Panel Discussion: Evolving DoD Security Requirements for Cloud

Transcription

1 Unclassfd Panl Dscusson: Evolvng DoD Scuty Rqumnts fo Cloud Rog S. Gnwll Chf, Cybscuty 29 Januay 2015

2 Balancng Scuty and Rsk Unclassfd Govnmnt Pvat Cloud (DoD ntgatd and opatd commcal tchnology) On-pms (DoD Ntwok & Faclts) Commcal Pvat Cloud (Commcally ntgatd and opatd) Scuty Cost Commcal Pvat/Communty Cloud (Fdal nants Only) Commcal Mult-nant Cloud (Communty and Publc) $$$ $ - + Innovaton Aglty/Spd Command and Contol / Stuatonal Awanss Off-pms (Commcal Faclts) Goal: Impov lvagng of commcal capablts and ffcncs whl nablng ffctv sk managmnt JAN

3 Unclassfd Cloud Scuty Contols Ronald S. Rc Cyb Standads Banch (RE71) 29 Januay 2015

4 Infomaton Impact Lvls Unclassfd Infomaton Impact Lvl - h combnaton of: 1) h snstvty of th nfomaton to b stod and/o pocssd n th cloud; and 2) h potntal mpact of an vnt that sults n th loss of confdntalty, ntgty o avalablty of that nfomaton Cloud Computng SRG dfns 4 Infomaton Impact Lvls Cloud Scuty Modl (CSM) dfnd 6 Infomaton Impact Lvls Smplfs Impact Lvl slcton and capablty matchng Lvls 1 and 3 hav bn olld up wth th nxt hgh lvl Lvls dsgnatd as Lvl 2, 4, 5, 6 fo consstncy wth th old CSM 25 JAN

5 Scuty and Pvacy Contols Unclassfd FdRAMP v2 contols sv as mnmum basln fo any authozaton DoD FdRAMP+ contols basd on a CNSSI 1253 catgozaton of M-M-x: Modat Confdntalty (M), Modat Intgty (M), Avalablty (x) Avalablty addssd n th contact/sla basd on msson own qumnts CNSSI 1253 (2014) M-M-x Basln NIS SP v4 Modat Basln PLUS CNSS talod C/CEs FdRAMP v2, Modat Basln NIS SP v4 Modat Basln PLUS FdRAMP talod C/CEs CNSSI 1253 & FdRAMP baslns compad to dv DoD s FdRAMP+ C/CEs Supplmntal Contol Rqumnts CNSSI 1253 Pvacy Ovlay (whn publshd) s nvokd f PII/PHI s nvolvd NIS SP v4 Pvacy contols plus supplmntal contol gudanc CNSSI 1253 Classfd Ovlay s nvokd at Lvl 6 25 JAN

6 Ky Scuty Rqumnts Unclassfd IMPAC LEVEL INFORMAION SENSIIVIY SECURIY CONROLS LOCAION OFF-PREMISES CONNECIVIY SEPARAION PERSONNEL REQUIREMENS 2 PUBLIC o Non-ctcal Msson Infomaton FdRAMP v2 Modat US / US outlyng aas o DoD on-pmss o AO authozd locatons Intnt Vtual / Logcal PUBLIC COMMUNIY Natonal Agncy Chck and Inqus (NACI) 4 5 CUI o Non-CUI Ctcal Msson Infomaton Non-Natonal Scuty Systms Hgh Snstvty CUI Natonal Scuty Systms Lvl 2 + CUI-Spcfc alod St Lvl 4 + NSS & CUI- Spcfc alod St US / US outlyng aas o DoD on-pmss o AO authozd locatons US / US outlyng aas o DoD on-pmss NIPRNt va CAP NIPRNt va CAP Vtual / Logcal PUBLIC COMMUNIY Stong Vtual Spaaton Btwn nant Systms & Infomaton Vtual / Logcal FEDERAL GOV. COMMUNIY Ddcatd Infastuctu ADP-1 Sngl Scop Backgound Invstgaton (SSBI) ADP-2 Natonal Agncy Chck wth Law and Cdt (NACLC) Non-Dsclosu Agmnt (NDA) 6 Classfd SECRE Natonal Scuty Systms Lvl 5 + Classfd Ovlay US / US outlyng aas o DoD on-pmss CLEARED / CLASSIFIED FACILIIES SIPRNE va CAP Vtual / Logcal FEDERAL GOV. COMMUNIY Ddcatd Infastuctu Favoably Adjudcatd SSBI SECRE Claanc NDA 25 JAN

