Securing ATE Using the DoD's Risk Management Framework

Information systems are subject to serious threats that can have adverse impacts on organizational operations and assets, individuals, as well as third parties by compromising the confidentiality, integrity, or availability of information being processed, stored, or transmitted by those systems. Successful attacks on systems can result in grave damage to the economic and security interests of those organizations. In the defense space, the DoD Risk Management Framework (RMF) can provide a foundation for an organization's cybersecurity protection strategy. Securing information systems is a shared responsibility between test companies and their customers. ATE suppliers serving the defense industry can assist customers in securing their Automatic Test Equipment (ATE) by implementing the first four steps of the RMF process. ATE customers further increase the security of their systems by working with test companies to understand what additional security controls they could implement to successfully perform the last two steps of the RMF process. ATE suppliers can implement the following steps for the systems they are supplying: (1) Security categorization; (2) Security control selection; (3) Security control implementation; and (4) Security control assessment. Steps that should be performed by ATE customers are: (5) System authorization; and (6) Continuous monitoring. Early integration of the RMF into the product development life cycle is one of, according to NIST 800–37, “the most cost-effective and efficient methods for an organization to ensure that its protection strategy is implemented” [1]. Test companies can ease customer implementation of the RMF by integrating a specific set of security controls into their own product development life cycles. ATE suppliers can develop a more secure supply chain, harden manufacturing and development processes, and apply operating system (OS) security controls. Finally, they can help customers understand the remaining steps of the RMF that could be implemented to secure the confidentiality, integrity, and availability of their information systems.