Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 32 views

    Nist

    Uploaded by

    smoulikarthik
    The NIST security model provides a comprehensive framework for information security based on several NIST special publications. These publications include NIST SP 800-12 which introduces computer security and should be used as a precursor to understanding security systems. NIST SP 800-14 details best practices and principles that can direct a security team in developing a security blueprint. NIST SP 800-18 provides methods for assessing, designing, and implementing controls and plans for applications and can serve as a guide for security planning. Additional NIST publications like SP 800-26 and SP 800-30 provide guidance on conducting security self-assessments and risk assessments.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Nist

    Uploaded by

    smoulikarthik
    32 views7 pages
    The NIST security model provides a comprehensive framework for information security based on several NIST special publications. These publications include NIST SP 800-12 which introduces computer security and should be used as a precursor to understanding security systems. NIST SP 800-14 details best practices and principles that can direct a security team in developing a security blueprint. NIST SP 800-18 provides methods for assessing, designing, and implementing controls and plans for applications and can serve as a guide for security planning. Additional NIST publications like SP 800-26 and SP 800-30 provide guidance on conducting security self-assessments and risk assessments.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The NIST security model provides a comprehensive framework for information security based on several NIST special publications. These publications include NIST SP 800-12 which introduces computer security and should be used as a precursor to understanding security systems. NIST SP 800-14 details best practices and principles that can direct a security team in developing a security blueprint. NIST SP 800-18 provides methods for assessing, designing, and implementing controls and plans for applications and can serve as a guide for security planning. Additional NIST publications like SP 800-26 and SP 800-30 provide guidance on conducting security self-assessments and risk assessments.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    32 views7 pages

    Nist

    Uploaded by

    smoulikarthik
    The NIST security model provides a comprehensive framework for information security based on several NIST special publications. These publications include NIST SP 800-12 which introduces computer security and should be used as a precursor to understanding security systems. NIST SP 800-14 details best practices and principles that can direct a security team in developing a security blueprint. NIST SP 800-18 provides methods for assessing, designing, and implementing controls and plans for applications and can serve as a guide for security planning. Additional NIST publications like SP 800-26 and SP 800-30 provide guidance on conducting security self-assessments and risk assessments.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 7

    Information Security

    UNIT-IV
    NIST Security Model

    Presented by
    Tmt.P.Tharani
    AP/CSE
    GCE,Salem

    1
    NIST Security Model
     This refers to “The National Security Telecommunications and
    Information systems Security Committee” document.
     This document presents a comprehensive model for
    information security
     The following NIST documents can assist in the design of a
    security framework:
    1. NIST SP 800-12 : An Introduction to Computer Security:
    The NIST Handbook
    2. NIST SP 800-14 : Generally Accepted Security Principles
    and Practices for Securing IT Systems
    3. NIST SP 800-18 : The Guide for Developing Security Plans
    for IT Systems
    4. NIST SP 800-26: Security Self-Assessment Guide for IT
    systems.
    5. NIST SP 800-30: Risk Management for IT systems. 2
    • NIST Special Publication SP 800-12 SP 800-12, An
    Introduction to Computer Security: The NIST Handbook, is an
    excellent reference and guide for the security manager or
    administrator in the routine management of information
    security.
     It provides little guidance, however, on design and
    implementation of new security systems, and therefore should
    be used only as a precursor to understanding an information
    security blueprint.

    3
    • NIST Special Publication 800-14 Generally Accepted Principles
    and Practices for Securing Information Technology Systems
    provides best practices and security principles that can direct the
    security team in the development of a security blueprint
     In addition to detailing security best practices across the spectrum of
    security areas, it provides philosophical principles that the security
    team should integrate into the entire information security process.
    • Security Supports the Mission of the Organization
    • Security is an Integral Element of Sound Management
    • Security Should Be Cost-Effective
    • Systems Owners Have Security Responsibilities Outside Their Own
    Organizations
    • Security Responsibilities and Accountability Should Be Made
    Explicit
    • Security Requires a Comprehensive and Integrated Approach
    • Security Should Be Periodically Reassessed
    • Security is Constrained by Societal Factors
    (Refer Table 5-6 in Textbook)
    4
    • NIST Special Publication 800-18 Rev. 1 The Guide for
    Developing Security Plans for Federal Information Systems
    can be used as the foundation for a comprehensive security
    blueprint and framework.
     This publication provides detailed methods for assessing,
    designing, and implementing controls and plans for
    applications of varying size.
     SP 800-18 Rev. 1 can serve as a useful guide to the activities
    described in this chapter and as an aid in the planning process.
    It also includes templates for major application security plans.
    (Refer Table 5-7 in Textbook)

    5
    • NIST SP 800-26: Security Self-Assessment Guide for IT
    systems
    1. Management Controls
    2. Operational Controls
    3. Technical Controls
    • NIST SP 800-30:The purpose of Special Publication 800-30 is
    to provide guidance for conducting risk assessments of federal
    information systems and organizations.
     Special Publication 800-30 also provides guidance to
    organizations on identifying specific risk factors to monitor on
    an ongoing basis, so that organizations can determine whether
    risks have increased to unacceptable levels (i.e., exceeding
    organizational risk tolerance) and different courses of action
    should be taken

    6
    Thank You

    You might also like