2NV Update. A look at where we are in the delivery of 2NV Wayne Jones, NNSA CIO Melissa Ujczo-Kovachich, IT Project Manager

Transcription

1 2NV Update A look at where we are in the delivery of 2NV Wayne Jones, NNSA CIO Melissa Ujczo-Kovachich, IT Project Manager

2 2NV Overview 2NV is a suite of IT initiatives sponsored by NA-IM that will provide a modern technology infrastructure for enabling future Nuclear Security Enterprise (NSE) shared services. The initiative will fundamentally re-architect the NNSA IT environment to provide a secure set of capabilities including unified networking, federated identity services, agile cloud infrastructure, and collaboration services across NNSA sites including HQ, Federal Field Offices, Labs, and Plants. YOURlcoud One NNSA Network OneID OneVoice 2

3 NNSA Network Vision: 2NV YOURcloud a secure hybrid community cloud broker that will deliver efficient and effective data storage and hosting capabilities to the enterprise. OneNNSA Network a mesh overlay that will connect all NNSA site offices, plants, and labs giving all of our customers access to the same network, tools, and applications. 3

4 NNSA Network Vision: 2NV OneID a single-sign-on user authentication application that will allow users to access shared applications across the Department via the YOURcloud hosting environment. ONEvoice provide a unified communications stack to our customers across the enterprise, allowing for increased collaboration and productivity. 4

5 Goals 2NV will help NNSA OCIO meet its goals now and into the future People Processes Mandates Technology Providing the NSE with effective collaboration tools will enable and empower our workforce across the NSE. Streamlining our business and project management processes will allow us to operate more effectively and efficiently. We are constantly being asked to adhere to federal and Department mandate that aim to make our organization better. 2NV will establish an infrastructure to allow us to keep up with FITARA, Cloud First, and other federal mandates. Modern technology is easier to implement and maintain. It also provides better security and increases our cybersecurity posture on the whole. 5

6 Where we are OneID One NNSA Network Proof of Concept Operationalize Operation & Maintenance YOURcloud OneVoice 6

7 Release Schedule * 2015 FY st Quarter FY nd Quarter FY rd Quarter FY th Quarter Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep IATO for Social cast Update docs to NNSA portal Back Up Prod Enclave Archive Enclave & Test Restore Lessons learned Develop/Test CCP SP Integration Testing: 10 users ONE ID receives ATO, add users Integration Prep/Testing, all users Address POA&M Items Scanning Secure ATO Integrated Testing of SP Execute SP Integration NTP SMTP SOPs for SP IoD Installation Social Cast SharePoint YOURcloud IoD ONE ID OneNNSA Network LYNC Completed items Risk Assessment Submit Memo for Approval of User Story #1 Transition O&M to IM-60 Hosting model Federation between all sites within NNSA Install/ Configure/Test in ABQ Align Federal ICAM and HSPD-12 Secure IATO Cross Connect Tier 1&2 OPS Support Model Install/ Configure/Test remaining Sites Secure ATO Enrich with CPCI & HSPD-12 Production testing for App Tier Production Attribute Exchange (Identity Broker) 7

8 Performance Methodology Product Owner Definition of Ready New! Scrum Master Daily Scrum Product Backlog 15 minutes every 24 hours Lorem ipsum dolor sit amet. Consectetur adipiscing elit. Vivamus sed enim placerat, euismod mi et, tempus neque. Aenean rhoncus, nisl at lobortis convallis, nunc urna pharetra lacus, eget maximus quam sem at nibh. Ut at auctor lacus. Aliquam erat volutpat. In vehicula vel enim vitae fringilla. Sed non bibendum nulla. Aenean gravida Sprint Planning What + How Sprint No more than one calendar month Definition of Done feugiat interdum. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Aenean eleifend tristique sem a feugiat. In rhon feugiat interdum. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Aenean eleifend tristique sem a feugiat. In rhon Sprint backlog + Sprint Goal Development Team Potentially Shippable Increment Sprint backlog might look like this. Note doesn t have to use tasks. PBI To Do In Progress Done Sprint Review Progress tracked transparently daily Sprint Retrospective 8

9 Scope (OneNNSA Network) High Level Requirements Connect all NNSA sites (HQ, Federal Field Offices, Labs, and Plants) together in a new NNSA Corporate Wide Area Network (WAN) mesh topology. Maximize network security with the latest protocols including Public Key Infrastructure (PKI) keys and Layer 3 FIPS compliant end to end encryption. Ability to connect and securely interoperate with the DOE Network (DOENET) through the a compliant Trusted Internet Connection (TIC). Provide for up to 1 GB/sec of encrypted throughput at each site router with the ability to expand over time. Audience All NNSA sites including Federal and M&O Contractor personnel. Metrics 100% of sites connected to the OneNNSA network. Average latency less than 150 ms with low jitter. 100% of network traffic monitored by DOE NOC/SOC (JC3). DOE Complete Ownership Status 9

