IWO Board Flashcards
101.1 Discuss the concept of ORM
Principles of ORM.
a. Accept Risk when Benefits Outweigh the Cost.
b. Accept No Unnecessary Risk.
c. Anticipate and Manage Risk by Planning.
d. Make Risk Decisions at the Right Level.
Levels of ORM.
a. In-depth.
b. Deliberate.
c. Time Critical.
101.2 Explain the 5-step ORM Process
a. Identify the Hazards:
A hazard is any condition with the potential to negatively impact mission accomplishment or cause injury, death, or property damage.
b. Assess the Hazards:
For each hazard identified, determine the associated degree of risk in terms of probability and severity.
c. Make Risk Decisions:
There are three basic actions which ultimately lead to making informed risk decisions:
(1) Identifying control options.
(2) Determine the effect of these controls on the hazard or risk.
(3) Decide how to proceed.
d. Implement Controls:
(1) Ensure the plan is clearly communicated to all the involved personnel
(2) Establish Accountability.
(3) Provide Necessary Support.
e. Supervise:
Supervise and review involves determining the effectiveness of risk controls throughout the mission or task.
(1) Monitor the effectiveness of risk controls.
(2) Determine the need for further assessment of all or a portion of the task due to an anticipated change.
(3) Provide feedback- both positive and negative lessons learned.
101.3 Discuss the safety aspects of the following:
a. Tag-out precautions [ref. b, vol. I, ch. B11]
b. Electrical fires [ref. b, vol. III, ch. C9]
c. First aid for electricity-related injury [ref. b, vol. III, ch. C9]
d. Electronic precautions [ref. b, vol. III, ch. C9]
e. HERO/HERP/HERF [ref. c, ch. 3]
a. Tag-out precautions-A tag is placed on equipment warning people that the equipment
is out of calibration or not functioning properly.
b. Electrical fires-Great care is required fighting such a fire to avoid creating another explosion from batteries. The safest and most effective method for fighting an electrical fire is through oxygen starvation. Secure the compartment and stop all ventilation within, including agitation air, to deprive flames of oxygen. WARNING: NEVER ATTEMPT
TO EXTINGUISH AN ELECTRICAL FIRE BY WATER. THE HYDROGEN AND OXYGEN GENERATED BY ELECTROLYSIS COULD PRODUCE A VIOLENT EXPLOSION.
c. First aid for electric shock-First step is to secure the power source or insulate victim from power. Next perform CPR.
d. Electronics and RF radiation hazards-When working in an energized environment, always have supervision, station a safety observer, and insulate metal tools.
e. HERO/HERP/HERF
HERO-Hazards of Electro Magnetic Radiation to Ordinance. HERO 1-susceptable, HERO 2-unsafe, HERO 3-safe
HERP-Hazards of Electro Magnetic Radiation to Personnel. The body can
absorb EM Radiation.
HERF-Hazards of electro Magnetic Radiation to Fuel. EM radiation can ignite fuel vapor.
101.4 Discuss safety considerations during execution of the Emergency Action Plan.
All personnel involved must be familiar with the tasks associated with emergency destruction. Use personal protective equipment when using an ax or sledge hammer. Station safety observers if time and space permit.
Safety Considerations for Emergency Action Plan
Review local EAP/EDP
Perform ORM steps
Train on procedures annually/semi-annually
Destruction tools could be potential hazards
Shredder, axe/hammer, electrical, etc.
102.1 State the functions of the following personnel:
a. SSO [ref. a, ch. 2; ref. b, ch. 2]
b. CSO/CSM [ref. a, ch. 2]
c. IAM/ISSM [ref. a; ref. b, ch. 2]
d. IAO [ref. b, ch. 2]
e. TSCO [ref. a, ch. 2; ref. b, ch. 2]
The SSO will be responsible for the operation of the Sensitive Compartmented Information Facility (SCIF) and the security control and use of the SCIF.
All SCI matters shall be referred to the SSO.
