v6.2.1.0
AWSGC
Jon Logout
Home Overview Progress Summary Reports Policies Assign Tasks
Customer 43 controls (31.6%)
Shared 81 controls (59.6%)
FBI 1 control (0.7%)
AWS 11 controls (8.1%)
4.1.1: Criminal History Record Information (CHRI)
4.2: Access, Use and Dissemination 4.2.1: Proper Access, Use, and Dissemination of CHRI 4.2.2: Proper Access, Use, and Dissemination of NCIC Restricted Files Information 4.2.3: Proper Access, Use, and Dissemination of NCIC Non-Restricted Files Information 4.2.4: Personally Identifiable Information (PII)
Description Procedures Objectives References Remediation
Information obtained from the III is considered CHRI. Rules governing the access, use, and dissemination of CHRI are found in Title 28, Part 20, CFR. The III shall be accessed only for an authorized purpose. Further, CHRI shall only be used for an authorized purpose consistent with the purpose for which III was accessed. Dissemination to another agency is authorized if (a) the other agency is an Authorized Recipient of such information and is being serviced by the accessing agency, or (b) the other agency is performing personnel and appointment functions for criminal justice employment applicants.
Description Procedures Objectives References Remediation
The NCIC hosts restricted files and non-restricted files. NCIC restricted files are distinguished from NCIC non-restricted files by the policies governing their access and use. Proper access to, use, and dissemination of data from restricted files shall be consistent with the access, use, and dissemination policies concerning the III described in Title 28, Part 20, CFR, and the NCIC Operating Manual. The restricted files, which shall be protected as CHRI, are as follows: Gang Files Known or Appropriately Suspected Terrorist Files Supervised Release Files National Sex Offender Registry Files Historical Protection Order Files of the NCIC Identity Theft Files Protective Interest Files Person With Information (PWI) data in the Missing Person Files Violent Person File NICS Denied Transactions File The remaining NCIC files are considered non-restricted files.
Description Procedures Objectives References Remediation
For Official Purposes: NCIC non-restricted files are those not listed as restricted files in Section 4.2.2. NCIC non- restricted files information may be accessed and used for any authorized purpose consistent with the inquiring agency’s responsibility. Information obtained may be disseminated to (a) other government agencies or (b) private entities authorized by law to receive such information for any purpose consistent with their responsibilities. For Other Authorized Purposes: NCIC non-restricted files may be accessed for other purposes consistent with the resources of the inquiring agency; however, requests for bulk data are discouraged. Information derived from NCIC non-restricted files for other than law enforcement purposes can be used by authorized criminal justice personnel only to confirm the status of a person or property (i.e., wanted or stolen). An inquiring agency is authorized to charge a nominal administrative fee for such service. Non- restricted files information shall not be disseminated commercially. A response to a NCIC person inquiry may include NCIC restricted files information as well as NCIC non-restricted files information. Agencies shall not disseminate restricted files information for purposes other than law enforcement. CSO Authority in Other Circumstances: If no federal, state or local law or policy prohibition exists, the CSO may exercise discretion to approve or deny dissemination of NCIC non-restricted file information. Storage: When CHRI is stored, agencies shall establish appropriate administrative, technical and physical safeguards to ensure the security and confidentiality of the information. These records shall be stored for extended periods only when they are key elements for the integrity and/or utility of case files and/or criminal record files. See Section 5.9 for physical security controls.
Description Procedures Objectives References Remediation
PII is information which can be used to distinguish or trace an individual’s identity, such as name, social security number, or biometric records, alone or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. Any FBI CJIS provided data maintained by an agency, including but not limited to, education, financial transactions, medical history, and criminal or employment history may include PII. A criminal history record for example inherently contains PII as would a Law Enforcement National Data Exchange (N-DEx) case file.
5.1: Information Exchange Agreements 5.1.1.1: Information Handling 5.1.1.2(r) State and Federal Agency User Agreements 5.1.1.3: Criminal Justice Agency User Agreements 5.1.1.4: Interagency and Management Control Agreements 5.1.1.5: Private Contractor User Agreements and CJIS Security Addendum 5.1.1.6: Agency User Agreements 5.1.2: Monitoring, Review, and Delivery of Services 5.1.2.1: Managing Changes to Service Providers
Description Procedures Objectives References Remediation
Procedures for handling and storage of information shall be established to protect that information from unauthorized disclosure, alteration or misuse. Using the requirements in this Policy as a starting point, the procedures shall apply to the handling, processing, storing, and communication of CJI. These procedures apply to the exchange of CJI no matter the form of exchange. The policies for information handling and protection also apply to using CJI shared with or received from FBI CJIS for noncriminal justice purposes. In general, a noncriminal justice purpose includes the use of criminal history records for purposes authorized by federal or state law other than purposes relating to the administration of criminal justice, including – but not limited to - employment suitability, licensing determinations, immigration and naturalization matters, and national security clearances Customer and Partners are responsible for creating procedures for handling and storage of information with their use of AWS service. Reference: AWS Data Protection FAQ AWS information Handling resources: 1. AWS Identity & Access Management (IAM) 2. Encrypting Data at Rest 3. Controlling Access to EC2 Resources 4. Amazon S3 encryption 5. AWS Key Management Service AC-21, CM-9, CP- 6, CP-7, IR-8, PL-2, PS-1
Description Procedures Objectives References Remediation
Each CSA head or SIB Chief shall execute a signed written user agreement with the FBI CJIS Division stating their willingness to demonstrate conformity with this Policy before accessing and participating in CJIS records information programs. This agreement shall include the standards and sanctions governing utilization of CJIS systems. As coordinated through the particular CSA or SIB Chief, each Interface Agency shall also allow the FBI to periodically test the ability to penetrate the FBI’s network through the external network connection or system per authorization of Department of Justice (DOJ) Order 2640.2F. All user agreements with the FBI CJIS Division shall be coordinated with the CSA head. AC-21, CA-3, SA- 2, SA-4, SA-4 (1), SA-12
Description Procedures Objectives References Remediation
Any CJA receiving access to CJI shall enter into a signed written agreement with the appropriate signatory authority of the CSA providing the access. The written agreement shall specify the FBI CJIS systems and services to which the agency will have access, and the FBI CJIS Division policies to which the agency must adhere. These agreements shall include: 1. Audit. 2. Dissemination. 3. Hit confirmation. 4. Logging. 5. Quality Assurance (QA). 6. Screening (Pre-Employment). 7. Security. 8. Timeliness. 9. Training. 10. Use of the system. 11. Validation. The customer and partner are responsible for ensuring Criminal Justice Agency (CJA) receive signed access agreements for personnel with access to CJI as part of their security addendum process AC-21, CA-3, SA- 2, SA-4, SA-4(1), SA-12 To enable this requirement, AWS supports user agreement where applicable, as part of the CJIS security addendum process with our customers, agencies and partners.
Description Procedures Objectives References Remediation
A NCJA (government) designated to perform criminal justice functions for a CJA shall be eligible for access to the CJI. Access shall be permitted when such designation is authorized pursuant to executive order, statute, regulation, or inter-agency agreement. The NCJA shall sign and execute a management control agreement (MCA) with the CJA, which stipulates management control of the criminal justice function remains solely with the CJA. The MCA may be a separate document or included with the language of an inter-agency agreement. An example of an NCJA (government) is a city information technology (IT) department. The Noncriminal Justice Agency (NCJA) shall signand execute a management control agreement (MCA) with the CJA, which stipulates management control of the criminal justice function remains solely with the CJA. AC-21, CA-3, SA- 2, SA-4, SA-4(1), SA-12
Description Procedures Objectives References Remediation
The CJIS Security Addendum is a uniform addendum to an agreement between the government agency and a private contractor, approved by the Attorney General of the United States, which specifically authorizes access to CHRI, limits the use of the information to the purposes for which it is provided, ensures the security and confidentiality of the information is consistent with existing regulations and the CJIS Security Policy, provides for sanctions, and contains such other provisions as the Attorney General may require. Private contractors who perform criminal justice functions shall meet the same training and certification criteria required by governmental agencies performing a similar function, and shall be subject to the same extent of audit review as are local user agencies. All private contractors who perform criminal justice functions shall acknowledge, via signing of the CJIS Security Addendum Certification page, and abide by all aspects of the CJIS Security Addendum. The CJIS Security Addendum is presented in Appendix H. Modifications to the CJIS Security Addendum shall be enacted only by the FBI. 1. Private contractors designated to perform criminal justice functions for a CJA shall be eligible for access to CJI. Access shall be permitted pursuant to an agreement that specifically identifies the agency’s purpose and scope of providing services for the administration of criminal justice. The agreement between the CJA and the private contractor shall incorporate the CJIS Security Addendum approved by the Director of the FBI, acting for the U.S. Attorney General, as referenced in Title 28 CFR 20.33 (a)(7). 2. Private contractors designated to perform criminal justice functions on behalf of a NCJA (government) shall be eligible for access to CJI. Access shall be permitted pursuant to an agreement that specifically identifies the agency’s purpose and scope of providing services for the administration of criminal justice. The agreement between the NCJA and the private contractor shall incorporate the CJIS Security Addendum approved by the Director of the FBI, acting for the U.S. Attorney General, as referenced in Title 28 CFR 20.33 (a)(7). The customer and partner are responsible for ensuring Criminal Justice Agency (CJA) receive signed access agreements for personnel with access to CJI as part of their security addendum process AC-21, CA-3, SA- 2, SA-4, SA-4(1), SA-12 To enable this requirement, AWS supports user agreement where applicable, as part of the CJIS security addendum process with our customers, agencies and partners.
Description Procedures Objectives References Remediation
AWS customers and partner should work with the appropriate CJA in order to implement these requirements for the affected user environments built on AWS. AC-21, CA-3, PS- 1, PS-2, PS-3, PS- 6, PS-7, SA-2, SA- 4, SA-4(1), SA-12 AWS has established formal policies and procedures to delineate the minimum standards for logical access to AWS platform and infrastructure hosts. AWS conducts pre-employment criminal background checks, as permitted by law, for employees commensurate with their position and level of access. The policies also identify functional responsibilities for the administration of logical access and security.
Description Procedures Objectives References Remediation
As specified in the inter-agency agreements, MCAs, and contractual agreements with private contractors, the services, reports and records provided by the service provider shall be regularly monitored and reviewed. The CJA, authorized agency, or FBI shall maintain sufficient overall control and visibility into all security aspects to include, but not limited to, identification of vulnerabilities and information security incident reporting/response. The incident reporting/response process used by the service provider shall conform to the incident reporting/response specifications provided in this Policy. Customers and partners can and should maintain overall control and visibility into their environment to include their own vulnerability scanning, pen testing and system monitoring. Reference: 1. Acceptable Use Policy 2. Pen testing on AWS 3. Security Bulletins RA-3, SA- 9, SA-9(1) As part of the FedRAMP process, AWS provides ongoing Continuous Monitoring reports in order to maintain its ATOs. These reports include providing vulnerability scan information, plan of actions and milestones (POA&M), security assessment results to federal agencies that have granted a formal ATO, and other reports which provide assurance that AWS services are being appropriately provided, monitored, and reviewed.
Description Procedures Objectives References Remediation
Any changes to services provided by a service provider shall be managed by the CJA, authorized agency, or FBI. This includes provision of services, changes to existing services, and new services. Evaluation of the risks to the agency shall be undertaken based on the criticality of the data, system, and the impact of the change Customers are responsible for reviewing these notices and understanding which services are applicable to their environment. References: 1. Service Health Dashboard 2. AWS Release Notes 3. What’s NEW from AWS RA-3 AWS communicates changes to its services through a variety of methods. These may include direct notices to the customer, notices posted to AWS public forums, or changes through the FedRAMP authorization package as part of its ongoing risk management and change management processes.
5.1.3: Secondary Dissemination 5.1.4: Secondary Dissemination of Non-CHRI CJI
Description Procedures Objectives References Remediation
If CHRI is released to another authorized agency, and that agency was not part of the releasing agency’s primary information exchange agreement(s), the releasing agency shall log such dissemination. The customer and partners should establishing exchange agreements where applicable. PS-7
Description Procedures Objectives References Remediation
If CJI does not contain CHRI and is not part of an information exchange agreement then it does not need to be logged. Dissemination shall conform to the local policy validating the requestor of the CJI as an employee and/or contractor of a law enforcement agency or civil agency requiring the CJI to perform their mission or a member of the public receiving CJI via authorized dissemination. The customer and partners should establish dissemination and local policy requirements. PS-7
5.2(r) Security Awareness Training 5.2.1.1: All Personnel 5.2.1.2(r) Personnel with Physical and Logical Access 5.2.1.3(r) Personnel with Information Technology Roles 5.2.2: Security Training Records
Description Procedures Objectives References Remediation
At a minimum, the following topics shall be addressed as baseline security awareness training for all authorized personnel with access to CJI: 1. Rules that describe responsibilities and expected behavior with regard to CJI usage. 2. Implications of noncompliance. 3. Incident response (Points of contact; Individual actions). 4. Media protection. 5. Visitor control and physical access to spaces—discuss applicable physical security policy and procedures, e.g., challenge strangers, report unusual activity. 6. Protect information subject to confidentiality concerns — hardcopy through destruction. 7. Proper handling and marking of CJI. 8. Threats, vulnerabilities, and risks associated with handling of CJI. 9. Social engineering. 10. Dissemination and destruction. Customer and partner should provide baseline security awareness training for all authorized personnel with access to CJI. AT-2(2), AT-3 AWS is responsible for providing baseline security awareness training for all authorized personnel with access to CJI.
