siprnet title here 3 lines if needed - jsac-dfw. · pdf fileccri united states ... solution...
TRANSCRIPT
![Page 1: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/1.jpg)
Tito Cordero Jr.
Information System Security Manager
March 19, 2012
SIPRNet : Processes & Responsibility
Copyright © 2010 Raytheon Company. All rights reserved.
Customer Success Is Our Mission is a registered trademark of Raytheon Company.
UNCLASSIFIED
UNCLASSIFIED
![Page 2: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/2.jpg)
What is SIPRNet ?
SIPRNet stands for the Secret Internet Protocol Router Network. It is the Department of Defense’s largest network for the exchange of classified information and messages at the SECRET level. It supports the Global Command and Control System, the Defense Message System, and numerous other classified war fighting and planning applications.
SIPRNet is no different from the Internet other than the domain name which is ‘.smil.mil’ or ‘.sgov.gov’.
SIPRNet uses the Transmission Control Packet – Internet Protocol (TCP-IP) in a secure environment using COMSEC equipment such as a KIV-7M, or KIV-7HSB.
UNCLASSIFIED
UNCLASSIFIED
![Page 3: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/3.jpg)
Page 3
Organizations and Responsibilities
Defense Information Systems Agency (DISA)
Office of the Assistant Secretary of Defense For Networks
and Information Integration (OASD) (NII))
DISA SIPRNet Management Office
Government Sponsor
Defense Security Service (DSS)
DISA Certification and Accreditation Office/Classified
Connection Approval Office (CAO)
Responsible for Defense Information Systems Networks
(DISN) circuits and oversight.
- Final approval authority for all connection requests in
support of sponsor’s mission
- Review SIPRNet requests and initial topologies to
determine whether the proposed DISN solution is
appropriate.
Forwards the approved solution to OASD NII for approval.
Sponsor/owner of contractor connection
Provide funding for circuit and any other required services
for contractor connection to SIPRNet (i.e. Computer
Network Defense Service Provider (CNDSP), email, Domain
Name Service (DNS)).
DAA for accrediting information systems used to process
classified information in industry
Process System Security Plans (SSP)
- Process Connection Approval Packages (CAP) – issues
IATT, IATC and ATC.
9/6/2015
UNCLASSIFIED
UNCLASSIFIED
![Page 4: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/4.jpg)
Page 4 9/6/2015
Circuit Ordering
Government Contracting Authority (GCA)
Requirements include a valid DD 254 that contains a mission support requirement.
GCA Sponsorship
Sponsorship letter must contain the following:
Contract number, cage code, POC, network diagram, ports, websites and
protocol.
This will be submitted to [email protected]
SIPRNet connection
DISA Direct ordering site https://www.disadirect.disa.mil/products/asp/welcome.asp that is
referred to as DISA Direct Order Entry(DDOE) is where you will order your circuit. You
must contract the DISN Global Support Center at 1-800-554-3476.
SIPRNet addresses Contact your Sponsor for IP addresses and web links contact DOD Network Information Center (NIC) at 1-
800-582-2567
UNCLASSIFIED
UNCLASSIFIED
![Page 5: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/5.jpg)
Page 5 9/6/2015
Required Devices
Type 1 encryption KIV-7HSB
SIPRNet circuit will require a Type 1 encryption device and the user must have the DTD which can be programmed to handle
(store, securely transport, and transfer) COMSEC and TRANSEC keys, Communications- Electronics Operating
Instructions (CEOI), frequency hopping parameters, and net control operating directions for the evolving family of COMSEC equipment crucial to new communications systems.
UNCLASSIFIED
UNCLASSIFIED
AN/PYQ-10 Crypto Fill Device.
![Page 6: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/6.jpg)
Page 6
Required Devices
9/6/2015
Firewall equipment required as part of the
SIPRNet .
1 Evaluated Assurance Level (EAL) 4 firewall
1 Intrusion Detection System (IDS)
UNCLASSIFIED
UNCLASSIFIED
![Page 7: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/7.jpg)
Page 7
CNDSP
DoD 8530 Directive and Instruction provides guidance to
– evaluate Computer Network Defense Service Providers (CNDSP)
– certify and accredit teams
Secondary goal: ensure a higher quality of protection through increased maturity and
understanding of the services provided by the CNDSP.
Contractors must have a CNDSP assignment before they will be allowed connections to the
DISN network.
CNDSP concerns: – Cost
– Army Research Labs (ARL) is the only one accepting new CNDSP services
– Waiting time for sensors as they have to request them from the vendor
Recommendation: ‒ obtain CNDSP service with acquisition of circuit prior to ATO/ATC
9/6/2015
UNCLASSIFIED
UNCLASSIFIED
![Page 8: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/8.jpg)
Page 8
CTO 10-133
A. THE LOCAL ISSM WILL:
(1) DIRECT ALL PERSONNEL TO CEASE DATA TRANSFERS TO REMOVABLE MEDIA ON THE SIPRNet .
(2) DISABLE "WRITE" PRIVILEGES, EITHER THROUGH PHYSICAL CONFIGURATION, SOFTWARE SETTINGS,
HOST BASED SECURITY SYSTEM (HBSS) DEVICE CONTROL MODULE SETTINGS, OR ANY COMBINATION
THEREOF.
