ATT0005 2.5 item d SIPRNET_Tech_Impl_Criteria V7 - Final 12Nov13.pdf

SIPRNET Technical Implementation Criteria

September 2013

FOR OFFICIAL USE ONLY

DEPARTMENT OF THE ARMY

UNITED STATES ARMY INFORMATION

SYSTEMS ENGINEERING COMMAND

FORT HUACHUCA, ARIZONA 85613-5300

SECRET INTERNET PROTOCOL ROUTER

NETWORK

TECHNICAL IMPLEMENTATION CRITERIA,

VERSION 7.0

SEPTEMBER 2013

FORT DETRICK ENGINEERING DIRECTORATE

Distribution C

Distribution authorized to U.S. Government agencies and their contractors only, for administrative or operational use, as of

September 2013. Refer other requests for this document to

Director, U.S. Army Information Systems Engineering Command, Fort Detrick Engineering Directorate, ATTN: ELIE-ISE-DE, Fort

Detrick, MD 21702-5047.

ii

DISCLAIMER

The use of trade names in this document does not constitute an official endorsement or approval of the use of such commercial hardware or software. Do not cite this document for advertisement.

CHANGES

Refer requests for all changes that affect this document to:

USAISEC, ATTN: ELIE-ISE-DE, Fort Detrick, MD 21702-

5047.

DISPOSITION INSTRUCTIONS

Destroy this document when no longer needed. Do not return it to the organization. Safeguard and destroy this document with consideration given to its classification or distribution statement requirements.

iii

FOR OFFICIAL USE ONLY

SECRET INTERNET PROTOCOL ROUTER

NETWORK

TECHNICAL IMPLEMENTATION CRITERIA,

VERSION 7.0

SEPTEMBER 2013

U.S. ARMY INFORMATION SYSTEMS ENGINEERING COMMAND

FORT DETRICK ENGINEERING DIRECTORATE

TINA M. REED FREDERICK M. SKROBAN

Group Leader, Military Construction Senior Systems Engineer - Technical

Fort Detrick Engineering Directorate Fort Detrick Engineering Directorate

THEODORE A. HENDY ALBERT M. RIVERA

Director Technical Director

Fort Detrick Engineering U.S. Army Information Systems

Directorate Engineering Command

Distribution C

Distribution authorized to U.S. Government agencies and their contractors only, for administrative or operational use, as of

September 2013. Refer other requests for this document to

Director, U.S. Army Information Systems Engineering Command, Fort Detrick Engineering Directorate, ATTN: ELIE-ISE-DE, Fort

Detrick, MD 21702-5047.

iv

FOR OFFICIAL USE ONLY

TABLE OF CONTENTS

Page

1.0 INTRODUCTION

1.1 Purpose

1.2 Scope

1.3 SIPRNET Project Goal

2.0 MAJOR PARTICIPANTS AND RESPONSIBILITIES

2.1 U.S. Army Corps of Engineer (USACE)

2.2 U.S. Army Information Systems Engineering Command (USAISEC)

2.3 USACTTA

2.4 DAA

2.5 NEC/Communications Service Provider

2.6 User IMO

2.7 Shared

3.0 TECHNICAL SOLUTIONS DESCRIPTION AND CRITERIA

3.1 Construction Criteria

3.2 Connectivity Areas of Responsibility

3.3 Access Areas

3.4 PDS

3.5 SIPRNet Architecture and Design

3.6 Tunneling

3.7 IPS Container

3.8 Encryption Devices

3.9 Secure Wireless Local Area Networks (SWLANs)

3.10 VoSIP

3.11 VTC

3.12 Thin/Zero Client

3.13 IA

4.0 SIPRNET CONNECTION PROCESS

4.1 DISN Connection Approval Process (CAP)

4.2 Accreditation and ATC

5.0 COST MODELING AND ESTIMATING FOR FINANCIAL PLANNING

5.1 General

5.2 Cost Typing

5.3 Funding Requirements and Limitations

Appendices

Appendix A. Figures, Drawings, and Diagrams .................................................................... A-1

Appendix B. PDS Inspection Checklist ................................................................................. B-1

Appendix C. SIPRNET Site Survey Checklist ...................................................................... C-1

Appendix D. SIPRNET User and Allocation Tables ............................................................ D-1 v

FOR OFFICIAL USE ONLY

Page

Appendices

Appendix E. SIPRNET Allocations for New Military Construction .................................... E-1

Appendix F. SIPRNET PDS Specification for MCA Construction...................................... F-1

