800-53-server

Prototype of making fisma 800-53 controls interactive and visualizing control relationships.

A running version is http://800-53.govready.com

Examples:

• http://800-53.govready.com/control?id=SA-4
• http://800-53.govready.com/control?id=SA-4&format=json
• http://800-53.govready.com/controllist?ids=SA-4,AC-2,AC-3,AU-5&format=json

Goal

Create a python class that generates basic information about a FISMA 800-53 security control including:

• Full name of control
• Who has responsibility for control (e.g., organization or information system)
• Listing of control dependencies (e.g., precursor controls)
• Visual depiction of control dependencies

Warning

This is early code. The graph methods may have errors.

Requirements

• Python 2.7
• xsltproc
• Graphviz (http://www.graphviz.org)
• Python Libraries
  • graphviz https://pypi.python.org/pypi/graphviz
  • jinja2 https://pypi.python.org/pypi/Jinja2
  • cherrypy https://pypi.python.org/pypi/CherryPy/3.8.0

800-53 security control web server

Run 800-53-server.py from root of repo on local machine

python web/800-53-server.py

Open browser and visit your local URLs:

• http://127.0.0.1:8080/control
• http://127.0.0.1:8080/control?id=SA-4
• http://127.0.0.1:8080/control?id=SA-4&format=json
• http://127.0.0.1:8080/controllist?ids=SA-4,AC-2,AC-3,AU-5&format=json
• http://127.0.0.1:8080/controllist?ids=SA-4,AC-2,AC-3,AU-5&format=control-masonry

800-53 security control from command line

Run viz_control_precursor.py from root of repo.

python lib/viz_control_precursor.py

Example output:

Resolve which control? AU-7
====================================
AU-7 :  ['AU-2', 'AU-3', 'AU-8', 'AU-14']
AU-7 - AUDIT REDUCTION AND REPORT GENERATION (information system)
AU-2 - AUDIT EVENTS (organization)
RA-3 - RISK ASSESSMENT (organization)
PM-9 - RISK MANAGEMENT STRATEGY (organization)
AU-3 - CONTENT OF AUDIT RECORDS (information system)
AU-8 - TIME STAMPS (information system)
AU-14 - SESSION AUDIT (information system)
   
Rendering precursor graph
nodes:  ['AU-7', 'AU-2', 'RA-3', 'PM-9', 'AU-3', 'AU-8', 'AU-14']
edges:  [('AU-2', 'AU-7'), ('AU-3', 'AU-7'), ('AU-8', 'AU-7'), ('AU-14', 'AU-7'), ('RA-3', 'AU-2'), ('PM-9', 'RA-3'), ('AU-2', 'AU-3'), ('AU-2', 'AU-8'), ('AU-2', 'AU-14')]
image: output/img/AU-7-precursors.png

Testing

python tests/unittest_seccontrol.py 
python tests/unittest_seccontrolviz.py 

Files

Files	Description
web/800-53-server.py	Launches Cherrypy-based web server providing 800-53 control info
lib/viz_control_precursor.py	Generates precursor list and graphviz of precursors for security control
lib/control2json.xsl	XSL transformation that creates json version of control from 800-53.xml
lib/seccontrol.py	Security Control class, provides information about a security control
lib/seccontrolviz.py	Security Control Graph+Viz class, provides information about a security control dependencies
lib/parsedependencies.py	(study) Produces dependencies of precursor security controls based on 800-53A Assessment docs
lib/vizgraph.py	(study) Generates graphviz dot file and graphic from within python
tests/*	unit tests files

Useful Links

Resource	Link
800-53 v4 PDF	http://dx.doi.org/10.6028/NIST.SP.800-53Ar4
800-53 v4 XML current	https://nvd.nist.gov/static/feeds/xml/sp80053/rev4/800-53-controls.xml
800-53 A v4 XML 06-06-2015	https://nvd.nist.gov/static/feeds/xml/sp80053/rev4/800-53a-objectives.xml
800-53 Assessment Cases (2010)	http://csrc.nist.gov/groups/SMA/fisma/assessment.html