Risk management process

Absolute confidence in the information accessed or available in the Army      enterprise is unachievable; as such, the Army and DOD will approach increasing that level of trust through the implementation of a risk management process.  With technological advances and capabilities, training, and IA-focused processes to reduce identifiable threats, the level of trust of information and ISs is significantly increased. Establish a risk management process containing the following phases as a minimum for all Army ISs. The process outlined in this chapter is based, in principle, on the risk management doctrine as defined by FM 100–14—

(1) Identify threats such as those posed by default designs or configurations, architecture deficiencies, insider access, and foreign or nation-state interests and capabilities.

A.  WebEx Conferencing Infrastructure allows multiple users at multiple locations to view documents, such as Power Point slides - simultaneously on their web browsers while discussing them telephonically -- a teleconference with visual aids, so to speak.  In it's most unsecured state, a skilled hacker could potentially access a session in progress and observe slides.

(2) Assess threats to determine risks. What information is accessible? Unclassified/ Unclassified Sensitive.  Who has authorization to access the information?  PM-UA personnel, FCS staff, Lead Support Integrator (LSI) (Boeing) and all subordinate contractors. What is the potential adverse effect of loss, access, or manipulation of the data? Most data is time-sensitive and effect of loss would be minimal.  Loss of non-time sensitive data would possibly give insight into the operations of the FCS program.  What are the OPSEC issues of data availability? Program is in its infancy, so as it develops data will become more sensitive in nature.  Data will become classified and be transmitted via SIPRNet or other classified network prior to the point where loss could be detrimental.  What are the data owner’s requirements?  Real-time collaboration capabilities with all aforementioned elements who have authorized access.

(3) Develop controls and make risk management decisions. How do you protect the information, access, and infrastructure?  Session can only be conducted in a secure manner.  Participants are required to utilize a browser with 128-bit encryption and cannot access the session without it.  A session ID and pass code is provided solely to authorized participants.  The session host can view the list of all session participants logged into the session, and block a participant they recognize as being an unauthorized attendee.  Data is transmitted encrypted from the host station to all participants' stations, via a segmented and isolated server.  Administrators of the server cannot see information or data as it passes through the server due to its encrypted state.  The server is segmented to protect the session from parallel sessions occurring simultaneously, and is further blocked from listing the session in the "active session" list.

(4) Implement controls, countermeasures, or solutions and monitor for compliance and success.  See #3.

(5) Supervise, evaluate, review, and refine as necessary.  Strictly monitored by LSI security personnel for compliance with all security requirements/procedures.

Commanders, combat developers, and materiel developers will integrate the risk management process in the planning, coordination, and development of Army ISs.  Security policy should mirror security restrictions as identified above.