NIST SPECIAL PUBLICATION 1800-9

---

Access Rights Management for the Financial Services Sector

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), and How-To Guides (C)

James Banoczi

Sallie Edwards

Nedu Irrechukwu

Josh Klosterman

Harry Perper

Susan Prince

Susan Symington

Devin Wynne

DRAFT

NIST SPECIAL PUBLICATION 1800-9

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), and How-To Guides (C)

James Banoczi

National Cybersecurity Center of Excellence

Information Technology Laboratory

Sallie Edwards

Nedu Irrechukwu

Josh Klosterman

Harry Perper

Susan Prince

Susan Symington

Devin Wynne

The MITRE Corporation

McLean, VA

DRAFT

August 2017

U.S. Department of Commerce

Wilbur Ross, Secretary

National Institute of Standards and Technology

Kent Rochford, Acting Undersecretary of Commerce for Standards and Technology and Director

• Volume A
  • Executive Summary
    • Challenge
    • Solution
    • Benefits
    • Share Your Feedback
    • Technology Partners/Collaborators

• Volume B
  • 1. Summary
    • 1.1. Challenge
    • 1.2. Solution
    • 1.3. Risk Considerations
    • 1.4. Benefits
  • 2. How to Use This Guide
    • 2.1. Typographical Conventions
  • 3. Approach
    • 3.1. Audience
    • 3.2. Scope
    • 3.3. Assumptions
      • 3.3.1. Security
      • 3.3.2. Modularity
      • 3.3.3. Human Resources Database/Identity Vetting
      • 3.3.4. Technical Implementation
      • 3.3.5. Limited Scalability Testing
      • 3.3.6. Replication of Enterprise Networks
    • 3.4. Risk Assessment
      • 3.4.1. Assessing Risk Posture
      • 3.4.2. Security Control Map
    • 3.5. Security Functions and Subcategories Related to FFIEC
    • 3.6. Technologies
  • 4. Architecture
    • 4.1. Architecture Description
      • 4.1.1. High-Level Architecture
      • 4.1.2. Reference Design
  • 5. Example Implementation
    • 5.1. Example Implementation Description
    • 5.2. Operation of the Example Implementation
      • 5.2.1. Example Implementation Network Components Overview
      • 5.2.2. Common Services Network
      • 5.2.3. Access Rights Management Network
      • 5.2.4. Network Data Flows
    • 5.3. Data
  • 6. Security Analysis
    • 6.1. Assumptions and Limitations
    • 6.2. Build Testing
    • 6.3. Scenarios and Findings
    • 6.4. Analysis of the Reference Design’s Support for CSF Subcategories
      • 6.4.1. Supported CSF Subcategories
    • 6.5. Security of the Reference Design
      • 6.5.1. Securing New Attack Surfaces
      • 6.5.2. Ensuring Information Integrity
      • 6.5.3. Privileged Access Management
      • 6.5.4. Isolating Reference Design Capabilities from Each Other
      • 6.5.5. Deployment Recommendations
    • 6.6. Security Evaluation Summary
  • 7. Functional Evaluation
    • 7.1. ARM Functional Test Plan
    • 7.2. ARM Use Case Requirements
    • 7.3. Test Case: ARM-1
    • 7.4. Test Case ARM-2
    • 7.5. Test Case ARM-3
    • 7.6. Test Case ARM-4
    • 7.7. Test Case ARM-5

