SERVICE DEFINITION G-CLOUD 7 THALES PSN REMOTE ACCESS. Classification: Open

Transcription

1 SERVICE DEFINITION G-CLOUD 7 THALES PSN REMOTE ACCESS Classification: Open

2 Classification: Open ii MDS Technologies Ltd Other than for the sole purpose of evaluating this Response, no part of this material may be reproduced or transmitted in any form, or by any means, electronic, mechanical, photocopied, recorded or otherwise or stored in any retrieval system of any nature without the written permission of MDS Technologies Ltd. MDS Technologies Ltd, 2 Methuen Park, Chippenham, Wiltshire, SN14 0GX Telephone: , Fax: CONTENTS WHY MDS?... 3 SUMMARY OF SERVICE FEATURES... 3 PRODUCT OVERVIEW... 3 PRODUCT FEATURES... 5 EXAMPLE USE CASES... 6 INFORMATION ASSURANCE... 6 ON BOARDING AND OFF BOARDING PROCESSES... 7 PRICE MODEL... 7 SERVICE MANAGEMENT... 7 SERVICE CONSTRAINTS... 8 SERVICE LEVELS... 8 ORDERING AND INVOICE PROCESS... 9 SERVICE LEAD TIME TERMINATION COSTS CUSTOMER RESPONSIBILITIES TECHNICAL REQUIREMENTS RELATED SERVICES... 11

3 WHY MDS? A tailored cloud solution that fits your business needs Full range of cloud hosting options from pure public cloud to hybrid cloud and physical enablement solutions A support team is based on the same highly secure campus as our cloud platform A cloud platform is Pan Government Accredited up to IL3 A fully managed platform, supported up to Operating System Over 12 years experience of providing infrastructure services SC cleared operational support staff 24/7 support through our ITIL-aligned Service Desk Additional professional services such as project delivery and technical consultancy ISO 27001, ISO 9001, ISO14001 accredited Over 12 years experience in supporting Public Sector customers A privately owned, UK sovereign company We are an SME - agile with minimal bureaucracy PROFESSIONAL, PERSONALISED SOLUTIONS SUMMARY OF SERVICE FEATURES Secure Remote Access on to the PSN Accredited Solution with ITIL service management Connects you directly to the PSN, enabling you to consume all PSN services, rather than to one specific Cloud provider Resilient service, provided from two data centres Options available for Users, Administrators and Third Parties PRODUCT OVERVIEW Connectivity is a key element of any Cloud service, and providing connectivity in to enhanced secure services such as those connected to the Elevated PSN requires a higher level level of security than a simple Internet link. Working with Thales, MDS can provide Secure Remote Access to the Protected Public Sector Network (PSN) in order that your users, administrators and third party support organisations can gain access to your Cloud services. By connecting through the Thales Secure RAS service, users are connected directly to the PSN, enabling access to the wide range of PSN based services that are available. This reduces the technical restrictions that are typically placed on Remote Access solutions which connect you in to a single Cloud service. Thales provides two Remote Access services: Internal Users using managed devices The Internal RAS solution enables users to be connected directly to their Cloud service by offering a full client based VPN service from the user s managed device. This option works in a similar way to most corporate VPN services where users are able to browse from their managed client computer and access a variety of network services.

4 The service offered by Thales provides connectivity between user devices through the internet to PSN services / platforms within the customer infrastructure. The service acts as a connectivity broker between user devices and the customer network. Thales provides connectivity from the hosted RAS services to the internet and to PSN(P) typically via the Thales PSN DNSP, or to other PSN DNSPs via the IPED. An overview of the solution is given in the diagram below. Enterprise AD AD Integrated Thales Managed Customer Internal RAS VPN Server Internal VPN Client IPSEC VPN PKD HTTP Access to PKD Thales shared INTERNET Firewall(s) Enterprise CA INTERNET Customer Firewall Optional RSA Token Authentication Server Customer Server/Desktop Environment The INTERNAL RAS Service provides a mechanism for the customer users to use their managed devices to access the customer s services from the Internet. The following are dependencies and assumptions between Thales and the organisation(s) that manage / operate the supporting services within the customer infrastructure. Assumptions End user devices meet PSN IA conditions Primary access authentication will be through the use of customer host based X509v3 certificates, signed by the Customer s Certificate Authority. The INTERNAL RAS VPN server will use a certificate, signed by the enterprise CA, to provide mutual authentication. Customer Dependencies The Server provider will provide CA DN structure to allow a CSR to be generated on the Internet RAS VPN server. The Server provider will provide CA certificates from the trust chain to allow full chain validation. The Server provider will provide access to a CRL to allow Thales to refuse access to devices with revoked certificates. The RAS Client IP ranges may require configuring within the customer AD and possibly DHCP scopes creating. The Server provider will provide the details of the DHCP, DNS server and domain details. The customer will provide details of the IP ranges that require access to the RAS clients for remote diagnostics, only this traffic will be permitted from the customer network to the RAS clients. Any traffic will be permitted from the RAS clients to the customer network.