(3) SET LOCAL GUIDELINES AND PROCEDURES FOR APPROVAL-DISAPPROVAL OF "WRITE" CAPABILITY TO
REMOVEABLE MEDIA ON THE SIPRNet .
(4) MAINTAIN A LIST OF ALL SYSTEMS THAT HAVE BEEN AUTHORIZED TO "WRITE" TO REMOVABLE MEDIA
DEVICES.
B. SECURITY MANAGERS SHALL:
(1) PROVIDE AUTHORIZED USER APPROVALS TO THE ISSP AND ISSM. PROVIDE FINAL APPROVALS FOR ANY
"WRITE" TO REMOVEABLE MEDIA CAPABILITY WHICH THE COMMAND REQUIRES.
(2) DOCUMENT PERSONNEL APPROVED TO USE "WRITE" CAPABILITIES AT THE LOCAL LEVEL AND RETAIN ON
FILE FOR A MINIMUM OF FIVE YEARS.
(3) ENSURE COMPLIANCE WITH REFERENCE A, PARA. 7.B(2) UPON COMPLETION OF WRITE ACTIVITY.
9/6/2015
UNCLASSIFIED
UNCLASSIFIED
![Page 9: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/9.jpg)
Page 9
Approval Package
After receiving circuit approval/validation and circuit order contractor should be developing all required
security documentation and begin system configuration/hardening.
Required documentation for Connection Approval Package (CAP) package submittal to DISA Classified
Connection Approval Office (CAO) [email protected] :
– DSS ISFO Process Manual for contractor Certification and Accreditation
• Systems Security Plan (SSP), Protection Profile (PP) other documentation as required
• Obtain DSS Accreditation Letter
– SIPRNet Connection Questionnaire (SCQ) with DSS RDAA signature (example)
– Consent to Monitor signed by sponsor
– Residual Risk Memorandum signed by contractor
– MOA between US ARL and the MACOM or Sponsor
– Topology diagram (example)
• IP addresses are required (FOUO, unless specified by sponsor with supporting security classification
guide)
9/6/2015
UNCLASSIFIED
UNCLASSIFIED
![Page 10: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/10.jpg)
Page 10
Connection Approval Process
• The DISA CAO manages the Connection Approval Process and security requirements for the SIPRNet .
• DISA CAO verifies CAP is complete with all required documentation.
• Once circuit is installed at Contractor facility (DMARC) and security package approved by DISA CAO, DISA will issue an Interim Approval To Test (IATT).
– Note: Prior to DISA scheduling technician to install/configure CSU/DSU, KIV-7 etc. the following items are required:
• 1) DSS ATO
• 2) CAP approved by DISA CAO
– Burn-in & implementation by GNSC
• After burn-in and implementation by the GNSC the CAO will initiate a remote compliance vulnerability scan. Once a successful scan has been completed, the CAO will issue an IATC/ATC.
• Contractor on SIPRNet
9/6/2015
UNCLASSIFIED
UNCLASSIFIED
![Page 11: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/11.jpg)
Page 11
SIPRNet Process Flowchart
Contract requires SIPRNet Connection
DD-254
START
DoD Sponsor submits access request to JS/J6
JS/J6 validates
OSD/CIO approves
DISA accepts OSD/CIO letter and assigns control No.
and CCSD No.
DISA informs DSS about new SIPRNet
connection
SIPRNet validation letter to JS/J6
MOA Letter for CNDSP Service
SIPRNet Approval Letter from OSD/CIO
Front Channel Message from DISA to DISA Field
Service to initiate the connection
DSS Letter to contractor FSO
Contractor prepares System
Security Plan
SIPRNet Maintenance
Process END
ATO SCQ Statement of
Residual Risks Consent to Monitoring
ATC Letter from DISA CCAO
DISA CCAO accepts all documents and
issues an ATC
9/6/2015
UNCLASSIFIED
UNCLASSIFIED
![Page 12: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/12.jpg)
Page 12
HBSS
Host Based Security System (HBSS): The Host Based Security System
(HBSS) baseline is a flexible, commercial-off-the-shelf (COTS)-based
application. It monitors, detects, and counters against known cyber-
threats to Department of Defense (DoD) Enterprise. Under the
sponsorship of the Enterprise-wide Information Assurance and computer
Network Defense Solutions Steering Group (ESSG), the HBSS solution
will be attached to each host (server, desktop, and laptop) in DoD. The
system will be managed by local administrators and configured to
address known exploit traffic using an Intrusion Prevention System (IPS)
and host firewall. DISA PEO-MA is providing the program management
and supporting the deployment of this solution.
