Applicable Doc. 04 - IAM-VAEC Configuration Management Plan_June-2021 (1).pdf

IAM-VAEC Configuration Management Plan

VAEC Microsoft Azure Government High

Identity and Access Management (IAM) EMASS(GRC)

Department of Veterans Affairs

Office of Information and Technology

June 2021

Version 1.9

INTERNAL SYSTEM SECURITY

ARTIFACT to support IAM ATO

(Product of SSP)

Controlled Unclassified Information (CUI) WARNING: This document contains

Sensitive information. No part of this document may be disclosed to persons without a “need to know”, except with written permission of the Department of

Veterans Affairs.

IAM-VAEC Configuration Management Plan ii June 2021

Revision History

Date Revision Description Author

June 2021 1.9 Reviewed / Updated for eMASS/ATO IAM Security Team

May 2021 1.8 Updates to CM Plan Technical Writer/CM

July 2020 1.7 Reviewed and Updated after SCA evaluation

IAM Security Team

March 2020 1.6 Updated and finalized for Signature IAM Security Team

January 2020 1.5 Reviewed and Updated for eMASS controls

IAM Security Team

November

1.4 Tech Writer Review/PM Review Technical

Writer/PM/CM

November

1.3 EPMO Review EPMO/VA

October 2019 1.2 Updated and integrated IAM systems into VAEC template format

IAM Security Team

August 2019 1.1 Baseline IAM CM Plan Technical Writer/CM

Manager/PM

June 2019 1.0 Updated VAEC Template IAM Security Team

IAM-VAEC Configuration Management Plan iii June 2021

Table of Contents

1 Executive Summary

1.1 IAM Project Overview

1.2 IAM Operations and Maintenance

2 Configuration Management Overview

2.1 Purpose of the IAM-VAEC Configuration Management Plan

2.2 Scope of the IAM-VAEC Configuration Management Plan

2.3 Structure of the Configuration Management Plan

2.4 Compliance with IT Security Requirements

2.4.1 Configuration Management Policy and Procedures

2.4.2 Baseline Configuration

2.4.3 Configuration Change Control

2.4.4 Security Impact Analysis

2.4.5 Access Restrictions for Change

2.4.6 Configuration Settings

2.4.7 Least Functionality

2.4.8 Information System Component Inventory

2.4.9 Configuration Management Plan

2.4.10 Software Usage Restrictions

2.4.11 User-installed Software

2.4.12 Cryptography Management

3 Configuration Identification and Storage

3.1 Introduction

3.2 Configuration Identification Activities

3.3 Criteria for Selecting Configuration Items

3.4 Items Placed Under Configuration Control

3.5 Configuration Item List (CIL)

3.6 Items Not Placed Under Configuration Control

3.7 Additional Guidance - IAM Configuration Management Plan

4 Configuration Management

4.1 Roles and Responsibilities

4.2 Interface/Dependency Management

4.3 CCM Implementation

4.4 CCM Environment Planning and Setup

4.4.1 Development Support

4.4.2 Release Preparation

4.5 Release Management and Version Control

4.6 Release Planning

4.7 Security Impact Assessment

4.8 Release Building

IAM-VAEC Configuration Management Plan iv June 2021

4.9 Vulnerability Scanning

4.10 User Acceptance Testing

4.11 Release Deployment

4.12 Version Control

4.12.1 Versioning of Directories

4.13 Project Closeout

4.14 Patch Management

4.15 FLAW Remediation Management (SI-2)

4.16 Malicious Code Protection (SI-3)

4.17 Software, Firmware, and Information Security (SI-7)

5 Configuration Identification

5.1 Naming Conventions

5.2 Configuration Control (Version and Baseline Management)

5.2.1 Source Code

5.2.2 Documentation

5.2.3 Environment

5.3 Change Management

5.4 Story and Task Management

5.5 Defect Management

5.6 Risk/Issue Management

5.7 Status Accounting

5.7.1 Dashboards

5.8 Queries

5.9 General Status Reports

5.10 Configuration Audits and Reviews

5.11 Auditing

5.11.1 Types of Audit

5.11.2 Goals

5.11.3 Configuration Audit Checklist

5.12 Release Management

5.12.1 Electronic Release Package

5.12.2 Version Description Document

5.12.3 Training

6 Change Control Board

6.1 Responsibilities

6.2 CCB Change Request

6.3 Assessment Criteria

6.3.1 CCB Change Request Template

6.3.2 Example of a Change Request

7 Emergency Change Process

7.1 What is Emergency Change?

7.2 What is Emergency Change Request?

IAM-VAEC Configuration Management Plan v June 2021

7.2.1 VA/ESCCB (Enterprise Security Change Control Board)

7.3 Emergency Change Process Diagram

8 IAM Service Desk Support

8.1 Service Desk Tool

8.1.1 IT Service Management

8.1.2 Platform

8.1.3 VIP Process

9 Plans and External Documentation in support of Configuration Management:

9.1 Backup and Disaster Recovery Plans

9.2 CM Environment Configuration Recovery Method

9.3 Method for Site Servers Recover

9.4 Communication and Environment Coordination

9.5 Information Security Architecture [PL-8 with language from SA-17 also] 62

9.6 IAM Azure Maintenance Processes [MA-1,MA-2, MA-4(6)]

9.7 IAM Developer Configuration Management [SA-10]

9.8 IAM Supply Chain Protection Processes [SA-12]

Appendix A: IAM Configuration Management Plan -- ATO Document Approval

Appendix B: IAM CM References and Resources

Appendix C: IAM Configuration Management Process Key Terms

Appendix D: IAM Suggested Configuration Items Data Elements

Appendix E: IAM Current Configuration Baseline Report

Appendix F: VAEC Change Order Approval Checklist -SAMPLE

Appendix G: VAEC Change Order Implementation Plan Template

Appendix H: VAEC Business Case Justification for Changes

Appendix I: VAEC Change Management Back-Out Plan Template

List of Tables

Table 1: Configuration Management Control Compliance Table 2: Configuration Management Documentation Table 3: Configuration Items (CIs) Table 4: Items Placed Under Configuration Control Table 5: Configuration Item List (CIL) Table 6: Required Configuration Management Activities Table 7: Responsibilities Table 8: Naming Conventions Table 9: IAM Environments Table 10: General Status Reports Table 11: CCB Board Table 12: Risk Attributes