5 External Users and untrusted devices The External RAS solution is designed to provide Administrator level users with the type of Remote Access that they may require in order to manage a customer s Cloud services. This service provides connectivity between untrusted user devices through the internet to Assured services / platforms (such as the PSN) within the customer infrastructure. The Thales Secure RAS Service acts as a connectivity broker between devices and provides a secure barrier between those devices and the customer provided terminal services in their PSN environment. Thales provides connectivity from the hosted RAS services to the internet and to PSN typically via the Thales PSN DNSP, or to other PSN DNSPs via the GCN. The service offers access to a single IP address such as a Cloud portal or a Bastion Host management server. The service is connected by means of accessing a web portal which connects the end user device to their specified IP address. Security is provided through a minimum of two factor authentication which includes certificates and login credentials for the VM Desktops. Additional factors can be provided if required, either through this service or within the customer s Cloud portal (such as token based anuthentication on a Bastion Host). The Secure RAS Service is offered to customers that require access to their PSN networks, but in addition the service can be provided to customers for non-psn networks. The following table outlines the connectivity options for the Secure RAS Service. Connectivity Options PSN PROTECTED WAN Overlay Service (Third party provided by an external PSN Services Provider) Thales PSN Protected WAN Overlay Service (see Thales G-Cloud Entry for Thales PSN PROTECTED WAN Overlay Services) Customer Existing Non-PSN Protected Overlay Service (An encrypted overlay service that is non-psn) Description Connection to the customer network via the GCN through an existing customer PSN PROTECTED connection. Connection to the customer network via the Thales provided PSN PROTECTED WAN Overlay Service (priced separately). The service can be provided via encrypted connections as a non-psn service. This connectivity can be provided by Thales or third party providers. PRODUCT FEATURES TheThales PSN Remote Access service has the following features: Internal RAS Uses best of breed industry technology Cisco Connections to IPED and PSN(P); the INTERNAL RAS service includes connection from the Thales Data Centre to IPED or PSN(P) (on the Thales PSN DNSP). This enables customers to connect through to their destination network

6 Fully Managed Solution; the solution is fully managed and protectively monitored. Assistance with Customer Active Directory Connection; Thales work with the customer to connect the service to their existing Active Directory services (please note in some cases this may require connectivity options). Client Software; as part of the Thales INTERNAL RAS Service, the client software for the end user devices is provided. Disaster Recovery; the INTERNAL RAS service operates within a fully resilient architecture with a Disaster Recovery site to ensure business continuity for customers and a highly available service. External RAS: Enables a connection to PSN from an untrusted device Acts as connectivity broker and security barrier Allows access to Cloud service portal or Bastion Host Optional Chargeable Additions; PSN(P) Connectivity via Thales DNSP; provision of PSN PROTECTED connectivity from the Thales Data Centres to the customer site(s). Consultancy and Design Assistance; Thales provide consultancy for the design and provision of bespoke remote access services. RSA Token Authentication; additional authentication factors can be added using an RSA authentication server. The default service does not include this. EXAMPLE USE CASES This service has a wide variety of uses, including: Providing access to PSN based services Remote access for OFFICIAL and OFFICIAL SENSITIVE cloud data Providing secure remote access for administrators to Bastion Hosts and administration portals Providing managed PSN remote access to third parties Where customers require a resilient and managed RAS solution INFORMATION ASSURANCE The Pan Government Accreditor (PGA) has accredited both the Thales PSN Protected WAN Overlay (formerly IL3 connectivity) and PKI services; these services are registered as PSNSP 002 and SRV0111. The protective monitoring and ITIL service management for both the accredited PSN Connectivity Services and the Secure RAS Gateway Services are hosted within our Tier 3 (TIA) List X Certified Doncaster Data Centre operation. In addition to the physical protection of the service, Thales, as a Certified CESG Assurance Service (Telecommunications) CAS(T) and ISO 27001:2005 supplier, has

7 a mature and regularly maintained ISO ISMS. All of the documentation required is in accordance with, and compliant against HM Government IS No 1&2 and PSNA documentation sets. Thales as both a PSN DNSP and PSNSP has been fully accredited under the PSN IA regime. This level of IA and Service Assurance ensures that the Thales services are compliant with Cyber Essentials and Network Security Principles; as specified in the Cabinet Office s Procurement Policy Note (09/14 25 September 2014). This level of assurance also ensures that Thales services are compliant with Implementing the Cloud Security Principles (14th August 2014). ON BOARDING AND OFF BOARDING PROCESSES On-boarding Customers will contract with MDS for the number of users required. During the on-boarding phase MDS and Thales will work with the customer to provide assurance that the end user devices are correctly configured to meet Thales requirements. We will also provision the service and configure user accounts to the end users. Off-boarding During off-boarding MDS will work with Thales to decommission your RAS service, securely removing any customer configuration and data such as customer certificates. PRICE MODEL Pricing for this service is dependant on the offering chosen. Internal Users The cost of implementing and supporting the Internal Users RAS depends on the number of accounts being ordered. Example pricing for 100 and 250 users is included below. Users Upfront charge Recurring Charge (12 months) Per-User Per-Month , , , , External users External RAS accounts are charged on a per account, per month fee of 50. Accounts are for named individuals and must be ordered in bundles of 10 accounts. SERVICE MANAGEMENT This service is managed by MDS 24/7 Service Desk, with Thales acting as a resolver group. Further support, maintenance, facilitation and training services are available if required.

