Managed Security Service National Security Information (MSS-NSI)

Transcription

1 Managed Security Service National Security Information (MSS-NSI) 16.1 AT&T MSS-NSI Overview AT&T will provide management, installation, operations, maintenance and upgrade services for U.S Government-owned, NSA-approved encryption devices using the processes and methodologies AT&T currently has in place to manage and maintain encryption devices, TACLANEs in particular. methodologies and practices are approved and supported by NSA. AT&T current AT&T s solution will support encrypted classified transport across an unclassified IPbased network that AT&T provides. The solution has been designed to support TACLANE or any High Assurance Internet Protocol Interoperability Standard (HAIPIS) equivalent Type 1 encryptors MSS-NSI Service Description AT&T will coordinate with the customer to segregate the classified data and its supporting management and transport infrastructure components into multiple security compartments. A security compartment will encompass a single National Security Information (NSI) classification such as US Secret or US Top Secret. Figure shows AT&T s Managed Encryption Design. Additional security compartments could be created within NSI classifications that are not segregated by default. For example, policy-defined segregation could be used to II-16-1

2 separate data from the same NSI classification into separate administrative compartments, e.g. separating US Secret data from the Agency A from US Secret data from Agency B within the same Department. Typically, this segregation is enforced through unique keys distributed only to compartment members. Communication with non-compartment members is prevented by the uniqueness of the keys. Policy-defined segregation could also be accomplished using the TACLANE routing facilities. AT&T Provided Figure AT&T Managed Encryption Design. TACLANE devices accomplish packet routing through static route tables. These static routes identify destinations the classified data can reach. A destination could be an individual host computer or an entire network segment. Controlling an individual TACLANE device's route table will restrict data delivery to only permitted destinations. Routing table-based segregation has management advantages. Member II-16-2

3 network segments can be added and removed by altering specific cryptographic devices routing tables. Figure is a graphical example of how the TACLANE routing facilities would provide policy-based segregation. AT&T Provided Figure : Policy-based Segregation using TACLANE s routing facilities The TACLANE encryptors offer the option to segregate different agencies similar classification traffic from each other. Routing table-based segregation eliminates the need for key distribution. Routing table changes can be effected rapidly, thereby providing flexible, responsive traffic segregation. Network segment grouping is based upon specific operating policies applied to a security management compartment. Member network segments must still belong to the same security management compartment, such as US Secret. II-16-3

4 Network segment grouping is independent of, yet occurring within the constraints defined for an individual security management compartment Billing Methods MSS-NSI Service, AT&T will bill the nonrecurring and recurring charges be billed from the AT&T Government Solutions Integrated Services Biller (ISB). MSS-NSI service charges will be invoiced and delivered to the Government on a monthly basis. The invoice for MSS-NSI will include the Agency Hierarchy Code (AHC) for each agency that has ordered this service. The Government will receive an invoice each month for each agency with installed MSS-NSI Service. The invoice will include the Service Configuration Identification (SCIDs). This invoice may include one-time charges and/or monthly recurring charges. Site-specific details will be included in the invoice for each agency. All adjustments will be included on the monthly invoice GSA Fee Each monthly MSS-NSI invoice from AT&T will include the Government s management fee Service Ordering Due to the sensitive nature of this service an appropriately cleared AT&T Sales Manager will work with the customer to initially order MSS-NSI service. Once the initial requirements are reviewed by an AT&T technical manager an ordering capability will be made available thru the AT&T BusinessDirect portal for specific site and SAS implementations. II-16-4

5 The MSS-NSI service may only be ordered as an overlay to an AT&T network service, which is separately ordered (e.g. Managed Router Solution, Managed Internet Service, etc.) The network service will be ordered using the process as described in the AT&T FTS-LD modification MACDs for MSS-NSI The MSS-NSI ordering approach to Moves, Adds, Changes and Disconnects (MACD) uses the AT&T BusinessDirect portal Implementation Support An AT&T Project Implementation Manager (PIM) will develop an implementation plan and, with agency approval, oversee installation activities. These include: Procuring Encryption Device (or receiving Government purchased Encryption Device) Installing and Connecting the Encryption at each site Loading necessary software Configuring all installed equipment Loading Keying material Performing Encryption Device validation testing. Customers will also be given a Single Point of Contact 800 number to the Service Assurance System (SAS) Implementation Intervals The MSS-NSI devices to be installed will be coordinated along with the specific network service that is ordered by a customer. If the classification level II-16-5

6 provides access restrictions or additional clearance requirements by the customer, then a mutually agreed implementation interval will be established. implementation intervals are available for a mutually agreed additional cost Management Faster AT&T will remotely manage the department-owned NSA approved encryption devices from the Service Assurance System (SAS). AT&T s will leverage the use of an existing accredited facility and upon final approval by the existing government customers AT&T will provide management support. AT&T personnel will acquire the appropriate clearances and AT&T requests customer sponsorship of both the clearances and the secured facility. The facility will house the encryption management systems for each security compartment as well as the spare encryptors and key used to replace any defective ones. The management platform that AT&T will use is the GEMS network management system. customer to provide a TACLANE encryptor. Each network management system will require the Customers will be given a Single Point of Contact 800 number to the SAS to report and coordinate trouble actions. AT&T will integrate the trouble reporting procedures of the associated network service and those of the SAS. However, due to the special security considerations associated with the encryption devices additional methods of transmission, such as, secured telephone and fax services may be necessary to coordinate restoral and these devices Service Level Agreements (SLAs) AT&T will support the following Service Level Agreements(SLAs) and will entertain more restrictive SLAs for additional cost: II-16-6

7 Repair or replacement of defective encryption device within of determination that dispatch to customer site within CONUS is necessary. Scheduled visit to each site to service, inventory, and, if necessary, re-key the device. Changes to Access Control List (ACL) for each device are implemented Support a mutually agreed Emergency Maintenance plan to visit the devices supporting a customer s network to perform an Emergency Change or Repair action within a specified timeframe. Upon official direction from the customer, transmit in a secure and authenticated manner via GEMS, notification of security compromise to all managed security devices and shut down all packet transmission through specified TACLANE devices. II-16-7