Implementing NIST 800-53 Using USP

Overview

You can implement NIST 800-53 regulation compliance that is tailored to your specific business requirements and network topology using a Unified Security Policy (USP). View compliance reports from the violations browser at any time, and verify compliance with each specific regulation. If a regulation is not in compliance, identify the specific device and rule that is causing the violation.

To implement best practices or the compliance regulations of a standard, you need to create a USP Matrix containing the compliance zones required by the standard. The compliance zones are placeholder zones into which you place your network zones, using SecureTrack zone hierarchies. Your existing zones can then be collected into these compliance zones, to ensure compliance monitoring of your entire network. To ensure that you maintain ongoing compliance as your network topology evolves, we recommend that you periodically review the hierarchy of your compliance zones.

The required NIST 800-53 compliance zones are:

Corporate
DMZ
Internet
Database
Wireless Network
Admin Network
Application
Users Network
VoIP

Create the USP

Before you create this USP, make sure all the required compliance zones have been created (see Network Zones).

Go to SecureTrack > Browser > USP Viewer.
Click +ADD USP.
Select NIST 800-53 from the menu. The zones required for NIST 800-53 appear.
For each required zone displayed, select the appropriate compliance zone.
(optional) Enter the USP description.
Click Create.

The NIST 800-53 USP has now been created. You can click the card to view the matrix in the USP Builder and modify the policy as needed.

The following requirements are defined in the USP matrix:

Source / Destination	Admin Network	Application	Corporate	Database	DMZ	Internet	Users Networks	VoIP	Wireless Networks
Admin Network	Allow All	Block all	Block all	Block all	Block all	Block all	Block all	Block all	Block all
Application	Allow only RDP ssh tcp 80 tcp 443	Block all	Block all	Block all	Allow only TCP 8080	Block all	Block all	Block all	Block all
Corporate	Allow only RDP ssh tcp 80 tcp 443 udp 53 tcp 53 tcp 445 tcp 389 tcp 686	Block all	Block all	Block all	Block all	Block all	Allow only ssh tcp 53 udp 53 udp 67 udp 68 tcp 389 tcp 686 tcp 445 tcp 3389	Allow only tcp 53 udp 53 udp 67 udp 68 tcp 389 tcp 8404	Allow only tcp 53 udp 53 tcp 389 tcp 686 tcp 445 ssh
Database	Allow only ssh RDP tcp 1433 tcp 3306 tcp 1521 tcp 1830 tcp 1434	Allow only tcp 1433 tcp 3306 tcp 1521 tcp 1830 tcp 1434	Block all	Block all	Block all	Block all	Block all	Block all	Block all
DMZ	Allow only ssh RDP tcp 80 tcp 443	Block all	Block all	Block all	Block all	Allow only tcp 80 tcp 443	Allow only tcp 80 tcp 443	Block all	Allow only tcp 80 tcp 443
Internet	Allow only tcp 80 tcp 443	Block all	Block all	Block all	Block all	Allow all	Allow only tcp 80 tcp 443	Block all	Allow only tcp 80 tcp 443
Users Networks	Allow all	Block all	Block all	Block all	Block all	Block all	Allow all	Allow only tcp 5060 udp 5060 tcp 5061 udp 5061	Allow all
VoIP	Allow only tcp 5060 udp 5060 tcp 5061 udp 5061 ssh RDP tcp 1720 tcp 2727 udp 2727 udp 2443 tcp 2443	Block all	Allow only tcp 5060 udp 5060 tcp 5061 udp 5061 ssh tcp 1720 tcp 2727 tcp 2443	Block all	Block all	Block all	Allow only tcp 5060 tcp 5061 udp 5060 udp 5061	Allow all	Allow only tcp 5060 tcp 5061 udp 5060 udp 5061
Wireless Networks	Allow all	Block all	Block all	Block all	Block all	Block all	Allow all	Block all	Allow all

NIST 800-53 regulations

AC - Access Control

Requirement ID	Requirement	USP Implementation
AC-4	Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on Assignment: organization-defined information flow control policies.	Create a unified security policy matrix that identifies all NIST 800-53 zone-to-zone connections. Apply the unified security policy to the relevant firewalls.
AC-17(3)	Establish and document usage restrictions and implementation guidance for each type of remote access prior to allowing such connections.	Configure the matrix to allow remote administrative access to the application, Database and DMZ zones, using the access type: restricted. Configure the rule properties to require an explicit source and an explicit destination, so remote access is granted only to specific systems.
AC-18	Establish configuration requirements, connect requirements, and implementation guidance for each type of wireless access, and authorize each type of wireless access prior to allowing such connections.	Configure the matrix to deny access from the Wireless Network zone to the application, Database and admin network zones using the access type: blocked. Configure the matrix to limit traffic from the wireless network zone to other zones to the required services only, using the access type: restricted.

CM - Configuration Management

Requirement ID	Requirement	USP Implementation
CM-7	Configure the system to provide only mission essential capabilities, and prohibit or restrict the use of unnecessary functions, ports, protocols, software and services.	Configure the matrix to explicitly specify in the access type only those services, protocols, and port that are required between zones, using the access type restricted. Services not explicitly identified are denied. Configure the matrix to deny all traffic between zones that do not require connectivity using blocked definition.

SC - System and Communications Protection

Requirement ID	Requirement	USP Implementation
SC-7	Monitor and control communications at the external managed interfaces to the system and at the key internal managed interfaces within the system.	Configure the matrix to deny traffic between zones by default using the access type blocked and allow only the required traffic using the access type: restricted. Configure the rule properties to require an explicit source, an explicit destination and specific services so that rules with ANY are reported as violations.
SC-7(5)	Deny network communications traffic by default and allow network communications traffic by exception.	Configure the matrix to deny traffic between zones by default using the access type blocked and allow only the required traffic using the access type: restricted. Configure the rule properties to require an explicit source, an explicit destination and specific services so that rules with ANY are reported as violations.
SC-7(21)	Employ boundary protection mechanisms to isolate system components supporting critical missions and/or business functions.	Configure the matrix to allow access to the database zone only from the application and admin network zones, limited to the required database services, using the definition: restricted. Configure the matrix to allow access to the Application zone only from the DMZ and admin network zones using the access type: restricted.