IAM-VAEC Configuration Management Plan vi June 2021

Table 13: CCB Board Members for DEVOPS Approvals Table 14: Identity and Access Management (IAM) Software and Services

List of Figures

Figure 1: Service Support Workflow Figure 2: Baseline Code History Figure 3: Linkages Between CM Tasks Figure 4: Change Control Board (CCB) Process Flow Figure 5: Emergency Change Process Diagram Figure 6: Service Support Integration Figure 7: ITSM Tool Modules Figure 8: VIP Framework Figure 9: Cloud Environments Availability Figure 10: Approved VA Configuration Management Tools

IAM-VAEC Configuration Management Plan 1 June 2021

1 Executive Summary

The Configuration Management Plan (CMP) is a security artifact that supports identification, control, and auditing of VA Enterprise Cloud (VAEC) and Identity and Access Management (IAM) assets in an orderly and controlled manner. This artifact will also support the Authorizing Official with the information needed to maintain a robust continuous readiness and monitoring posture as the system moves through the lifecycle development process.

This document defines the change management process and evaluates change for potential adverse impacts. The VA Enterprise Cloud (VAEC) for Microsoft Azure Government (MAG)

High, will determine the items to be managed, establish configuration baselines, and ensure modifications incorporate security considerations for security controls for the VAEC system in accordance with VA Continuous Readiness and Information Security Program (CRISP) Guidelines. Configuration Management (CM) is a security function within the System

Development Life Cycle (SDLC) and has security implications if the baseline configurations are not managed and changes are not controlled.

The Identity and Access Management (IAM) team, will determine the items to be managed, establish configuration baselines, and ensure modifications incorporate security considerations for security controls for the Identity and Access Management (IAM) system in accordance with VA Continuous Readiness and Information Security Program (CRISP) Guidelines.

Configuration Management (CM) is a security function within the System Development Life

Cycle (SDLC) and has security implications if the baseline configurations are not managed and changes are not controlled.

This document is intended to be a living document. The final version will be placed under IAM

Configuration Management for review and the respective changes managed according to IAM Configuration Management policies referenced.

1.1 IAM Project Overview

The IAM Program provides on-demand access to a suite of comprehensive and cohesive VA services and benefits in a consistent, user-centric manner. As part of this initiative, Identity and

Access Management (IAM) is a multi-project effort consisting of identity and access services to support full integration across the IAM spectrum. These activities enable all internal VA Users and external VA users (including but not limited to all Veterans, beneficiaries and business partners) to find information about VA's benefits and services to be identified quickly by the VA, to complete their transactions within the VA, without having to repeat information, and to seamlessly access multiple VA service lines.

All IAM solutions are implemented as modular solutions that can stand alone as well as integrate with other IAM projects and activities, thereby providing an integrated IAM security and architecture framework. The IAM solutions must comply with all VA and Federal guidelines pertaining to Identity and Access Management and Information Systems security. The VAEC-

IAM-VAEC Configuration Management Plan 2 June 2021

IAM program will support the Platform as a Service (PaaS) for the setup and maintenances of IAM's tightly-controlled Pre-Production (PREPROD) and Production (PROD) environments.

The VAEC MAG project provides cloud computing for the IAM infrastructure to support enterprise level efforts for the VA. System virtualization is the process of software implementation that establishes system boundaries and allows a computer to execute multiple instances of an operating system. The solution utilizes platforms that allow for integrated lifecycle development of software artifacts while providing a scalable enterprise-class solution without the constraints of physical hardware. The IAM solution requires the physical components to be integrated into its environments to meet necessary enterprise-wide requirements.

The IAM Product set is comprised of Commercial Off -The-Shelf (COTS) and custom software working together to provide an enterprise-wide level of Identity and Access Services. Identity

Access Management (IAM) encapsulates people, processes, and products to identify and manage the data used in an information system to authenticate users and grant or deny access rights to data and system resources. The goal of IAM is to provide appropriate and authenticated access to VA and selected business partners enterprise resources

Access Services (AcS)

Access Services (AcS) provide VA business lines a service that: streamlines the granting and removing of electronic permissions to access VA technology systems, resources and data;

ensures only authorized users are granted access; supports role-based/attribute-based and Single

Sign-On (SSO) access; allows beneficiaries to use electronic or digital signatures; and allows Veterans to receive a VA credential without having to appear at a VA facility.

