Interpreting and applying federal cybersecurity mandates and requirements based on an agency’s unique mission can be challenging. With over 20 years’ experience supporting cybersecurity initiatives within the federal government, Electrosoft understands this dilemma and is positioned to help.

We stay abreast of all current and upcoming federal cybersecurity standards, guidance, mandates and statutes in order to help customers create and shape appropriate cybersecurity architecture, product solutions, policies and procedures. Electrosoft uses our Cybersecurity Center of Excellence (CCoE) to maintain currency, evaluate, test and perform demonstrations using today’s leading cybersecurity products. We then help customers implement solutions and technical or procedural controls that comply with these requirements and agency objectives. By analyzing security controls in light of the latest revision of NIST Special Publication (SP) 800-53, we ensure that each policy’s intent is satisfied through standard operating procedures and ongoing compliance assessments.

The Federal Information Security Modernization Act (FISMA) requires federal agencies to develop, document and implement an information security program. The NIST Risk Management Framework (RMF) delineates a seven-step process for managing information security and privacy risk.

Electrosoft helps federal customers categorize information systems, select appropriate security controls, prepare System Security Plans (SSLs) and related documentation, conduct security analyses and assessments and maintain authorization to operate (ATO). We not only help customers prepare for independent assessments of security controls but also perform security control assessments using the latest NIST SP 800-53A guidance. In addition, we document our findings in a Security Assessment Report (SAR) and develop Plans of Actions and Milestones (POA&Ms) to manage and mitigate any identified risks. By getting to know each customer’s unique environment and risk tolerances, we can focus on their priorities and make optimized risk management and system authorization recommendations

For agencies that are ready to embrace Ongoing Authorization (OA), we leverage Electrosoft’s Agile-ATO methodology to implement

• effective management and oversight of security risk management activities, recognizing the evolving federal information security landscape;
• integrated security and development teams working in unison to ensure ATO of new/updated information systems;
• efficient continuous monitoring, documentation updates and POA&M management of operational information systems; and
• Agile change management of existing information systems in response to evolving requirements.

Our Agile-ATO methodology leverages Governance Risk and Compliance (GRC) tools and automation techniques such as the Open Security Controls Assessment Language (OSCAL) to enable rapid development and update of security documents, efficient security assessments and centralized management and view of information system security status.

In today’s world, developing a holistic vulnerability management and assessment program is critical to maintaining visibility, reducing overall cyberthreat and supporting asset management activities. It involves effective testing of hosts, networks, web applications and databases for known vulnerabilities and compliant configurations (such as to NIST Security Checklists, Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and Center for Internet Security (CIS) Benchmarks) as well as appropriate use of credentials based on threat landscape. We also perform external and internal penetration testing using various levels and approaches based on the customer’s penetration testing history and objectives. We perform these services in two ways: embedded within federal agencies and as a Managed Security Services offering within our CCoE.

Electrosoft uses cutting-edge tools from vendors such as Rapid 7, Tenable, Qualys, Offensive Security (Kali Linux), Arch Linux, Portswigger, Trustwave, HP, IBM and others. Our tool selection depends on the technologies employed within the target system (e.g., OS, databases, web applications, network devices) and the tools used for ongoing vulnerability scanning. In this way, we can discover assets; identify and mitigate common vulnerabilities and exposures; identify the real-world extent of exposure; and make and prioritize recommendations to remediate, mitigate or accept them before they can be exploited. Our process includes pre scheduled, periodic vulnerability testing as well as ad hoc testing.

Electrosoft has deep knowledge and experience with the Federal Risk and Authorization Management Program (FedRAMP). We were an approved FedRAMP Third Party Assessor Organization (3PAO) between 2012 and 2018 and assisted many Cloud Service Providers (CSPs) in interpreting and implementing FedRAMP controls to achieve FedRAMP Joint Authorization Board (JAB) authorization. Currently, we support specific federal customers to work with industry-leading cloud products to obtain FedRAMP agency-level authorization, saving customers money, reducing complexity and driving efficiency. In addition, we support FedRAMP-based security control implementations and authorizations for federal agency customers migrating on-premise information systems to the cloud.

Electrosoft experts guide vendors and agencies along the most streamlined, cost-effective path to achieve Authority to Operate (ATO) under FedRAMP. Our structured, well-defined processes, honed through numerous past engagements, systematically identify gaps in the CSP’s current security posture; provide specific, practical and actionable recommendations to close these gaps; and assist the CSP in preparing the documentation needed for an independent 3PAO review.

One of the most challenging aspects of security monitoring is effectively using the growing, massive volume of log information collected to identify anomalies and security events. Electrosoft analysts apply not only sophisticated techniques that eliminate false positives but also asset, user and zone models that integrate cohesively with numerous industry-leading tools and products, such as various Security Information and Event Management (SIEM) platforms, firewalls, Intrusion Detection and Prevention Systems (IDPS), Network Detection and Response (NDR) solutions, anomalous behavior detection solutions, Enhanced Detection and Response (EDR) solutions and the latest eXtended Detection and Response (XDR) solutions. We work to automate responses through scripting, low-code development, built-in automations and the latest Security Orchestration and Automated Response (SOAR) solutions. Electrosoft security experts interpret cybersecurity threat feeds to identify applicable indicators of compromise (IOC) and identify persistent threats lurking within the IT environment.

Compliance auditing and security forensic investigations demand an end-to-end review of who did what and when. To achieve a complete picture, Electrosoft helps customers align identity management data with log and security event management data. Electrosoft’s approach can reduce the time and effort necessary for security event detection, root cause analysis and proactive incident response.

Electrosoft employs a holistic approach to engineer the implementation, operation and monitoring of secure systems. We define customer needs, security protection requirements and required functionality early in the systems development lifecycle. Then, we document requirements and proceed with design, synthesis and system validation. We vet, select and implement the appropriate set of security tools and define processes to operate these systems in a secure manner. Finally, we monitor security status throughout the lifecycle.

Government is recognizing the weaknesses of traditional perimeter-based cybersecurity mechanisms. Various government mandates, statutes and guidelines require federal agencies to move to a ZTA model and implement zero trust solutions in various pillars (such as identity, devices, networks, applications and data). Electrosoft is helping agencies define requirements, select solutions that align with zero trust principles and implement them. For example, we can implement enterprise-wide strong, non-phishable identity authentication solutions that are verified at the end application rather than at the network level. Or, we can identify and implement enterprise-wide encryption solutions to protect sensitive data at rest and in motion including DNS/web/email traffic.

The zero trust strategies Electrosoft creates in collaboration with agency leaders take into account the agency’s unique mission, budget and current posture. We develop a prioritized roadmap for implementation of specific zero trust solutions that move the agency forward in the quest to manage cybersecurity risk through ZTA.