Functions
SSO Special Security Officer
Handles SCI program - responsible for operation/security of SCIF
CSO/CSM Command Security Officer/Manager
Handles classified information programs (Secret and below, just not SCI)
IAM/ISSM Information Assurance/Information Systems Security Manager
Responsible for information assurance program (IAP)
IAM is new name for ISSM
IAO Information Assurance Officer
Designated for each system/network in command
Implement/maintain commands IT ssems and neork secri reqiremens
TSCO Top Secret Control Officer
Ensures inventories of TS info conducted at least once annually
Keep record of receipt from each TS recipient
Information Security vs. Information Assurance
INFOSEC
Ensuring personnel follow protocol in protecting information
Prevent illicit access to info
Information Assurance
Ensuring systems and networks are maintained to protect information
Maintained by DISA
Safeguard integrity of data
102.2 Discuss security classification levels, receipt, custody, document markings and handling requirements for the following:
a. TOP SECRET, SECRET, CONFIDENTIAL [ref. b, chs. 2, 7 thru 9]
b. U//FOUO [ref. b, chs. 4, 6]
c. SCI [ref. c, encls. 3, 5]
d. Allied Information/Publications [ref. e, ch. 5]
e. SAP [ref. m, encl. 4]
f. ORCON [ref. m, encl. 4]
g. ACCM [ref. m, encl. 4]
h. Foreign Releasability [ref. m, encl. 4]
a. Top Secret - exceptionally grave damage; Secret - serious damage; Confidential - damage
b. Unclassified, for official use only - unclassified info that should be protected for internal use only
c. sensitive compartmentalized information - Classified information concerning or derived from
intelligence sources or methods, or analytical processes, that is required to be handled within formal access control systems established by the DCI.
d. Allied Information/ NATO Control Documents - NATO has four levels of classified information: COSMIC TOP SECRET, NATO SECRET, NATO CONFIDENTIAL, and NATO RESTRICTED. Certain NATO information is further classified in a specific category as ATOMAL which can be either RESTRICTED DATA (RD) or FORMERLY RESTRICRED DATA (FRD).
e. Special Access Program (SAP) - Any DoD program or activity employing enhanced security measures exceeding those normally required for classified information at the same classification
level which is established, approved, and managed as a DoD SAP.
f. Originator Control - Dissemination & Extraction of Information Controlled by Originator
g. Alternative or Compensatory Control Measures - security measures used to safeguard classified intelligence or operations and support information when normal measures are insufficient to achieve strict need-to-know controls and where special access program (SAP) controls are not required.
h. Foreign Releasability
Ex. REL TO USA, FVEY
Released directly to foreign government representative
Designated by recipient gov’t to assume custody/responsibility
102.3 Discuss the following aspects of physical security:
a. Access controls [ref. b, ch. 10]
b. ATFP [ref. s]
c. Storage requirements for classified material [ref. a, ch. 9; ref. b, ch.10]
d. Required forms [ref. b, ch 2, app. B]
a. Access Controls
Uncleared persons escorted by cleared person
Entrance under visual control at all times
ATFP (Anti-Terrorism/Force Protection)
b. Anti-Terrorism Defensive measures to reduce vulnerability of individuals/properties
Force Protection Actions to prevent/mitigate hostile actions against DoD personnel,
resources, facilities
FPCON levels conserve fighting potential
c. Storage Requirements
Guard/store in locked GSA-approved security container, vault, modular vault, secure
room
TS and S require supplemental controls, C does not
Intrusion Detection System, continuous protection by duty personnel, etc.
d. Required Forms
SF-700 Security Container Information
Vital info about container (location, container #, contact info)
SF-701 Activity Security Checklist
Checklist at the end of each day (ensure classified materials secured properly,
employee accountability)
SF-702 Security Container Check Sheet
Record of names/times people have opened and closed container
SF-153 COMSEC Material Report
SF-312 Classified Information NDA
Contract between USG and cleared employee
102.4 Explain the purpose of your Command Emergency Action/Destruction Plan
and discuss the following: [ref. g; ref. i, Annex M]
a. Conditions that warrant implementation
b. Authority to impose, modify or cancel
c. Authority to order emergency destruction onboard a deployed unit
d. Primary and alternate means of completion
e. Procedures to be followed upon implementation, from first order to destroy through completion and follow-up documentation and reporting