Identity Services (IdS)

Identity Services (IdS) provide the VA business lines a service that: uniquely identifies all persons of interest; enables assignment of universal VA identifiers to service members; and facilitates data sharing between VA Lines of Business (LOB's) and external partners. IdS systems support the input/retrieval of data and person-specific functionality such as identity management, lookup, and enumeration. The objective of IdS VA-MPI is to create an index that uniquely identifies each person within the VA domain and to identify the sites where the person is known. Because IdS VA-MPI uniquely differentiates persons, all applications can use IdS VA- MPI to maintain person records and ensure that duplicate records are eliminated. IdS VA-MPI is the authoritative VA identity service.

VA Master Person Index (VA-MPI)

The objective of VA-MPI is to create an index that uniquely identifies each active patient treated by the VA by assigning an Integration Control Number (ICN) and identifying the sites where a patient is receiving care. This index is crucial to the sharing of patient information across sites.

IdS manages the synchronization of the VistA PATIENT File (#2) information with VA-MPI and with the patient’s treating facilities to ensure that data being shared is stored in the correct patient’s record. VA-MPI enumerates and maintains person identities of both patients and non-patients, synchronizes identities with VistA during transition from Legacy VistA to Cerner

JEHR/EHRM, maintains a history of identity changes, correlates the ICN to internal and external

IAM-VAEC Configuration Management Plan 3 June 2021 identity domains, provides duplicate prevention and resolution tools, and identifies and initiates identity link and unlink activities.

Veteran Health Identification Card (VHIC)

Veteran Health Identification Card (VHIC) is an application that allows the issuer to gather patient data from VistA, capture the patient’s picture, save the data and picture file, and electronically submit a request for a veteran health identification card (VHIC). The Department of Veterans Affairs (VA) provides the VHIC card to eligible Veterans for use at VA medical facilities. The VHIC currently displays the Veteran’s name, picture, and special eligibility indicators, such as Service Connected, Purple Heart, and Former POW on the front of the card.

After a Veteran’s identity is verified in person, a Veteran who is eligible for VA medical benefits can request the card. After the Veteran has his/her picture taken at the VA medical facility and after eligibility is verified, the card is mailed to the Veteran within ten days.

Toolkit (TK) - is a graphical user interface that allows Health Care Identity Management (HC IdM) staff to search and view identity and exception information in the Administrative Data Repository (ADR) and MPI. This interface includes the ability to view the Primary View record and any associated correlations, correlation data, history, audit trails, and Business Rule Events.

IdM TK includes integration with Master Data Management, which is a COTS tool that provides a probabilistic algorithm for searching and duplicate matching. The IdM TK also allows HC IdM staff to review and resolve potential duplicate exceptions.

Identity Verification Services (IVS) and Identity Verification Maintenance Support

(IVMS)

Identity Verification Services (IVS) and Identity Verification Maintenance Support (IVMS) provide specific support to maintain the integrity of the interface for the duration of the period of performance. Identity verification validates VA person population against external identity data services. VA intends to leverage (not replace) VA-MPI capabilities and the existing interface to a national data store of identities provided by Experian that will allow VA to validate identities and create correlations between the commercial system and VA identity store to provide increasingly robust identity services.

Identity Verification Tool (IVT)

Identity Verification Tool (IVT) will provide Identity Verification Services that utilizes commercial identity verification databases to verify VA-MPI identities and provide the VA with data feeds and reports related to potential matches, non-matches, duplicates and updates of identity information. The tool integrates the identify verification with industry-standard best practice methods with the VA enterprise Identity Management Index system, VA-MPI. The population data includes the set of all persons resident in the U.S., as well as all U.S. citizens residing in foreign countries. Identification information can be exchanged through the existing web-serviced based interface already established by the VA with Experian as an authoritative credit data source to validate Veteran applicant’s credit information.

Person Services Identity Management (PSIM) - provides the interface to and integrates with the commercial off-the-shelf (COTS) Master Data Management (MDM) product and supports both deterministic and probabilistic patient searches. PSIM enumerates and maintains person identities of patients, synchronizes identities with VistA during transition from Legacy VistA to

IAM-VAEC Configuration Management Plan 4 June 2021

HeV, maintains a history of ID changes, correlates the Integration Control Number (ICN) to internal and external identity domains, provides duplicate prevention and resolution tools, initiates identity link and unlink activities, and provides a data quality management user interface. PSIM updates include storing and receiving Date of Death from VistA and updates supporting VA MPI becoming the authoritative source for Date of Death, integration with Identity Verification Capabilities, and Person Types at the Correlation and Primary View.

1.2 IAM Operations and Maintenance

Operations and Maintenance activities are associated with the on-going support related to the performance of routine, preventive, predictive, and scheduled actions aimed at preventing system failure to increase efficiency and reliability on a continuous basis. Maintenance is defined as technical tasks and ongoing activities, planned or reactive, which are needed to keep applications, services and systems working in a secure and optimum state. Examples of

Operations and Maintenance functions include Product Installs and Upgrades, Application Patching, Hotfixes, Highly Availability configuration of Systems, Automatic failover of applications, application performance tuning, capacity planning.

