MANAGED FIREWALL SERVICE. Service level description

2 MANAGED FIREWALL SERVICE Service level description

of 11 Version 1.7 (17/09/2015) NSMS Managed Firewall, Service Level Definition NSMS, IT Services, University of Oxford. Contents Document control... 3 Editor... 3 History... 3 Document storage... 3 Document approval... 3 Distribution list... 3 Glossary... 3 Service level definition management... 3 Service level definition administration... 3 Service level definition change management... 3 Force majeure... 3 Introduction... 4 Purpose... 4 NSMS MFS roles & responsibilities... 4 Scope... 4 Exceptions... 4 Contacts & escalation routes... 5 NSMS support... 5 Client contacts... 5 Escalation routes... 5 NSMS Contact Details... 5 Service expectations... 5 Overview... 5 Service availability... 6 Firewall service deployment... 6 Firewall monitoring... 6 Performance reporting and inventory... 6 Maintenance and operations... 6 Service components... 7

of 11 Version 1.7 (17/09/2015) Central MFS infrastructure... 7 Security... 7 Device authentication and authorisation... 7 Compliance... 7 Hardware... 8 Lifecycle management... 8 Hardware failure emergency response and disaster recovery... 8 Other peripherals... 8 Health and safety PAT assessment... 8 Other... 8 Support... 8 NSMS... 8 End user support... 8 Service levels... 9 Service provision... 10 General Service availability... 10 Hours of service... 10 Resilience... 10 Central MFS infrastructure schedule... 10 Charges and payment... 10 Termination of Service... 10 Limit of Liability... 11

of 11 Version 1.7 (17/09/2015) Document control Editor Brian Hicks History The text for this document has been taken from the NSMS SLD, originally composed by: Wylie Horn, Jon Hutchings, Marko Jung, James Partridge, and Marcus Saunders, and has been adapted for the needs of the NSMS Firewall Service. Document storage The document is located at ******** Document approval This document has been approved for use by: Head of NSMS NSMS Windows and Firewalls Team Leader NSMS Firewall Support Team Distribution list Concerned customers or parties can obtain the latest version of this document from the NSMS website. Should a new version be released all affiliated members of this service will be notified via email, these members include: Client nominated administrative contacts Client nominated technical contacts All members of NSMS Glossary MFS - Managed Firewall Service ITSERV - IT Services, University of Oxford NSMS - Network Systems Management Services ITSS - IT Support Staff SLD - Service Level Definition SD - Service Description LAN - Local Area Network WAN - Wide Area Network UTM - Unified Threat Management HA - High Availability Service level definition management Service level definition administration Updates to this Service Level Description (SLD) are the responsibility of NSMS. Service level definition change management NSMS are not adopting a formal change management process. Any agreed changes will be implemented as soon as possible and the new version of the SLD will be uploaded to the NSMS website. Force majeure Either NSMS or the client may suspend the SLD on request in the event of a catastrophic event or any other event deemed critical enough to warrant the suspension of the SLD.

of 11 Version 1.7 (17/09/2015) Introduction The NSMS group provides a Managed Firewall Service (MFS) to colleges, departments and units, within the University of Oxford. The aim of the service is to provide users of the service with a reliable, secure and industry recognised firewall service provider, to support the research and administrative tasks of the University. Unlike third party companies, NSMS doesn t have to make a profit and our only customers are the recognised and affiliated units of the University of Oxford. Because of this, we aim to offer the University a tailored and HA service at cost. Purpose This document describes the parameters of the service and will be reviewed annually, in light of experience gained from continually managing the MFS. NSMS MFS roles & responsibilities NSMS will only manage NSMS deployed and/or supported firewalls where support is being paid for. Any local network infrastructure inside the LAN or outside on the WAN that is not supported by NSMS, will not be included in the firewall support, unless a separate contract itemising any additional hardware has been created, agreed and signed by both parties. Scope This SLD covers the delivery and support of the following NSMS Managed Firewall Services: Firewall hardware (under support); Vendor supported firmware, patching and updates; Deployment of the vendor releases of firmware, patching and updates; Vendor supported firewall services (such as client VPN and UTM); Configuration backup; System traffic logging (90 days retention period); Client support; Change management; Service support; Hardware renewal support and advice (if under continual support since original deployment). Exceptions The following are omitted from the SLD: Systems not owned by the University of Oxford Systems and/or hardware not itemised in the support agreement

