RMF Security Control Testing Hands On (Using SP 800-53 and 800-53A)

The speaker introduces the concept of control testing, emphasizing the importance of examining control artifacts, testing configurations, and interviewing personnel. They mention that while they cannot test all 1200 controls, they will focus on key ones and use evidence from the 'student product' for assignments. The speaker also highlights the importance of understanding how to present test results and clarifies that proprietary information cannot be used without authorization.

The speaker discusses the process of planning control testing, explaining how to create multiple copies of test cases based on the number of controls to be tested. They stress the importance of organizing these copies by control family and avoiding mixing different families. The speaker also mentions the use of SharePoint for evidence storage and retrieval, detailing how evidence should be accessed and managed during testing.

The speaker delves into the specifics of control testing procedures, explaining how to document the testing process. They discuss the importance of detailing the control activity or requirement and how to craft the assessment procedure. The speaker also provides an example of how to document the testing of AC1, highlighting the need for clarity and precision in documenting the testing process.

The speaker explains how to document the results of control testing, focusing on the need to present findings clearly. They discuss the importance of stating the control number, name, and the specific control activity being tested. The speaker also provides an example of how to write the assessment procedure and results, emphasizing the need to reference the evidence used in the testing.

The speaker discusses the process of reviewing and updating control policies, focusing on the frequency of reviews. They explain how to determine if an organization reviews and updates its access control policies annually, using the example of a policy from North Carolina State. The speaker also highlights the importance of reading the entire document to ensure all aspects of the control are addressed.

The speaker provides a detailed example of testing access control procedures, specifically focusing on AC7, which deals with unsuccessful login attempts. They explain how to document the testing process, including the system's enforcement of a limit on consecutive invalid login attempts and the automatic locking of accounts. The speaker also discusses how to verify the system's configuration settings through screenshots and group policy management.

The speaker demonstrates how access controls are configured and enforced in a virtual server environment. They show how to create and manage user accounts, enforce password policies, and handle account lockouts. The speaker also explains how group policies are used to push configuration settings across an organization's network, ensuring uniform enforcement of access controls.

The speaker discusses the process of verifying and documenting control evidence, using the example of AC7. They explain how to reference the evidence used in testing, such as screenshots and group policy settings, and how to document the findings. The speaker emphasizes the importance of accuracy and detail in documenting the testing process, including the use of specific language to indicate that no exceptions were noted.

The speaker concludes the discussion on control testing by explaining how to finalize the process. They discuss how to document the testing results, including any issues noted and the overall satisfaction of the control. The speaker also emphasizes the importance of reviewing and approving the testing documentation, ensuring that all controls have been adequately tested and documented.