Description Procedures Objectives References Remediation
In addition to 5.2.1.1 above, the following topics, at a minimum, shall be addressed as baseline security awareness training for all authorized personnel with both physical and logical access to CJI: 1. Rules that describe responsibilities and expected behavior with regard to information system usage. 2. Password usage and management —including creation, frequency of changes, and protection. 3. Protection from viruses, worms, Trojan horses, and other malicious code. 4. Unknown e -mail/attachments. 5. Web usage —allowed versus prohibited; monitoring of user activity. 6. Spam. 7. Physical Security —increases in risks to systems and data. 8. Handheld device security issues —address both physical and wireless security issues. 9. Use of encryption and the transmission of sensitive/confidential information over the Internet —address agency policy, procedures, and technical contact for assistance. 10. Laptop security —address both physical and information security issues. 11. Personally owned equipment and software —state whether allowed or not (e.g., copyrights). 12. Access control issues —address least privilege and separation of duties. 13. Individual accountability —explain what this means in the agency. 14. Use of acknowledgement statements —passwords, access to systems and data, personal use and gain. 15. Desktop security —discuss use of screensavers, restricting visitors’ view of information on screen (mitigating “shoulder surfing”), battery backup devices, allowed access to systems. 16. Protect information subject to confidentiality concerns —in systems, archived, on backup media, and until destroyed. 17. Threats, vulnerabilities, and risks associated with accessing CJIS Service systems and services. Customer and partners should ensure personnel with both physical and logical access to CJI receives additional security awareness training relevant to their access. AT-2(2), AT-3, CM- 10, PL-4, PL-4(1) AWS provides comprehensive security training for AWS staff that supports this requirement.
Description Procedures Objectives References Remediation
In addition to 5.2.1.1 and 5.2.1.2 above, the following topics at a minimum shall be addressed as baseline security awareness training for all Information Technology personnel (system administrators, security administrators, network administrators, etc.): 1. Protection from viruses, worms, Trojan horses, and other malicious code—scanning, updating definitions. 2. Data backup and storage—centralized or decentralized approach. 3. Timely application of system patches—part of configuration management. 4. Access control measures. 5. Network infrastructure protection measures. Customer and partners should ensure Information Technology personnel (e.g., system administrators, security administrators, network administrators, etc.) receive additional training related to protection from malicious code, data backup and storage, timely implementation of system patches, access control measures and network infrastructure protection measures. AT-3 AWS's security awareness training addresses all the requirements in the CJIS Security Policy. AWS ensures Information Technology personnel (e.g., system administrators, security administrators, network administrators, etc.) receive additional training related to protection from malicious code, data backup and storage, timely implementation of system patches, access control measures and network infrastructure protection measures.
Description Procedures Objectives References Remediation
Records of individual basic security awareness training and specific information system security training shall be documented, kept current, and maintained by the CSO/SIB/Compact Officer. Maintenance of training records can be delegated to the local level. Customer and partners should maintaining records of individual basic security awareness training and specific information system security training. AT-4, PL-4 AWS maintains training records for AWS employees.
5.3: Incident Response 5.3.1: Reporting Information Security Events 5.3.1.1: Incident Response FBI CJIS Division Responsibilities 5.3.1.1.2: CSA ISO Responsibilities 5.3.2: Management of Information Security Incidents 5.3.2.1: Incident Handling 5.3.2.2: Collection of Evidence 5.3.3: Incident Response Training 5.3.4: Incident Monitoring
Description Procedures Objectives References Remediation
The agency shall promptly report incident information to appropriate authorities. Information security events and weaknesses associated with information systems shall be communicated in a manner allowing timely corrective action to be taken. Formal event reporting and escalation procedures shall be in place. Wherever feasible, the agency shall employ automated mechanisms to assist in the reporting of security incidents. All employees, contractors and third-party users shall be made aware of the procedures for reporting the different types of event and weakness that might have an impact on the security of agency assets and are required to report any information security events and weaknesses as quickly as possible to the designated point of contact. Customer and partners should establish and/or include their existing incident reporting process for reporting security events to the appropriate authorities as it relates to their AWS customer environments. IR-4 (1), IR-6, IR-6 (1), IR-6 (2), IR-7, IR-7 (1), IR-7 (2), IR-8, PE- 17 AWS has an established Incident Response (IR) program regarding the detection, investigation, and mitigation of information security-related incidents. Reference: 1. AWS Vulnerability Reporting
Description Procedures Objectives References Remediation
The FBI CJIS Division shall: 1. Manage and maintain the CJIS Division's Computer Security Incident Response Capability (CSIRC). 2. Serve as a central clearing house for all reported intrusion incidents, security alerts, bulletins, and other security-related material. 3. Ensure additional resources for all incidents affecting FBI CJIS Division controlled systems as needed. 4. Disseminate prompt advisories of system threats and operating system vulnerabilities via the security policy resource center on FBI.gov, to include but not limited to: Product Security Bulletins, Virus Bulletins, and Security Clips. 5. Track all reported incidents and/or trends. 6. Monitor the resolution of all incidents. None Applicable to FBI CJIS Division only.
Description Procedures Objectives References Remediation
The CSA ISO shall: 1. Assign individuals in each state, federal, and international law enforcement organization to be the primary point of contact for interfacing with the FBI CJIS Division concerning incident handling and response. 2. Identify individuals who are responsible for reporting incidents within their area of responsibility. 3. Collect incident information from those individuals for coordination and sharing among other organizations that may or may not be affected by the incident. 4. Develop, implement, and maintain internal incident response procedures and coordinate those procedures with other organizations that may or may not be affected. 5. Collect and disseminate all incident-related information received from the Department of Justice (DOJ), FBI CJIS Division, and other entities to the appropriate local law enforcement POCs within their area. 6. Act as a single POC for their jurisdictional area for requesting incident response assistance. None Applicable to CSA ISO Responsibilities only.
Description Procedures Objectives References Remediation
A consistent and effective approach shall be applied to the management of information security incidents. Responsibilities and procedures shall be in place to handle information security events and weaknesses effectively once they have been reported. The AWS shared responsibility model requires you to monitor and manage your environment at the operating system and higher layers. Customer and Partners should establish processes for reporting security incidents as they related to their AWS environment as well as options for mitigating security incidents before they occur. Reference: AWS Best Practices for DDoS Resiliency IR-1, IR-8 AWS and the customer are responsible for applying a consistent approach to the management of information security incidents. Reference: 1. AWS Vulnerability Reporting
Description Procedures Objectives References Remediation
The agency shall implement incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery. Wherever feasible, the agency shall employ automated mechanisms to support the incident handling process. Incident-related information can be obtained from a variety of sources including, but not limited to, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports. The agency should incorporate the lessons learned from ongoing incident handling activities into the incident response procedures and implement the procedures accordingly. Customer and partners should implement an incident handling capability for security incidents which includes preparation, detection and analysis, containment, eradication, and recovery capabilities. There are several AWS services and tools which, can support these capabilities.] Reference AWS services: AWS CloudWatch EC2 Describe API Amazon Simple Notification Service AWS Health Dashboard AWS CloudTrail logs AWS Config IR-4, IR-4 (1), IR-4 (3), IR-4 (4), IR-8 AWS has an established Incident Response (IR) program regarding the detection, investigation, and mitigation of information security-related incidents. Reference: 1. AWS Vulnerability Reporting
Description Procedures Objectives References Remediation
Where a follow-up action against a person or agency after an information security incident involves legal action (either civil or criminal), evidence shall be collected, retained, and presented to conform to the rules for evidence laid down in the relevant jurisdiction(s). Customer and partner should establish a responsible process for the collection, retention, and presentation of evidence to conform to the rules for evidence laid down in the relevant jurisdiction(s). IR-4, IR-4 (1), IR-4 (3), IR-4 (4), IR-8 AWS has an established Incident Response (IR) program regarding the detection, investigation, and mitigation of information security-related incidents. In order to protect the confidentiality of customer information, AWS does not permit third parties access to data centers. AWS is responsible for working with customer with the collection, retention, and presentation of evidence to conform to the rules for evidence laid down in the relevant jurisdiction(s).
Description Procedures Objectives References Remediation
The agency shall ensure general incident response roles and responsibilities are included as part of required security awareness training. Customer and partners should ensure general incident response roles responsibilities are included as part of required security awareness training. IR-2, IR-3 AWS includes team roles and responsibilities in its Incident Response program. AWS is responsible for ensuring general incident response roles responsibilities are included as part of required security awareness training.
Description Procedures Objectives References Remediation
The agency shall track and document information system security incidents on an ongoing basis. The CSA ISO shall maintain completed security incident reporting forms until the subsequent FBI triennial audit or until legal action (if warranted) is complete; whichever time-frame is greater. Customer and/or partners should maintaining completed security incident reporting forms until the subsequent FBI triennial audit or until legal action (if warranted) is complete; whichever time frame is greater. IR-5 AWS and the customer are both responsible for tracking and documenting information system security incidents in their respective environments on an ongoing basis.
5.4: Auditing and Accountability 5.4.1: Auditable Events and Content (Information Systems) 5.4.1.1: Events 5.4.1.1.1: Content 5.4.2: Response to Audit Processing Failures 5.4.3: Audit Monitoring, Analysis, and Reporting 5.4.4: Time Stamps 5.4.5: Protection of Audit Information 5.4.6: Audit Record Retention
Description Procedures Objectives References Remediation
The agency’s information system shall generate audit records for defined events. These defined events include identifying significant events that need to be audited as relevant to the security of the information system. The agency shall specify which information system components carry out auditing activities. Auditing activity can affect information system performance and this issue must be considered as a separate factor during the acquisition of information systems. The agency’s information system shall produce, at the application and/or operating system level, audit records containing sufficient information to establish what events occurred, the sources of the events, and the outcomes of the events. The agency shall periodically review and update the list of agency-defined auditable events. In the event an agency does not use an automated system, manual recording of activities shall still take place. Customers and partners should establish audit and accountability controls for their customer environments (e.g. IAM, API and Config access).] References: 1. AWS Security Audit Guideline 2. Amazon Resource Names (ARNs) 3. AWS CloudTrail 4. AWS CloudWatch AC-9, AU- 2, AU-2 (3), AU-3, AU-3 (1), AU-6, AU- 6(1), AU- 6(3), AU- 12, CA-7 AWS has established audit trails to maintain a record of the system activity by system and application processes and by user activity. Specific events are recorded based on a risk assessment that identified auditable event categories.
Description Procedures Objectives References Remediation
The following events shall be logged: 1. Successful and unsuccessful system log-on attempts. 2. Successful and unsuccessful attempts to use: a. access permission on a user account, file, directory or other system resource; b. create permission on a user account, file, directory or other system resource; c. write permission on a user account, file, directory or other system resource; d. delete permission on a user account, file, directory or other system resource; e. change permission on a user account, file, directory or other system resource. 3. Successful and unsuccessful attempts to change account passwords. 4. Successful and unsuccessful actions by privileged accounts. 5. Successful and unsuccessful attempts for users to: a. access the audit log file; b. modify the audit log file; c. destroy the audit log file. Customers and partners should implement event logging within their AWS customer environment (e.g. IAM, API calls, Server Access and Load Balancers] References: 1. Logging IAM Events with AWS CloudTrail 2. Server Access Logging S3 3. S3 Bucket logging 4. Access Logs Elastic Load Balancer (ELB) AC-9, AU- 2, AU-12, CA-7 AWS logs a variety activities in order to support investigations and to meet the AWS Audit and Accountability Policy including: • Successful and unsuccessful account logon events • Account management events • Object access • Policy changes • Privilege functions • Process tracking • System events/error • Administrator activity • Authentication/Authorization checks • Data Deletions, access, changes, and permissions
Description Procedures Objectives References Remediation
The following content shall be included with every audited event: 1. Date and time of the event. 2. The component of the information system (e.g., software component, hardware component) where the event occurred. 3. Type of event. 4. User/subject identity. 5. Outcome (success or failure) of the event. Customers and partners should implement content logging using CloudTrail and CloudWatch for operating and application content monitoring] Reference: 1. CloudTrail User Guide 2. Monitor OS & Application Log Files AU-2 AWS audited events include date, time, component, type of event, user ID, and outcome for auditable events.
Description Procedures Objectives References Remediation
The agency’s information system shall provide alerts to appropriate agency officials in the event of an audit processing failure. Audit processing failures include, for example: software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Customers and partners should document their policy on how their organization responds to audit processing failures. Reference: 1. API operations for CloudTrail AU-5, AU-5(2) Audit processing errors are logged and archived according to the AWS Audit and Accountability Policy.
Description Procedures Objectives References Remediation
The responsible management official shall designate an individual or position to review/analyze information system audit records for indications of inappropriate or unusual activity, investigate suspicious activity or suspected violations, to report findings to appropriate officials, and to take necessary actions. Audit review/analysis shall be conducted at a minimum once a week. The frequency of review/analysis should be increased when the volume of an agency’s processing indicates an elevated need for audit review. The agency shall increase the level of audit monitoring and analysis activity within the information system whenever there is an indication of increased risk to agency operations, agency assets, or individuals based on law enforcement information, intelligence information, or other credible sources of information Customers and partners should document their implementation of AWS audit monitoring, analysis, and reporting. There are several capabilities within AWS services as well as partner services such as Splunk AMI Reference: 1. Web Server Log Analysis 2. Web Log Analysis Architecture 3. Marketplace Log Analysis 4. CloudWatch Log Files AU-6, AU-6(1), AU-6(3), AU-7, CA-7 AWS maintains an ongoing audit monitoring, analysis, and reporting posture that investigates and reports suspicious activities and anomalies.
Description Procedures Objectives References Remediation
The agency’s information system shall provide time stamps for use in audit record generation. The time stamps shall include the date and time values generated by the internal system clocks in the audit records. The agency shall synchronize internal information system clocks on an annual basis. Customers and partners are responsible for configuring time stamps and NTP services on their servers and applications. References: 1. Setting the Time for Your Linux Instance 2. Setting the Time for a Windows Instance AU-8, AU-8(1) Timestamps of suit records are generated using internal system clocks that are synchronized to internal Network Time Protocol (NTP) servers. Timestamps are used for log retention, processing, and analysis. All AWS hosts are synced to NTP servers.