f. Priority for destruction of classified materials
g. Responsibility for ensuring a correct inventory of destroyed materials is maintained and recorded
h. Methods of destruction
i. Classified waste
Emergency Action/Destruction Plan
* Conditions: Natural disasters, hostile action
* Authority: CO, XO, OPS
o In absence, CDO or most senior person present
o Senior person present is overall responsible for inventory
o Command Destruction Supervisor - - - EKMS manager or CDO
■ Maintains status/inventory
* Authority to destroy onboard deployed unit: CO, XO, CDO, senior person
o Only CO can authorize precautionary destruction
■ Anything not being used right now to complete mission
* Means of Completion
o Primary - Assets used to destroy material
o Alternate - Device used to render material useless
o Precautionary Destruction - Reduce classified material present in preparation for potential hostile action
o Complete Destruction - Prevent capture/compromise of COMSEC or classified material (destroy everything)
o Methods of Destruction:
■ Shred, pulverize, incinerate, hand tools, zeroize (wipe/burn) crypto equipment
* Procedures
o EAP details all procedures —
o Report situation to EKMS manager —
o Distribute destruction cards, commence destruction (track status, inventory) —
o EKMS or CDO reports the loss/compromise
* Priorities
o 1 — TS+
o 2 — S
o 3 — C
* Classified Waste
o Keep to a minimum - reduces buildup/excess if EAP or EDP is implemented
102.5 Define and discuss the following:
a. Access [ref. a, ch. 9]
b. Clearance [ref. a, ch. 8]
c. Compromise [ref. a, app. A]
d. Marking [ref. b, app. A]
e. Need-to-know [ref. a, app. A]
f. Transmission security [ref. c, encl. 5]
g. TPI [ref. i. ch. 4]
h. TPC [ref. i, ch. 9]
i. Working papers [ref. h, encl. 4]
j. Downgrading [ref. b, Exhibit 6b]
k. Disclosures [ref. h, encl. 4]
l. Sanitization [ref. b, ch. 11]
m. COMSEC [ref. b, app. A]
n. INFOSEC [ref. d]
o. TEMPEST [ref. u, encl. 4]
p. SSBI [ref. a, ch. 6]
a Access - Ability/opportunity to obtain knowledge
o Access is provided via the information owner, Clearance is provided by the Navy
b Clearance - Administrative decision by adjudicating authority
o DONCAF is adjudicating authority (levels: TS, S, C)
c Compromise - Unauthorized disclosure to unauthorized person/systems
d Marking - Indicates material’s classification/handling procedures
e Need-to-Know - Determination that person requires access to specific information
f OCA - Original Classification Authority
o Person/organization authorized to take raw intel and classify
■ Authorized in writing, by either POTUS, VPOTUS, or agency heads, to classify info in the first place
■ Shall apply the following markings:
* Classified By
* Classification Reason
* Declassify On
o To downgrade something, need permission from the OCA
o The point of classification is to protect sources and methods!
* DCA - Derivative Classification Authority
o Ability to classify based on previous classification determinations, made either from an authorized classification guide or from a source document
■ Shall apply the following markings:
* Derived From
* Declassify On
* Transmission Security - Protect transmissions from interception/exploitation
o Component of COMSEC
o Protect transfer of data via radio/electronics
g TPI - Two-person Integrity
o Handling/storing to prevent single-person access to COMSEC keying manual, cryptographic manuals
h TPC - Two-person control
o Continuous surveillance/control of positive control material at all times
i Working Papers - Docs/materials accumulated and created while preparing finished materials
o ex. Classified notes from training sessions, conferences, etc.
j Downgrading - Reducing classification to lower level
o Determined by approved authority (need permission from the OCA)
k Disclosures - Conveying classified info in any manner
o Unauthorized disclosure = crime
l Sanitization - Process of removing sensitive information to allow it to exist at a lower classification
o The point of classification is to protect sources and methods!
m COMSEC (Communications Security)
o Protective measures to deny unauthorized interceptors from accessing information from telecommunications, while still delivering content to intended recipients
■ Prevent unauthorized persons from interception/knowing your comms (ex. encryption)
o Includes:
■ Cryptosecurity - Security from technically sound cryptosystems and proper use
* Ex. PKI
■ Emissions Security - Securing emanations from crypto equipment, computers, telecomms systems
■ Physical Security - Physical measures to safeguard material/equipment
* Ex. Folders, safes, etc.