of 11 Version 1.7 (17/09/2015) Contacts & escalation routes NSMS support All MFS related support and change requests should be sent to the NSMS Firewall Team Client contacts The client will provide contact details for at least one technical contact and one administrative contact. Escalation routes If service levels are not met then the following escalation processes should be followed. Reason for escalation 1 st escalation level 2 nd escalation level Support request not assigned under the terms of the SLD NSMS Firewall Team nsms-firewalls@it.ox.ac.uk NSMS Firewall Team Leader Support request not responded to under the terms of the SLD NSMS Firewall Team nsms-firewalls@it.ox.ac.uk NSMS Firewall Team Leader Support request left unresolved under the terms of the SLD NSMS Firewall Team nsms-firewalls@it.ox.ac.uk NSMS Firewall Team Leader General customer complaint about the service NSMS Firewall Team Leader NSMS Section Manager Workaround solution not accepted by the user NSMS Firewall Team Leader NSMS Section Manager Customer complaint against NSMS NSMS Section Manager IT Services Director of Infrastructure Services NSMS Contact Details These contacts are given for information and escalation purposes only. NSMS Firewall Team Email: nsms-firewalls@it.ox.ac.uk Phone: 01865 273 209 Brian Hicks - NSMS Windows and Firewalls Team Leader Email: brian.hicks@it.ox.ac.uk Phone: 01865 (6)13430 Jon Hutchings - Head of NSMS Email: jon.hutchings@it.ox.ac.uk Phone: 01865 (2)83 290 Service expectations Overview A unit adopting the MFS can expect a complete service for the device, including: Consultation & design; Initial design and configuration; Management; System changes; Logging; Life cycle.

of 11 Version 1.7 (17/09/2015) Client(s) will be issued with credentials for a read only access account to the firewall(s). NSMS will handle maintenance and support matters relating to the firewall whilst the NSMS support agreement is being paid for. The service includes: configuration, backups, firmware upgrades, to recording the traffic syslogs and making sure they are available when you need them, NSMS will cover it for you. The NSMS helpdesk is open during normal office working hours: Mon-Fri, 9am until 5pm excluding public holidays, bank holidays and periods of forced closure. Service availability Users can expect approximately 99% service availability (approximately 3.65 days per year of unplanned outage time) for hardware covered by this SLD. On the rare occasion of a hardware we would look at deploying a hot swap spare. If the hot swap spare has already been issued to another unit, we are bound to the FortiNet next business day hardware replacement service. Whilst 3.65 days seems a long time, in the worst case of a device breaking on a Friday evening and there being a bank holiday Monday, we cannot expect a replacement from FortiNet until Tuesday. NSMS does not guarantee the service availability of other third party services linked to the firewall, such as: FroDo, JaNET, FortiNet and so on. Firewall service deployment NSMS will be responsible for: Installation, maintenance, documentation and configuration of a firewall device; Integration of firewall services into the NSMS monitoring and alerting systems; Advising and assisting with the device renewal once fully depreciated, or out of warranty, with an uninterrupted support agreement since installation was carried out by NSMS. It will be the responsibility of the Customer to purchase the agreed firewall device through their own purchasing processes directly with NSMS chosen supplier (Nouveau Solutions ltd.). Firewall monitoring As part of the MFS, performance monitoring of the firewall(s) will be handled by a centralised management system. FortiNet FortiManager is currently used by NSMS to administer its MFS devices. Traffic and system logs will be captured under the MFS and securely archived onsite for a period of 90 days. Comprehensive traffic logs (syslogs) will be provided as and when requested in writing. Performance reporting and inventory Clients may request hardware inventory reports for their managed NSMS services. Performance reporting can be requested as and when needed by the client, up to a maximum of three requests per annum for all NSMS services. Maintenance and operations The NSMS support team will be solely responsible for the installation and management of the hardware and software on the managed firewall for the duration of a support package. Planned firewall maintenance and updates, requiring a reboot of the device, will occur between the hours of 9am and 11am on Tuesday mornings. This window of time is referred to the at risk period. Alternatively, a mutual time can be agreed during normal working hours, if requested by the client and agreed by NSMS. Notice of unplanned maintenance and updates requiring a reboot of the device, will be communicated at least twenty-four hours in advance via direct email to the technical and/or administrative representative. Security updates, patches or upgrades, made available by the manufacture post-delivery (which can be installed without the need of a reboot), will be deployed automatically by our central firewall management system without notice. Should an urgent security update present itself, which requires a reboot and if not performed

