FISMA Compliance & Auditing

The Challenge

IT security managers in federal agencies face increasingly complex challenges in securing and managing information systems that span Windows, Linux, UNIX and Mac platforms. While Active Directory serves as the single, central hub for managing Windows workstations and servers, many Linux and UNIX deployments have evolved in their own silos, each managed through separate identity stores and administrative processes. A growing number of Mac workstations are also entering the mix, introducing another layer of complexity. In addition, access to these diverse systems must be managed across a workforce that contains a mix of permanent and temporary employees, vendors and contractors.

With the passage of the Federal Information Systems Management Act (FISMA) in 2002, federal IT security managers - and the vendors and consultants who work for them - have been tasked with addressing loose practices around access control, privilege management, accountability and auditing in particular. The National Institute of Standards and Technology (NIST) has issued Special Publication 800-53 to provide guidance on complying with FISMA. While NIST SP 800-53 divides FISMA compliance into a wide range of issues, from physical security to training to IT auditing, four of its 17 sections are of specific interest to federal IT security managers. (See our FISMA white paper and on-demand webinar for a comprehensive examination of these issues.)

At a high level, however, the most essential requirements are to:

• Establish accountability by uniquely identifying each individual and linking their access rights, permissions, and audited activity to a single user identity
• Enforce a separation of duties between enterprise IT managers, who administer user identities and set policy, and departmental staff, who administer systems
• Apply role-based access controls and permission management on a least-privilege basis, giving each user access only to the systems and functions needed to perform their jobs
• Audit user activity, capturing sufficient detail to establish what events occurred, who performed them, and the outcome

In addition, the Office of Management and Budget continues to push federal IT departments toward commercial off-the-shelf (COTS) procurement in order to reduce costs, promote standardization, and eliminate standalone solutions.

The Centrify Solution

Centrify's FISMA solution simplifies and streamlines your IT infrastructure by centralizing identity and access management for Linux, UNIX and Mac systems and applications within Microsoft Active Directory. The Centrify Suite does this while addressing FISMA's essential identity and access management requirements to:

• Consolidate all identity stores in Active Directory, providing the ability to link access rights, permissions, and audited activity to a single, centrally managed user identity
• Enforce separation of duties and "need to know" access control by using Centrify's unique Zone-based access controls to define logical sets of systems that can have their own authorized users, administrators, and security policies
• Implement least-privilege security by centrally managing role-based permissions for superusers on Linux and UNIX systems
• Add additional layers of security for classified information by isolating and protecting systems holding sensitive information, and encrypt data in motion as it moves across the network.
• Capture detailed audit logs on UNIX and Linux systems to verify that access controls are working as designed and to monitor for suspicious activity

In addition, leveraging a ubiquitous platform like Active Directory helps you contain costs and eases the task of standardizing identity and access management processes across agencies and vendors.

Learn More

White Paper	FISMA Compliance through Centralized Identity & Access Management Leveraging Microsoft Active Directory
White Paper	Privileged User Activity Auditing: The Missing Link for Enterprise Compliance and Security
White Paper	Implementing Detailed User-Level Auditing of UNIX and Linux Systems Using Centrify DirectAudit
White Paper	Centrify DirectControl & Regulatory Compliance
On-Demand Webinar	Getting Federal Data Center Consolidation Right the First Time: Successful Strategies for Identity, Security & Auditing
On-Demand Webinar	The 60-Minute IT Compliance Formula (with Security Expert Rolf von Roessing)
On-Demand Webinar	Solving the PCI Puzzle (with Security Expert Dr. Eugene Schultz)
On-Demand Webinar	FISMA Compliance in Cross-Platform Environments
Video Chalktalk	Introducing Centrify DirectSecure Part 1: Server Isolation and Protection
Video Chalktalk	Introducing Centrify DirectSecure Part 2: Securing UNIX and Linux Systems with IPsec and Active Directory
Video Chalktalk	Introducing Centrify DirectSecure Part 3: Leveraging the Racoon Internet Key Exchange (IKE) Daemon
Video Chalktalk	Smart Card for Mac Part 1: Introduction to Active Directory Integration
Video Chalktalk	Smart Card for Mac Part 2: Architecture & Authentication Flow
Blog Post	Attaining FISMA Compliance for UNIX and Linux Systems by Leveraging Microsoft Active Directory

Next Steps