• Responsible to monitor alarms (AppDynamics, Splunk, OEM & F5).

• Run Smoke Tests, Open Tickets when necessary, Perform initial problem determination.

• Contact different tiers 2, 3 & 4 if additional assistance is needed.

• Deploy New releases, Deploy Security patches, respond to tickets that affect VM’s/OS level.

• Review and resolve LETT tickets for lower environments.

• Automate task and reduce the human interactions and produce repeatable deployments.

• Provide 24x7 Production support to the team.

System Administration

System Administration Support tasks related to monitoring and management of the IAM solution in the VAEC environments to ensure system availability, reliability and sustainability, including

Incident Response and Information Assurance Support Tasks optimizing system performance using VAEC capabilities, and Network and Resource Monitoring tasks.

2 Configuration Management Overview

2.1 Purpose of the IAM-VAEC Configuration Management Plan

The overall objective of a CMP is to identify CM roles and responsibilities, resources, and formal processes and procedures to ensure that all proposed changes to a General Support System (GSS) / Major Application (MA) are evaluated and approved before implementation.

This also includes the process used for controlling implementation, evaluation, and auditing of the CM processes and Configuration Items (CIs) to include maintaining a current baseline configuration of the system under Configuration Management Control. This IAM-VAEC Configuration Management Plan contains all the information pertinent to the VAEC and Identity and Access Management (IAM) in support of the IAM ATO

The requirements for this Configuration Management Plan include:

• Map into the four architecture layers of the Federal Enterprise Architecture Framework

IAM-VAEC Configuration Management Plan 5 June 2021

• Maintain consistency with the goals of CMMI

• Comply with Federal standards

• Establish a CM repository

• Allow for continuous process improvement

2.2 Scope of the IAM-VAEC Configuration Management Plan

The VAEC Microsoft Azure Government High CMP and Identity and Access Management (IAM) document, along with the OIT CM Standard Operating Procedure (SOP), defines the Information System’s structure and methods to ensure that changes to the system are managed according to a repeatable process. This document is intended to govern change directly pertaining to the project team and/or application teams as it applies to the IAM PREPROD and PROD environment’s infrastructure framework, network, assets, artifacts and documents. This CM Plan will cover activities including Configuration Identification of CI’s, Configuration

Control (CC), Configuration Status Accounting (CSA), Configuration Verification and Audit (CVA). The information contained in this document is most applicable to day -to-day performance of activities within the IAM PREPROD and PROD environments as it relates to configuration management processes. The purpose of CM is to establish and maintain the integrity of work products using configuration identification (CI), configuration status reporting, and configuration audits. Configuration Management is applied using CIs. A CI is treated as a distinct entity in the CM process called an artifact. These artifacts may include individual requirements, code, hardware or documentation.:

• Identifying, defining, and base-lining CIs o Creating CI Records o Identifying relationships

• Controlling modifications and releases of CIs

• Reporting and recording status of CIs and any requested modifications

• Ensuring completeness, consistency, and correctness of CIs

• Controlling storage, handling, and delivery of the CIs

Each project and process may potentially have a different set of artifacts placed under CM.

Configuration Management answers the questions who, what, when, why and how:

• Who makes the changes?

• What changes are made to the system and documents?

• When will the changes be made?

• Why will the changes be made?

• How to track and document changes?

Configuration Management is a discipline that integrates a set of practices to achieve general and specific goals. The CM process starts from an approved baseline and is the process by which a baseline can be changed. Configuration Management can be defined as all activities and tools necessary to enable the completion of tasks needed to identify, define, and baseline items;

control modifications and releases of these items; report and record status of change modification

IAM-VAEC Configuration Management Plan 6 June 2021 requests; ensure completeness, correctness, and consistency of these items; and control storage, handling, and delivery of these items.

The objectives of this CMP, as established by the Capability Maturity Model Integration

(CMMI), include:

• Institutionalize a managed process

• Institutionalize a defined process

• Institutionalize a quantitatively managed process

• Institutionalize an optimizing process

• Establish baselines

• Establish and maintain integrity of baselines

• Track and control changes to Cis

The IAM CMP adheres to the Capability Maturity Model Integration (CMMI) standards.

Standards include a set of required, expected, and informative practices in a process area. An organization’s practices are examined to see how well these goals are met. A process area is a collection of related practices that taken together, meet a set of specific goals considered important for making improvement in that area1. There are six levels of maturity, which characterize an organization’s ability to perform, control, and improve its performance in a process area. These capability levels of a process area include:

• Incomplete

• Performed

• Managed

• Defined

• Quantitatively Managed

• Optimizing

IAM-VAEC Configuration Management Plan 7 June 2021

SERVICE SUPPORT

Service Desk

Release Management

Change Management

Configuration Management

Problem Management

Incident Management

1 Carnegie Mellon, Software Engineering Institute, Capability Maturity Model Integration (CMMI), Version 1.1

Figure 1: Service Support Workflow

2.3 Structure of the Configuration Management Plan

The intended audience of the CMP is System Owners, Organizational Service Lines and divisions, Facility Chief Information Officers, System Administrators, Information Security Officers and Information Owners, Cloud Operations and Migration Services (COMS) staff, and Office of Information and Technology (OIT) staff within these identified areas responsible for the day-to-day maintenance of the configuration items.

