PM-16 Threat Awareness Program

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	1 (0 in a baseline)

Related controls: IR-4, PM-12

Control statement

Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.

NIST discussion

Because of the constantly changing and increasing sophistication of adversaries, especially the advanced persistent threat (APT), it may be more likely that adversaries can successfully breach or compromise organizational systems. One of the best techniques to address this concern is for organizations to share threat information, including threat events (i.e., tactics, techniques, and procedures) that organizations have experienced, mitigations that organizations have found are effective against certain types of threats, and threat intelligence (i.e., indications and warnings about threats). Threat information sharing may be bilateral or multilateral. Bilateral threat sharing includes government-to-commercial and government-to-government cooperatives. Multilateral threat sharing includes organizations taking part in threat-sharing consortia. Threat information may require special agreements and protection, or it may be freely shared.

Control enhancements

PM-16(1) Automated Means for Sharing Threat Intelligence

Baselines: Not in a baseline

Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.

Discussion and assessment objectives for PM-16(1)

To maximize the effectiveness of monitoring, it is important to know what threat observables and indicators the sensors need to be searching for. By using well-established frameworks, services, and automated tools, organizations improve their ability to rapidly share and feed the relevant threat detection signatures into monitoring tools.

Determine if automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.

Examine: Information security program plan; privacy program plan; threat awareness program policy; threat awareness program procedures; risk assessment results related to threat awareness; documentation about the cross-organization information-sharing capability; other relevant documents or records.

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for the threat awareness program; organizational personnel responsible for the cross-organization information-sharing capability; organizational personnel with information security and privacy responsibilities; external personnel with whom threat awareness information is shared by the organization.

Test: Organizational processes for implementing the threat awareness program; organizational processes for implementing the cross-organization information-sharing capability; automated mechanisms supporting and/or implementing the threat awareness program; automated mechanisms supporting and/or implementing the cross-organization information-sharing capability.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-16

Determine if a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.

Examine: Information security program plan; privacy program plan; threat awareness program policy; threat awareness program procedures; risk assessment results relevant to threat awareness; documentation about the cross-organization information-sharing capability; other relevant documents or records.

Interview: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for the threat awareness program; organizational personnel responsible for the cross-organization information-sharing capability; organizational personnel with information security and privacy responsibilities; external personnel with whom threat awareness information is shared by the organization.

Test: Organizational processes for implementing the threat awareness program; organizational processes for implementing the cross-organization information-sharing capability; mechanisms supporting and/or implementing the threat awareness program; mechanisms supporting and/or implementing the cross-organization information-sharing capability.

Policy statement

• The Chief Information Security Officer shall implement a threat awareness program. (PM-16)
• The program shall include a capability to share threat intelligence with other organizations. (PM-16)

PM-16(1) Automated means for sharing threat intelligence

• The Security operations team shall use automated mechanisms to share threat intelligence, such as machine-readable feeds exchanged with sharing partners. (PM-16(1))

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-16 asks for a threat awareness program that includes a capability to share threat intelligence with other organizations. NIST’s PM-16 discussion says sharing threat information is one of the best ways to deal with capable adversaries. That means threat events and their tactics, techniques and procedures, mitigations that worked, and threat intelligence such as indications and warnings. Sharing can be bilateral, or multilateral through threat-sharing consortia; some information needs special agreements and protection.

PM-16 and PM-16(1) are in no SP 800-53B baseline, but the PM policy includes both clauses, so they apply.

SP 800-150, Guide to Cyber Threat Information Sharing (October 2016), is NIST’s guide to building this capability. Section 2.1 sets out four types of threat information: indicators, tactics, techniques and procedures, security alerts, and threat intelligence reports. Section 3 covers setting up sharing: goals, internal sources, scope, sharing rules and joining a community. Section 4 covers taking part: consuming and using indicators, storing them, and producing your own.

Common implementations. The Program Management policy has the Chief Information Security Officer implement the program, with a capability to share threat intelligence with other organizations. The security operations team usually runs it day to day. It works in a loop:

• Collect from sharing partners, government and vendor advisories, commercial feeds and your own incidents. The partners are often the ISAC or ISAO kept under PM-15.
• Analyze for relevance to your systems and threats.
• Use the results in detection (SI-4, section 5 of the system monitoring standard) and log review (the log review procedure).
• Feed the results into risk assessment: the Risk Management Strategy names the program as a source of threat information in section 4.
• Share what you learn back to partners under written sharing rules.

SP 800-150, section 3.4, says to set those rules before sharing, with input from legal and privacy officials. List the information types that may be shared, the conditions, the approved recipients, redaction, source attribution, and handling designations. Section 7 of the Incident Response Plan records who incident information is shared with and who approves it.

Organization-defined parameters. PM-16 and PM-16(1) have none. The choices the clauses leave open, typical values your organization may set differently:

Choice	Typical value
Who implements the program (PM-16)	The Chief Information Security Officer, with day-to-day work by the security operations team
Sharing partners (PM-16)	The sector ISAC or ISAO, government partners, and suppliers and peers with a sharing agreement
Who approves sharing outside the organization	The Chief Information Security Officer, under written sharing rules reviewed by legal and the senior privacy official
Automated mechanisms (PM-16(1))	Machine-readable feeds exchanged with sharing partners and loaded into detection tools (the clause’s example)

Evidence assessors ask for.

• The program description, its owner, and its sharing partners with any agreements
• The written sharing rules, with the legal and privacy review
• Records of threat information received and the actions taken, such as new detections or blocked indicators
• Records of information shared with partners, and its approval
• For PM-16(1), the automated feeds and the tools that consume and publish them

Inheritance. PM-16 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Systems benefit through the detections and risk assessments the program feeds.

Common findings.

• Feeds that arrive but are never checked for relevance or loaded into detection tools.
• A program that only receives and never shares, so PM-16’s sharing capability is missing.
• Sharing without written rules, approvals or handling designations.
• Indicators that are never aged out, so detections fill with stale entries and false positives.

Enhancements. PM-16(1) asks you to use automated mechanisms to make threat intelligence sharing more effective. NIST’s discussion says monitoring works best when sensors know which observables and indicators to look for. Established frameworks, services and automated tools let you share and feed detection signatures into monitoring tools quickly. The PM-16(1) clause has the security operations team use such mechanisms, such as machine-readable feeds exchanged with sharing partners.

In practice that is usually a threat intelligence platform that exchanges indicators in a structured format, such as STIX over TAXII, and pushes them to the SIEM, endpoint and network tools. SP 800-150, section 3.4.3, says to “automate the processing and exchange of threat information where possible.” Section 4.5 adds that “any automated mechanisms should be hardened and tested to ensure that they do not become viable attack vectors for threat actors.”

Artifacts

• Program Management Decision Worksheet
• Program Management Policy