Description Procedures Objectives References Remediation
The agency’s information system shall protect audit information and audit tools from modification, deletion and unauthorized access. Customers and partners are responsible for protecting any logs they generate from their systems as well as the auditing tools themselves. References: 1. Access Control List (ACL) Overview 2. Managing Access to S3 resources 3. Editing S3 Bucket Permissions AU-9, AU-9(4) AWS implements several internal processes to help protect audit information and audit tools form unauthorized access, modification, and deletion to include a service for collecting and archiving logs for AWS service owners. This service encrypts logs, protects encryption keys, and uses asymmetric encryption with at least 1024 bits.
Description Procedures Objectives References Remediation
The agency shall retain audit records for at least one (1) year. Once the minimum retention time period has passed, the agency shall continue to retain audit records until it is determined they are no longer needed for administrative, legal, audit, or other operational purposes. This includes, for example, retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoena, and law enforcement actions. Customers and partners should establish their record retention policies and technical implementations as applicable. Leading practice for meeting this requirement is setting S3 retentions to 30 days with an archiving rule to move records to Glazier for the remaining 335 days with a delete rule on the 366 day of retention. References: 1. Archiving S3 to Glazier 2. S3 FAQs AU-4, AU-5(1), AU-9(2), AU-11 AWS audit logs are stored on an internal AWS service that archives and secures logs stored in S3. All logs are considered “online” and available for the AWS service teams. Audit data is pulled at least every 24 hours.
5.4.7: Logging NCIC and III Transactions
Description Procedures Objectives References Remediation
A log shall be maintained for a minimum of one (1) year on all NCIC and III transactions. The III portion of the log shall clearly identify both the operator and the authorized receiving agency. III logs shall also clearly identify the requester and the secondary recipient. The identification on the log shall take the form of a unique identifier that shall remain unique to the individual requester and to the secondary recipient throughout the minimum one-year retention period. The customer must establish auditing capabilities to log transactions for one year related to NCIC and III transactions as part of the management of those data sets. References: 1. Enterprise Splunk Amazon Machine Image (AMI) AU-4, AU-11
5.5: Access Control 5.5.1: Account Management 5.5.2: Access Enforcement 5.5.2.1: Least Privilege 5.5.2.2: System Access Control 5.5.2.3: Access Control Criteria 5.5.2.4: Access Control Mechanisms 5.5.3: Unsuccessful Login Attempts 5.5.4: System Use Notification
Description Procedures Objectives References Remediation
The agency shall manage information system accounts, including establishing, activating, modifying, reviewing, disabling, and removing accounts. The agency shall validate information system accounts at least annually and shall document the validation process. The validation and documentation of accounts can be delegated to local agencies. Account management includes the identification of account types (i.e., individual, group, and system), establishment of conditions for group membership, and assignment of associated authorizations. The agency shall identify authorized users of the information system and specify access rights/privileges. The agency shall grant access to the information system based on: 1. Valid need-to-know/need-to-share that is determined by assigned official duties. 2. Satisfaction of all personnel security criteria. The agency responsible for account creation shall be notified when: 1. A user’s information system usage or need-to-know or need-to-share changes. 2. A user is terminated or transferred or associated accounts are removed, disabled, or otherwise secured. Audit support procedures: A) Attach AWS IAM policy B) Attach internal Account management Policy C) Provide sample output of users and group membership D) Attach screenshots or sample of a completed access request ticket that shows the process of initial request, access validation approval and request completion Customers and partners should create users groups and roles in IAM, and manage permissions to control which operations can be performed by the entity, or AWS service, that assumes the role. The customer can also define which entity is allowed to assume the role. IAM enables organizations with multiple employees to create and manage multiple users under a single AWS account. With IAM policies, it is possible to grant IAM users fine-grained control to AWS services. References: 1. AWS Identity and Access Management (IAM) 2. AWS IAM Best Practices AC-2, AC-5, IR-8 AWS User accounts are established as part of the onboarding workflow process in Amazon’s Human Resource Management System (HRMS). All employees, vendors, and contractors who require a user account must be on-boarded through Amazon’s HR system. As part of the onboarding workflow, the direct manager of the employee, vendor, or contractor requests the establishment of a user account. The approved request serves as the approval to establish a user account
Description Procedures Objectives References Remediation
The information system shall enforce assigned authorizations for controlling access to the system and contained information. The information system controls shall restrict access to privileged functions (deployed in hardware, software, and firmware) and security-relevant information to explicitly authorized personnel. Explicitly authorized personnel include, for example, security administrators, system and network administrators, and other privileged users with access to system control, monitoring, or administration functions (e.g., information system security officers, maintainers, system programmers). Access control policies (e.g., identity-based policies, role-based policies, rule-based policies) and associated access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) shall be employed by agencies to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains) in the information system. Shared The customer and partners can use ACLs to selectively add (grant) certain permissions on individual objects. Amazon S3 Bucket Policies can be used to add or deny permissions across some or all of the objects within a single bucket. AWS Identity and Access Management (IAM) enable the customer to create multiple users within the customer's AWS account and manage their permissions via IAM policies. These policies are attached to the users, enabling centralized control of permissions for users under the customer's AWS account. Bucket policies are attached to a bucket and the IAM policies are attached to individual users in the account. References: 1. S3 Access Control List (ACL) Overview 2. Granting IAM Users Required Permissions AC-2, AC-2(1), AC-2(7), AC-3, AC-3(3), AC-3(4), AC-5, AC-6(1), AC-6(2), SC-23(1), SC-23(2), SC-23(3) AWS Identity and Access Management (IAM) enables the customer to create multiple users within the customer's AWS account and manage their permissions via IAM policies. These policies are attached to the users, enabling centralized control of permissions for users under the customer's AWS account.
Description Procedures Objectives References Remediation
The agency shall approve individual access privileges and shall enforce physical and logical access restrictions associated with changes to the information system; and generate, retain, and review records reflecting all such changes. The agency shall enforce the most restrictive set of rights/privileges or access needed by users for the performance of specified tasks. The agency shall implement least privilege based on specific duties, operations, or information systems as necessary to mitigate risk to CJI. This limits access to CJI to only authorized personnel with the need and the right to know. Logs of access privilege changes shall be maintained for a minimum of one year or at least equal to the agency’s record retention policy – whichever is greater. Pease provide Access Control policy along with sample logs of access privilege changes. Make sure to include log retention configuration setting with a minimum of 1 year retention. Customers and partners to grant unique security credentials to every user and specify which AWS service APIs and resources they can access. IAM is secure by default; users have no access to AWS resources until permissions are explicitly granted. References: 1. AWS IAM Best Practices Blog 2. AWS IAM Best Practices AC-2, AC-2(4), AC-2(7), AC-5, AC-6, AC-6(5), AC-6(9), AC-10, RA-5(5) AWS manages its own infrastructure based on the "least privilege" principal and also implements a variety of segregation of duties designed to ensure that individual access is appropriately limited and restricted. Customers are responsible for managing their own accounts and permissions leveraging the aforementioned AWS IAM capabilities as well as any other policies and procedures within their non-AWS environment.
Description Procedures Objectives References Remediation
Access control mechanisms to enable access to CJI shall be restricted by object (e.g., data set, volumes, files, records) including the ability to read, write, or delete the objects. Access controls shall be in place and operational for all IT systems to: 1. Prevent multiple concurrent active sessions for one user identification, for those applications accessing CJI, unless the agency grants authority based upon operational business needs. Agencies shall document the parameters of the operational business needs for multiple concurrent active sessions. 2. Ensure that only authorized personnel can add, change, or remove component devices, dial-up connections, and remove or alter programs. Customers and partners should architecting an environment and granting permissions that meet CJI specific access control requirements established by the Agency or local policies. References: 1. IAM Roles (Delegation and Federation) 2. Managing AWS Access Keys 3. Federated Access to AWS Console AC-2, AC-2(4), AC-2(7), AC-5, AC-6, AC-6(5), AC-6(9), AC-10, RA-5(5) AWS administrators authenticate their SSH connection to the network bastion hosts using an RSA private key and passphrase, then log on to the network device which uses TACACS to authenticate the user with their LDAP user ID and password. For privileged (root) commands, users must escalate privileges using an authenticated password. All escalations of privilege commands are audited.
Description Procedures Objectives References Remediation
Agencies shall control access to CJI based on one or more of the following: 1. Job assignment or function (i.e., the role) of the user seeking access. 2. Physical location. 3. Logical location. 4. Network addresses (e.g., users from sites within a given agency may be permitted greater access than those from outside). 5. Time of day and day of week/month restrictions. Customers and partners can limiting access to data based on roles, location (i.e., US East, US West), logical location (utilizing Virtual Private Cloud), and network addresses. Time of day and day of week restrictions are normally enforced through federated access controls (i.e., integrating to Windows Active Directory). References: 1. AWS Security Token Service AC-2, AC-2 (4), AC-2(7), AC-5, AC-6, AC-6(5), AC-6(9), AC-10, RA-5(5) AWS has implemented a formal, documented access control policy called “AWS Access Control Policy,” System accounts are established by submitting a request using Amazon’s self-service system account creation tool. Using this tool, mandatory fields, including unique account name, an account description, account owner, and a justification for the account creation.
Description Procedures Objectives References Remediation
When setting up access controls, agencies shall use one or more of the following mechanisms: 1. Access Control Lists (ACLs). ACLs are a register of users (including groups, machines, processes) who have been given permission to use a particular object (system resource) and the types of access they have been permitted. 2. Resource Restrictions. Access to specific functions is restricted by never allowing users to request information, functions, or other resources for which they do not have access. Three major types of resource restrictions are: menus, database views, and network devices. 3. Encryption. Encrypted information can only be decrypted, and therefore read, by those possessing the appropriate cryptographic key. While encryption can provide strong access control, it is accompanied by the need for strong key management. If encryption of stored information is employed as an access enforcement mechanism, the cryptography used is Federal Information Processing Standards (FIPS) 140-2 (as amended) compliant (see Section 5.10.1.2 for encryption requirements). 4. Application Level. In addition to controlling access at the information system level, access enforcement mechanisms are employed at the application level to provide increased information security for the agency. [Customers and Partners can and should create unique user accounts to access AWS management console functions, AWS services, as well as instances and data stored within EC2, RDS, S3 or other services. In a federated environment, this can be accomplished by assigning unique accounts in the organization’s LDAP implementation and only assigning AWS rights to accounts that are individually assigned.] References: 1. AWS Resource-Level Permissions 2. AWS Services integration with IAM 3. Managing Access with ACLs 4. AWS Key Management Service (KMS) 5. Signing AWS API Requests 6. Granting Permissions to AWS Applications AC-2, AC-2(4), AC-2(7), AC-5, AC-6, AC-6(5), AC-6(9), AC-10, RA-5(5) AWS has implemented a formal, documented access control policy called “AWS Access Control Policy,” System accounts are established by submitting a request using Amazon’s self-service system account creation tool. Using this tool, mandatory fields, including unique account name, an account description, account owner, and a justification for the account creation.
Description Procedures Objectives References Remediation
Where technically feasible, the system shall enforce a limit of no more than 5 consecutive invalid access attempts by a user (attempting to access CJI or systems with access to CJI). The system shall automatically lock the account/node for a 10-minute time period unless released by an administrator. [Customers and partners should configure IAM account settings and MFA to restrict unsuccessful login attempts.] References: 1. Setting an Account Password Policy for IAM Users 2. Multi-Factor Authentication (MFA) Devices with AWS AC-7, IA-5 (1) AWS administrators access the AWS infrastructure through a combination of methods including SSH using RSA keys with 2,048 bits of strength, bastion hosts, multi-factor tokens, and other mechanisms. Together, these controls exceed the intent of the CJIS policy requirement. Additionally, the customer still has the option for enforcing this requirement within any internal access management policies (e.g., Windows Active Directory Global Policy Objects).
Description Procedures Objectives References Remediation
The information system shall display an approved system use notification message, before granting access, informing potential users of various usages and monitoring rules. The system use notification message shall, at a minimum, provide the following information: 1. The user is accessing a restricted information system. 2. System usage may be monitored, recorded, and subject to audit. 3. Unauthorized use of the system is prohibited and may be subject to criminal and/or civil penalties. 4. Use of the system indicates consent to monitoring and recording. The system use notification message shall provide appropriate privacy and security notices (based on associated privacy and security policies or summaries) and remain on the screen until the user acknowledges the notification and takes explicit actions to log on to the information system. Privacy and security policies shall be consistent with applicable laws, executive orders, directives, policies, regulations, standards, and guidance. System use notification messages can be implemented in the form of warning banners displayed when individuals log in to the information system. For publicly accessible systems: (i) the system use information is available and when appropriate, is displayed before granting access; (ii) any references to monitoring, recording, or auditing are in keeping with privacy accommodations for such systems that generally prohibit those activities; and (iii) the notice given to public users of the information system includes a description of the authorized uses of the system. [Customer and partners should create systems use notifications within their hosted applications and specific systems.] Reference: 1. AWS Notification API 2. Amazon Simple Notification Service API 3. Invoking Lambda notification functions AC-8, AC-11(1), AC-22 AWS implements a notification banner into the internal management access file, which will appear upon each successful internal remote access request. The banner informs the AWS user that their usage/activities on the systems may be monitored, audited, or recorded as well as sanction.
5.5.5: Session Lock 5.5.6: Remote Access 5.5.6.1: Personally Owned Information Systems 5.5.6.2: Publicly Accessible Computers
Description Procedures Objectives References Remediation
The information system shall prevent further access to the system by initiating a session lock after a maximum of 30 minutes of inactivity, and the session lock remains in effect until the user reestablishes access using appropriate identification and authentication procedures. Users shall directly initiate session lock mechanisms to prevent inadvertent viewing when a device is unattended. A session lock is not a substitute for logging out of the information system. In the interest of officer safety, devices that are: (1) part of a police vehicle; or (2) used to perform dispatch functions and located within a physically secure location, are exempt from this requirement. Note: an example of a session lock is a screensaver with password. [Customers and partners should federate their AWS services using AD connector in-order to meet this control for through group policies within Active Directory.] Reference: 1. AWS AD Connector 2. Connecting AD to AWS AC-11 AWS implements this control by enforcing client systems (authorized workstations), which are used to remotely access the system, to meet Active Directory sessions lock out requirements through domain policy, which is set to 15 minutes.