10 Scope (OneID) High Level Requirements Provide single sign on authentication to support unclassified Enterprise Applications in YOURcloud using industry standards. Provide alignment with Federal ICAM and HSPD-12 efforts. Provide a secure system architecture for housing of Personally Identifiable Information (PII). Federate identity information from each site into an enterprise directory using industry standards. Provide an enterprise directory view to the application tier for supported Enterprise Applications to allow application authorization decisions based on a consistent set of enterprise metadata. Enrich site data in the enterprise directory with additional identity information for CPCI and GSA. Audience All NNSA sites including Federal and M&O Contractor personnel. DOE Federal Employees. Metrics Average roundtrip latency time for authentication hub < 3 seconds. 100% of active computer accounts in NNSA (as provided by the sites) captured within the enterprise directory; excluding foreign nationals. 100% of active computer accounts for DOE Federal users (as provided by HQ) captured within the enterprise directory; excluding foreign nationals. > 90% of identities reconciled through business logic with no manual intervention. Enterprise directory accounts deactivated within 1 business day of site disablement. DOE Ownership NOTE: Initially supported applications include ONEvoice Social Network (Socialcast), Infrastructure on Demand (IoD), and Enterprise SharePoint. NOTE: HSPD-12 implementation is out of scope but the project should accept PIV card authentication. NOTE: This response time goal is only for the Authentication Hub and does not include any delays or additional latency at the application tier. NOTE: Initial design goal is for a 60 second automated update process. However, the success metric is 24 hours to allow for manual remediation when necessary. 10

11 Scope (Yourcloud) High Level Requirements Provide a custom, unclassified, private cloud infrastructure based on NNSA security requirements within a commercial data center. Deliver the private cloud as a fully managed service, including security services, leveraging a commercial cloud services provider. Deploy a secure community cloud services broker supporting both multi-tenant and multi-cloud environments. Deliver a self-service provisioning portal through the cloud services broker for Infrastructure as a Service (IaaS). Deliver a data centric approach to security where controls are inherited from the underlying infrastructure (pick a plan v/s write a plan). Provide multiple tiers of service based on application requirements (i.e. Gold, Silver, Bronze). Audience NNSA Feds mandatory usage for server infrastructure over time. DOE Feds recommended usage for server infrastructure over time. M&O Contractors optional usage for server infrastructure. Metrics > 90% of Virtual Machines (VM) self-service provisioned through the cloud services broker. 100% continuous monitoring capabilities for back channel (i.e. management) infrastructure. Deliver expansion of compute and/or storage within 45 days of request. 100% of VMs provisioned from secure/hardened templates. Year over Year reductions in cost based on cloud scale in accordance with cost model. 100% outsourced compute and storage infrastructure in YOURcloud commercial data centers. DOE and NNSA Ownership NOTE: Monitoring will be accomplished through a combination of Verizon Managed Security Service (MSS) and IARC. NOTE: Assumes that each customer of YOURcloud will provide hardened ISO images to the cloud services broker 11

12 Scope (ONEvoice) High Level Requirements Provide a unified, unclassified communications capability across the NNSA that includes the following features: Web Conferencing Presence Instant Messaging Desktop Video Provide access to an existing agency enterprise content repository. Provide an agency wide social network with the following features: Community streams/news feeds Town Hall Meetings Private Messaging Collaboration Groups File Sharing Action Tracking Personal Pages Employee Interaction (Hash Integration with Line of Business Systems Audience Social Network: All NNSA federal personnel and NNSA M&O Contractor personnel; excluding foreign nationals. Lync: All DOE/NNSA federal personnel and NNSA M&O contractor personnel; excluding foreign nationals. Metrics 100% of employees able to connect to collaboration capabilities; excluding foreign nationals 100% of Labs, Plants, and HQ with community news feeds 100% of employees with the ability to create personal pages within the social network; excluding foreign nationals Year over Year decrease in internal volume based on ONEvoice capabilities Replacement of legacy agency communication tools (i.e. NNSACAST) DOE and NNSA Ownership NOTE: Scope is only areas authorized by the Cognizant Security Authority (CSA) as eligible for webcam capability. In addition, this assumes each site has or will have a production Lync deployment in place. NOTE: DOE is considering potential future use by DOE Federal employees and Support Services Contractors. NOTE: This does not imply personal MySite pages in SharePoint which is out of scope. 12

13 Challenges The DOE ICAM project may or may not use the OneID application; still in flux. A service catalog will be required in order to fulfill the multi-tenancy, level of service and inherited security controls portion of the YOURcloud HLR. Issues with YOURcloud environment are being addressed. SharePoint SSO Testing activities will be on hold until OneID receives ATO. The DOE ESPC project may negatively impact YOURcloud product. DOE ESPC project has made cross connect virtually impossible. Security boundaries between NNSA and DOE will need to be confirmed for the OneID team: Understand how NNSA will align with the current ICAM project. Engage a new product owner from IM-70. Lync Federation is being held up by an ISA issue and site funding issues. 13

14 QUESTIONS? 14

15 Thank You Wayne Jones, NNSA CIO Melissa Ujczo-Kovachich, IT Project Manager 15