■ Transmissions Security - Protecting transmissions by means other than crypto
* Ex. Frequency hopping
o COMSEC Incident - If cryptographic keys (used by IPs/Its) are not destroyed in time, given to people without access, not secured
■ Cryptographic COMSEC Incident - Using keying material that is compromised, defective, or not authorized for use/reuse
■ Personnel COMSEC Incident - Defection, espionage, capture by enemy
■ Physical COMSEC Incident - Physical loss of COMPSEC material, failure to maintain TPI
n INFOSEC (Information Security)
o Protect info/info systems from unauthorized access, disclosure
o Concerned with confidentiality, integrity, availability of data (regardless of form data may take)
o TEMPEST
o Program to protect against unauthorized RF transmissions in/out of SCIF
■ TEMPEST team comes to certify DoD space
o NSA provides lists of TEMPEST-certified telecomms equipment
p SSBI (Single Scope Background Information)
o Investigative standard for TS & SCI
102.6 Discuss the authoritative manuals and instructions that govern the following:
a. Physical Security [refs. h]
b. Information Assurance/Cyber Security [ref. o]
Authoritative Manuals/Instructions
a DCID 6/1 - Security Policy for SCI and Security Manual
a DCID 6/9 - Physical Security Standards for SCIFs
b ALNAV 055/10 - Safeguarding Classified National Security Info
b SECNAVINST 5239.1-3B - DON Information Assurance Policy
b COMNAVCYBERFORINST 5239.2A - Guidance for Cyber Security Inspection and Certification Program
102.7 Describe the steps required to report a compromise, a suspected compromise of
classified material or a PDS. [ref. i, ch. 10]
Steps Required to Report Compliance
* Take custody of/safeguard info
* Notify SM or SSO/EKMS manager and CO (plus supervisory chain of command)
* CO initiates Preliminary Inquiry (PI), notifies NCIS of loss or compromise
o Most reports of compromise sent to CO
* CoC remediates practices dangerous to security
o PDS is a level below COMSEC incident
o Reportable
■ Premature/out-of-sequence use of keying material
■ Inadvertent destruction of material (if destruction properly documented and re- supply required)
o Non-Reportable
■ Improperly completed accounting reports
■ Late destruction
102.8 Discuss proper protocol for classified communications to include:
a. Telephone [ref. r, encl. 4]
b. Computer Systems [ref. f, ch. 11]
c. Radio Communications [ref. p, Exhibit b; ref. q]
d. Video / VTC [ref. r, encl. 4]
a Phones
o National Secure Telephone System (NSTS) - SCI, completely isolated phone network
o Defense Red Switched Network (DRSN) - Secure voice/conferencing requirements for POTUS, SECDEF, CJCS, etc.
o Voice Over Internet Protocol (VOIP) - NSTS uses VOIP to transfer data
o Colors (in SUPPLOT)
■ TS/SCI - Grey
■ SECRET - Red
■ UNCLASS - Black
b Computer Systems
o SIPR/JWICS
o CHAT (know/pay attention to avoid spillage!)
o Computer terminals must comply with OPNAVINST C5510.93
■ Be installed in accordance with TEMPEST guidelines
c Radio Communications
o FLTTAC - Book on bridge of ship with codewords (everything is in code)
■ Over open net (unclassified), so everyone can hear - including civilians
■ VHF
o NAVYRED - Encrypted comms line all surface stations are attached to
■ Can talk in plain language
d Video/VTC
o May occur on unclassified or classified networks
102.9 Describe the purpose of network scanning and patching. [ref. j]
- Scanning - Scan all components of network to identify possible threats/vulnerabilities
- Patching - Permanent or temporary restoration solution to a network
102.10 Describe the different types of firewalls and intrusion detection systems. [ref. n]
- Packet Filtering
o Everything going over the Internet is a “packet”
■ Firewall has certain rules to filter packets (ex. certain IP addresses, etc.) - Stateful Packet Filtering
o Instead of checking every packet, network connection made w/firewall; firewall remembers connection
■ Only passes packet with known active connection
o More concise than packet filtering
o Lacks ability to filter encrypted traffic - Application Proxies
o Application (ex. web server, email server proxy) takes packets to reroute through server proxy so application doesn’t get bogged down
o Can read encrypted sessions
■ Encrypted services can be set up on server
o Slower/more susceptible to overflow attacks
102.11 Define the purpose of DoD Cyber Security Workforce, including required baseline IAT and IAM certification levels (note: ref. r to be replaced by DoD Directive 8140).
[ref. r, chs. 1, 2]
- Anyone working on or with network must be cybersecurity qualified ➔ 40 hours of CEUs
- IA Certification Program
o IA principles & practices
o IAT (Technical) - Levels I, II, III
o IAM (Management) - Levels I, II, III
102.12 Define the following:
a. Electronic spillage. [ref. b, ch. 12; ref. k]
b. Network incident [refs. t, l]
- Electronic Spillage
o When data is placed on IT system with insufficient information security controls to protect data at required classification - Network Incident
o Any possible security compromise on a network
■ Ex. Attempted entry, unauthorized entry, malicious code execution, information attack
102.13 Define the following:
a. COMSEC incident [ref. i, ch. 11]
b. PDS [ref. i, ch. 10]
COMSEC = communications security incident: Occurrence that potentially jeopardizes the security of COMSEC material or the secure electrical transmission of national security information.
PDS = practice dangerous to security: A procedure that has the potential to jeopardize the security of COMSEC material if
allowed to continue. (NOTE: A PDS is not a COMSEC incident and does not have a COMSEC case number assigned.)
