SERVICE DEFINITION G-CLOUD 7 THALES PSN WEB GATEWAY. Classification: Open

Transcription

1 SERVICE DEFINITION G-CLOUD 7 THALES PSN WEB GATEWAY Classification: Open

2 Classification: Open ii MDS Technologies Ltd Other than for the sole purpose of evaluating this Response, no part of this material may be reproduced or transmitted in any form, or by any means, electronic, mechanical, photocopied, recorded or otherwise or stored in any retrieval system of any nature without the written permission of MDS Technologies Ltd. MDS Technologies Ltd, 2 Methuen Park, Chippenham, Wiltshire, SN14 0GX Telephone: , Fax: CONTENTS WHY MDS?... 3 SUMMARY OF SERVICE FEATURES... 3 PRODUCT OVERVIEW... 3 PRODUCT FEATURES... 6 EXAMPLE USE CASES... 7 INFORMATION ASSURANCE... 7 ON BOARDING AND OFF BOARDING PROCESSES... 8 PRICE MODEL... 8 SERVICE MANAGEMENT... 8 SERVICE CONSTRAINTS... 8 SERVICE LEVELS... 9 ORDERING AND INVOICE PROCESS SERVICE LEAD TIME TERMINATION COSTS CUSTOMER RESPONSIBILITIES RELATED SERVICES... 11

3 WHY MDS? Bespoke cloud solutions that fit your business needs Trusted provider of agile, scalable and assured digital services Full range of cloud hosting and enablement solutions Security Cleared (SC) operational support staff Honest providers of services, support and practical advice 24/7 support through our ITIL-aligned Service Desk A privately owned, UK sovereign company We are an SME - agile with minimal bureaucracy Providing infrastructure services to the Public Sector for over 12 years Certified against ISO 27001, ISO 9001, ISO14001 and Cyber Essentials Plus We listen to our customers, we understand, we deliver PROFESSIONAL, PERSONALISED SOLUTIONS SUMMARY OF SERVICE FEATURES Accredited Solution with ITIL service management Complete suite of features including firewalling, virus checking, intrusion detection and gateway policy enforcement Complete reporting service Resilient service, provided from two data centres Suitable for information protected up to OFFICIAL SENSITIVE. Options available for Remote Access solutions. PRODUCT OVERVIEW Connectivity is a key element of any Cloud service, and providing connectivity in to enhanced secure services, such as those connected to the Elevated PSN, requires a higher level of security than a simple Internet link. Working with Thales, MDS can provide Web Gateway solutions to the Protected Public Sector Network (PSN) in order that your users, administrators and third party support organisations can exchange data between your Cloud services and the internet. By connecting through the Thales Secure Web Gateway service, users can exchange web data with the internet with protections in place based on defined security policies, thus supporting business process. This reduces the technical restrictions that are typically placed when using PSN networks combined with Cloud service solutions. The Thales Web Gateway Service securely manages the boundary between the Customer s own security domain(s) and other external networks or security domains. These domains may be at different security levels (previously referred to as Impact Levels), or may be just a separate domain at the same security level, for which the customer needs to exercise control over the flow of information and access. The Web Gateway Service will be configured and managed to execute the Customer s own security policies. The policies will define the data contained within Web traffic allowed to traverse the

4 boundary both into and out of the customer network. In the case of Web traffic, the security policies provide filtering capabilities that include but are not necessarily limited to URL categorisation, restricting posting material onto web pages, restricting uploading or downloading files, controlling interaction with social media, malware detection, protocol restrictions and additional advanced application controls (enable or disable interaction with web based applications). The Service enables a safe, controlled and secure access to external web based applications or sites, helping to facilitate joined up government, whilst protecting the Customer s secure information held with the caveats OFFICIAL and OFFICIAL SENSITIVE. The diagram below shows the Thales Web Gateway solution in the context of PSN. The solution provides customers with the capability to connect to it and pass their Web traffic through between their secure network and other PSN (at ASSURED or PROTECTED) and untrusted networks such as the Internet. THIRD PARTY PROVIDER PSN DNSP PSN(P) IPED THALES GATEWAY SERVICE BOUNDARY Customer Users And Customer User Auth THALES PSN DNSP PSN(P) PRIMARY PSN(P) DR PSN(P) Customer Users And Customer User Auth INTERNET INTERNET FW Primary Web Gateway Service Web Security Policy DR Web Gateway Service INTERNET FW INTERNET PRIMARY PSN(A) DR PSN(A) Customer Users And Customer User Auth THALES PSN DNSP PSN(A) GCN Customer Users And Customer User Auth THIRD PARTY PROVIDER PSN DNSP PSN(A) This solution provides customers with a single point at which they can control all data leaving and entering their network, and ensure that it meets their internal security policy.