Description Procedures Objectives References Remediation
The agency shall authorize, monitor, and control all methods of remote access to the information system. Remote access is any temporary access to an agency’s information system by a user (or an information system) communicating temporarily through an external, non-agency-controlled network (e.g., the Internet). The agency shall employ automated mechanisms to facilitate the monitoring and control of remote access methods. The agency shall control all remote accesses through managed access control points. The agency may permit remote access for privileged functions only for compelling operational needs but shall document the rationale for such access in the security plan for the information system. [Customers and partners should implement policies and procedures for remote access into their AWS customer environments. AWS provides multiple options for securing remote access. Access to the AWS Management Console is logged and monitored by AWS. If direct access by allowing access to common management ports (i.e. 3389 for Windows or 22 for Linux) to EC2 instances is configured, logging and monitoring should be configured in the systems to log all remote access in the operating system configuration] Reference: 1. Remote Gateway Reference Architecture 2. Connecting Windows EC2 Using RDP 3. Deploy Remote Desktop Gateway on the AWS Cloud 4. AWS Multi-Factor Authentication AC-17, AC-17(3), AC-17(4), AC-17(6) AWS employs automated mechanisms to facilitate the monitoring and control of remote access methods, through syslog running on the bastion hosts. Auditing occurs on the systems and devices within the sys.log or auth.log files, which are then aggregated and stored for review and incident investigation.
Description Procedures Objectives References Remediation
A personally owned information system shall not be authorized to access, process, store or transmit CJI unless the agency has established and documented the specific terms and conditions for personally owned information system usage. When bring your own devices (BYOD) are authorized, they shall be controlled using the requirements in Section 5.5.7.3 Cellular. This control does not apply to the use of personally owned information systems to access agency’s information systems and information that are intended for public access (e.g., an agency’s public website that contains purely public information). [Customers and partners should address this requirement with their systems security policies and procedures.] AC-17 Personally owned information systems are prohibited from connecting to the AWS infrastructure.
Description Procedures Objectives References Remediation
Publicly accessible computers shall not be used to access, process, store or transmit CJI. Publicly accessible computers include but are not limited to: hotel business center computers, convention center computers, public library computers, public kiosk computers, etc. [Customers and partners should address this requirement when accessing their AWS environment through appropriate policies and procedures.] AC-17, AC-22 Publically accessible computers are not used to store or transmit CJI on the AWS infrastructure.
5.6: Identification and Authentication 5.6.1: Identification Policy and Procedures 5.6.1.1: Use of Originating Agency Identifiers in Transactions and Information Exchanges 5.6.2: Authentication Policy and Procedures 5.6.2.1: Standard Authenticators 5.6.2.1.1: Password 5.6.2.2: Advanced Authentication 5.6.2.2.1: Advanced Authentication Policy and Rationale 5.6.2.2.2: Advanced Authentication Decision Tree
Description Procedures Objectives References Remediation
Each person who is authorized to store, process, and/or transmit CJI shall be uniquely identified. A unique identification shall also be required for all persons who administer and maintain the system(s) that access CJI or networks leveraged for CJI transit. The unique identification can take the form of a full name, badge number, serial number, or other unique alphanumeric identifier. Agencies shall require users to identify themselves uniquely before the user is allowed to perform any actions on the system. Agencies shall ensure that all user IDs belong to currently authorized users. Identification data shall be kept current by adding new users and disabling and/or deleting former users. [The customer and partners can create unique identifiers in IAM; assign them individual security credentials (i.e., access keys, passwords, and Multi-Factor Authentication devices).] Reference: 1. IAM Best Practices 2. IAM Business Use Cases 3. Identities (Users, Groups, and Roles) IA-1, IA-2, IA-2 (5) AWS uses unique identifiers for all administrators and users with access to the AWS infrastructure. Which operations can be performed by the entity, or AWS service, that assumes the role. The customer can also define which entity is allowed to assume the role.
Description Procedures Objectives References Remediation
An FBI authorized originating agency identifier (ORI) shall be used in each transaction on CJIS systems in order to identify the sending agency and to ensure the proper level of access for each transaction. The original identifier between the requesting agency and the CSA/SIB/Channeler shall be the ORI, and other agency identifiers, such as user identification or personal identifier, an access device mnemonic, or the Internet Protocol (IP) address. Agencies may act as a servicing agency and perform transactions on behalf of authorized agencies requesting the service. Servicing agencies performing inquiry transactions on behalf of another agency may do so using the requesting agency’s ORI. Servicing agencies may also use their own ORI to perform inquiry transactions on behalf of a requesting agency if the means and procedures are in place to provide an audit trail for the current specified retention period. Because the agency performing the transaction may not necessarily be the same as the agency requesting the transaction, the CSA/SIB/Channeler shall ensure that the ORI for each transaction can be traced, via audit trail, to the specific agency, which is requesting the transaction. Audit trails can be used to identify the requesting agency if there is a reason to inquire into the details surrounding why an agency ran an inquiry on a subject. Agencies assigned a P (limited access) ORI shall not use the full access ORI of another agency to conduct an inquiry transaction. [Customers and partners are responsible for ensuring that originating agency identifiers (ORIs) are used in each transaction on CJIS systems.] References: 1. Amazon Resource Names (ARNs) and AWS Service Namespaces 2. Monitor AWS ELB Load Balancer 3. ELB Access Logs 4. Enable Access logging SC-16
Description Procedures Objectives References Remediation
Authentication refers to mechanisms or processes that verify users are valid once they are uniquely identified. The CSA/SIB may develop an authentication strategy, which centralizes oversight but decentralizes the establishment and daily administration of the security measures for access to CJI. Each individual’s identity shall be authenticated at either the local agency, CSA, SIB or Channeler level. The authentication strategy shall be part of the agency’s audit for policy compliance. The FBI CJIS Division shall identify and authenticate all individuals who establish direct web-based interactive sessions with FBI CJIS Services. The FBI CJIS Division shall authenticate the ORI of all message-based sessions between the FBI CJIS Division and its customer agencies but will not further authenticate the user nor capture the unique identifier for the originating operator because this function is performed at the local agency, CSA, SIB or Channeler level. [The customer and partners can create roles in IAM, and manage permissions to control which operations can be performed by the entity, or AWS service, that assumes the role. The customer can also define which entity is allowed to assume the role.] IA-1, IA-2, IA-2(8), IA-2(9), IA-3 AWS has implemented a formal, documented access control policy called “AWS Access Control Policy,” System accounts are established by submitting a request using Amazon’s self-service system account creation tool. Using this tool, mandatory fields, including unique account name, an account description, account owner, and a justification for the account creation.
Description Procedures Objectives References Remediation
Authenticators are the something you know, something you are, or something you have part of the identification and authentication process. Examples of standard authenticators include passwords, tokens, biometrics, and personal identification numbers (PIN). Agencies shall not allow the same authenticator (i.e., password, PIN) to be used multiple times on a device or system. Shared [Customers must address this requirement through appropriate policies, procedures, and configurations in how they access AWS resources.] Reference: 1. AWS Multi-Factor Authentication 2. AWS Security Token Service 3. Managing Access Keys for IAM Users IA-5, IA-5(1), IA-5(5), IA-6 AWS does not re-use the same authenticators across multiple systems. Where practical, AWS has implemented unique multi-factor authentication such as electronic key fobs, soft certificates, asymmetric encryption, and passwords.
Description Procedures Objectives References Remediation
Agencies shall follow the secure password attributes, below, to authenticate an individual’s unique ID. Passwords shall: 1. Be a minimum length of eight (8) characters on all systems. 2. Not be a dictionary word or proper name. 3. Not be the same as the User ID. 4. Expire within a maximum of 90 calendar days. 5. Not be identical to the previous ten (10) passwords. 6. Not be transmitted in the clear outside the secure location. 7. Not be displayed when entered. [Customers and partners are responsible for controlling the creation of user accounts. AWS IAM features include basic password management options for local accounts such as password length and complexity requirements. Customers and partners should establish a policy for the servers that align with the applicable CJIS requirements.] Reference: 1. Managing AWS account passwords 2. Setting an Account Password Policy for IAM Users IA-5 AWS administrators employ the Password Tool to associate an RSA public key with their system account. This public key is propagated to all hosts in the host classes that the user has permissions to manage. This allows the administrator to SSH to the hosts with their user id and the RSA private key, which the user maintains, protected by a passphrase. AWS enforces password complexity in the AWS LDAP with the AWS Password tool, which is employed by users to change passwords.
Description Procedures Objectives References Remediation
Advanced Authentication (AA) provides for additional security to the typical user identification and authentication of login ID and password, such as: biometric systems, user-based public key infrastructure (PKI), smart cards, software tokens, hardware tokens, paper (inert) tokens, or “Risk-based Authentication” that includes a software token element comprised of a number of factors, such as network information, user information, positive device identification (i.e. device forensics, user pattern analysis and user binding), user profiling, and high-risk challenge/response questions. [Customers and partners can use Multi-factor authentication (MFA) for extra security (Advanced Authentication) for privileged IAM users (users who are allowed access to sensitive resources).] References: 1. Using Multi-Factor Authentication (MFA) in AWS 2. AWS Developer Authenticated Identities IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(11), IA-3(1), IA-5(2), IA-5(2), IA-5(11), MA-4 AWS administrators authenticate their SSH connection to the network bastion hosts using an RSA private key and passphrase, then log on to the network device which uses TACACS to authenticate the user with their LDAP user ID and password. For privileged (root) commands, users must escalate privileges using an authenticated password. All escalations of privilege commands are audited.
Description Procedures Objectives References Remediation
The requirement to use or not use AA is dependent upon the physical, personnel and technical security controls associated with the user location. AA shall not be required for users requesting access to CJI from within the perimeter of a physically secure location (Section 5.9), when the technical security controls have been met (Sections 5.5 and 5.10). Conversely, if the technical security controls have not been met, AA shall be required even if the request for CJI originates from within a physically secure location. Section 5.6.2.2.2 provides agencies with a decision tree to help guide AA decisions. The intent of AA is to meet the standards of two-factor authentication. Two-factor authentication employs the use of two of the following three factors of authentication: something you know (e.g. password), something you have (e.g. hard token), something you are (e.g. biometric). The two authentication factors shall be unique (i.e. password/token or biometric/password but not password/password or token/token). INTERIM COMPLIANCE: 1. For interim compliance, users accessing CJI from devices associated with, and located within, a police vehicle are exempt from the AA requirement until September 30, 2014 if the information system being used has not been procured or upgraded any time after September 30, 2005. For the purposes of this Policy, a police vehicle is defined as an enclosed criminal justice conveyance with the capability to comply, during operational periods, with Section 5.9.1.3. 2. Internet Protocol Security (IPSec) does not meet the 2011 requirements for advanced authentication; however, agencies that have funded/implemented IPSec in order to meet the AA requirements of CJIS Security Policy v.4.5 may continue to utilize IPSec for AA until September 30, 2014. Examples: a. A police officer runs a query for CJI from his/her laptop mounted in a police vehicle. The police officer leverages a cellular network as the transmission medium; authenticates the device using IPSec key exchange; and tunnels across the cellular network using the IPSec virtual private network (VPN). IPSec was funded and installed in order to meet the AA requirements of CJIS Security Policy version 4.5. AA requirements are waived until September 30, 2014. b. A detective accesses CJI from various locations while investigating a crime scene. The detective uses an agency-managed laptop with IPSec installed and leverages a cellular network as the transmission medium. IPSec was funded and installed in order to meet the AA requirements of CJIS Security Policy version 4.5. AA requirements are waived until September 30, 2014. EXCEPTION: AA shall be required when the requested service has built AA into its processes and requires a user to provide AA before granting access. EXAMPLES: a. A user, irrespective of his/her location, accesses the LEO website. The LEO has AA built into its services and requires AA prior to granting access. AA is required. b. A user, irrespective of their location, accesses a State’s portal through which access to CJI is facilitated. The State Portal has AA built into its processes and requires AA prior to granting access. AA is required. [Customers and partners are responsible for determining when Advanced Authentication must be used in establishing an appropriate policy and rationale.] References: 1. Managing Federation in AWS 2. External Identity Providers 3. Amazon Cognito Identity 4. Adding a Hardware Virtual Private Gateway to Your VPC 5. AWS VPN CloudHub
Description Procedures Objectives References Remediation
The following AA Decision Tree, coupled with figures 9 and 10 below, assist decision makers in determining whether or not AA is required. 1. Can request’s originating location be determined physically? If either (a) or (b) below are true the answer to the above question is “yes”. Proceed to question 2. a. The IP address is attributed to a physical structure; or b. The mnemonic is attributed to a specific device assigned to a specific location that is a physical structure. If neither (a) or (b) above are true then the answer is “no”. Skip to question number 4. 2. Does request originate from within a physically secure location (that is not a police vehicle) as described in Section 5.9.1? If either (a) or (b) below are true the answer to the above question is “yes”. Proceed to question 3. a. The IP address is attributed to a physically secure location; or b. If a mnemonic is used it is attributed to a specific device assigned to a specific physically secure location. If neither (a) or (b) above are true then the answer is “no”. Decision tree completed. AA required. 3. Are all required technical controls implemented at this location or at the controlling agency? If either (a) or (b) below are true the answer to the above question is “yes”. Decision tree completed. AA requirement waived. a. Appropriate technical controls listed in Sections 5.5 and 5.10 are implemented; or b. The controlling agency (i.e. parent agency or agency leveraged as conduit to CJI) extends its wide area network controls down to the requesting agency and the extended controls provide assurance equal or greater to the controls listed in Sections 5.5 and 5.10. If neither (a) or (b) above are true then the answer is “no”. Decision tree completed. AA required. 4. Does request originate from an agency-managed user device? If either (a) or (b) below are true the answer to the above question is “yes”. Proceed to question 5. a. The static IP address or MAC address can be traced to registered device; or b. Certificates are issued to agency managed devices only and certificate exchange is allowed only between authentication server and agency issued devices. If neither (a) or (b) above are true then the answer is “no”. Decision tree completed. AA required. 5. Is the agency managed user device associated with and located within a law enforcement conveyance? If any of the (a), (b), or (c) statements below is true the answer to the above question is “yes”. Proceed to question 6. a. The static IP address or MAC address is associated with a device associated with a law enforcement conveyance; or b. The certificate presented is associated with a device associated with a law enforcement conveyance; or c. The mnemonic presented is associated with a specific device assigned and that device is attributed to a law enforcement conveyance. If none of the (a), (b), or (c) statements above are true then the answer is “no”. Skip to question number 7. 6. Has there been an acquisition or upgrade since 2005? If any of the (a), (b), (c), or (d) statements below are true the answer to the above question is “yes”. Proceed to question number 7. a. The “green-screen” MDTs have been replaced with laptops or other mobile devices; or b. An upgrade of technology exceeding 25% of the cost of the system being upgraded has taken place; or c. Any upgrade to the system encryption module has taken technology has taken place. If none of the (a), (b), (c), or (d) statements above are true then the answer is “no”. Decision tree completed. AA requirement waived. 7. Was IPSec implemented to meet the requirements of Policy Version 4.5? If either (a) or (b) below are true the answer to the above question is “yes”. Decision tree completed. AA requirement is waived. a. The budget acquisition of IPSec was completed prior to January 1, 2009 and IPSec was subsequently implemented; or b. Implementation of IPSec was completed prior to January 1, 2009. If neither (a) or (b) above are true then the answer is “no”. Decision tree completed. AA required. place; or d. Any upgrade to the system that is not replacing like [Customers and Partners are responsible for creating an Advanced Authentication Decision tree based on their specific implementation of AWS.] References: 1. Managing Federation in AWS 2. External Identity Providers 3. Amazon Cognito Identity 4. Adding a Hardware Virtual Private Gateway to Your VPC 5. AWS VPN CloudHub
5.6.3: Identifier and Authenticator Management 5.6.3.1: Identifier Management 5.6.3.2: Authenticator Management 5.6.4: Assertions
Description Procedures Objectives References Remediation
The agency shall establish identifier and authenticator management processes. [The customer and/or partner should establish identifier and authenticator management processes.] IA-4, IA-4(2), IA-4(4), IA-5, IA-5(8), IA-8
Description Procedures Objectives References Remediation
In order to manage user identifiers, agencies shall: 1. Uniquely identify each user. 2. Verify the identity of each user. 3. Receive authorization to issue a user identifier from an appropriate agency official. 4. Issue the user identifier to the intended party. 5. Disable the user identifier after a specified period of inactivity. 6. Archive user identifiers [Customers and partners are responsible for managing their own user identities and permissions according to this requirement.] AC-2(3), IA-4, IA-4(2), IA-4(4), IA-5(3), IA-5(8), IA-8 All access to the AWS infrastructure from AWS administrators is unique and requires verification.