Appendix G. Sample IPS Containers with Movable Racks ..................................................G-1

Appendix H. MCA Information System Cost Funding Breakout .........................................H-1

Appendix I. References............................................................................................................. I-1

Glossary. Abbreviations, Acronyms, and Definitions ............................................... Glossary-1

Table

Table 1. VoSIP Area Codes

Figures

Figure 1. Epoxy Beads on Connectors Figure A-1. Example of WAN, MAN, CAN, and LAN ........................................................A-2 Figure A-2. SIPRNET High-Level Overview ........................................................................A-3

Figure A-3. DISA-Managed SIPRNET Assets ......................................................................A-4 Figure A-4. NEC-Managed SIPRNET Assets .......................................................................A-5 Figure A-5. Tenant-Managed SIPRNET Assets ....................................................................A-6

Figure A-6. SIPRNET Dial-Up Example ...............................................................................A-7 Figure A-7. PDS Physical Architecture Examples ................................................................A-8 Figure A-8. Wireless Architectures ........................................................................................A-9

Figure A-9. Secure-Only ISDN or IP VTC ..........................................................................A-10 Figure A-10. Multi-Domain ISDN or IP VTC .....................................................................A-10 Figure G-1. Hamilton IPS Clearance Requirements ..............................................................G-2

Figure G-2. Hamilton IPS Dimensions ...................................................................................G-3 Figure G-3. Trusted Systems IPS Clearance Requirements ..................................................G-4 Figure G-4. Trusted Systems IPS Dimensions .......................................................................G-5

Figure H-1. MCA Information System Cost Funding Breakout ...........................................H-1

Attachment

Attachment 1. Memorandum, U.S. Air Force Judge Advocate, Subject: Medical Use of

Encrypted Phone Systems and SIPRNET, 14 April 2004 ................................................ Att 1-1 vi

FOR OFFICIAL USE ONLY

SUMMARY OF CHANGES

Changes for Version 7.0 include the following:

a. Updated all sections to current regulations and policies.

b. Updated, replaced, or added appendices and attachments.

c. Updated references and links.

d. Included technical criteria for new construction.

e. Included SRM technical criteria.

FOR OFFICIAL USE ONLY

SECRET INTERNET PROTOCOL ROUTER NETWORK

TECHNICAL IMPLEMENTATION CRITERIA, VERSION 7.0

1.0 INTRODUCTION

1.1 Purpose

The purpose of this document is to provide a set of criteria, culled from numerous

Government regulations, policies, and standards into one document, with the intent of assisting a communications service provider, such as the Network Enterprise Center (NEC) on an Army installation, in planning, designing, and installing or expanding SIPRNET capability for its users. This document replaces the Secret Internet Protocol Router Network

(SIPRNET) Technical Implementation Criteria, Version 6.0 and all versions of the Technical

Guide for the Integration of SIPRNET.

1.2 Scope

This document is not intended to replace any guidance given in any Government regulation, policy, standard, or other official documentation nor to relieve users of the responsibility to ensure their design and installation meets those regulatory requirements. This document incorporates information from the referenced regulations, policies, and standards (see

Appendix I) current as of the time of publication of this document. It is incumbent upon the users of this document to ensure they are familiar with any changes made after the publication of this document to the referenced regulations, policies, and standards. At the same time, a SIPRNET installation that follows the criteria described herein will meet the criteria published in the references and meet accreditation requirements for operational use of the system.

Although this document may contain some information that may be useful in the Outside

Continental United States (OCONUS) environment, the exact specifications and requirements in the OCONUS theater may differ from the Continental United States

(CONUS) theater. This document is not intended for use as technical criteria for OCONUS implementation. Likewise, this document is not intended for use as technical criteria for classified network implementation in a tactical environment.

1.3 SIPRNET Project Goal

The goal of a typical SIPRNET project is to extend the classified network’s Red-side infrastructure to users not collocated with the SIPRNET distribution node or Point of

Presence (POP). The methodology used to provide the SIPRNET service will vary based upon such factors as the number of users, their relative locations and concentrations, building layout and construction, operational requirements, and design requirements/limitations imposed by higher headquarters or funding limitations.

Several standard designs have been developed and are discussed in more detail in

Section 3.0. These designs are intended for use as a guideline and must be tailored to meet unique requirements at each location.