5 Thales PSN Web Gateway solution provides a mechanism to allow a customer to; exchange web with the PSN and the Internet, and provides access to the PSN and Internet to access web based applications. An overview of the integration touch points with the customer infrastructure is depicted in the diagram below. Enterprise CA Enterprise AD Customer Firewall AD Integration HTTP/HTTPS (Using ProxyPAC) Ironport Web (WSA) Customer Server/Desktop Environment The Thales Web Gateway service includes connectivity between the Customer Server/Desktop Environment, the PSN and the Internet. The following sections identify the dependencies on the other customer infrastructure elements. Assumptions Proxy Pac files, managed by the customer, will be used by the customer device as a mechanism to access the Web Gateway Service Access to the gateway will be controlled using AD credentials and associated groups SSL/TLS protocol will be intercepted by the web gateway to allow the contents to be inspected. A list of exceptions (e.g. banking) will be provided by the customer The web gateways will operate as a Subordinate CA to the AD managed CA, allowing it to issue temporary certificates to allow the SSL/TLS interception to occur AD groups will be used to align web content restrictions and users Detailed security policy to be controlled by the gateway will be provided by the customer. Note: services to develop these policies are available on request and will be a chargeable option Customer Dependencies The Thales solution needs to join the customer AD to allow it to control access to content. The customer is to provide a mechanism, associated information and support, to allow the Thales managed Gateways to join the AD domain infrastructure

6 The customer is to manage the AD groups associated with permitted web content The customer is to provide DN information to allow Thales to produce a CSR for the Thales operated WSA s. On receipt of the CSR, the customer will sign and return to Thales. These certificates will be used by the Thales managed Web Gateways to support the interception of TLS/SSL traffic to allow the content to be scanned for malware All devices on the customer network that require access to the Web Gateway will require a certificate from the Enterprise CA. If Firefox is used as a browser, the Enterprise Root CA certificate will require installing into the Firefox certificate store. This may require additional software PRODUCT FEATURES The Thales PSN Web Gateway service has the following features: Uses best of breed industry technology Connections to IPED, PSN(A) and PSN(P); the Web Gateway service includes connection from the Thales Data Centre to IPED, GCN, PSN(A) or PSN(P) (on the Thales PSN DNSP). This enables customers to connect through to their destination network Fully Managed Solution; the solution is fully managed and protectively monitored Assistance with Customer Active Directory Connection; Thales work with the customer to connect the service to their existing Active Directory services (please note in some cases this may require connectivity options) Disaster Recovery; the Web Gateway service operates within a fully resilient architecture with a Disaster Recovery site to ensure business continuity for customers and a highly available service Advanced filtering capabilities as follow: Custom Disclaimers / Policy Text; Provides the ability for customisation of the Internet Access Policy Acknowledgement Notification, Blocked Website Notifications and URL Warning Notifications URL Filtering and Global Policies; Filtering options for URL categories based on Security Domain, Allowed Sites, Customer Blocked Sites, Temporary Allowed Sites, Out of Hours Sites (Blocked Out of Hours), Customer Bypass Sites. Note: Uncategorised URLs are monitored by default Application Web Data Flow Control; Provides application control for web traffic such as blogging, Facebook, Google+, web mail, instant messaging and Enterprise Applications. Object / Data Type Filters; Blocks objects within web pages such as torrent links, java code, RTF files and executable files Malware Filtering Engine (Anti-Malware and Reputation) URL Filtering and Encrypted Data Control; Control access to sites where encrypted data passes from the user to the destination network e.g. Banking, web mail

7 Optional Reporting Mechanisms: System Information or System Status URL Categorisation Reports Websites Usage User Activity Optional Chargeable Additions; PSN(P), PSN(A), IPED and GCN Connectivity via Thales DNSP Policy definition; as an option MDS can provide a service to develop a web security policy that the Gateway will enforce Consultancy and Design Assistance; Thales provide consultancy for the design and provision of bespoke remote access services Remote Access Solutions Secure Mail Gateways EXAMPLE USE CASES This service has a wide variety of uses, including: Providing access to PSN based web services Providing managed, secure and monitored web information exchange with other PSN networks and untrusted networks such as the internet INFORMATION ASSURANCE The Pan Government Accreditor (PGA) has accredited both the Thales PSN Protected WAN Overlay (formerly IL3 connectivity) and PKI services; these services are registered as PSNSP 002 and SRV0111. Thales has registered its Gateway Services solution with the Public Services Network Authority under the registration number SRV This service is currently accredited by the Pan Government Accreditor (PGA). The protective monitoring and ITIL service management for both the accredited PSN Connectivity Services and the Secure Gateway Services are hosted within our Tier 3 (TIA) List X Certified Doncaster Data Centre operation. In addition to the physical protection of the service, Thales, as a Certified CESG Assurance Service (Telecommunications) CAS(T) and ISO 27001:2005 supplier, has a mature and regularly maintained ISO ISMS. All of the documentation required is in accordance with, and compliant against HM Government IS No 1&2 and PSNA documentation sets. Thales as both a PSN DNSP and PSNSP has been fully accredited under the PSN IA regime. This level of IA and Service Assurance ensures that the Thales services are compliant with Cyber Essentials and Network Security Principles; as specified in the Cabinet Office s Procurement Policy