Description Procedures Objectives References Remediation
In order to manage information system authenticators, agencies shall: 1. Define initial authenticator content. 2. Establish administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators. 3. Change default authenticators upon information system installation. 4. Change/refresh authenticators periodically. Information system authenticators include, for example, tokens, user-based PKI certificates, biometrics, passwords, and key cards. Users shall take reasonable measures to safeguard authenticators including maintaining possession of their individual authenticators, not loaning or sharing authenticators with others, and immediately reporting lost or compromised authenticators. [Customer and/or partner are responsibility based on customer agency requirements.] References: 1. AWS IAM Services 2. Signing and Authenticating REST API Requests 3. Amazon Cognito 4. AWS Security Token Service IA-5, IA-5(6), IA-5(8)
Description Procedures Objectives References Remediation
Identity providers can be leveraged to identify individuals and assert the individual’s identity to a service or to a trusted broker who will in turn assert the identity to a service. Assertion mechanisms used to communicate the results of a remote authentication to other parties shall be: 1. Digitally signed by a trusted entity (e.g., the identity provider). 2. Obtained directly from a trusted entity (e.g. trusted broker) using a protocol where the trusted entity authenticates to the relying party using a secure protocol (e.g. transport layer security [TLS]) that cryptographically authenticates the verifier and protects the assertion. Assertions generated by a verifier shall expire after 12 hours and shall not be accepted thereafter by the relying party. [Customer and partners should leverage identity certificates within various AWS services such as IAM, ELB and CloudFront to ensure trust of identities within their AWS customer environment.] References: 1. Working with Server Certificates 2. SSL Certificates for Elastic Load Balancing 3. Install and Configure OpenSSL IA-2 (12), IA-8 (1), IA-8 (2), IA-8 (3) AWS utilizes a combination of internal and trusted external certification authorities for validating individual identities. X.509 certificates are issued internally through a self-service certificate creation tool signed by the Amazon.com IT Security Certificate Authority. For external access points, commercial CA’s are used. Private keys and certificates are stored and distributed securely.
5.7: Configuration Management 5.7.1: Access Restrictions for Changes 5.7.1.1: Least Functionality 5.7.1.2: Network Diagram 5.7.2: Security of Configuration Documentation
Description Procedures Objectives References Remediation
Planned or unplanned changes to the hardware, software, and/or firmware components of the information system can have significant effects on the overall security of the system. The goal is to allow only qualified and authorized individuals access to information system components for purposes of initiating changes, including upgrades, and modifications. Section 5.5, Access Control, describes agency requirements for control of privileges and restrictions. [Customers and partners should establish their own CM Plan for their systems within AWS.] References: 1. AWS Config Guide 2. ITIL Event Management in the Cloud CM-3, CM-3 (2), CM-4, CM-4 (2), CM-5 (5), CM-5 (6), CM-6, CM-9, MA-2, MA-5, SA-10 AWS has a Change Management (CM) plan which governs the process to making significant changes to hardware, software, or firmware. The CM Plan is designed to make changes without disrupting users, and the vast majority of changes are made with no impact to the customers.
Description Procedures Objectives References Remediation
The agency shall configure the application, service, or information system to provide only essential capabilities and shall specifically prohibit and/or restrict the use of specified functions, ports, protocols, and/or services. [Customers and partners should configure their AWS application, service, or operating system to provide only essential capabilities; based on least functionality principals.] References: 1. Adhere to IAM Best Practices CM-2, CM-3, CM-6, CM-7, CM-7(1), CM-7(2), CM-7(3), CM-7(4), CM-7(5), CM-8(3), CM-10, CM-11, SA-4(9), SA-9(2) The AWS infrastructure was designed with least functionality principals. Customers must likewise configure their own applications and services with least functionality.
Description Procedures Objectives References Remediation
The agency shall ensure that a complete topological drawing depicting the interconnectivity of the agency network, to criminal justice information, systems and services is maintained in a current status. See Appendix C for sample network diagrams. The network topological drawing shall include the following: 1. All communications paths, circuits, and other components used for the interconnection, beginning with the agency-owned system(s) and traversing through all interconnected systems to the agency end-point. 2. The logical location of all components (e.g., firewalls, routers, switches, hubs, servers, encryption devices, and computer workstations). Individual workstations (clients) do not have to be shown; the number of clients is sufficient. 3. “For Official Use Only” (FOUO) markings. 4. The agency name and date (day, month, and year) drawing was created or updated. [Customers and partners should create their own network diagrams for their AWS environments according to the parameters in this control.] References: 1. AWS Architecture Center 2. AWS Icons for Architecture Diagrams CA-3, CA-9, SC-7 (4)
Description Procedures Objectives References Remediation
The system configuration documentation often contains sensitive details (e.g. descriptions of applications, processes, procedures, data structures, authorization processes, data flow, etc.) Agencies shall protect the system documentation from unauthorized access consistent with the provisions described in Section 5.5 Access Control. [Customers and partners should incorporate protective measures for system documentation.] CM-2, CM-5, CM-5 (1), CM-5 (2), CM-8, CM-8 (1), CM-9, SA-5 AWS protects its security configuration and shares the documentation only with those that have a validated need to know, and only for a limited time. AWS shares information with the federal government and protects documentation through additional controls such as Adobe LiveCycle services.
5.8: Policy Area 8: Media Protection 5.8.1: Media Storage and Access 5.8.2: Media Transport 5.8.2.1: Electronic Media in Transit 5.8.2.2: Physical Media in Transit 5.8.3: Electronic Media Sanitization and Disposal 5.8.4: Disposal of Physical Media
Description Procedures Objectives References Remediation
The agency shall securely store electronic and physical media within physically secure locations or controlled areas. The agency shall restrict access to electronic and physical media to authorized individuals. If physical and personnel restrictions are not feasible then the data shall be encrypted per Section 5.10.1.2. AWS has implemented a formal "Media Protection Policy" which outlines the requirements for protecting electronic media. AWS restricts access to digital media within their data centers through the implementation of physical and environmental security controls.
Description Procedures Objectives References Remediation
The agency shall protect and control electronic and physical media during transport outside of controlled areas and restrict the activities associated with transport of such media to authorized personnel. MP-5 AWS has implemented a formal "Media Protection Policy" which outlines the requirements for protecting electronic media. Customers must address this control within their environment via appropriate policies and procedures. Magnetic, non-magnetic, and hardcopy media types are not transported outside of the customer environments.
Description Procedures Objectives References Remediation
“Electronic media” means electronic storage media including memory devices in laptops and computers (hard drives) and any removable, transportable digital memory media, such as magnetic tape or disk, optical disk, flash drives, external hard drives, or digital memory card. Controls shall be in place to protect electronic media containing CJI while in transport (physically moved from one location to another) to help prevent compromise of the data. Encryption, as defined in Section 5.10.1.2 of this Policy, is the optimal control during transport; however, if encryption of the data isn’t possible then each agency shall institute other controls to ensure the security of the data. Shared [Customers and partners should develop polices and procedures related to their CJI media transfers.] References: 1. AWS Key Management Service AWS has implemented a formal "Media Protection Policy" which outlines the requirements for protecting electronic media. Customers must address this control within their environment via appropriate policies and procedures. Magnetic, non-magnetic, and hardcopy media types are not transported outside of the customer environments.
Description Procedures Objectives References Remediation
The controls and security measures in this document also apply to CJI in physical (printed documents, printed imagery, etc.) form. Physical media shall be protected at the same level as the information would be protected in electronic form. Customer [Customers and partners should address this control within their environment via appropriate policies and procedures.] MP-5
Description Procedures Objectives References Remediation
The agency shall sanitize, that is, overwrite at least three times or degauss electronic media prior to disposal or release for reuse by unauthorized individuals. Inoperable electronic media shall be destroyed (cut up, shredded, etc.). The agency shall maintain written documentation of the steps taken to sanitize or destroy electronic media. Agencies shall ensure the sanitization or destruction is witnessed or carried out by authorized personnel. MA-2, MP-6, MP-6(1), MP-6(2), MP-6(3) AWS has established a Data Destruction Policy, Data Destruction Guidelines, and Media Protection Policy. Portable magnetic media, non-magnetic media, and paper output are not permitted or applicable to the AWS environment. For other data storage services (such as standard hard drives), AWS follows its Media Destruction Procedures.
Description Procedures Objectives References Remediation
Physical media shall be securely disposed of when no longer required, using formal procedures. Formal procedures for the secure disposal or destruction of physical media shall minimize the risk of sensitive information compromise by unauthorized individuals. Physical media shall be destroyed by shredding or incineration. Agencies shall ensure the disposal or destruction is witnessed or carried out by authorized personnel. MP-6 AWS has established a Data Destruction Policy, Data Destruction Guidelines, and Media Protection Policy. Portable magnetic media, non-magnetic media, and paper output are not permitted or applicable to the AWS environment. For other data storage services (such as standard hard drives), AWS follows its Media Destruction Procedures.
5.9: Physical Protection 5.9.1.1: Security Perimeter 5.9.1.2: Physical Access Authorizations 5.9.1.3: Physical Access Control 5.9.1.4: Access Control for Transmission Medium 5.9.1.5: Access Control for Display Medium 5.9.1.6: Monitoring Physical Access 5.9.1.7: Visitor Control 5.9.1.8: Delivery and Removal
Description Procedures Objectives References Remediation
The perimeter of physically secure location shall be prominently posted and separated from non-secure locations by physical controls. Security perimeters shall be defined, controlled and secured in a manner acceptable to the CSA or SIB [Customers and partners are responsible for any applicable security perimeter requirements for their facilities.] AWS maintains strong controls around its data centers. Access to AWS data centers is limited to a small number of AWS employees, and AWS customers are prohibited from entering AWS data centers. Entry areas are the only publically accessible areas of data centers, where non-permanent personnel check-in and are validated as authorized personnel and issued appropriate access cards. Intrusions detection systems and other technologies are used to protect and sound alarms if the security perimeter is breached.
Description Procedures Objectives References Remediation
The agency shall develop and keep current a list of personnel with authorized access to the physically secure location (except for those areas within the permanent facility officially designated as publicly accessible) or shall issue credentials to authorized personnel. [Customers and partners must implement a process to control secure locations in accordance with this control.] MA-4(7), MA-5, PE-2, PE-2(1) AWS maintains a list of authorized personnel with access to the AWS data centers.
Description Procedures Objectives References Remediation
The agency shall control all physical access points (except for those areas within the facility officially designated as publicly accessible) and shall verify individual access authorizations before granting access. PE-3, PE-3(3) Only authorized personnel are allowed to enter the AWS data centers. Every access is individually verified prior to granting access.
Description Procedures Objectives References Remediation
The agency shall control physical access to information system distribution and transmission lines within the physically secure location. PE-4 AWS maintains control over physical access to distribution and transmissions lines.