of 11 Version 1.7 (17/09/2015) immediately presents an unacceptable risk to the customer and/or University s security, NSMS will deploy the update and reboot without notice. Adding, amending or deleting rules can and will be performed during normal working hours, assuming no loss of service will be experienced. Review of firewall policy will occur as and when requested. NSMS will maintain backups of device configurations every time a change is deployed and retain the previous seven versions. Maintenance, fault analysis, customer enquiries, incident response, emergency response and disaster recovery will only occur within our advertised hours of service. Service components Central MFS infrastructure The Managed Firewall Service relies on infrastructure hosted and maintained by NSMS, IT Services (ITSERV) Networks, ITSERV Operations and the end client s infrastructure. The NSMS support teams liaise with the departments of ITSERV, to ensure that service delivery is adequate from ITSERV to a client s FroDo switch. It is the client s responsibility to ensure the local network infrastructure provides the necessary means for network enabled devices to reach the firewall for communication with the Wide Area Network (WAN) or more commonly known as the Internet and/or centrally provided University Services. NSMS can and will provide assistance necessary for the successful operation of the NSMS MFS. Security The NSMS team s security responsibilities are limited to; security updates, firmware updates and patch updates, released by FortiNet and any other vendor contributing towards the MFS infrastructure. Device authentication and authorisation NSMS will retain a user account with full admin rights throughout any MFS agreement/contract. Customer s technical and administrative points of contact will have read access to their firewall thorough the FortiManager console device if requested. It is the responsibility of the client to notify NSMS of changes in staffing/permitted users and their associated rights. Clients will have no access to the centralised management system used by NSMS for device management, configuration backups, reporting and logging. Compliance The client is responsible for the IT aspects of compliance with the following UK legislation: Data Protection Act (1998) Regulation of Investigatory Powers Act (2000) Privacy and Electronic Communications (EC Directive) Regulations (2003) Any other associated, linked or relevant laws of the land The client is responsible for the IT aspects of compliance with the following University regulations: University of Oxford Acceptable Use Policy University of Oxford Information Security Policy Any relevant policy issued by the University of Oxford