8 SERVICE CONSTRAINTS There is a minimum contract period of 12 months on both Internal and External options. Pricing is exclusive of IMACs (Installs, Moves and Changes). SERVICE LEVELS The following table details the services levels that apply to the Service Management functions (ITIL V3) for the Secure RAS Service. Service Attribute Incident Management Availability Service Requests Release Management Service Reporting Service Level 24hrs, 365 days per year. Incidents may be raised by designated Customer personnel, or by those identified in the Thales Network Operation Centre s processes and procedures. Escalation and reporting will be in accordance with Thales Network Operations Centre processes and procedures. For a severity 1 incident, Time to Respond is 1 hour from logging the incident followed by a further Time to Fix of 4 hours. The availability target is 99.9% and will be measured and reported on monthly. A threshold for service credits is set at 99.7%. The high level of availability is underwritten by the dual resilient architecture. In the event of a RAS Service component failure the service will continue to operate on a single VPN device, or in the case of a DR event will failover to the single VPN device at the DR location. Including IMACs (Installs Moves and Changes). Service Requests are not a part of the Secure RAS Service and all changes are required to be progressed through the CR process. Service Requests are chargable. Releases will be issued and applied in-line with those provided by the original equipment manufacturers and according to a Forward Schedule of Change that will be circulated to all customers prior to any work. Service reports will be provided monthly and show usage, and failed login attempts.

9 Service Attribute Capacity Management Service Outages Change Request Disaster Recovery Service Level The Thales RAS Service is provided on a per user / end point device basis and can be scaled to meet the changing demands of the customer. Capacity Management issues relating to an extended capability will be addressed through the change process. Please note that if possible the customer provides information on future scaling in the initial stages, not doing so and subsequent large growth in user number may potentially result in high cost for implementation. Performance will be monitored by Network Operations staff, and any potential capacity issues will be addressed through the incident management or change management process. The RAS service provided by Thales assumes a capacity of 100Kbps as a maximum per user meaning a maximum of 10 users per 1Mbps. Any scheduled outage will be excluded from availability calculations. Thales operates with a planned maintenance window between the hours of 01:00 and 05:00 on Sunday subject to an agreed Forward Schedule of Change. Maintenance is carried out only when necessary and all outages are subject to a rolling monthly Forward Schedule of Change circulated to customers. Customers can generate changes to the service through submission of a change request by the designated customer representative to the Thales Service Delivery Manager. All change requests will be managed by the Thales Change Advisory Board (CAB). The RAS Service provides a resilient service with a DR capability operating in a hot-standby configuration. If DR has been initiated and a service effecting incident occurs within the DR site, this will be considered as a severity one failure with the resultant four hour time to fix target and escalation procedures. ORDERING AND INVOICE PROCESS A purchase order and Call-Off form are required. The Call-Off form details the services, charges and payment arrangements. In support of this Thales will provide a written: Specification Document Service Level Agreement Deployment Plan that includes key milestone dates and any customer dependencies (see customer requirements). Billing for the service is monthly in advance. Payment can be via the following methods: Bacs or Cheque.

10 SERVICE LEAD TIME Organisations can order services and be activated within 6 8 weeks. TERMINATION COSTS There are no termination costs for this service, subject to the minimum contract period. At the point of termination, all client configuration, accounts and access will be permanently deleted. CUSTOMER RESPONSIBILITIES To ensure a smooth integration and operation of the service the Customer is responsible for the following: Provide suitably qualified staff with knowledge of the customer infrastructure to work with the Supplier delivery team, enabling the RAS systems to be correctly configured by the Supplier. Provide contact details for an approved set of IT staff that will have permissions to raise Incidents. Provide contact details for incident escalation. Ensure the Customer network is compliant with relevant PSN Code of Connection requirements. Ensure the Customer devices using this service are compliant with the Government security guidance for end user devices and browsers, details of which are contained in the following websites: Provide Security Manager contact details for reporting any notifiable security events. Providing connectivity to the Internet for client devices Provide connectivity for PSN to allow connection from the service to the Customer estate. The service is provided on the basis that the required Active-X controls and Java enabling access to the Secure RAS Service are enabled on the end user devices. TECHNICAL REQUIREMENTS Individual users will require internet access and a suitable end user device to access this service.

11 RELATED SERVICES This service may be bought in conjunction with the following other G-Cloud services: Cloud Enablement Transition Management Managed Server DevOps Services Two Factor Authentication