let me see so D truth is saying hey Bruce I have a question for you in regards to inheritance oh man somebody else is this you asked me this question somebody asked me this today I was like in the in shopping or something I meant to answer this one what would be the best practice to review current controls than an organization should be inheriting from another Associated Enclave okay so first of all let's explain like what inheritance is and a good example of inheritance let me give you a one security control family that's really prepped for inheritance usually inherited so let's go back to missed 853 right let's just let's keep this very simple very cut and dry and very plain so we can understand it so these are all the security controls right you got technical security controls that you would maybe technical security control might be audit logs you got to turn audit logs on if you didn't know even the system that you're on your phone your laptop wherever you happen to be watching this it has something where it can collect logs and the reason why logs are important in environments to fix systems to catch somebody trying to infiltrate your system or see leaked data going out of your system things like that right that's a technical security control that you would enable by going into the to settings of the system other controls might be configuration management that's making sure that the organization has a set standard of how secure how the templates are being done on all workstations in an environment every workstation looks exactly the same it has the same security pattern on throughout all the same image throughout the whole organization that's and then whenever it's changed you would go to a meeting like normally like a CCB a board where everybody meets up and says okay we're going to change from Windows 10 to Windows 11 or Windows 11 to Windows whatever right so that would be a cm now let's talk about one that's normally inherited an inherited control would be a uh a physical security control that will be inherited the difference between these controls is one is a system control that the first example I gave you was a system control that's like you have to go on the system and turn some sort of security on the system on that particular system that is a system level control then you have something called common controls so a common control is an inherited control that means that common meaning everyone in the organization will do X anybody who comes in our facility will have X Security will do X so a physical control is typically meets this not always but it usually meets this criteria and I'll explain what I mean by that let's go into this control and I'll show you and then we'll get to your question the truth I just want to invite everybody in this conversation so that they can get an understanding of what we're talking about here so common control usually it's a physical control why is it a common control and how is it used how is it done and why is it inherited that's what we're going to talk about Okay so the reason why it's a common controls because everyone who comes in the facility is beholden to the physical security controls so if you come into the facility you can't bring your own personal laptop into the facility that's one thing that you might have an organization might have as a rule another thing is in the facility all systems All Mission essential systems have to be locked in an environment that are the only authorized Personnel can access a good example of that would be like a restricted area so all those systems in there are beholden to a common control for protecting the physical security of that control so that one would be pe3 physical control access see that one right there pe3 so this is a common control it's inherited by every system that is in that office any system that's any systems that's in the rack of servers that's in that restricted area will have control of physical access so that it's protected by of course a door um and like a key card system maybe or a locking mechanism that only authorized people can have to come in that facility so that is an inherited control it's in every system that comes in there is inheriting the that particular physical control now this isn't just physical controls you can have inherited and common controls common controls are inherited so we'll just we'll refer to them as common controls those controls are it cannot are not only physical controls like you can have a logging be a common control you can have Personnel security be law be controlled by the common control now what all common controls have in common is this it is controlled by another organization a whole other organization or body or Department within your organization is the is controlling that and those are typically called a common control provider and this is how we get into this question here so whenever we as Information Systems security officers have to do this work we have to contact the common control provider now it depends on what level of effort if we're doing a security assessment we would have to contact them and get information because they control it so we have to go through them we have to go through The Gatekeepers of this particular control family let me see your control your question was so now that we have some idea the difference between a normal technical security control and a common control now let's answer this question okay I have a question in regards to inheritance what is the best practice to review current controls that a organization should be inheriting from an Associated Enclave so they're talking about common controls from another Enclave I believe if I'm interpreting this all right so I've actually done this before I've actually had to do this before on a couple different occasions and it depends on how the organization handles it but what I'll do is I'll just give you a couple of examples of how we did this the best practice for reviewing current controls that an organization should be inheriting from another Enclave okay so in the private sector I had to do this let's say we had I'm just gonna the names will be changed to protect the innocent obviously I'm a security guy I'm not trying to destroy my career by using real information but let's say we were we had a health care client right and the healthcare client had just bought another company they had just bought this other company and they