Description Procedures Objectives References Remediation
The agency shall control physical access to information system devices that display CJI and shall position information system devices in such a way as to prevent unauthorized individuals from accessing and viewing CJI. [This is a customer and/or partner responsibility. AWS systems do not display CJI information.] PE-5
Description Procedures Objectives References Remediation
The agency shall monitor physical access to the information system to detect and respond to physical security incidents. PE-3, PE-5, PE-6, PE-6(1) Access to AWS data centers is monitored by trained guards 24x7, video surveillance, and intrusion detection systems.
Description Procedures Objectives References Remediation
The agency shall control physical access by authenticating visitors before authorizing escorted access to the physically secure location (except for those areas designated as publicly accessible). The agency shall escort visitors at all times and monitor visitor activity. PE-2(3), PE-3 Visitors are not authorized into AWS facilities.
Description Procedures Objectives References Remediation
The agency shall authorize and control information system-related items entering and exiting the physically secure location. PE-8 All equipment entering or existing AWS data centers must be approved prior to their introduction or removal. Data storage components are always destroyed before leaving AWS data centers.
5.9.2: Controlled Area
Description Procedures Objectives References Remediation
If an agency cannot meet all of the controls required for establishing a physically secure location, but has an operational need to access or store CJI, the agency shall designate an area, a room, or a storage container, as a controlled area for the purpose of day-to-day CJI access or storage. The agency shall, at a minimum: 1. Limit access to the controlled area during CJI processing times to only those personnel authorized by the agency to access or view CJI. 2. Lock the area, room, or storage container when unattended. 3. Position information system devices and documents containing CJI in such a way as to prevent unauthorized individuals from access and view. 4. Follow the encryption requirements found in Section 5.10.1.2 for electronic storage (i.e. data “at rest”) of CJI. PE-2, PE-5 AWS meets all requirements defined for a "physically secure location".
5.10: System and Communications Protection and Information Integrity 5.10.1: Information Flow Enforcement 5.10.1.1: Boundary Protection 5.10.1.2: Encryption 5.10.1.3: Intrusion Detection Tools and Techniques 5.10.1.4: Voice over Internet Protocol 5.10.1.5: Cloud Computing 5.10.2: Facsimile Transmission of CJI 5.10.3: Partitioning and Virtualization
Description Procedures Objectives References Remediation
The network infrastructure shall control the flow of information between interconnected systems. Information flow control regulates where information is allowed to travel within an information system and between information systems (as opposed to who is allowed to access the information) and without explicit regard to subsequent accesses to that information. In other words, controlling how data moves from one place to the next in a secure manner. Examples of controls that are better expressed as flow control than access control (see Section 5.5) are: 1. Prevent CJI from being transmitted unencrypted across the public network. 2. Block outside traffic that claims to be from within the agency. 3. Do not pass any web requests to the public network that are not from the internal web proxy. Specific examples of flow control enforcement can be found in boundary protection devices (e.g. proxies, gateways, guards, encrypted tunnels, firewalls, and routers) that employ rule sets or establish configuration settings that restrict information system services or provide a packet filtering capability. [Customers and partners should define and manage their own ACLs, NCLs and VPC's.] References: 1. AWS Network and Security 2. Security Groups for VPCs 3. Network ACLs 4. Adding Hardware Virtual Private Gateway to VPC AC-4, AC-20, AC-20(1), CA-3, CA-9, IA-5(7), SC-7(4), SC-7(8), SC-7(11), SC-10, SC-15, SC-15(1) AWS Security approved ACLs, or traffic flow policies, are established on each managed interface, which manage and enforce the flow of traffic within the AWS infrastructure.
Description Procedures Objectives References Remediation
The agency shall: 1. Control access to networks processing CJI. 2. Monitor and control communications at the external boundary of the information system and at key internal boundaries within the system. 3. Ensure any connections to the Internet, other external networks, or information systems occur through controlled interfaces (e.g. proxies, gateways, routers, firewalls, encrypted tunnels). See Section 5.10.4.4 for guidance on personal firewalls. 4. Employ tools and techniques to monitor network events, detect attacks, and provide identification of unauthorized use. 5. Ensure the operational failure of the boundary protection mechanisms do not result in any unauthorized release of information outside of the information system boundary (i.e. the device shall “fail closed” vs. “fail open”). 6. Allocate publicly accessible information system components (e.g. public Web servers) to separate sub networks with separate, network interfaces. Publicly accessible information systems residing on a virtual host shall follow the guidance in Section 5.10.3.2 to achieve separation. Shared [To support customers and partners with FIPS 140‐2 requirements, the Amazon Virtual Private Cloud VPN endpoints and SSL‐terminating load balancers in AWS GovCloud (US) operate using FIPS 140‐2 Level 2 validated hardware.} References: 1. VPC Endpoints 2. AWS GovCloud Endpoints AC-20, CA-3(1), CA-3(2), CA-3(5), PE-3(2), SC-5, SC-5(1), SC-5(2), SC-7, SC-7(3), SC-7(4), SC-7(5), SC-7(7), SC-7(8), SC-7(11), SC-7(12), SC-7(13), SC-7(14), SC-7(18), SC-24 AWS has strategically placed a limited, but growing, number of access points to AWS. These customer access points are called API endpoints, and they allow secure HTTP access (HTTPS), which allows the customer to establish a secure communication session with their storage or compute instances within AWS. In addition, AWS has implemented network devices that are dedicated to managing interfacing communications with Internet service providers (ISPs). AWS employs a redundant connection to more than one communication service at each Internet‐facing edge of the AWS network. These connections each have dedicated network devices.
Description Procedures Objectives References Remediation
1. Encryption shall be a minimum of 128 bits. 2. When CJI is transmitted outside the boundary of the physically secure location, the data shall be immediately protected via cryptographic mechanisms (encryption). EXCEPTIONS: See Sections 5.5.7.3.2 and 5.10.2. 3. When CJI is at rest (i.e. stored electronically) outside the boundary of the physically secure location, the data shall be protected via cryptographic mechanisms (encryption). 4. When encryption is employed, the cryptographic module used shall be certified to meet FIPS 140-2 standards. Note 1: Subsequent versions of approved cryptographic modules that are under current review for FIPS 140-2 compliancy can be used in the interim until certification is complete. Note 2: While FIPS 197 (Advanced Encryption Standard) certification is desirable, a FIPS 197 certification alone is insufficient as the certification is for the algorithm only vs. the FIPS 140-2 standard, which certifies the packaging of an implementation. 5. For agencies using public key infrastructure technology, the agency shall develop and implement a certificate policy and certification practice statement for the issuance of public key certificates used in the information system. Registration to receive a public key certificate shall: a) Include authorization by a supervisor or a responsible official. b) Be accomplished by a secure process that verifies the identity of the certificate holder. c) Ensure the certificate is issued to the intended party. [Customer and partners can choose to connect to AWS through multiple secure protocols. AWS supports the use of the Secure Shell (SSH) network protocol to enable the customer to connect remotely to their UNIX/Linux. Customers and partners can also connect remotely to their Windows instances using Remote Desktop Protocol (RDP) by utilizing an RDP certificate generated for their instance.] Note: AWS requires that every message be authenticated. For API requests using SOAP, messages must be hashed and signed for integrity and non‐repudiation. AWS services require that SOAP messages be secured using the WS‐Security standard BinarySecurityToken profile, consisting of an X.509 certificate with an RSA public key. References: 1. Overview of Security Processes AC-17(2), IA-7, MA-4(6), SC-8, SC-8(1), SC-8(2), SC-11, SC-12, SC-12(1), SC-12(2), SC-12(3), SC-13, SC-17, SC-28, SC-28(1), SI-7(6) AWS protects the confidentiality of transmitted data through the use of symmetric encryption of data before transmission to ensure the message contents are not readable in transit. SSL or TLS session are terminates at load balancers or, for S3 connections, at the web servers. Both the load balancers and the web servers employ OpenSSL. Cryptographic ciphers available: AES-256-CBC, AES-128-CBC, 3DES-EDE-CBC
Description Procedures Objectives References Remediation
The agency shall implement network-based and/or host-based intrusion detection tools. The CSA/SIB shall, in addition: 1. Monitor inbound and outbound communications for unusual or unauthorized activities. 2. Send individual intrusion detection logs to a central logging facility where correlation and analysis will be accomplished as a system wide intrusion detection effort. 3. Employ automated tools to support near real-time analysis of events in support of detecting system level attacks. [Customers and partners are responsible to deploy requisite intrusion detection solutions in the data environment.] References: 1. Intrusion Detection in the Cloud SC-7(19), SI-4, SI-4(1), SI-4(2), SI-4(4), SI-4(5), SI-4(7), SI-4(9), SI-4(11), SI-4(12), SI-7, SI-7(1), SI-7(7) AWS security monitoring tools are in position to identify several types of system anomalies for the AWS infrastructure. If issues are identified, the AWS incident response process is initiated. Additionally, redundant telecommunication providers at each region as well as additional capacity protect against the possibility of service degradation.
Description Procedures Objectives References Remediation
Voice over Internet Protocol (VoIP) has been embraced by organizations globally as an addition to, or replacement for, public switched telephone network (PSTN) and private branch exchange (PBX) telephone systems. The immediate benefits are lower costs than traditional telephone services and VoIP can be installed in-line with an organization’s existing Internet Protocol (IP) services. Among VoIP’s risks that have to be considered carefully are: myriad security concerns, cost issues associated with new networking hardware requirements, and overarching quality of service (QoS) factors. In addition to the security controls described in this document, the following additional controls shall be implemented when an agency deploys VoIP within a network that contains unencrypted CJI: 1. Establish usage restrictions and implementation guidance for VoIP technologies. 2. Change the default administrative password on the IP phones and VoIP switches. 3. Utilize Virtual Local Area Network (VLAN) technologies to segment VoIP traffic from data traffic. Appendix G.2 outlines threats, vulnerabilities, mitigations, and NIST best practices for VoIP. [VoIP is not applicable to the AWS environment. The customer and/or partner should address this control as applicable.] SC-19
Description Procedures Objectives References Remediation
Organizations transitioning to a cloud environment are presented unique opportunities and challenges (e.g., purported cost savings and increased efficiencies versus a loss of control over the data). Reviewing the cloud computing white paper (Appendix G.3), the cloud assessment located within the security policy resource center on FBI.gov, NIST Special Publications (800-144, 800-145, and 800-146), as well as the cloud provider’s policies and capabilities will enable organizations to make informed decisions on whether or not the cloud provider can offer service that maintains compliance with the requirements of the CJIS Security Policy. The metadata derived from CJI shall not be used by any cloud service provider for any purposes. The cloud service provider shall be prohibited from scanning any email or data files for the purpose of building analytics, data mining, advertising, or improving the services provided. AWS is a FedRAMP Moderate compliant Cloud Service Provider and meets NIST guidelines for secure cloud hosting.
Description Procedures Objectives References Remediation
CJI transmitted via facsimile is exempt from encryption requirements. Facsimile is not applicable in the AWS environment
Description Procedures Objectives References Remediation
As resources grow scarce, agencies are increasing the centralization of applications, services, and system administration. Advanced software now provides the ability to create virtual machines that allows agencies to reduce the amount of hardware needed. Although the concepts of partitioning and virtualization existed previously, the need for securing the partitions and virtualized machines has evolved due to the increasing amount of distributed processing and federated information sources now available across the Internet. [Customer and partners can isolate their environment in their own virtual network and connect to their existing IT infrastructure using industry-standard encrypted IPSec VPN and direct connect to their Virtual Private Cloud (VPC). AWS recommends that customers further protect their data using appropriate means. One common solution is to run an encrypted file system on top of the virtualized disk device.] References: 1. Amazon Virtual Private Cloud 2. Expanding a Linux Partition 3. Linux AMI Virtualization Types SC-2, SC-4 AWS utilizes a highly customized hypervisor, taking advantage of paravirtualization. Because paravirtualized guests rely on the hypervisor to provide support for operations that normally require privileged access, the guest OS has no elevated access to the CPU. This explicit virtualization of the physical resources leads to a clear separation between guest and hypervisor, resulting in additional security separation between the two. Note: Customer instances have no access to raw disk devices, but instead are presented with virtualized disks that map logical blocks to physical blocks on the disk device.
5.10.3.1: Partitioning 5.10.3.2: Virtualization 5.0.10.4.1: Patch Management 5.0.10.4.2: Malicious Code Protection 5.0.10.4.3: Spam and Spyware Protection 5.0.10.4.4: Security Alerts and Advisories 5.0.10.4.5: Information Input Restrictions
Description Procedures Objectives References Remediation
The application, service, or information system shall separate user functionality (including user interface services) from information system management functionality. The application, service, or information system shall physically or logically separate user interface services (e.g. public web pages) from information storage and management services (e.g. database management). Separation may be accomplished through the use of one or more of the following: 1. Different computers. 2. Different central processing units. 3. Different instances of the operating system. 4. Different network addresses. 5. Other methods approved by the FBI CJIS ISO. Customer and partner have a variety of ways to meet partitioning requirements in the AWS infrastructure. This may include the use of physical separation through separate services (GovCloud versus US East/West), Dedicated Instances, Availability Zones, Regions, or logical controls such as the use of Virtual Private Clouds (VPC's), Access Control Lists (ACLs), encryption and key management, or access control. References: 1. AWS Regions and Endpoints 2. VPC Endpoint for Amazon S3 3. Access Control List (ACL) Overview SC-2, SC-2 (1), SC-3, SC-4, SC-32 Traffic that is not explicitly allowed to or from an instance is automatically denied. In addition to security groups, network traffic entering and exiting each subnet can be allowed or denied via network Access Control Lists (ACLs).
