Login | Register

• Print this |
• Email this
• Digg
• De.licio.us
• Slashdot
• Technorati

Image: Zaid Hamid

That is what FISMA is all about. What are your weaknesses and what can you do about it?” Dennis Heretick, Justice Department

Inside the project

Database security

Challenge: Getting the Justice Department’s FISMA performance grade out of the basement requires tools to automate the compliance process as much as possible. Key to this is the ability to perform vulnerability assessments of critical IT systems and fix the vulnerabilities as they are found. What’s more, Justice needs to document progress and processes for FISMA’s certification and accreditation process.

Solution: Justice was already using tools to scan its network for holes and assess security configurations. Application security was the next logical step. The department began with an enterprise license for AppDetective, a database application security-scanning tool already in use by the FBI and the Office of Justice Programs. Administrators are now being trained on the new tool, which will be phased in across the enterprise.

Mission benefit: AppDetective automatically performs application discovery to identify database resources. It then performs penetration testing and audits to identify vulnerabilities. Problems are ranked according to severity, and the software provides information about fixes. Some fixes, such as closing down or changing default accounts and passwords, can be automated.

Lessons learned: It is still early in the implementation process, but introducing a new technology into the database mix will require care, said Dennis Heretick, Justice’s IT security staff director. “You have to work with the implementation to create a workable schedule.” You also should start small and grow, he said. Justice will begin with pilot projects and expand from there. “Otherwise you make a lot of mistakes all over the place, rather than in one small area.”