2.0 MAJOR PARTICIPANTS AND RESPONSIBILITIES

2.1 U.S. Army Corps of Engineer (USACE)

The USACE is responsible for ensuring the construction Contractor selected to install

Protected Distribution System (PDS) is technically qualified to do so for the construction projects (Military Construction Army [MCA], Military Construction Army Reserve

FOR OFFICIAL USE ONLY

(MCAR), Sustainment, Restoration, and Modernization [SRM], etc.) it manages. The

USACE is also responsible for providing PDS documentation, including shop drawings (i.e., T1, T2, and T4), a List of Materials (LOM), etc., from the construction Contractor to the

NEC prior to installation of the PDS with sufficient time (approximately 30 to 60 days) for the U.S. Army Central TEMPEST Technical Authority (USACTTA) to perform a technical review of the PDS. The NEC is responsible for forwarding this documentation to the

USACTTA.

2.2 U.S. Army Information Systems Engineering Command (USAISEC)

USAISEC serves as one of the Army’s major communications engineering and implementation organizations and offers its services to Department of Defense (DOD) agencies on a reimbursable basis. Services range from performance of site surveys, development of the Engineering Design Plan (EDP) and LOM, procurement of materials, implementation and configuration of systems, and testing of completed installations.

To ensure the collection of all information in an organized and complete manner, USAISEC has adopted the use of a Site Survey Checklist to assist in gathering all required information during the site survey for a SIPRNET expansion project. This document provides a sample checklist, attached in Appendix C, as an example of the information gathered to design a

SIPRNET implementation. It is not an all inclusive list, as each site has unique design requirements. To ensure design implementation occurs per all applicable criteria, the surveyor must gather any additional information affecting the design.

2.3 USACTTA

The USACTTA is responsible for performing technical reviews on all PDS designs prior to the procurement of materials or awarding of contracts, determining whether any TEMPEST countermeasures apply and advising the Designated Approving Authority (DAA) on all technical matters pertaining to TEMPEST issues and to a PDS (see Section 4.2.2).

The request for a PDS technical review must come from a Government official, not a

Contractor, prior to committing funds. However, the Government official can designate a

Contractor as the Point of Contact (POC) for the review. Technical review requests will be classified as at least Confidential in accordance with (IAW) Army Regulation (AR) 25-2.

The PDS information provided in the technical review will be classified as at least

Confidential. The same applies to any information relating to approval of a specific PDS.

All PDS technical review requests must be sent via SIPRNET e-mail to the TEMPEST

Program Manager (TPM) at 902d310thTEMPEST@mi.army.smil.mil.

The request for a PDS technical review must include the information required by National

Security Telecommunications and Information Systems Security Instruction (NSTISSI)

7003, Annex C and will be classified appropriately, based on its accumulative content. The

USACTTA technical review determines whether the PDS design is compliant with NSTISSI

7003 and will prepare a PDS technical review memorandum for the DAA.

AR 380-27, Chapter 3.

mailto:902d310thTEMPEST@mi.army.smil.mil

FOR OFFICIAL USE ONLY

If the USACTTA technical review finds the proposed PDS design is non-compliant, they will assist the customer to develop a compliant design. If the design cannot be made fully compliant, the USACTTA will provide a risk assessment of the proposed design to the

DAA.

All Army PDSs will be approved according to NSTISSI 7003, AR 25-2, and AR 380-27.

A copy of the PDS technical review must be included as part of the PDS accreditation package for review/approval by the DAA.

The DAA has the authority to accept the risk of a non-compliant PDS and must formally accept any risk in writing. A copy of the USACTTA risk assessment must be attached. A copy of the risk acceptance memorandum must be provided to the supporting USACTTA

2.4 DAA

The DAA is responsible for ensuring all Information Systems (ISs) are properly certified and accredited. The DAA is also responsible for approving all local connections to the

Campus Area Network (CAN) at the site.

The DAA is vested with the authority to formally assume responsibility for operating an IS at an acceptable level of risk. The DAA must weigh the operational need for the systems capabilities, the protection of personal privacy, the protection of the information being processed, and the protection of the information environment.

The DAA legally accepts any unmitigated risk associated with the approval of the system.

2.5 NEC/Communications Service Provider

The NEC/communications service provider is responsible for the following:

a. Obtaining the systems’ DOD Information Assurance Certification and

Accreditation Process (DIACAP) accreditation for all ISs that connect to the installation

SIPRNET.

b. Obtaining PDS technical reviews from the USACTTA.

c. Providing the required Red-side and Black-side Internet Protocol (IP) addresses.