This CMP, in conjunction with the Office of Information and Technology (OIT) Configuration and Change Management Process Documents, and Service, Delivery and Engineering (SDE) Change Management Policy and Standard Operating Procedures, identifies configuration management and change management roles and responsibilities and system relationships. In addition, the scope includes the automated tools and processes used to manage the information system baseline configuration.

2.4 Compliance with IT Security Requirements

The IAM-VAEC MAG Configuration Management Plan adheres to security requirements of the

CM, SA. PL, RA, MA, SI control families as prescribed in NIST SP 800-53 Rev. 4 and by the system’s FIPS 199 Security Categorization (SC) of High; Confidentiality: High, Integrity: High, Availability: Moderate. The following table identifies the sections that contain control implementation statements that meets NIST SP 800-53 Rev. 4 CM control requirements.

IAM-VAEC Configuration Management Plan 8 June 2021

Table 1: Configuration Management Control Compliance

Control

Number Security Control Requirement

Document

Section

Page

Number

CM-1

Configuration Management Policy and Procedures

Section 2.4.1 8

CM-2 Baseline Configuration Section 2.4.2 10

CM-3 Configuration Change Control Section 2.4.3 11

CM-4 Security Impact Analysis Section 2.4.4 13

CM-5 Access Restrictions for Change Section 2.4.5 14 CM-6 Configuration Settings Section 2.4.6 15

CM-7 Least Functionality Section 2.4.7 16

CM-8 Information System Component Inventory Section 2.4.8 18

CM-9 Configuration Management Plan Entire Document 20

CM-10 Software Usage Restrictions Section 2.4.10 21

CM-11 User-installed Software Section 2.4.11 22

CM-3(6) Cryptograph Management Section 2.4.12 23

PL-2 System Security Plan Section 3.4.1 36 Patch IAM Enterprise Patch Process Section 3.5 38

SI-2 Flaw Remediation Section 3.6 39

SI-3 Malicious Code Protection Section 3.7 40

SI-7 Software, Firmware, Information Integrity Section 3.8 41

Change Detailed Change Request Process Section 5 49

Plans Backup, Disaster Recovery, COOP Plans Section 8 64

PL-8

SA-17

Developer Security Architecture Design Section 8.5 64

MA1 MA2

/ MA-4(6)

System Maintenance Policy & Procedures Section 8.6 66

SA-10 Developer Configuration Management Section 8.7 66

SA-12 Supply Chain Protection Section 8.8 68

2.4.1 Configuration Management Policy and Procedures

Control CM-1

The VAEC inherits this control from OI&T. OI&T develops, documents, and disseminates policies and procedures enterprise-wide. In accordance with VA Directive and Handbook 6330, the Configuration Management Policy is reviewed every five (5) years. The VAEC develops and maintains SOPs as needed. The IAM Configuration Management team reviews configuration management events and processes each month. The IAM Configuration management team reviews all configuration management documentation, process, SOPs for update approval each quarter.

Central repository for Configuration Management documentation for reference:

IAM-VAEC Configuration Management Plan 9 June 2021

Table 2: Configuration Management Documentation

Tool VA Enterprise

Consult/Request Tracking Product

Source/Documentation Management

GitHub – Source code https://github.ec.va.gov/

GitHub - Documentation https://github.ec.va.gov/EPMO/iam-vampi-product https://github.ec.va.gov/EPMO/acsvc-product https://github.ec.va.gov/EPMO/vhic-product

Backlog and Work Item Tracking

Jira https://vajira.max.gov/projects/VAMPI/summary https://vajira.max.gov/projects/ACSVC/summary https://vajira.max.gov/projects/VHIC/summary

Release Tracking

Confluence https://community.max.gov/x/UM8zfw

Document Sharing

Share Point IAM SharePoint

Product

TBD

Document management: This plan was developed according to the project’s needs and tailored to comply with VA’s Veteran Focused Integration Process (VIP). The Configuration Management Plan (CMP) is identified by name and is maintained under Configuration Management (CM) control. Modifications will be made when project circumstances require a change, and the details for each release are noted in the revision history table. The approved release of the plan is stored and posted on the VA’s SharePoint site, and Microsoft (MS) SharePoint documents repository located on the project site (https:/dvagov.sharepoint.com/sites/OITEPMOIAM/default.aspx). The following list identifies some types of managed documentation:

• Project administrative artifacts

• Requirements, design, and architecture documents

• Configuration Management documents [Configuration Management Plan (CMP)]

• Installation Guide (Processes and procedures for installing the delivered application package)

• Technical release notes, as applicable

Project Management (PM) Artifacts are static documents that provide information about a specific project state. For example, installation and upgrade process plans are PM artifacts.

