PWS_Attachment_4_Sample_Enterprise_IT_Infrastructure_Architecture_Information.docx

Example Example Example Example

Attachment 4 to the Performance Work Statement (PWS)

USDA FOREST SERVICE

Natural Resource Management (NRM) Infrastructure Technology Support Services

NRM Enterprise-Infrastructure/Architecture Information

11 July 2016

Enterprise IT Architecture The IT component of the Forest Service Enterprise Architecture consists of approximately 33,000 desktop PCs and 8,000 laptops refreshed on a four-to-six-year refresh cycle. These PCs and laptops are supported by over 1,000 Unix® based (AIX®) servers, over 200 Linux-based X 86 servers, and associated data and voice networks. Desktop and laptop computers connect to the Forest Service Distributed Computing Environment/Distributed File System (DCE/DFS) environment through a server operating system component named Fast Connect for AIX, which enables Microsoft® Windows® clients to access AIX file systems and printers using the Server Message Block (SMB) networking protocol. The Forest Service is migrating from the Unix®-based (AIX®) Mid-Range servers, located in over 150 locations, to architecture based on Linux-based X-86 servers located in two data centers.

The Forest Service also has deployed significant numbers of handheld computers including, but not limited to, Windows CE® (Pocket PC), Palm®-based systems, and Blackberry OS in both office and field/outdoor ruggedized configurations. The Forest Service also uses both wireless (e.g., radio, satellite) and wired facilities to support remote sensing and telemetry applications.

The Forest Service has implemented several components of the Tivoli® Enterprise Management system for providing Enterprise-wide operational monitoring capability (server and desktop monitoring, control, and troubleshooting facilities). Components include Tivoli Service Desk, Tivoli Framework, Tivoli Management Region, Tivoli Trusted Information Systems, Tivoli Remote Control, and Tivoli Endpoints. Additionally, the Forest Service has deployed Computer Associates‘ UAPM for Asset Management.

Commercial-off-the-shelf (COTS) software packages are installed as part of the standard image and include ERDAS® Remote Sensing Software, ESRI® Geographic Information Systems software, Lotus Notes®/Domino® mail and collaboration software, Microsoft Office® software, Oracle software, Web browsers, and may include other software depending on Forest Service requirements.

The Forest Service has over 7,000 networked output devices (printers, plotters, and digitizers) located across the Forest Service. Over 6,000 of these devices are laser printers connected to the network. The Forest Service deploys its networked output devices only after performing extensive testing in its integration lab.

Network Network assets are distributed across the entire Forest Service. The Wide Area Network (WAN) consists of a USDA Departmental ATT owned MPLS Network that provides any-to-any connectivity between 170 FS facilities and Internet Access through two USDA provided Internet Gateways. In addition, the FS network consists of point-to-point connectivity, provided by Local Exchange Carriers (LECs) in a hub-and-spoke implementation for more than 800 facilities. Current circuit counts are in excess of 1,500 circuits consisting of satellite links, T1 circuits, non-dedicated Internet services (DSL, Broadband, and Satellite), T3, OC3 and OC12 circuits. Approximately 60,000 IP hosts reside in the FS Enterprise Network.

Remote access is provided to end users by dial-up modem connectivity located in approximately 23 locations throughout the Continental US and Alaska. Remote access is also provided via Virtual Private Network (VPN).

Network Operations Center (NOC) The Forest Service Network Operations function is comprised of two Network Operations Centers for redundancy – one in Albuquerque, NM and one in Portland, OR. Each NOC has monitors that display continuous Big Brother and Concord eHealth status. The Forest Service uses MRTG (Multi Router Traffic Grapher) to check specific connections when troubleshooting problems. The NOC also utilizes Cable News Network (CNN) to watch for adverse weather conditions or events. Additional tools in use today include Spectrum and Cisco Works 2000. Future tools may vary as requirements dictate.

Security Operations The Forest Service Security Group is responsible for two distinctly different, yet complimentary, functions: security operations and computer incident response. The Forest Service Computer Incident Response Team (CIRT) responds to security incidents that originate from several sources including the USDA's OCIO, US Computer Emergency Readiness Team (CERT), complaints from the public, and from the Security Group's analysis of information collected through the security operations component of the group. The CIRT is responsible for following computer incidents from their inception through successful incident resolution. This includes complying with Federal, USDA, and Forest Service guidelines for incident reporting, coordinating different lines of service (LOS) groups within the Forest Service and forensic analysis of both network packet captures and full computer systems. The CIRT must be available 24x7x365 to respond to any security incident as it arises.

The security operations area is the primary monitor of the Forest Service's network security state. Currently this is accomplished using a variety of tools including Cisco IDS, NetForensics, ISS Internet Scanner and Cisco Security agent, although these tools are constantly being reviewed against current industry offerings to provide the best security cost/benefit for the Forest Service. These tools are currently monitored from geographically disparate locations in a 10x5 mode of operation. The Security Group is in the process of migrating this functionality to a 24x7 capacity for more comprehensive coverage of the Forest Service's security posture The Security Group is also responsible for the interface between the Forest Service and the Forest Service's Internet Service Provider (ISP) for security. This includes development of firewall rules for the Forest Service's ISP using Cisco PIX and CIRT integration for responding to security incidents.

Enterprise Operations Center (EOC) The Forest Service Enterprise Operations Center:

1. Monitors the IT infrastructure including network, services, critical services, business applications, radio and telephone components;

2. Tracks performance against service levels;

3. Provides 24X7 support through the combined resources of the EOC and Duty Officer Process; and

4. Provides services including Incident Management, Problem Management, Change Management, Availability Management, and Release Management