102.14 Discuss reporting requirements and actions to be completed upon discovery of the
following:
a. Electronic spillage [ref. b, ch. 12)
b. Network incident [ref. l]
c. COMSEC incident [ref. i, ch. 11]
d. PDS [ref. i, ch. 10]
- Command originating electronic spillage - Call SSO/SSM
o Report spillage via naval message
o Conduct/complete preliminary inquiry (PI) within 72 hours
o Acknowledge NETWARCOM SITREP within 24 hours
o Clean up/report completion within 72 hours - Command receiving
o Same steps as originating, no PI required, notify originating immediately
102.15 Define and Discuss PKI [ref. f, ch. 11]
Achieves 4 of the 5 pillars of Information Assurance - ensuring systems and networks are maintained to protect information (safeguard integrity of data)
o Confidentiality - Information only read by authorized entities
■ How: Encryption, passwords
o Integrity - Data is unchanged from its source
■ “Hash” - snapshot of message turned into a long string of binary tacked onto the end of the email (not actually in text of the email)
* Taken when email is sent
* Taken again when email received
* Program compares hashes to ensure they are the same to achieve integrity - if they are not the same, email was tampered with
■ How: Digital certifications/signatures
o Authentication - You are who you say you are
■ How: CAC/PKIs, username/password
o Non-Repudiation - Evidence of an information exchange or transaction
■ How: Log/digital signatures
o Availability - Information systems are available (PKI DOES NOT ACHIEVE THIS ONE)
■ How: Firewalls, anti-virus
103.1 Define the following terms as they apply to maintenance operations and management:
a. Tag-Out [ref. c]
b. MFOM [ref. h, app. B]
c. ASI [ref. g, ch. 7]
d. SKED [ref. d, app. F]
e. CSOSS [ref. j]
a Tag-Out Program
o Maintain electrical safety during maintenance
■ Let others know not to energize/operate
■ Serviced isolated from power
■ Must be kept in log
b Maintenance Figure of Merit (MFOM)
o Web-based, near real-time software tool
o Calculates material readiness values
■ Prioritizes job requests/work orders
■ Provides priority-ranked Consolidated Ship’s Maintenance Plan (CSMP)
c1 Automated Shore Interface
o Way to view statistics across fleet for specific equipment (type of file, not system)
c2 Authorized Service Interruption
o Identifies maintenance/repairs accomplished during authorized system shutdown
■ Reports include uplink alignments, antennas, etc.
d Automated Planned Maintenance System Scheduling Tool (SKED)
o Program/Scheduler
■ Tracks all 3-M efforts
■ Schedules based on ship, what you have
e Combat Systems Operational Sequencing System (CSOSS)
o Instructions with emergency procedures on how to emergency shut off work equipment
■ Provide info for casualty control
103.2 Describe the 3-M system, to include:
a. PMS schedule [ref. d, app. F]
b. Spot check program [ref. d, app. G]
c. Tag-Out Program [ref. b, ch. 1]
a Planned Maintenance Schedule (PMS)
o Displays planned maintenance to be performed over different periods of time in the maintenance life cycle
■ Quarterly, monthly, weekly, daily, situational
b Spot Check Program
o Test to determine if PMS is being performed correctly
■ Spot check grade entered in SKED Spot Check Accomplishment Rating (SCAR)
c Tag-Out Program
o Provides tag-out directives, maintain electrical safety
103.3 Discuss CASREP, including the categories and types. [ref. a, ch. 4]
- Go out on SIPR (ship readiness)
o Message to CNO/fleet commanders reporting malfunction or deficiency which cannot be corrected within 48 hours
■ Reduces unit’s ability to perform primary or secondary mission - Types
o INITIAL - First CASREP
o UPDATE (CASUP) - After trying to troubleshoot, something else breaks, new updates
o CORRECT (CASCOR) - Rescind something already sent
o CANCEL (CASCAN) - Cancel entirely (not just a correction) - Levels/Categories (CATs)
o 4 - Major degradation to primary mission/total loss
o 3 - Major degradation to primary mission
o 2 - Major degradation to secondary/minor to primary
o 1 - Minor degradation to secondary (not really used in fleet)
103.4 Explain who is responsible for the command’s maintenance program and the role of the Division Officer. [ref. d, ch.1]
- CO has ultimate responsibility for maintenance program, tasked down to XO/DHs
o XO is 3-M System Manager (3-M = Material Maintenance Management System)
o DIVOs are qualified in 3-M system, assist in managing maintenance requirements for division
103.5 Explain the following: [ref. i, ch. 3]
a. SOVT requirements
b. TCD waiver
- System Operation and Verification Test (SOVT) Requirements
o Ensure system/equipment performs as advertised before taking ownership from contractor who installed it
■ Ensure it works properly with everything it “touches” after being installed/modified - Target Configuration Date (TCD) Waiver
o Date when all planned installations and upgrades are to be completed
■ No further updates without waiver