• Daily Firewall Rules Report https://github.ec.va.gov/EPMO/iam-vampi-product https://github.ec.va.gov/EPMO/acsvc-product https://vajira.max.gov/projects/VAMPI/summary https://vajira.max.gov/projects/ACSVC/summary https://dvagov.sharepoint.com/sites/OITEPMOIAM/IAM%20Documents/Forms/AllItems.aspx?viewpath=%2Fsites%2FOITEPMOIAM%2FIAM%20Documents%2FForms%2FAllItems%2Easpx

IAM-VAEC Configuration Management Plan 10 June 2021

• Service Interruption/Incident (SI) Post Action Reports

• Monthly Change Control logs

2.4.2 Baseline Configuration

Control CM-2

The VAEC develops, documents, and maintains configuration control, a current baseline configuration of the information system during each VIP cycle. Baseline configurations are developed and documented in the IAM-VAEC Configuration Management Plan. IAM system administrators, security team members, and project leadership review system baseline inventories and configurations on a regular basis (no less than monthly) to ensure no unauthorized changes have been made and to prepare for future updates to the baseline, such as planned version updates or cyclical patch application. Baseline configurations are updated as needed, such as to compensate for a newly discovered security vulnerability or the release of newly available COTS software. Baseline configurations are maintained through the use of server planning sheets, server listings in Azure's server management portal, and in SharePoint.

The IAM teams are responsible for patching/updating the following IAM components in accordance with the associated frequency: - Windows OS: Monthly - Linux OS: Monthly - Oracle DB: Quarterly - MS SQL DB: Quarterly or as required - Non-OS/DB security vulnerabilities: Within required 30/60/90-day remediation period depending on severity Any other changes to IAM systems require a formal change request and must be submitted, reviewed, and approved by the Configuration Control Board (CCB). The process is documented in the IAM Change Management Plan. All system modifications, to include patches/upgrades made by the

IAM team, will be tested in the pre-production environment prior to deployment in production.

• Code Baseline Configuration: GitHub Enterprise is used as the centralized repository and management of baselines. Currently the IAM project is using Jira and GitHub for source Control for the code/documentation repository. O&M team is also using GitHub to store ansible scripts and documentation.

• Servers: VA IBM BigFix is used to validate/manage server configuration in accordance with VA CRISP Guidelines. And the Jira server to document configurations

• FAQ: https://dashboard.tic.va.gov/Docs/Pages/BigFix-FAQ.aspx

CM-02.E02 Baseline Configuration | Automation Support For Accuracy / Currency The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system. IAM uses a combination of scanning, monitoring, and intrusion prevention tools that offer real-time alerting and reporting functions to help maintain an up-to-date system configuration. The use of Splunk and McAfee ePolicy Orchestrator (ePO) offers a variety of perspectives into the system. Each application has the ability to alert and report based on its primary function in real-time. AppDynamics provides network and hardware-related information, generally layer 1-4 of the OSI Model. AppDynamics monitors application-related information. Splunk log aggregation tools that provide searching and analysis functions. VA IBM BigFix is used to manage server configuration in accordance with VA Guidelines and periodic reports are pulled to ensure integrity of the IAM environment.

Splunk monitor and analyze user behavior, object access and modification, security control analysis, and identification of suspicious activity within the system. McAfee ePO is a central management platform for McAfee agents. Enterprise Anti-Virus monitors the execution of

IAM-VAEC Configuration Management Plan 11 June 2021 programs and files with known signatures. Anti-Virus signatures are updated every day to ensure accuracy and prevent execution of new threats. The applications described above are used to collect, correlate and analyze data to provide indications of security incidents. Th e Security

Team monitors these tools for unusual activity and identifies sources of potential problems. The Security Team will assess events to determine if the alert or reports are indicating a security or service delivery incident.

CM-02.E03 Baseline Configuration | Retention Of Previous Configurations The organization retains defined previous versions of baseline configurations of the information system to support rollback. The Configuration Manager is responsible for supporting the change process by controlling changes and maintaining baselines and developmental configuration for the IAM systems. IAM/Azure is responsible for changes to the virtual environment, which are documented in "as built" server planning sheets, while Azure maintains baselines for all hardware. Additionally, server snapshots allow for rollback to earlier system configurations.

CM-02.E07 Baseline Configuration | Configure Systems The organization: (a) Issues information systems, system components, or devices with organization defined configurations to individuals traveling to locations that the organization deems to be of significant risk; and applies organization-defined security safeguards to the devices when the individuals return. VA staff assigned to the project will not work in areas deemed high risk. If travel to a high risk area is warranted, the IAM program will ensure that its personnel and equipment are handled according to NIST and VA guidelines. This control is partly inherited from VA and VBA policies. VA resources (GFEs) are managed by the VA according to policies. IAM resources are managed by IAM in accordance with the contracted Statement of Work (SOW). The IAM management team determines, documents, and allocates the resources required to adequately protect the information systems. The security requirements and/or security specifications that are explicitly identified in information system acquisition contracts are based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. In addition, physical and logical configurations and changes are strictly controlled through the CCB and monitored according to IAM, Azure, and VA requirements and guidance

Figure 2: Baseline Code History

IAM-VAEC Configuration Management Plan 12 June 2021

2.4.3 Configuration Change Control

Control CM-3

(a) The VAEC categorizes changes into two (2) categories. These are (1) changes that affect other VA information systems and (2) changes that affect the VAEC. For changes that only affect the VAEC, there are two (2) additional categories of changes:

2.4.3.1 Changes that do not require CCB approval

2.4.3.2 Changes that requires CCB approval

• All changes to the Production environment.

