This
month’s Criminal Justice Information Services (CJIS) Security Policy blog looks
at Policy Area 2 – Security Awareness Training. In CJIS Security Policy version
5.1 we find an increase in requirements for awareness training that was brought
forward from version 5.0 but not found in previous versions, where only record
keeping was addressed. The updated requirements focus on content of training
and levels of training dependent upon a person’s level of access to Criminal
Justice Information (CJI).
Awareness Topics
Before discussing the content of training, the security policy requires basic security awareness training within six months of initial assignment for personnel who are able to access CJI. Further training is required every two years. If training is accepted from another agency, such training must also meet CJIS requirements. Security awareness training must include specific information for the following groups:
Ø All personnel
Ø Personnel with physical and logical access
Ø Personnel with information technology roles
All Personnel – At a minimum, the following topics must be addressed as baseline security awareness training for all authorized personnel with access to CJI:
- Rules that describe responsibilities and expected behavior with regard to CJI usage
- Implications of noncompliance
- Incident response; points of contact and individual actions
- Media protection
- Visitor control and physical access to spaces; applicable physical security policy and procedures, e.g., challenge strangers, report unusual activity
- Protect information subject to confidentiality concerns; hardcopy through destruction
- Proper handling and marking of CJI
- Threats, vulnerabilities, and risks associated with handling CJI
- Dissemination and destruction
Personnel with Physical and Logical Access – In addition to baseline training for all personnel, the following topics, at a minimum, must be addressed as baseline security awareness training for all authorized personnel with both physical and logical access to CJI:
- Rules that describe responsibilities and expected behavior with regard to information system usage
- Password usage and management; including creation, frequency of changes, and protection
- Protection from viruses, worms, Trojan horses, and other malicious code
- Unknown e-mail and attachments
- Web usage; allowed versus prohibited, monitoring of user activity
- Spam
- Social engineering
- Physical security; increases in risks to systems and data
- Media protection
- Handheld device security issues; address both physical and wireless security issues
- Use of encryption and the transmission of sensitive and confidential information over the Internet; address agency policy, procedures, and technical contact for assistance
- Laptop security; address both physical and information security issues
- Personally owned equipment and software; state whether allowed or not, including copyrights
- Access control issues; address least privilege and separation of duties
- Individual accountability; explain what this means in the agency
- Use of acknowledgement statements; passwords, access to systems and data, personal use and gain
- Desktop security; discuss use of screensavers, restricting visitors’ view of information on screen, e.g. mitigating “shoulder surfing”, battery backup devices and allowed access to systems
- Protect information subject to confidentiality concerns; in systems, archived, on backup media, and until destroyed
- Threats, vulnerabilities, and risks associated with accessing CJIS service systems and services
Personnel with Information Technology Roles – In addition to baseline security for all personnel and personnel with physical and logical access, the following topics at a minimum must be addressed as baseline security awareness training for all information technology personnel, e.g. system administrators, security administrators, network administrators:
- Protection from viruses, worms, Trojan horses, and other malicious code to include scanning and updating definitions
- Data backup and storage; centralized or decentralized approach
- Timely application of system patches; part of configuration management
- Access control measures
- Network infrastructure protection measures
Security Training Records
The policy standards pertaining to security training records remain relatively the same as in earlier versions. One rule which has been added requires security training records to be maintained by the CJIS Systems Officer (CSO)/State Identification Bureaus (SIB)/Compact Officer. The policy also states that maintenance can be delegated to the local level.
Summary
The Security Awareness Training section of the CJIS Security Policy has become more robust with recent versions. The content of baseline training is very specific and is cumulative, commissariat with increased access and roles of responsibilities for maintaining the security of CJI. Timeframes for training are in effect for initial training as well as additional training every two years. Training records must be maintained by the proper authority.
Next Blog
Policy Area 3. Incident Response. This area addresses the capability to detect and address a security incident. Increased mandates are added to include reporting, addressing weaknesses, and the processes in place. Formal responsibilities are added as are mandates for monitoring and incident response training. Join us next month to learn more about the increased mandates for incident response.
