Several years have passed since the announcement and inception of the new Department of Defense (DoD) program protection process. In 2011, the DoD program protection process was changed to integrate security into Systems Engineering, which enables the application of science and engineering in identifying vulnerabilities and completing an associated risk-cost-benefit trade study. The expanded role of the program protection process enables the most appropriate mix of measures to protect the information, components and technologies from known security threats and attacks. Show This following Question and Answer series provides some lessons learned from a program protection practitioner’s experiences. Q. What is the purpose of the Program Protection Plan
(PPP)? Further, the DoD Directive on Cybersecurity in the Defense Acquisition System requires that the PPP continue to be reviewed and approved by the appropriate sustainment program manager. The PPP document includes five appendices: Security Classification Guide (SCG), Counterintelligence Support Plan (CISP), Criticality Analysis, Anti-Tamper (AT) Plan, and the Cybersecurity Strategy. Table 2 outlines this document and appendices. Q. How can program protection be made more effective?
 For example, to influence the project’s design, the SSE should participate in the design trade-offs and be present during the System Requirements Review (SRR) to review the security requirements with the stakeholders. Experience shows that many programs do not start early enough with PPP requirements, nor do they have an SSE as part of their systems engineering integrated product team (IPT). As another example, during the system specification review, the following should be accomplished:
Even under the best circumstances, the PPP remains largely misunderstood. For example, many PMs identify the cybersecurity person, who is usually not the most appropriate PPP development leader, either because the most appropriate skill set is lacking, or the person already is very busy with the Risk Management Framework and other cyber activities. Some managers have found that they need a specialist to perform this analysis but then select the Information System Security Officer as the overseer. As a best practice, the systems engineer should take overall responsibility for the program’s security, and the lead role for PPP development should be assigned to the SSE (a systems engineer trained in system security techniques) working directly for the systems engineer. Table 3 lists the responsibilities for the three key roles associated with PPP development.
In developing the system, the contractor can resource and implement program protection only as directed in the Request for Proposal (RFP). Regardless of how well the PPP document is written, the contractor effort is not affected unless the SOW includes the following types of contractual requirements:
This is an iterative process. As the system requirements, design and implementation are defined and further refined, new vulnerabilities may be discovered and others eliminated. As each successive RFP is developed, it is necessary to update the protection requirements and language in the corresponding sections of the RFP based on the results from the PPP analysis of the previous contracted phase. In this PPP example, the requirement minimizes the access paths to the most critical functions to reduce the possible ways of attacking these functions: The system shall use a least privilege implementation with distrustful decomposition (privilege reduction) or a similar approach, to move Level I critical functions into separate, mutually untrusting programs. In the following SOW PPP example, the statement requires the contractor to develop software to meet security standards: The contractor shall develop secure design and coding standards and inspect the developed software through static analysis and design and code reviews to ensure that the developed software conforms to these standards. Q. What are some other lessons learned regarding security requirements? Q. What are the challenges in developing an effective PPP?
Conducting a roundtable discussion and deciding by committee what is critical in just a few hours is not the best course of action if it concludes the program’s criticality analysis effort. The best results come from many hours of objective application of science and engineering principles by the systems engineer and SSE documenting that analysis in worksheets, and then sharing this with the PPP IPT so that any necessary changes are made. Table 4 is a sample worksheet used to document the system’s high-level mission tasks, supporting critical functions, and the components required to make the critical functions operate. Table 5 is a sample worksheet used to record the analysis of the critical components, including their impact on the system, the assigned criticality level, and the rationale for the identified criticality level. Q. What tools would you recommend be used in developing an effective PPP? Conclusion The DoD-established program protection methods, processes and tools have proven useful in developing effective PPPs. The deliberate approach in identifying vulnerabilities and risks provides opportunities for thoughtful consideration and insight necessary for PMOs to analyze which program elements require additional protective measures. A few PMs have recognized the positive attributes of early program protection planning by proactively investing resources into the PPP development, and ensuring mechanisms were in place to best protect their program information. Network Enablers of the U.S. Army’s Program Executive Office Command Control Communications Tactical, have even directed PPP development for their non-program of record product lines. The Product Manager Waveforms Office from PM Tactical Radios is another organization that has embraced this process for all product lines. These offices may not be required to do everything involved but are keenly aware to the merits of the program protection process. Knowledge and appreciation of the PPP requirements vary across programs. However, one constant many organizations share is the lack of knowledge base, SSEs and proper funding levels to develop the program’s PPP via the Program Objective Memorandum process. As the overarching security plan for acquisition programs, PPPs should be the program’s most wide-ranging security document. A program’s successful execution of these procedures depends upon the integration of system security engineering into systems engineering. The PM’s recognition of the SSE specialty and assignment of the right people with the right skill-sets and experiences to key program-protection roles demonstrate program prioritization. PPP development success also is influenced by a knowledgeable workforce that is familiar with PPP basics and that contributes to the PPP’s iterative process. Merrill is a retired lieutenant colonel of the U.S. Army Signal Corps and president of Merrill Trusted Solutions, a program protection consulting company in San Diego, California. Harris is a professor of Program Management at the Defense Acquisition University’s West Region in San Diego. The authors can be contacted at and . What is the program protection plan?The Program Protection Plan (PPP) is a living plan to guide efforts to manage the risks to CPI and mission-critical functions and components, as well as program and system information.
What is the purpose of a program protection plan PPP?The purpose ofthe PPP is to help programs ensure that they adequately protect their technology, compqnents, and infonnation.
What are the three pillars of program protection?The three pillars of software security are applied risk management, software security touchpoints, and knowledge (see the above illustration). By applying the three pillars in a gradual, evolutionary manner and in equal measure, a reasonable, cost-effective software security program can result.
|