• Initial configuration of hosted application environment.

• All changes to Core Services.

(b) All configuration changes are documented and tracked in the Service Desk Manager (SDM) and Configuration Management Database (CMDB) (SDM and CMDB are defined in section 3.2).

(c) Based on the type of change, approval is required by the requisite CCB.

(d) In accordance with VA Handbook 6500, the VAEC will retain configuration -controlled records for five (5) years. The change request tickets are retained in the SDM and CMDB ticketing systems.

(e) All approved changes are reviewed prior to the closure of the change request ticket. IBM BigFix is used to identify and audit for unapproved changes. Reports are pulled biweekly for review and action.

(f) The VAEC coordinates and provides oversight for all configuration changes via a CCB.

CM-03.E01 The organization employs automated mechanisms to: (a) Document proposed changes to the information system; (b) Notify IAM team and VA leadership of proposed changes to the information system and request change approval; (c) Highlight proposed changes to the information system that have not been approved or disapproved by IAM team and VA leadership within proposed time requirement; (d) Prohibit changes to the information system until designated approvals are received; (e) Document all changes to the information system; and (f) Notify IAM team and VA leadership when approved changes to the information system are completed. Detailed configuration management policies and procedures are outlined in the

IAM-VAEC MAG Configuration Management Plan. IAM employs Jira as the core automated mechanism to document proposed changes to the system, notify approval authorities and relevant personnel of the proposed changes, and highlight proposed changes that are under consideration during each VIP cycle and tracked, prohibit unauthorized changes to the system, maintain a record of both approved and disapproved changes, and monitor the approval process automatically. Jira robust notification and approval tracking capabilities allow IAM to easily inform all relevant personnel of proposed changes; track development and testing of that proposed change as it progresses; and then require a series of approvals before implementation.

JIRA work items can never be deleted and thus form a permanent history of changes considered and approved/rejected by the program. Additionally, user access to perform changes on IAM-controlled servers is closely monitored and made as restrictive as possible to prevent unauthorized changes through the use of GPOs, two-factor authentication, and other security methods. Moreover, changes to the system are documented in Microsoft SharePoint, and server snapshots allow for rollback to earlier system configurations.

IAM-VAEC Configuration Management Plan 13 June 2021

CM-03.E02 Configuration Change Control | Test / Validate / Document Changes The organization tests, validates, and documents changes to the information system before implementing the changes on the operational system. The IAM program follows the system development life cycle as directed by VA 6500 and industry best practices. System planning is developed between the IAM PMO, Architects, Development Team, Infrastructure Team (Azure Team), Administration Team, and the Operations and Maintenance Team. Each team will conduct an analysis of the proposed system changes in relation to their supporting function.

System design is handled by the Development Team in coordination with the IAM O&M team, which supports implementation of new functions in production environments. Upon final approval of the system design and availability of resources, the development of the system changes will begin. Newly developed changes will be tested and reviewed for vulnerabilities and weaknesses in the design. New developments are integrated and tested by progressing the deployment through the non-production networks; Dev, SQA, and PREPROD prior to deployment in production. Implementation into the Production environment will occur once final testing is complete and is typically done at a time of day that will not affect user functionality.

IAM deployment managers will schedule any downtime and work activities with IAM personnel.

The system owner will approve the deployment schedule prior to development. After successful deployment the updated system will fall into operational activities managed by the IAM O&M Team and Operations and Maintenance Team. Security personnel will be present throughout the

SDLC and drive testing and security validation requirements. IAM staff maintains a record of all proposed changes to the system in JIRA and in SharePoint.

2.4.4 Security Impact Analysis

Control CM-4

The VAEC utilizes a workflow change management process that includes a security review prior to approval. The security official will conduct a security impact assessment based on the probability and impact of the proposed change to the information system.

CM-04.1 Security Impact Analysis New developments are integrated and tested by progressing the deployment through the non-production networks; Dev, SQA, and PREPROD prior to deployment in production. Implementation into the Production environment will occur once final testing -- to fully understand the impact of the propose change on both functionality and system security - is complete. IAM management, members of the IAM O&M team, the information security team, VA system owner, the ISO, and other specified individuals, comprise the Change Control Board. The Board ensures that changes are documented and tested. The Board monitors changes to the information system and ensures security impact analyses are completed to determine the effects of the changes. If the facility environment necessitates a different configuration for a particular system than the configuration approved by VA, the change request must be documented and evaluated by the Change Control Board. If the proposed change affects the security of the system, the system must be re-certified and accredited by OCS. All changes to the configuration of a system are documented in the SSP and appropriate system diagrams/inventories. The system owners, system managers, information security team, and th e ISO review all VA-NSOC security alerts and take appropriate remedial actions in a timely manner. The Board ensures that access restrictions associated with changes to the system are implemented and monitored. Emergency change procedures are documented and approved by management either prior to the change or immediately after the fact. Each Operating Unit audits activities associated with configuration changes to the information systems. IAM system

IAM-VAEC Configuration Management Plan 14 June 2021 administrators, in coordination with Azure engineers, perform and document routine preventative and regular maintenance on the components of their information systems in accordance with manufacturer or vendor specifications. The IAM development environment serves as the test bed for IAM configuration changes.