Description Procedures Objectives References Remediation
Virtualization refers to a methodology of dividing the resources of a computer (hardware and software) into multiple execution environments. Virtualized environments are authorized for criminal justice and noncriminal justice activities. In addition to the security controls described in this Policy, the following additional controls shall be implemented in a virtual environment: 1. Isolate the host from the virtual machine. In other words, virtual machine users cannot access host files, firmware, etc. 2. Maintain audit logs for all virtual machines and hosts and store the logs outside the hosts’ virtual environment. 3. Virtual Machines that are Internet facing (web servers, portal servers, etc.) shall be physically separate from Virtual Machines that process CJI internally. 4. Device drivers that are “critical” shall be contained within a separate guest. The following are additional technical security control best practices and should be implemented wherever feasible: 1. Encrypt network traffic between the virtual machine and host. 2. Implement IDS and IPS monitoring within the virtual machine environment. 3. Virtually firewall each virtual machine from each other (or physically firewall each virtual machine from each other with an application layer firewall) and ensure that only allowed protocols will transact. 4. Segregate the administrative duties for the host. Appendix G-1 provides some reference and additional background information on virtualization. [Customer and partner instances have no access to raw disk devices, but instead are presented with virtualized disks that map logical blocks to physical blocks on the disk device. Customer and partners should review the different options for setting their EC2 instances and machine images.] References: 1. Amazon EC2 2. Amazon Machine Images (AMI) 3. AMI Types SC-2, SC-4 AWS utilizes a highly customized hypervisor, taking advantage of paravirtualization. Because paravirtualized guests rely on the hypervisor to provide support for operations that normally require privileged access, the guest OS has no elevated access to the CPU. This explicit virtualization of the physical resources leads to a clear separation between guest and hypervisor, resulting in additional security separation between the two.
Description Procedures Objectives References Remediation
The agency shall identify applications, services, and information systems containing software or components affected by recently announced software flaws and potential vulnerabilities resulting from those flaws. The agency (or the software developer/vendor in the case of software developed and maintained by a vendor/contractor) shall develop and implement a local policy that ensures prompt installation of newly released security relevant patches, service packs and hot fixes. Local policies should include such items as: 1. Testing of appropriate patches before installation. 2. Rollback capabilities when installing patches, updates, etc. 3. Automatic updates without individual user intervention. 4. Centralized patch management. Patch requirements discovered during security assessments, continuous monitoring or incident response activities shall also be addressed expeditiously. [Customers and partners should track and implement patch management processes on their AWS systems.] References: 1. Amazon Machine Images (AMI) 2. AWS Windows AMI Version History 3. Updating Instance Software CM-3, CM-4, CM-4(1), RA-5, RA-5(1), RA-5(2), RA-5(3), SA-11, SA-11(1), SI-2, SI-2 (2), SI-2(3) All AWS patch management activities must go through the patch validation/vetting process by the service team responsible for researching vulnerabilities. Patches are applied after the security and infrastructure teams have reviewed the risks, implementation, fixes, and potential impact.
Description Procedures Objectives References Remediation
The agency shall implement malicious code protection that includes automatic updates for all systems with Internet access. Agencies with systems not connected to the Internet shall implement local procedures to ensure malicious code protection is kept current (i.e. most recent update available). The agency shall employ virus protection mechanisms to detect and eradicate malicious code (e.g., viruses, worms, Trojan horses) at critical points throughout the network and on all workstations, servers and mobile computing devices on the network. The agency shall ensure malicious code protection is enabled on all of the aforementioned critical points and information systems and resident scanning is employed. [Customers and Partners should define a malicious code protection approach for their use of AWS services.] References: 1. AWS Overview of Security Services 2. AV protection AWS marketplace MA-3 (2), SI-3, SI-3 (1), SI-3 (2) The AWS infrastructure is built primarily on a customized Linux-based environment. AWS has taken a non-traditional approach to malicious code protection, and uses a combination of internal research, open source community-distributed software alerts, and has special support contracts to receive appropriate notifications when a security alert is released (and in some cases before it is made public). AWS deploys changes using its approved change management process.
Description Procedures Objectives References Remediation
The agency shall implement spam and spyware protection. The agency shall: 1. Employ spam protection mechanisms at critical information system entry points (e.g. firewalls, electronic mail servers, remote access servers). 2. Employ spyware protection at workstations, servers and mobile computing devices on the network. 3. Use the spam and spyware protection mechanisms to detect and take appropriate action on unsolicited messages and spyware/adware, respectively, transported by electronic mail, electronic mail attachments, Internet accesses, removable media (e.g. diskettes or compact disks) or other removable media as defined in this Policy. [Customers and partners are responsible for detecting and preventing spam and spyware on their AWS systems and services they deploy.] References: 1. AWS Overview of Security Services 2. Spam & Spyware protection on AWS marketplace SI-8, SI-8(1), SI-8(2) AWS has limited exposure to spam and spyware in its infrastructure environment, which is not connected to e-mail servers and is heavily Linux based. Malware mitigation practices are in place across the infrastructure.
Description Procedures Objectives References Remediation
The agency shall: 1. Receive information system security alerts/advisories on a regular basis. 2. Issue alerts/advisories to appropriate personnel. 3. Document the types of actions to be taken in response to security alerts/advisories. 4. Take appropriate actions in response. 5. Employ automated mechanisms to make security alert and advisory information available throughout the agency as appropriate. [Customers and partner should define a process for receiving and issuing system security alerts within their environment.] References: 1. AWS Security Bulletins 2. Security Resources SI-5, SI-5(1), SI-11 AWS uses a combination of internal research, open source community-distributed software alerts, and special support contracts to receive appropriate notifications when a security alert is released (in some cases before it is made public).
Description Procedures Objectives References Remediation
The agency shall restrict the information input to any connection to FBI CJIS services to authorized personnel only. Restrictions on personnel authorized to input information to the information system may extend beyond the typical access controls employed by the system and include limitations based on specific operational/project responsibilities. [The customer and partners are responsible for restricting the information input to any connection to FBI CJIS services to authorized personnel only.] SI-10, SI-12
5.11: Formal Audits 5.11.1.1: Triennial Compliance Audits by the FBI CJIS Division 5.11.1.2: Triennial Security Audits by the FBI CJIS Division 5.11.1.3: Audits by the CSA 5.11.1.4: Special Security Inquiries and Audits
Description Procedures Objectives References Remediation
The FBI CJIS Division is authorized to conduct audits, once every three (3) years as a minimum, to assess agency compliance with applicable statutes, regulations and policies. The CJIS Audit Unit (CAU) shall conduct a triennial audit of each CSA in order to verify compliance with applicable statutes, regulations and policies. This audit shall include a sample of CJAs and, in coordination with the SIB, the NCJAs. Audits may be conducted on a more frequent basis if the audit reveals that an agency has not complied with applicable statutes, regulations and policies. The FBI CJIS Division shall also have the authority to conduct unannounced security inspections and scheduled audits of Contractor facilities. [The customer and/or partners are responsible for supporting FBI CJIS Division audits and in turn requesting support from AWS if applicable.] CA-2, CA-7 AWS is a FedRAMP compliant CSP. AWS was assessed by the Veris Group, LLC. an accredited FedRAMP 3PAO and has been granted two Agency FedRAMP Authorizations by the US Department of Health and Human Services (HHS) after demonstrating compliance with the FedRAMP security requirements.
Description Procedures Objectives References Remediation
The FBI CJIS Division is authorized to conduct security audits of the CSA and SIB networks and systems, once every three (3) years as a minimum, to assess agency compliance with the CJIS Security Policy. This audit shall include a sample of CJAs and NCJAs. Audits may be conducted on a more frequent basis if the audit reveals that an agency has not complied with the CJIS Security Policy. [The customer and/or partners are responsible for supporting FBI CJIS Division audits and in turn requesting support from AWS if applicable.] CA-2 AWS is a FedRAMP compliant CSP. AWS was assessed by the Veris Group, LLC. an accredited FedRAMP 3PAO and has been granted two Agency FedRAMP Authorizations by the US Department of Health and Human Services (HHS) after demonstrating compliance with the FedRAMP security requirements.
Description Procedures Objectives References Remediation
Each CSA shall: 1. At a minimum, triennially audit all CJAs and NCJAs which have direct access to the state system in order to ensure compliance with applicable statutes, regulations and policies. 2. In coordination with the SIB, establish a process to periodically audit all NCJAs, with access to CJI, in order to ensure compliance with applicable statutes, regulations and policies. 3. Have the authority to conduct unannounced security inspections and scheduled audits of Contractor facilities. [The customer and/or partners are responsible for supporting FBI CJIS Division audits and in turn requesting support from AWS if applicable.] CA-2 AWS is a FedRAMP compliant CSP. AWS was assessed by the Veris Group, LLC. an accredited FedRAMP 3PAO and has been granted two Agency FedRAMP Authorizations by the US Department of Health and Human Services (HHS) after demonstrating compliance with the FedRAMP security requirements.
Description Procedures Objectives References Remediation
All agencies having access to CJI shall permit an inspection team to conduct an appropriate inquiry and audit of any alleged security violations. The inspection team shall be appointed by the APB and shall include at least one representative of the CJIS Division. All results of the inquiry and audit shall be reported to the APB with appropriate recommendations. [The customer and/or partners are responsible for supporting FBI CJIS Division audits and in turn requesting support from AWS if applicable.] CA-2, CA-2(1), CA-5, CA-6, CA-7(1), CM-3(4) AWS is a FedRAMP compliant CSP. AWS was assessed by the Veris Group, LLC. an accredited FedRAMP 3PAO and has been granted two Agency FedRAMP Authorizations by the US Department of Health and Human Services (HHS) after demonstrating compliance with the FedRAMP security requirements.
5.12: Personnel Security 5.12.1.1: Minimum Screening Requirements for Individuals Requiring Access to CJI: 5.12.1.2: Personnel Screening for Contractors and Vendors 5.12.2: Personnel Termination 5.12.3: Personnel Transfer 5.12.4: Personnel Sanctions
Description Procedures Objectives References Remediation
1. To verify identification, a state of residency and national fingerprint-based record checks shall be conducted within 30 days of assignment for all personnel who have direct access to CJI and those who have direct responsibility to configure and maintain computer systems and networks with direct access to CJI. However, if the person resides in a different state than that of the assigned agency, the agency shall conduct state (of the agency) and national fingerprint-based record checks and execute a NLETS CHRI IQ/FQ/AQ query using purpose code C, E, or J depending on the circumstances. When appropriate, the screening shall be consistent with: (i) 5 CFR 731.106; and/or (ii) Office of Personnel Management policy, regulations, and guidance; and/or (iii) agency policy, regulations, and guidance. (See Appendix J for applicable guidance regarding noncriminal justice agencies performing adjudication of civil fingerprint submissions.) Federal entities bypassing state repositories in compliance with federal law may not be required to conduct a state fingerprint-based record check. 2. All requests for access shall be made as specified by the CSO. The CSO, or their designee, is authorized to approve access to CJI. All CSO designees shall be from an authorized criminal justice agency. 3. If a felony conviction of any kind exists, the hiring authority in the Interface Agency shall deny access to CJI. However, the hiring authority may ask for a review by the CSO in extenuating circumstances where the severity of the offense and the time that has passed would support a possible variance. 4. If a record of any other kind exists, access to CJI shall not be granted until the CSO or his/her designee reviews the matter to determine if access is appropriate. 5. If the person appears to be a fugitive or has an arrest history without conviction, the CSO or his/her designee shall review the matter to determine if access to CJI is appropriate. 6. If the person is employed by a NCJA, the CSO or his/her designee, and, if applicable, the appropriate board maintaining management control, shall review the matter to determine if CJI access is appropriate. This same procedure applies if this person is found to be a fugitive or has an arrest history without conviction. 7. If the person already has access to CJI and is subsequently arrested and or convicted, continued access to CJI shall be determined by the CSO. This does not implicitly grant hiring/firing authority with the CSA, only the authority to grant access to CJI. 8. If the CSO or his/her designee determines that access to CJI by the person would not be in the public interest, access shall be denied and the person's appointing authority shall be notified in writing of the access denial. 9. Support personnel, contractors, and custodial workers with access to physically secure locations or controlled areas (during CJI processing) shall be subject to a state and national fingerprint-based record check unless these individuals are escorted by authorized personnel at all times. It is recommended individual background re-investigations be conducted every five years unless Rap Back is implemented. [Customers and partner should address this control within their AWS environment through appropriate policies, procedures and implementations.] PS-2, PS-3, PS-3 (1), PS-3 (2), PS-3 (3), PS-6, PS-6 (2), PS-7 AWS has established formal policies and procedures to delineate the minimum standards for logical access to AWS platform and infrastructure hosts. AWS conducts criminal background checks, as permitted by law, as part of pre-employment screening practices for employees and commensurate with the employee’s position and level of access. The policies also identify functional responsibilities for the administration of logical access and security.
Description Procedures Objectives References Remediation
In addition to meeting the requirements in paragraph 5.12.1.1, contractors and vendors shall meet the following requirements: 1. Prior to granting access to CJI, the CGA on whose behalf the Contractor is retained shall verify identification via a state of residency and national fingerprint-based record check. However, if the person resides in a different state than that of the assigned agency, the agency shall conduct state (of the agency) and national fingerprint-based record checks and execute a NLETS CHRI IQ/FQ/AQ query using purpose code C, E, or J depending on the circumstances. 2. If a record of any kind is found, the CGA shall be formally notified and system access shall be delayed pending review of the criminal history record information. The CGA shall in turn notify the Contractor-appointed Security Officer. 3. When identification of the applicant with a criminal history has been established by fingerprint comparison, the CGA or the CJA (if the CGA does not have the authority to view CHRI) shall review the matter. 4. A Contractor employee found to have a criminal record consisting of felony conviction(s) shall be disqualified. 5. Applicants shall also be disqualified on the basis of confirmations that arrest warrants are outstanding for such applicants. 6. The CGA shall maintain a list of personnel who have been authorized access to CJI and shall, upon request, provide a current copy of the access list to the CSO. Applicants with a record of misdemeanor offense(s) may be granted access if the CSO determines the nature or severity of the misdemeanor offense(s) do not warrant disqualification. The CGA may request the CSO to review a denial-of-access determination. [Customers and partners should ensure contractors' identification is verified via the state of residency and national fingerprint-based record check.] PS-2, PS-3, PS-7 AWS has addressed this control with documented policies and procedures.