this little Enclave was going to inherit the controls of this other system so these guys the org in this case the organization said right now we just inherited him and we're still going through the legal process of of in of adopting all of their systems so right now we're not going to touch this system I say that to say that it depends on how the organization wants to handle it okay and I'll get to other examples that are probably more in line with what you want to do so the first thing you want to do as an information security officer as a security compliance person is determine what the organization wants to do all right what is the best practice for reviewing for reviewing oh shoot hold on a second wow what the heck just happened there for for reviewing current controls that a organization should be inheriting from a Associated Enclave okay so here's another example so I was working for a federal organization and their whole thing was different we had let me see we what we did was we had two different enclaves that were touching and so the security controls were overlapping so one was inheriting some of the controls from the other one so the other control the other system had its own security system security plan and this other one we were developing system security plans and we're reviewing the security plan on this one and essentially it was a cloud it was a cloud system Federal cloud system and we had to review the existing cloud system security plan and other documentation that they had and that was not controlled by us so what we did was we looked at our security control families so let's say we looked at AU controls since we've been talking about that one and Au controls as logging controls we're looking at those login controls but then there's overlap with other log like it was a plot let's say it was a platform as a service and that means that the other organization was using AWS Cloud to do their security so in this instance what we did was we referred to we reviewed those controls that they controlled that they have complete control over those but we reviewed what they had in place to see if there's anything we can do in the documentation what we did was we referred to their document that's what we did in that particular situation it's situational right so if you give me a little bit more context I might be able to answer your question effectively in the first organization where there was two different enclaves and one had security controls and it was inheriting other security controls they told us don't worry about it all right so first of all talk to the organization they will guide you do not try to wing it do not try to improv ask the organization what they want you to do number one okay and then in the second situation I told you about was a cloud-based federal system and we had to review our side of the controls which was a system that's on premises and then there was another portion of that system that was in the cloud we didn't control the part that was in the cloud so we had to get their documentation and when we were reviewing our controls on let's say AU au3 we had to look at their documentation and then we were in our documents we refer to their we first of all reviewed their document to see how they talked about Au controls that particular au3 and then we refer to their documents that look it's in their document it's here's how they describe it we even took the text directly from their document put in all hours to address it let me see if I answered that review current controls that a organization should be inheriting from another Associated Enclave let me see if you gave me more examples and then you say Bruce it's the same person just more in-depth questions I sent before let me see Bruce have a question for you okay so what would be the best practice to review current controls number one best practice talk to the organization on how they want to don't wing it don't do improv ask the organization your organization how we handle it number one number one because they might say don't even worry about don't worry about their controls don't worry about these particular controls we're worried about ours okay that's number one how do you review current controls that the organization should be inheriting from another and okay number two number two is this if it's a if it's a common control provider that means the other enclave and they control that piece you have to talk to them to review those controls because you don't have direct control over those so you have to talk to the common control provider that would be the other Enclave and that's what we did in that in the second example I gave you we talked to them we said okay here's what we're doing we're reviewing these controls you guys control this set of controls can we get your do you have any documentation on it can we get a meeting on this we're trying to get as much information as we could about that particular part of the of the system so we got we are able to get their documentation read through it and say okay here's what they're doing so I hope that answers your question I don't maybe I hope I understood it correctly should and should be inherited from another associate that's how I've had to do it in the past but the number one make sure you ask your organization how we want to treat it and then number two if it's if it's controlled by another organization get as much information from them as possible to see how they're controlling it and in another situation what we did was we had to get the GPO because another organization had a GPO that they controlled and so we just got their GPO on the global policy I forget what the o means but we had to look at their policies and look and see how okay how are they doing the passwords how complex are the passwords how this how that like we had to look at the actual GPO to see to determine how it's affecting our system it depends on the situation is how it's how I could best put it but if you follow those two things I just said then that will make sure you ask your organization how we're going to treat it don't wing it and then number two ask the common control provider whoever is controlling that get some insight into them from them and that should help you out hope that answers your question that's how I've done it in the past and if I'm wrong there's plenty of people who follow me who have more insight on than me on how to do that