Unified Management of the Common Operating Environment (COE)

Transcription

1 SAND C Unified Management of the Common Operating Environment (COE) Standardizing and managing commonly used software on Windows, Mac, and Linux Sandia National Laboratories Exceptio nal service in the national in teres t Sandia National Laboratories is a multi-program laboratory managed and operated by Sandia Corporation, a wholly owned subsidiary of Lockheed Martin Corporation, for the U.S. Department of Energy s National Nuclear Security Administration under contract DE-AC04-94AL85000.

2 Introduction At Sandia, there are computing platforms in Sandia's "productivity computing*" environment: Windows, Mac, and Linux In general, Sandia defines and manages an operating system and a core set of security and productivity applications for each platform This is what we call the Common Operating Environment (COE) But Sandia has faced some challenges in defining and managing the COE for each platform in a consistent, "unified" manner This presentation describes the effort we are taking to... Develop a common set of definitions around exactly what the COE is Develop a unified approach to managing the COE across the three computing platforms *Classified and unclassified computing for typical office- or project-related tasks, as opposed to high performance computing or mobile-device computing.

3 What does "COE" even Sandia National Laboratories We're still working on it! Proposed Definition: The suite of software Sandia agrees on to be standardized for most computers on a particular platform (Linux, Mac, or Windows) Includes the operating system, office productivity products, security applications and collaborative tools that meet Sandia's mission needs. What characterizes the COE: Rigorous lifecycle management of the COE Commonly installed on many desktop devices across Sandia's networks Actual software included in the COE and how it is delivered varies by platform and network Provides information to customers about what IT core computing capabilities are available for their desktop to enable them to do their work

4 History: COE management before the Unified COE team s-,- Concept of COE was well-branded and well-known part of Sandia's culture (especially for Windows) Constituent components for all three computing platforms were unevenly defined Fairly well-defined for Windows Somewhat well-defined for Mac Almost non-existent for Linux And not only unevenly defined, unevenly understood What was included in the COE varied according to who you asked COE teams that managed the OS and common applications were split among several organizations and teams Technical teams for Windows and Mac in one organization Linux team in a different organization with little to no contact with the Mac or Windows teams

5 History: COE management before the Unified COE Team, ^ Laborato cont'd Windows COE was the most formally managed and defined platform, with welldeveloped requirements Security Patch management VPN capabilities Corporate web application compatibility with the browser (e.g. browser fully compatible with COTS and in-house built web applications) Testing changes to the environment Mac team typically interpreted requirements for Windows and applied them to the Mac COE (when possible) to ensure alignment with Windows requirements Linux COE existed mostly in theory (Sandia standardized on Red Hat Enterprise Linux as COE), but MANY Linux distributions exist in the environment Approaches to patch management, corporate web application compatibility, functionality improvements (VPN, e.g.) were very different for Linux

6 What we did to address this Sandia National Laboratories April 2014: Created a Unified COE team comprising staff who manage and deliver the COE for all three platforms By computing platform, team members presented to the team how they managed their particular COE, including the following: Research, select, develop, and deliver standard hardware and software offerings Develop tools to deliver secure installation packages or images for their computing environment and network (classified, unclassified, open) Develop tools for technical support staff to support the desktop Manage or provide patches and enhancements for the desktops and servers Ensure all devices in their computing environment met security requirements Provide Tier 3 support Define processes and identify common activities for lifecycle management of the operating systems and applications

7 Results of presentations by team members Determined the team needed a new name to describe the common work performed to deliver the COE Sandia Core Computing Capabilities Team or SC3 team Realized there were common COE lifecycle management processes across the platforms Still did not have a clear definition of the COE (What does it mean?) Current definition still very Windows-focused Determined the COE was the product that the teams delivered to the customer Identified that COE is well-branded at Sandia and needed to be retained in some fashion Prior attempts to map the various applications needed to support the business for each platform were thus far unsuccessful Moving toward the concept that "Unified COE" involves developing a common approach to managing the lifecycle of constituent applications across the platforms, but actual offerings would differ by network and platform

8 We are currently defining COE lifecycle management processes Laboratories Define the process to release the COE to Sandia We do this in partnership with sister organizations containing the Tier 3 group that deploys the COE to the Labs (typically via desktop management software) We have already identified common activities for the Release Process Define the process for managing the COE while it's in the live environment Especially, how we support the field technicians who support customers running the COE We manage compliance in the live environment through a Network Disconnect Process that removes noncompliant devices from the network Defined the process to remove legacy COE especially operating systems from the live environment

9 Manage the release process Sandia National Laboratories Identify issues with the new software Test compatibility with various users (deployment team, early adopters, etc.) for the following COE application Browser readiness for corporate web applications Firewall protection Desktop management software solutions VPN solution Cyber security machine protection requirements Complete Sandia admin activities Proper internal network, cyber, and test machine registrations for new OS Adhere to Change Management processes

10 For example: Release the Mac OS to Sandia Sandia National Laboratories Sandia Administrative Activities to bring newly released OS in compliance for use on Sandia's networks Development

11 We have mostly well-developed process to manage gs^ COE while it's in the live environment Well-defined Incident and Request management processes (Tiers 1, 2, and 3 support, beginning with the help desk) Patch management: Very mature in the Windows environment Still maturing for the Mac OS Still maturing for Red Hat Enterprise Linux Ongoing process to ensure compliance to requirements of computers on Sandia's networks Network Disconnect Process helps manage the risk Well-defined process to manage less-than-full-version software updates for Windows and Mac

12 Process to remove legacy COE (especially operating systems) from the live environment The team monitors OS vendors for the following criteria: Number of versions behind vendors' latest released OS Security patches and enhancements no longer provided by the vendor Support by vendor ends or is available only at additional costs Cost increases due to Compatibility issues with other core applications Increase in OS instability, performance, errors, troubleshooting Legacy browsers embedded in the OS are no longer compatible with core applications We declare the OS meeting these criteria as "legacy" and they are no longer approved for Sandia networks Sandia's Network Disconnect Process helps drive customers to upgrade, purchase a new computer, or retire their device with the legacy OS: Sandia requirements provide the "teeth" to manage the risk of legacy devices (prevent network access, require additional protections, etc.) Non-exempt devices with legacy OSes that are discovered on the network are automatically submitted to the Network Disconnect Process An exemption process is available for customers to keep their legacy OS devices while securing Sandia's networks from vulnerabilities

13 Next steps: Unify lifecycle management of the COE acros computing platforms Sandia National Laboratories Define COE components for each platform Collaborate across computing platforms to standardize lifecycle management processes Move toward making common capabilities available for all platforms IT Infrastructure teams engaging Mac and Linux teams by investigating Windows infrastructure capabilities for the non-windows platforms Standardize communications with customers regarding release and removal of the COE from Sandia's environment Build in communications and self-help training opportunities for customers to minimize impact to their work

14 Why do all of this? Common, formal processes standardize on the delivery of the COE AND help us identify opportunities for improvement Standardized processes help us spin up new projects quickly and consistently Don't reinvent the wheel every time we get a new or remove an old software version A unified team encourages collaboration and sharing of experiences and challenges A standardized COE helps manage customer expectations, especially when we do the more difficult task of removing software from the live environment Obviously, a standardized, unified COE helps Sandia manage risk and secure its networks