8 Note (09/14 25 September 2014). This level of assurance also ensures that Thales services are compliant with Implementing the Cloud Security Principles (14th August 2014). ON BOARDING AND OFF BOARDING PROCESSES On-boarding Customers will contract with MDS for the number of users required. During the on-boarding phase MDS and Thales will work with the customer to provide assurance that the customer web services are correctly configured to meet Thales requirements. Off-boarding During off-boarding MDS will work with Thales to decommission your Web Gateway service, securely removing any customer configuration. PRICE MODEL Pricing for this service is dependent on the offering chosen. Internal Users The cost of implementing and supporting the Web Gateway depends on the number of accounts being ordered. Example pricing for 100 and 250 users is included below. Users Upfront charge Recurring Charge (12 months) Per-User Per-Month , , , , Significant discounts can be supplied where the Gateway is purchased alongside our other Thales provided services. SERVICE MANAGEMENT This service is managed by MDS 24/7 Service Desk, with Thales acting as a resolver group. Further support, maintenance, facilitation and training services are available if required. SERVICE CONSTRAINTS There is a minimum contract period of 12 months. Pricing is exclusive of IMACs (Installs, Moves and Changes).

9 SERVICE LEVELS The following table details the services levels that apply to the Service Management functions (ITIL V3) for the Secure Web Gateway Service. Service Attribute Incident Management Availability Service Requests Release Management Service Reporting Capacity Management Service Outages Change Request Service Level 24hrs, 365 days per year. Incidents may be raised by designated Customer personnel, or by those identified in the Thales Network Operation Centre s processes and procedures. Escalation and reporting will be in accordance with Thales Network Operations Centre processes and procedures. For a severity 1 incident, Time to Respond is 1 hour from logging the incident followed by a further Time to Fix of 4 hours. The availability target is 99.9% and will be measured and reported on monthly. A threshold for service credits is set at 99.7%. The high level of availability is underwritten by the dual resilient architecture. In the event of a Gateway Service component failure the service will continue to operate by failing over to the DR location. Including IMACs (Installs Moves and Changes). Service Requests are not a part of the Secure Web Gateway Service and all changes are required to be progressed through the CR process. Service Requests are chargeable. Releases will be issued and applied in-line with those provided by the original equipment manufacturers and according to a Forward Schedule of Change that will be circulated to all customers prior to any work. Service reports may be provided and show monthly information regarding policy infringements. The Thales Gateway Service is licenced to operate up to the defined number of users in the customer contract for Web and Mail authorised users. Capacity Management issues relating to an extended capability will be addressed through the change process. Performance will be monitored by Network Operations staff, and any potential capacity issues will be addressed through the incident management or change management process. Any scheduled outage will be excluded from availability calculations. Thales operates with a planned maintenance window between the hours of 01:00 and 05:00 on Sunday subject to an agreed Forward Schedule of Change. Maintenance is carried out only when necessary and all outages are subject to a rolling monthly Forward Schedule of Change circulated to customers. Customers can generate changes to the service through submission of a change request by the designated customer representative to the Thales Service Delivery Manager. All change requests will be managed by the Thales Change Advisory Board (CAB).

10 Service Attribute Disaster Recovery Service Level The Web Gateway Service provides a resilient service with a DR capability operating in a hot-standby configuration. If DR has been initiated and a service effecting incident occurs within the DR site, this will be considered as a severity one failure with the resultant four hour time to fix target and escalation procedures. ORDERING AND INVOICE PROCESS A purchase order and Call-Off form are required. The Call-Off form details the services, charges and payment arrangements. In support of this Thales will provide a written: Specification Document Service Level Agreement Deployment Plan that includes key milestone dates and any customer dependencies (see customer requirements). Billing for the service is monthly in advance. Payment can be via the following methods: Bacs or Cheque. SERVICE LEAD TIME Organisations can order services and be activated within 6 8 weeks. TERMINATION COSTS There are no termination costs for this service, subject to the minimum contract period. At the point of termination, all client configuration, accounts and access will be permanently deleted. CUSTOMER RESPONSIBILITIES To ensure a smooth integration and operation of the service the Customer is responsible for the following: Provide suitably qualified staff with knowledge of the customer infrastructure to work with the Supplier delivery team, enabling the Gateway systems to be correctly configured by the Supplier. Provide contact details for an approved set of IT staff that will have permissions to raise Incidents. Provide contact details for incident escalation. Ensure the Customer network is compliant with relevant PSN Code of Connection requirements. Provide Security Manager contact details for reporting any notifiable security events.

11 Providing connectivity to the Internet for client devices Provide connectivity for PSN to allow connection from the service to the Customer estate. RELATED SERVICES This service may be bought in conjunction with the following other G-Cloud services: Cloud Enablement Managed Server Thales PSN Remote Access Thales PSN Mail Gateway