of 11 Version 1.7 (17/09/2015) NSMS continuously develops compliance checks to ensure the services that it provides, adhere to the various acts, laws, policy and regulations, set out by the laws of this land and the University of Oxford policies. Hardware Lifecycle management The MFS includes hardware lifecycle management notifications. A FortiGate firewall arranged under the NSMS MFS will be given a lifecycle of five years. Throughout this time the firewall device(s) will be have an 8x5 hardware support agreement in place directly with FortiNet (NBD for hardware replacement). This agreement protects the hardware (with the exception of user imposed damage) and ensures all new updates, patches and releases, are received from the vendor. NSMS reviews its chosen firewall manufacturer/vendor and reseller every 2.5 years. Customers must understand that when the lifecycle for their device expires (every 5 years) a different manufacturer and/or vendor may be deployed upon renewal. This is to ensure that NSMS is always offering what it regards to be the very best hardware and support for its MFS. The customer, with guidance from NSMS, will be responsible for the purchase of the firewall device. Prior to the renewal of a device s five year contract, NSMS will contact the customer in advance to discuss and arrange the deployment of the new replacement firewall or to terminate and/or handover the service. Hardware failure emergency response and disaster recovery NSMS retains a spare firewall of 70D, 100D and 200D firewalls. Assuming that not more than one device will fail in a given day, NSMS will be able to offer the following replacement service in the event of a major failure and no High Availability (HA) unit is present. Units hosted in a University of Oxford ITSERV Data Centre will be replaced within 4 hours during normal working hours. Units on customer sites will ordinarily be replaced within 4 working hours, dependant on criteria and access. Should the NSMS spare unit have already been issued, the client and NSMS will be bound to the 8x5 support agreement with FortiNet, where a replacement device will be issued NBD. Other peripherals Setup and configuration of any other peripheral devices is a chargeable service. Health and safety PAT assessment It is the client s responsibility to ensure compliance with any health and safety regulations, including PAT assessments. Other The NSMS group will manage problem escalation procedures to ensure that client queries are dealt with satisfactorily. It is the client s responsibility to report all incidents, as well as requests for service modifications or new aspects of the service, to the NSMS support team. Support NSMS The NSMS group will support the service using local in-house expertise. If necessary, the NSMS group will liaise with other departments within IT Services and external software and hard suppliers to ensure continuity of service. End user support End users within a unit must always contact their local ITSS for matters relating to any aspect of the MFS. Should the local ITSS not be able to fulfil the user request, the client s NSMS recognised technical and/or

of 11 Version 1.7 (17/09/2015) administrative contacts should contact the NSMS support team by emailing nsms-firewalls@it.ox.ac.uk. Should the unit s NSMS recognised contact not be known by the local ITSS or user, the local ITSS or user may contact NSMS directly using email address nsms-firewalls@it.ox.ac.uk. Where necessary, NSMS will seek the approval of the unit s NSMS recognised person(s) to approve any changes and/or chargeable support work, where such work falls outside the scope of the SLD and/or support package Each support request submitted via email, to nsms-firewalls@it.ox.ac.uk, will generate a support ticket in an incident management system. All subsequent correspondence related to a particular request should maintain the email thread and refer to the support ticket number. Urgent support requests (priority levels 1 and 2 in the Service levels table) may be made by telephone to 01865 273 209. A support ticket will be generated for each phone request to facilitate job tracking. The NSMS support desk service is provided between 0900 and 1700 on weekdays, excluding public holidays, bank holidays and periods of forced closure as advertised by IT Services and the University of Oxford. There is no formal commitment to respond to support requests outside these hours. Service levels Service levels only apply to the previously defined working hours of NSMS. Timings listed are from the moment an incident is reported is created. Priority level 1 2 Description Unit firewall device hardware failure: e.g. faulty PSU on device resulting in loss of connection to WAN Unit firewall software failure: e.g. corrupt firmware/os resulting in loss of connection Target response time Target time to initiate diagnosis Expected Target fix/work around time 1 hour 3 hours 4 hours* 1 hour 3 hours 4 hours 3 User request to deploy from a backup 1 hour 3 hours 4 hours 4 Syslog request as a result of OxCERT contacting your unit 2 hours 4 hours 6 hours 5 Add, modify or remove rule 2 hours 6 hours 7 hours 6 Add, modify or remove authorised users from VPN service 4 hours 7 hours 8 hours 7 Configure and deploy point to point VPN or IPSec service 4 hours 2 days Dependant on any external parties 5 days Dependant on any external parties 8 Add or modify firewall zone/vdom: 4 hours 2 days Dependant on any external parties 9 Information request only: no immediate problem. 4 hours 2 days Dependant on any external parties 5 days Dependant on any external parties 10 days Dependant on any external parties This is not an exhaustive list, but allows for an understanding of how NSMS will prioritise jobs, should a sudden unexpected high demand on service requests be received. * The hardware replacement service is restricted by the NSMS reserve stock levels, where NSMS carries one spare firewall of each model being advertised. In the unlikely event of two firewall units failing on the same