Description Procedures Objectives References Remediation
The agency, upon termination of individual employment, shall immediately terminate access to CJI. [Customers and partners should also address this control within their AWS environment through appropriate policies and procedures.] PS-4 Accounts are reviewed every 90 days and explicit re‐approval is required or access to the resource is automatically revoked. Access is also automatically revoked when an employee’s record is terminated. Windows and UNIX accounts are disabled and Amazon’s permission management system removes the user from all systems. Requests for changes in access are captured in the Amazon permissions management tool audit log. When changes in an employee’s job function occur, continued access must be explicitly approved to the resource or it will be automatically revoked.
Description Procedures Objectives References Remediation
The agency shall review CJI access authorizations when personnel are reassigned or transferred to other positions within the agency and initiate appropriate actions such as closing and establishing accounts and changing system access authorizations. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] PS-5 Accounts are reviewed every 90 days and explicit re‐approval is required or access to the resource is automatically revoked. Access is also automatically revoked when an employee’s record is terminated. Windows and UNIX accounts are disabled and Amazon’s permission management system removes the user from all systems. Requests for changes in access are captured in the Amazon permissions management tool audit log. When changes in an employee’s job function occur, continued access must be explicitly approved to the resource or it will be automatically revoked.
Description Procedures Objectives References Remediation
The agency shall employ a formal sanctions process for personnel failing to comply with established information security policies and procedures. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] PS-8 AWS has established sanctions, including termination, for personnel that violate AWS policies. Customers are responsible for creating their own sanctions for their systems and employees.
5.13: Mobile Devices 5.13.1.1: All 802.11x Wireless Protocols 5.13.1.2: Cellular 5.13.1.2.1: Cellular Service Abroad 5.13.1.2.2: Voice Transmissions Over Cellular Devices 5.13.1.3: Bluetooth 5.13.2: Mobile Device Management (MDM) 5.13.3: Wireless Device Risk Mitigations 5.13.3.1: Legacy 802.11 Protocols
Description Procedures Objectives References Remediation
Agencies shall: 1. Perform validation testing to ensure rogue APs (Access Points) do not exist in the 802.11 Wireless Local Area Network (WLAN) and to fully understand the wireless network security posture. 2. Maintain a complete inventory of all Access Points (APs) and 802.11 wireless devices. 3. Place APs in secured areas to prevent unauthorized physical access and user manipulation. 4. Test AP range boundaries to determine the precise extent of the wireless coverage and design the AP wireless coverage to limit the coverage area to only what is needed for operational purposes. 5. Enable user authentication and encryption mechanisms for the management interface of the AP. 6. Ensure that all APs have strong administrative passwords and ensure that all passwords are changed in accordance with Section 5.6.2.1. 7. Ensure the reset function on APs is used only when needed and is only invoked by authorized personnel. Restore the APs to the latest security settings, when the reset functions are used, to ensure the factory default settings are not utilized. 8. Change the default service set identifier (SSID) in the APs. Disable the broadcast SSID feature so that the client SSID must match that of the AP. Validate that the SSID character string does not contain any agency identifiable information (division, department, street, etc.) or services. 9. Enable all security features of the wireless product, including the cryptographic authentication, firewall, and other privacy features. 10. Ensure that encryption key sizes are at least 128 bits and the default shared keys are replaced by unique keys. 11. Ensure that the ad hoc mode has been disabled. 12. Disable all nonessential management protocols on the APs and disable hypertext transfer protocol (HTTP) when not needed or protect HTTP access with authentication and encryption. 13. Enable logging (if supported) and review the logs on a recurring basis per local policy. At a minimum logs shall be reviewed monthly. 14. Segregate, virtually (e.g. virtual local area network (VLAN) and ACLs) or physically (e.g. firewalls), the wireless network from the operational wired infrastructure. Limit access between wireless networks and the wired network to only operational needs. 15. When disposing of access points that will no longer be used by the agency, clear access point configuration to prevent disclosure of network configuration, keys, passwords, etc. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] There are no wireless access points allowed within the system boundaries. Wireless access is not permitted within the AWS infrastructure.
Description Procedures Objectives References Remediation
Cellular telephones, smartphones (i.e. Blackberry, iPhones, etc.), personal digital assistants (PDA), and “aircards” are examples of cellular handheld devices or devices that are capable of employing cellular technology. Additionally, cellular handheld devices typically include Bluetooth, infrared, and other wireless protocols capable of joining infrastructure networks or creating dynamic ad hoc networks. Threats to cellular handheld devices stem mainly from their size, portability, and available wireless interfaces and associated services. Examples of threats to cellular handheld devices include: 1. Loss, theft, or disposal. 2. Unauthorized access. 3. Malware. 4. Spam. 5. Electronic eavesdropping. 6. Electronic tracking (threat to security of data and safety of law enforcement officer). 7. Cloning (not as prevalent with later generation cellular technologies). 8. Server-resident data. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] There are no cellular devices allowed within the system boundary. Cellular devices are not permitted to connect to the AWS infrastructure.
Description Procedures Objectives References Remediation
Certain functions on cellular devices may be modified or compromised by the cellular carrier during international use as the devices are intended to have certain parameters configured by the cellular provider which is considered a “trusted” entity by the device. When devices are authorized for use outside the U.S., agencies shall perform an inspection to ensure that all controls are in place and functioning properly in accordance with the agency’s policies. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] There are no cellular devices allowed within the system boundary. Cellular devices are not permitted to connect to the AWS infrastructure.
Description Procedures Objectives References Remediation
Any cellular device used to transmit CJI via voice is exempt from the encryption and authentication requirements. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] VoIP is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
Bluetooth is an open standard for short-range radio frequency (RF) communication. Bluetooth technology has been integrated into many types of business and consumer devices, including cell phones, laptops, automobiles, medical devices, printers, keyboards, mice, headsets, and biometric capture devices. Bluetooth technology and associated devices are susceptible to general wireless networking threats (e.g. denial-of-service [DoS] attacks, eavesdropping, man-in-the-middle [MITM] attacks, message modification, and resource misappropriation) as well as specific Bluetooth-related attacks that target know vulnerabilities in Bluetooth implementations and specifications. Organizational security policy shall be used to dictate the use of Bluetooth and its associated devices based on the agency’s operational and business processes. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] Bluetooth is not applicable to the AWS environment. Customers must address this requirement through appropriate policies and procedures according to the agency’s operational and business processes.
Description Procedures Objectives References Remediation
MDM facilitates the implementation of sound security controls for mobile devices and allows for centralized oversight of configuration control, application usage, and device protection and recovery (if so desired by the agency). Due to the potential for inconsistent network access or monitoring capability on mobile devices, methods used to monitor and manage the configuration of full featured operating systems may not function properly on devices with limited feature operating systems. MDM systems and application coupled with device specific technical policy can provide a robust method for device configuration management if properly implemented. Devices that have had any unauthorized changes made to them (including but not limited to being rooted or jailbroken) shall not be used to process, store, or transmit CJI data at any time. Agencies shall implement the following controls when allowing CJI access from cell/smart phones and tablet devices: 1. Ensure that CJI is only transferred between CJI authorized applications and storage areas of the device. 2. MDM with centralized administration configured and implemented to perform at least the: i. Remote locking of device ii. Remote wiping of device iii. Setting and locking device configuration iv. Detection of “rooted” and “jailbroken” devices v. Enforce folder or disk level encryption vi. Application of mandatory policy settings on the device vii. Detection of unauthorized configurations or software/applications [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
Organizations shall, at a minimum, ensure that cellular wireless devices: 1. Apply available critical patches and upgrades to the operating system as soon as they become available for the device and after necessary testing as described in Section 5.10.4.1 2. Are configured for local device authentication (see Section 5.13.9.1). 3. Use advanced authentication. 4. Encrypt all CJI resident on the device. 5. Erase cached information, to include authenticators (see Section 5.6.2.1) in applications, when session is terminated. 6. Employ personal firewalls or run a Mobile Device Management (MDM) system that facilitates the ability to provide firewall services from the agency level. 7. Employ antivirus software or run a MDM system that facilitates the ability to provide antivirus services from the agency level. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA) cryptographic algorithms, used by all pre-802.11i protocols, do not meet the requirements for FIPS 140-2 and shall not be used. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] There are no wireless access points allowed within the system boundaries. Wireless access is not permitted within the AWS infrastructure.
5.13.4: System Integrity 5.13.4.1: Patching/Updates 5.13.4.2: Malicious Code Protection 5.13.4.3: Physical Protection 5.13.4.4: Personal Firewall 5.13.5: Incident Response 5.13.6: Auditing and Accountability 5.13.7: Access Control
Description Procedures Objectives References Remediation
Managing system integrity on limited function mobile operating systems may require methods and technologies significantly different from traditional full featured operating systems. In many cases, the requirements of Section 5.10 of the CJIS Security Policy cannot be met with a mobile device without the installation of a third-party MDM, application, or supporting service infrastructure. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
Based on the varying connection methods for mobile devices, an “always on” connection cannot be guaranteed for patching and updating. Devices without “always on” cellular connections may not be reachable for extended periods of time by the MDM or solution either to report status or initiate patching. Agencies shall monitor mobile devices not capable of an “always on” cellular connection (i.e. Wi-Fi only or Wi-Fi with cellular on-demand) to ensure their patch and update state is current. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
Appropriately configured MDM software is capable of checking the installed applications on the device and reporting the software inventory to a central management console in a manner analogous to traditional virus scan detection of unauthorized software and can provide a high degree of confidence that only known software or applications are installed on the device. Agencies that allow smartphones and tablets to access CJI shall have a process to approve the use of specific software or applications on the devices. An appropriately configured MDM shall be used on smartphones and tablets to prevent the installation of unauthorized software or applications. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
Due to small form factors and the fact that mobile devices are often stored in lower security areas, the risk to theft or loss of the device and any data stored on it is elevated. Physical protections will often be the responsibility of the assigned device user. When mobile devices are authorized for use to access CJI are lost or stolen, agencies shall: 1. Have the ability to determine the location of agency controlled smartphones and tablets. 2. Immediately wipe the device. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
For the purpose of this policy, a personal firewall is an application that controls network traffic to and from a user device, permitting or denying communications based on policy. A personal firewall shall be employed on all mobile devices that have a full-feature operating system (i.e. laptops or tablets with Windows or Linux/Unix operating systems). At a minimum, the personal firewall shall perform the following activities: 1. Manage program access to the Internet. 2. Block unsolicited requests to connect to the user device. 3. Filter incoming traffic by IP address or protocol. 4. Filter incoming traffic by destination ports. 5. Maintain an IP traffic log. Mobile devices with limited feature operating systems (i.e. tablets, smartphones) may not support a personal firewall. However, these operating systems have a limited number of system services installed, carefully controlled network access, and to a certain extent, perform similar functions a personal firewall would provide on a device with a full feature operating system. Appropriately configured MDM software is capable of controlling which applications are allowed on the device. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
In addition to the requirements in Section 5.3 Incident Response, agencies shall develop additional or enhanced incident reporting and handling procedures to address mobile device operating scenarios. Rapid response to mobile device related incidents can significantly mitigate the risks associated with illicit data access either on the device itself or within online data resources associated with the device through an application or specialized interface. Special reporting procedures for mobile devices shall apply in any of the following situations: 1. Loss of device control. a. Device known to be locked, minimal duration of loss b. Device lock state unknown, minimal duration of loss c. Device lock state unknown, extended duration of loss d. Device known to be unlocked, more than momentary duration of loss 2. Total loss of device. a. CJI stored on device b. Lock state of device c. Capabilities for remote tracking or wiping of device 3. Device compromise. 4. Device loss or compromise outside the United States. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
The ability to implement audit and accountability functions may not be natively included on mobile devices with limited function operating systems (e.g. Android, Apple iOS). Either additional device management systems or auditing from systems accessed by the mobile device may be necessary to ensure appropriate levels of auditing exist. Additionally, the type of connectivity capable by the device will also affect the ability to collect audit logs for review. A mobile device not capable of providing required audit and accountability on its own accord shall be monitored by a MDM, other management system, or application capable of collecting required log data. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
Multiple user accounts are not generally supported on limited function mobile operating systems. This may mean the policy requirements for access control (Section 5.5 Access Control, regarding account management) would not apply to the operating system, but rather to a particular application, either stand-alone to the device or as part of a client server architecture. [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
5.13.8: Wireless Hotspot Capability 5.13.9: Identification and Authentication 5.13.10: Device Certificates
Description Procedures Objectives References Remediation
Many mobile devices include the capability to function as a wireless access point or Wi-Fi hotspot that allows other devices to connect through the device to the Internet over the devices cellular network. When an agency allows mobile devices to function as a wireless access point, they shall be configured: 1. In accordance with the requirements in section 5.13.1.1 All 802.11 Wireless Protocols 2. To only allow connections from agency authorized devices [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.
Description Procedures Objectives References Remediation
Due to the technical methods used for identification and authentication on many limited feature mobile operating systems, achieving compliance may require many different components. Customer [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment..
Description Procedures Objectives References Remediation
Device certificates are often used to uniquely identify mobile devices using part of a public key pair on the device in the form of a public key certificate. While there is value to ensuring the device itself can authenticate to a system supplying CJI, and may provide a critical layer of device identification or authentication in a larger scheme, a device certificate alone placed on the device shall not be considered valid proof that the device is being operated by an authorized user. When certificates or cryptographic keys used to authenticate a mobile device are stored on the device, they shall be: 1. Protected against being extracted from the device 2. Configured for remote wipe on demand or self-deletion based on a number of unsuccessful login or access attempts 3. Configured to use a secure authenticator (i.e. password, PIN) to unlock the key for use [Customers and partners should address this control within their AWS environment through appropriate policies and procedures.] MDM is not applicable to the AWS environment.