When potential hardware changes owned and operated by Azure are involved, Azure’s Change Management Process defines roles and responsibilities of the Azure Change Advisory Board (CAB). This board consists of at least 5 senior representatives from various func tional groups who are authorized to review, approve and/or deny RFCs based on completeness, readiness, business impact and business need. The CAB meets at least once a week to review RFCs. Any RFC considered to be high risk will be referred to the Executive Review Board (ERB) for review. CM-04.E01 Security Impact Analysis | Separate Test Environments The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice. IAM's three non-production environments --development, software quality assurance (SQA) and preproduction -- exist for testing any changes that wish to be made to the production environment. All proposed changes are first implemented in the development environment and tested for security weaknesses and impact on user access/functionality before being promoted closer to the production environment. IAM Security Team performs vulnerability scans on any systems that are modified in the preproduction environment prior to implementation in the Production (operational) environment, and production and pre-production model one another very closely to support configuration management and security.

2.4.5 Access Restrictions for Change

Control CM-5

The VAEC utilizes a workflow change management process that defines, documents, approves all proposed changes prior to implementation. Only system engineers have logical access to make changes to the operational environment. IBM BigFix is used to identify unapproved changes.

CM-05.1 Access Restrictions For Change The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system. Logical access controls will be employed to permit only authorized access to VA computer systems and restrict users to authorized transactions, functions, and information. These automated controls will ensure that only authorized individuals gain access to information system resources, that these individuals will be assigned an appropriate level of privilege, and that they will individually be accountable for their actions as captured in audit logs. Every user account will be reviewed by management and security staff based on system impact levels. User accounts and privileges will be assessed to ensure appropriate separation of duties and to ensure that the most restrictive set of rights/privileges or access needed by users is in place. The implementation of Splunk across IAM environments ensures that auditing of user activity is enabled. This helps enforce access restrictions and prevent unauthorized changes.

CM-05.E02 Access Restrictions For Change | Review System Changes The organization reviews information system changes [Assignment: organization-defined frequency] and [Assignment:

organization-defined circumstances] to determine whether unauthorized changes have occurred.

Splunk, the automated mechanism software employed by IAM/Azure, provides utilization of centralized monitoring and provides automated review and alerting of system activity across the

IAM-VAEC Configuration Management Plan 15 June 2021 enterprise. Splunk securely collects, stores, reports and alerts on event data from Windows, Unix & Linux systems to by auditing access to critical VA systems and detecting inappropriate or suspicious access-related events. With Splunk, IAM/Azure collects, analyzes, reports, and generates automated real-time alerts for all relevant access-related events across the GSS network. Splunk provides log aggregation capabilities that build upon Splunk to give IAM an even more precise and automated view of regular system access and the ability to identify irregular or restricted actions.

CM-05.E03 Access Restrictions for Change | Signed Components The information system prevents the installation of software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization. IAM/Azure recognizes packages and security patches that are signed by Microsoft and Red Hat only. Software not signed by a trusted source will need approvals for installation.

The IAM system administrators will only apply patches to the COTS products that are acquired directly from the manufacturer and do so in accordance with the process outlined in the IAM

Configuration Management Plan. IAM also utilizes the Shavlik patch management software, as required by the VA, to identify and collect patches from third-party (non-OS) vendors, such as Mozilla Firefox, Google Chrome, and 7-Zip.

2.4.6 Configuration Settings

Control CM-6

(a) The VAEC utilizes a gold image for initial baseline configurations. The baseline configuration settings are based on DISA STIGs and VA CRISP Guidelines.

• Windows Server 2012 and 2012 R2 DISA STIG – Version 2, Release 8, 28 Apr 2017

• Red Hat Enterprise Linux (RHEL) 7 DISA STIG – Version 1, Release 1, 13 Mar 2017

(b) The VAEC utilizes Ansible to deploy the gold image configuration settings.

(c) The VAEC conducts baseline configuration scans prior to a system going operational.

Deviations from the gold image baseline are documented and approved prior to implementation into the operational environment.

(d) The VAEC utilizes IBM BigFix to monitor configuration settings. IAM stores Server Build sheets within IAM SharePoint.

CM-06.1 Configuration Settings VA Enterprise Cloud (VAEC) and Identity and Access Management (IAM): a. Establishes and documents configuration settings for information technology products employed within the information system using build guides and scripts as defined by security configuration checklists that reflect the most restrictive mode consistent with operational requirements; b. Implements the configuration settings; c. Identifies, documents, and approves any deviations from established configuration settings for IAM production system components based on operational requirements; and d. Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures. The IAM-VAEC Configuration Management Plan addresses the requirements as outlined for this control at the system/enclave level. Specifica lly for hardware owned, operated and controlled by Azure, Azure’s Change Management Process defines roles and responsibilities of the CCB. This board consists of at least 5 senior representatives from various functional groups who are authorized to review, approve and/or

IAM-VAEC Configuration Management Plan 16 June 2021 deny RFCs based on completeness, readiness, business impact and business need.