7 Unclassfd Cloud Comput Ntwok Dfns () Robt J. Mawhnny Chf, Effctvnss Banch (RE61) 29 Januay 2015

8 Bounday Povds Unclassfd USCYBERCOM JFHQ-DODIN CP JCC / CCMD DISA DCC DNC CONUS CAP SPs USCYBERCOM JFHQ-DODIN CP Bounday (B) JCC / CCMD 1 US- CER DISA DCC DNC CONUS CAP SPs Msson (C2+Ops) Bounday (B) 1 2 Ods LEGEND Data Shang Data Flow/Rpotng Msson Owns Mssons Contan 3 25 JAN

9 Msson Povds Unclassfd USCYBERCOM JFHQ-DODIN CP JCC / CCMD Msson (C2+Ops) 2 US- CER DISA DCC DNC CONUS CAP SPs Msson (C2+Ops) Bounday (B) 1 2 Ods LEGEND Data Shang Data Flow/Rpotng Msson Owns Mssons Contan 3 25 JAN

10 Msson Owns / s Unclassfd Msson Owns Mssons Contan 3 US- CER DISA DCC DNC CONUS CAP SPs Msson (C2+Ops) USCYBERCOM JFHQ-DODIN CP Bounday (B) JCC / CCMD 1 2 Ods LEGEND Data Shang Data Flow/Rpotng Msson Owns Mssons Contan 3 25 JAN

11 Conncton Managmnt Unclassfd DISN Conncton Appoval Offc Mantans th Conncton Pocss Gud (CPG) to stablsh scu, ddcatd conncton to Cloud Svc Offng Assus DoD Cloud Accss Pont (CAP) s stablshd as pat of ssung Authoty to Connct Assus Impact Lvl consdatons appopat to th conncton typ Mantans a gsty of all cloud opatons fo puposs Conncton Appoval US- CER DISA DCC DNC CONUS CAP SPs Msson (C2+Ops) Msson Owns Mssons Contan USCYBERCOM JFHQ-DODIN Bounday (B) CP JCC / CCMD JAN

12 Unclassfd Cloud Accss Pont (CAP) Pt. Dnsmo Rsk chnology Excutv (RE) 29 Januay 2015

13 Impact Lvl 4/5 Achtctu Unclassfd Potcts th DoDIN Conncton at Lvls 4+5 Povds Bounday Functons/Capablts Extnds th DMZ achtctu Intnt DoD Intnt Accss Pont (IAP) Lvl 4/5 s Conncton Cloud Accss Pont (CAP) Potct applcatons xcutng n th cloud fom malcous actvty Intnt Us NIPRNt Us NIPRNt Potct th DoDIN fom malcous actvty occung n th cloud 25 JAN

14 Impact Lvl 2 Achtctu Unclassfd Intnt basd uss connct to Lvl 2 s va dct Intnt Accss Lvl 2 s Intnt Connctvty lvags Intnt connctvty Intnt Us DoD Intnt Accss Pont (IAP) NIPRNt uss connct to Lvl 2 s va th DoD IAPs NIPRNt Us NIPRNt 25 JAN

15 Lvl 4/5 s On-pms vs. Off-pms Intnt Us Lvl 4/5 s Unclassfd NIPR Conncton On-Pms Intnal CAP (ICAP) Intnt DoD Intnt Accss Pont (IAP) Pvat anspot Off-Pms Bounday CAP (BCAP) Mt M Ponts (MMP) wll suppot multpl s On-pms (DoD B/P/C/S) connctvty va Intnal CAP (DoD Ddcatd Offngs) NIPRNt Us NIPRNt Off-pms connctvty though Bounday CAP 25 JAN

16 ELEMENS OF Intuson Dtcton/Pvnton Systm (IDPS) Fwall Capablts Entps Infomaton Assuanc Enclav Scuty Intnt Us Infastuctu vs. Msson s a shad sponsblty btwn DISA, th, povds, and Msson Owns Intnt DoD Intnt Accss Pont (IAP) Lvl 4 / 5 s Msson Own (VPC) Conncton Cloud Accss Pont (CAP) Unclassfd Applcaton Potcton Loggng and Analyss NIPRNt Us NIPRNt 25 JAN

17 CAP Pocss and Pocdus Unclassfd Conncton of a msson systm to th DoDIN va an ICAP o BCAP wll b appovd and codd by th DISA Conncton Appoval Offc n accodanc wth nomal conncton appoval pocdus Intal connctons (physcal o vtual) to a s ntwok wll occu dung onboadng of th s fst Msson Own custom. Addtonal connctons wll b mad o capacty wll b scald as mo Msson Owns us th gvn. 25 JAN

18 Untd n Svc to Ou Naton Unclassfd 26 JAN