate configuration management
• Improper session controls
• Identification & authentication controls
CI Integration
CI Award
• 20% of industry is reporting – Only 10% reporting “actionable” SCRs
 Goal is 40% of industry reporting “actionable” SCRs
• Cyber Incident reporting has doubled, still ~ three (3) percent

New CI awareness and analytical products
• Better define the threat
• More timely, focused products -- individual company assessments
• Expanded distribution of products
• Pushing classified threat, including cyber
• Deeper look into supply chain and unclassified subcontract vulnerabilities
CI course, Thwarting the Enemy

• 40,000 course completions in first year
Education and Training
• Two curriculum tracks for FSOs
• American Council on Education (ACE) Credit Equivalency recommendations for
several courses
• Two new awareness courses available outside of STEPP
• Professionalization – SPeD Certification
• FSO Toolkit
 An on-line tool with a variety of
security resources
 Information is designed to be modified
or adapted to each facility
 Go to www.cdse.edu and click on
Facility Security Officers (FSOs) under
Toolkits.
Looking ahead
• New automation
 ODAA BMS
 DD 254 Database
 PKI Requirements
 NISS
• Webinars
• Clearance Reform?
• Budget?
NISS Program
 Environment
 Persistent threats to the Defense Industrial Base (NIB)
 Dispersed, complex, labor intensive oversight mission
 Budget restrictions
 Limited DSS personnel
 Stovepiped, legacy information systems
 National Industrial Security System (NISS) Solution

 Modernizes business processes and tools to maximize efficiency
 New, highly automated business information capability:
 Replaces the legacy Industrial Security Facility Database (ISFD)
 Incorporates additional functionality
 Broader user base across the Government and Industry
 Implements National Industrial Security Program (NISP) System Architecture vision
NISS vision is for a data-driven, collaborative, automated, online environment

accessible to government and industry users that delivers industrial security
services, training, and oversight with interoperability and efficiency.
14
NISS Concept Summary
 NISS is key to realize a Proactive, Risk-Based NISP Oversight Strategy
 Integrating the NIB Threats, Vulnerabilities, and Assets/Consequences
 NISS will be the ubiquitous go-to system interface for DSS, Industry, and Government
interaction as it relates to the NISP.
 NISS enables DoD enterprise decision making and analysis (Acquisition, IC, etc.)
Systems
Users Access Interface DSS Systems
• DSS • Computer or • One Web or App • ISFD Replacement
Mobile Device Interface • ODAA BMS
• Industry • NCCS (DD254)
• Single Point of • Role Based Privileges • STEPP
Entry and Access • e-FCL
• Government
• Cross-Domain Solution
• Analytics,
• NCAISS (PKI/CAC) Automated
External Data
Login • JPAS / DISS
Business • e-QIP / SWFT
Management, • FPDS / SAM
Workflows • SEC Filings
• Commercial Data
Social Media
@DSSPublicAffair
@TheCDSE
Like Us on facebook at
DSS.stakeholders
16
Questions?
17

DSS Overview and UpdatesPresentationDecember2013

Uploaded by

Copyright:

Available Formats

DSS Overview and UpdatesPresentationDecember2013

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

DSS Overview and UpdatesPresentationDecember2013

Uploaded by

Copyright:

Available Formats

Defense Security Service

DSS Changing With A Changing

• Updates to Security Vulnerability Assessment Matrix being implemented

• Initiate full DSS CCRI team reviews --- late 2013

• DISCO merged into the DoDCAF

• Partnership with Industry

• Foreign Intelligence • FOCI Mitigation

Top five vulnerabilities we’re seeing during visits:

CI course, Thwarting the Enemy

 National Industrial Security System (NISS) Solution

NISS vision is for a data-driven, collaborative, automated, online environment

You might also like