9/6/2015
UNCLASSIFIED
UNCLASSIFIED
![Page 13: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/13.jpg)
Page 13
HBSS
HBSS with Device Control Manager (DCM): – Active circuit with proper ATO and ATC
– Circuit must be approved by DSS which will verify if you meet the CTO 10-133 Guidelines
Obtaining HBSS software: – You can have your customer to provide the software
– Contact DISA HBSS web site http://www.disa.mil/hbss/
Configuration: – Verify that your DCM module is installed correctly to prevent data transfers
– DSS must approve any data transfer if an Risk Acceptance Letter (RAL) is on file with the Master System Security Plan
(MSSP)
9/6/2015 UNCLASSIFIED
UNCLASSIFIED
![Page 14: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/14.jpg)
Page 14
CCRI
United States Cyber Command (USCYBERCOM) directs CAM 09-031A, 09-039.
Defense Information Systems Agency executes the Command Cyber Readiness
Inspection (CCRI) program. – A Field Security Operations (FSO) team will coordinate with the Information Assurance Manger visit
and validations of the SIPRNet connectivity.
– 120 day notice prior to CCRI
– An Email from a CCRI will request information for the coming inspections.
– Evaluation Criteria:
DOD IA Enterprise Solution STIG
HBSS checklist
Windows STIG
Windows 2003 Checklist
Windows 2000 Checklist
– Tools Utilized:
DOD Vulnerability Management System
GOLD DISK [DISA]
Manual Processes as defined in checklists
9/6/2015
UNCLASSIFIED
UNCLASSIFIED
![Page 15: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/15.jpg)
Page 15 9/6/2015
CCRI Form
UNCLASSIFIED
UNCLASSIFIED
![Page 16: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/16.jpg)
Page 16 9/6/2015
Vulnerability Management System
UNCLASSIFIED
UNCLASSIFIED
Vulnerability Management System
All systems in the Department of Defense (DoD) must be built in accordance with DoD requirements such as those outlined in the
Security Technical Information Guides (STIGs) and consensus baseline standards. Tools such as the DoD Gold Disk and Defense
Information Systems Agency (DISA) Field Security Operations (FSO) scripts can be used to build a compliant system.
Once a system is built, it must be maintained to ensure compliance with any new requirements such as Information Assurance
Vulnerability Management (IAVM) notices, new STIG checks, Port and Protocol guidance, or Directives (e.g., Communications Tasking
Orders (CTOs), Operational Orders (OPORDs)).
In November 2004, the Department of Defense released for use eEye’s Retina/REM product suite as the DoD enterprise scanning
solution for validating compliance with the Information Assurance Vulnerability Management (IAVM) process. This suite is known as the
Secure Configuration Compliance Validation Initiative (SCCVI). The SCCVI can determine whether the system is in compliance with
IAVM notices and some STIG requirements. If the system is not in compliance, the Secure Configuration Remediation Initiative (SCRI)
can be used to remediate the vulnerability or exposure. Maintaining compliance with any new requirements helps to ensure the security
of the system.
The Vulnerability Management System (VMS) was developed to interface with the DoD Enterprise tools to assist all DoD
Combatant Commands, Services, Agencies, and Field Activities (CC/S/A/FAs) in the identification of security vulnerabilities
and tracking the issues through the lifecycle of the vulnerabilities existence.
This user’s guide provides common information for all users. It has been designed to familiarize you with VMS concepts and common
functions, and general navigation information.
![Page 17: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/17.jpg)
Page 17
VMW Process
9/6/2015
UNCLASSIFIED
UNCLASSIFIED
![Page 18: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/18.jpg)
Page 18
Overview of VMS Users and Roles
9/6/2015
Many people use VMS to accomplish various tasks. These include:
Vulnerability Entry Users
Combatant Commands/Services/Agencies/Field Activities Points of Contact
(CC/S/A/FA POCs)
Designated Approving Authorities (DAA)
Certification Authorities
Information Assurance Managers (IAM)
Information Assurance Officers (IAO)
Accredited System/Program Managers (PM)
System Administrators (SA)
Network Administrators (NA)
Security Managers (SM)
Team Leads and Reviewers
Command Oversight
UNCLASSIFIED
UNCLASSIFIED
![Page 19: SIPRNET Title here 3 lines if needed - jsac-dfw. · PDF fileCCRI United States ... solution for validating compliance with the Information Assurance Vulnerability Management (IAVM)](https://reader031.vdocument.in/reader031/viewer/2022030503/5ab005007f8b9adb688e6014/html5/thumbnails/19.jpg)
Page 19
Overview of the Primary Data Tracked by VMS
9/6/2015
In response to increased military reliance on a security computing infrastructure, VMS
continues to evolve as a near real-time security decision support system. At the core of the
VMS model is:
Assets – Any computing device, building, network, vault, etc. that requires
compliance to emerging vulnerabilities, configuration settings, and policies.
Vulnerabilities – Within VMS, the term vulnerability includes IAVM notices,
configuration settings, and policy guidance. Vulnerabilities are tailored to the
specific configuration of the asset as defined within the VMS. As vulnerabilities are
added to and removed from specific configurations, they are added and removed
from the appropriate asset.
Statuses – Each asset and vulnerability has a status that is determined by a
script, scan, or manual determination. The status history, user type, and tool used to
determine the status is also maintained. Self-assessment, outside review, or internal
security managers can contribute to the status and validation history for all
vulnerabilities.
UNCLASSIFIED
UNCLASSIFIED