• Volume C
  • 1. Introduction
    • 1.1. Practice Guide Structure
    • 1.2. Build Overview
    • 1.3. Typographical Conventions
    • 1.4. Logical Architecture Summary
    • 1.5. Network Diagrams
    • 1.6. NCCoE Lab
  • 2. Product Installation Guides
    • 2.1. AlertEnterprise
      • 2.1.1. How It’s Used
      • 2.1.2. Virtual Machine Configuration
      • 2.1.3. Prerequisites
      • 2.1.4. Java
      • 2.1.5. Apache Activemq
      • 2.1.6. Oracle DB
      • 2.1.7. 7-Zip
      • 2.1.8. Installation
      • 2.1.9. Install and Configure Tomcat
      • 2.1.10. Configure the Database Server
      • 2.1.11. Deploying the Application
      • 2.1.12. Start the Server
      • 2.1.13. Provisioning Configuration
      • 2.1.14. Creating System Connectors
      • 2.1.15. User Data Source
      • 2.1.16. Process Designer
      • 2.1.17. Policies
      • 2.1.18. Rules
      • 2.1.19. Policy Designer
      • 2.1.20. Triggers Field Map
      • 2.1.21. Form Customization
      • 2.1.22. User Field Mapping
      • 2.1.23. Provisioning Mapping
      • 2.1.24. External Provisioning Attributes
      • 2.1.25. Role Repository
      • 2.1.26. Enabling SSL
    • 2.2. HyTrust Cloud Control
      • 2.2.1. How Its Used
      • 2.2.2. Virtual Machine Configuration
      • 2.2.3. Installing Vcenter Server
      • 2.2.4. Configuring Vcenter Server
      • 2.2.5. Deploying HTCC
      • 2.2.6. Configuring HTCC
      • 2.2.7. Integrating With Active Directory
      • 2.2.8. Creating and Deploying Access Policies
      • 2.2.9. Configure Logging
    • 2.3. Microsoft Active Directory
      • 2.3.1. How It’s Used
      • 2.3.2. Virtual Machine Configuration
      • 2.3.3. Installing AD
      • 2.3.4. DNS Configuration
      • 2.3.5. Installing Splunk Universal Forwarder
      • 2.3.6. Install Security Compliance Manager
      • 2.3.7. Group Policy Object (GPO) Configuration
      • 2.3.8. Script: AdDOnlineStatus.ps1
      • 2.3.9. LDAPS Configuration
    • 2.4. NextLabs Entitlement Manager
      • 2.4.1. How It’s Used
      • 2.4.2. Virtual Machine Configuration
      • 2.4.3. Prerequisites
      • 2.4.4. Installing NextLabs
    • 2.5. OpenLDAP
      • 2.5.1. How It’s Used
      • 2.5.2. Virtual Machine Configuration
      • 2.5.3. Firewall Configuration
      • 2.5.4. Installation
      • 2.5.5. Audit Configuration
      • 2.5.6. STARTTLS and LDAPS Configuration
      • 2.5.7. Formatting Audit Logs
      • 2.5.8. Script: /etc/ldap/logs/auditlogscript
      • 2.5.9. Script: /etc/ldap/logs/add-timestamp.py
      • 2.5.10. Script: /etc/cron.daily/openldap-status
    • 2.6. Radiant Logic
      • 2.6.1. How Its Used
      • 2.6.2. Virtual Machine Configuration
      • 2.6.3. Installing the Virtual Directory
      • 2.6.4. Configuring VD
      • 2.6.5. Configure Logging
      • 2.6.6. Configure Views for SharePoint
      • 2.6.7. Scripts
      • 2.6.8. Script: RadiantOnlineStatus.ps1
      • 2.6.9. Script: VanguardOnlineStatus.ps1
      • 2.6.10. LDAPS Configuration
    • 2.7. SharePoint
      • 2.7.1. How It’s Used
      • 2.7.2. Virtual Machine Configuration
      • 2.7.3. Prerequisites
      • 2.7.4. Installing SharePoint 2013
      • 2.7.5. Configuring SharePoint
      • 2.7.6. Web Configs
    • 2.8. Splunk
      • 2.8.1. How It’s Used
      • 2.8.2. Installation
      • 2.8.3. Queries
      • 2.8.4. Query: Detect User Provisioning Accounts Events
      • 2.8.5. Query: Authorized and Unauthorized Provisioning Trend Line Chart
      • 2.8.6. Query: Combined Provisioning Trend Line Chart
      • 2.8.7. Query: Detect modifications to High Value or Privileged Accounts
      • 2.8.8. Query: Virtual Directory Server Offline Detection
      • 2.8.9. Query: Critical Servers Offline
      • 2.8.10. SSL Forwarding
    • 2.9. TDI ConsoleWorks
      • 2.9.1. How It’s Used
      • 2.9.2. Virtual Machine Configuration
      • 2.9.3. Firewall Configuration
      • 2.9.4. Installation
      • 2.9.5. Console Connection Configuration
      • 2.9.6. Graphical Gateway Configuration
      • 2.9.7. Graphical Connection Configuration
      • 2.9.8. Profile Creation
      • 2.9.9. Access Controls
      • 2.9.10. User Auditing
      • 2.9.11. Cron Configuration: /etc/crontab
      • 2.9.12. Scripts: connectionreporting
      • 2.9.13. Scripts: bashconnectionreporting
    • 2.10. Network Firewall Configuration
      • 2.10.1. Firewall Configuration for Backbone Subnet
      • 2.10.2. Firewall Configuration for Common Services Subnet
      • 2.10.3. Firewall Configuration for ID-ARM Subnet
      • 2.10.4. Firewall Configuration for Private Cloud Subnet
      • 2.10.5. Firewall Configuration for the Management and Monitoring Subnet