of 11 Version 1.7 (17/09/2015) day, NSMS will, if possible, deploy a higher model until an identical replacement is shipped and received the next day. Where this is not possible, a next business day service, in accordance to the 8x5 support agreement with FortiNet, will be offered for replacing a faulty device. NSMS reserves the right to refuse the implementation of a change request, if NSMS determines that the change broadens the scope of service, or if they determine that it adversely affects other aspects of service availability/stability, or if they regard the change as an unacceptable risk. Service provision General Service availability Hours of service The MFS operates automatically at all times. Automatic monitoring of the main service elements takes place inside and outside NSMS working hours. Please note, no arrangements exist for NSMS support staff to be called outside of normal business/working hours, should the automated system identify a fault, issue or failure. NSMS working hours coincide with the NSMS support desk hours. Resilience All central components of the MFS, such as the FortiManager Virtual Console, have been deployed with resilience and business continuity in mind. The central infrastructure for centrally based virtualised management components are located in the ITSERV data centres. In the unlikely event of one site failing, services will transfer to our backup data centre. In the unlikely scenario of both data centres failing, will result in a total loss of the central management facilities, however the end device will still be effective and configurable locally. NSMS continuously reviews its disaster recovery strategies in accordance with the general IT Services strategy. Central MFS infrastructure schedule The NSMS firewall team will be solely responsible for the operation, maintenance, and backup of the servers and storage that deliver the central infrastructure components (FortiManager). The NSMS support team will ensure that this hardware and software meets the operational requirements of the central infrastructure components and will be responsible for any hardware or software upgrades required to ensure that excellent levels of performance are maintained. Software updates for the centralised components are provided by the relevant vendor and applied by NSMS. Charges and payment The charges specified in the schedule and/or quotation, attached to this description, shall initially be paid on the signing of the agreed works. Any annual charges for NSMS services or NSMS support services shall be due on the anniversary of the agreement date. NSMS may vary the charges specified in the schedule attached to this description with effect from the end of the first year or any date thereafter, by giving to the Customer three calendar months' notice in writing of the new charges. If time permits, NSMS is prepared to take on work for the Customer that falls outside this contract on the basis of an hourly or daily charge (NSMS hourly and daily charges can be found on the NSMS website). Termination of Service This Agreement is for a minimum period of one year and shall continue as an annual agreement thereafter until terminated by either party giving the other three calendar months' notice in writing. In the event of a request to terminate a MFS agreement, NSMS undertake to complete the following:

of 11 Version 1.7 (17/09/2015) Immediately after an agreed termination of service date, NSMS will terminate all support, logging and backups. NSMS will remove their access rights to the firewall. All data on the centrally managed firewall infrastructure (backups, syslogs etc.) will be secured and retained for 3 months after the termination date of the service. After three months all data will be safely destroyed. The firewall device(s) will remain the property of the user/unit. On request, any documentation relating to the firewall will be handed over. Limit of Liability It should be recognised that it is not possible to create a system that guarantees absolute security when the system is exposed to network and/or physical access. NSMS cannot take responsibility for network weakness resulting from poor rule-base implementation instigated by the customer by way of a change request. NSMS cannot take responsibility of any security breaches. NSMS reserves the right to cancel any agreement or contract. NSMS cannot be held accountable for any hardware or software related failures. Although NSMS will use all reasonable endeavours to perform the work set out in this description, it can make no guarantees concerning any particular outcome. NSMS accepts no responsibility for the use which the Customer makes of advice or information which it gives, or opinions which it expresses, or of materials, certificates or documents which it supplies. Without prejudice to any right which the Customer may have to claim against NSMS, the Customer undertakes to make no claim against any employee, agent or appointee of NSMS in regard to this SLD and/or contract. The liability of either party for any breach of this SLD, or arising in any way out of the subject matter of this SLD, will not extend to any incidental or consequential damages or losses including (without limitation) loss of profit. In any event, the maximum liability of NSMS to the Customer under or otherwise in connection with this SLD or its subject matter shall not exceed the return of all monies provided to NSMS by the Customer under the charges and payments, together with interest at the prevailing Barclays Bank PLC rate. Thank you.