This includes obtaining additional IP subnets to satisfy new requirements.

d. Configuring the CAN to pass encrypted, classified network service to remote buildings, as required, if such service is tunneled through the CAN.

e. Ensuring the Black-side connectivity through the facility’s Local Area Network

(LAN) and the post CAN is available for all encryption devices, as required.

f. Implementing any new circuits required for the installation or expansion of a classified network service on the installation.

g. Procuring encryption devices through the Communications Security Logistics

Activity (CSLA) and coordination with the local Communications Security (COMSEC) custodian for COMSEC devices that fall within their control.

AR 380-27, Chapter 3.

FOR OFFICIAL USE ONLY

h. Coordinating with the COMSEC Custodian for the procurement and issuing of encryption key material and key material loading devices.

The Information Assurance (IA) Manager (IAM) is responsible for the overall security of the network. These items will include security oversight, vulnerability assessments, and IA

Vulnerability Alert (IAVA) compliance roll-ups, as well as other areas.

In conjunction with the user, the Information Management Officer (IMO) is responsible for the procurement, installation, and configuration of application software to be installed on end-user computer resources.

Coordination with the Directorate of Public Works (DPW) will take place to complete any agreements regarding site preparation issues (space, power, outlet locations, etc.).

The communications service provider will perform these responsibilities on military installations that do not have a NEC.

2.6 User IMO

User IMO is responsible for the following:

a. Maintaining the physical and information security of the classified network access.

b. Providing information to the NEC for system accreditation.

c. Ensuring user equipment is properly marked with the appropriate classification level for the classified network on which it is used.

d. Ensuring user equipment is stored in approved security containers or in an open storage area during non-duty hours.

e. Procuring COMSEC devices (IAW organizational procedures) through CSLA, and coordinating with the COMSEC custodian for COMSEC material within their control.

2.7 Shared

The NEC, IMO, and user must coordinate the extension of the SIPRNet drops, ordering of equipment, and overall accountability for the system.

The NEC, IMO, and user must coordinate closely with each other to ensure the implementation of all physical security and operating procedures required for the system to be accredited.

The construction Contractor shall provide PDS documentation (shop drawings, LOM, etc.)

to USACE. USACE will forward the PDS documentation to the NEC for submission to the

USACTTA prior to the installation of the PDS. The NEC will forward this documentation to the USACTTA for technical review. USACE will also ensure the construction Contractor is technically qualified to install a PDS.

Do not commit funds for the acquisition of material or the installation of a PDS until after the USACTTA has completed its technical review of the PDS design and its comments (if any) are addressed.

FOR OFFICIAL USE ONLY

3.0 TECHNICAL SOLUTIONS DESCRIPTION AND CRITERIA

3.1 Construction Criteria

3.1.1 General

There have been several programs in the past focused on expanding the SIPRNET user base.

Over time, many lessons have been learned, and those lessons have been incorporated into these criteria.

Two remaining programs, MCA and SRM, are still relevant and are discussed in subsequent sections of this document. The most prevalent SIPRNET implementation is the organization/agency-funded implementation. These projects vary in size from a few to several hundred new connections.

3.1.2 MCA

SIPRNET distribution will be installed in most, but not all, buildings (see Appendix E) and originate from a secure Telecommunications Room (TR) (see Section 3.5.5).

All private offices and conference rooms, not to exceed 25 percent of designed building occupancy, shall be designed to have SIPRNET capability. A SIPRNET-capable room requires either non-operational or lockable windows; Heating, Ventilation, and Air

Conditioning (HVAC); and sound attenuation to at least Sound Transmission Category

(STC)-35 whether or not a SIPRNET drop is installed in the space.

For example, a new building designed for a 100-person occupancy that has 20 private offices and conference rooms is authorized 25 SIPRNET User Drop Boxes (UDBs). In this scenario, each office would receive one SIPRNET UDB with one cable connection;

however, conference rooms and Commander/Director offices would receive one UDB with two cable connections. To accommodate occasional SIPRNET users, five UDBs with one cable connection are located in a room designed and designated as a SIPRNET café. Design and use of SIPRNET cafés (see Section 3.5.8) is highly encouraged to accommodate the occasional SIPRNET user group.

Conference rooms using amplified sound (e.g., secure Video Teleconference [VTC]) during a classified meeting may require sound attenuation of at least STC-35 or more for the walls, ceiling, and door(s). Contact local security (physical, information, etc.) to determine conference room sound attenuation requirements.

SIPRNET drops located in buildings with secure rooms (e.g., Network Operations Center

[NOC], Brigade Operations Center [BOC], Division Operations Center [DOC], Joint

Operations Center [JOC], etc.), Sensitive Compartmented Information Facilities (SCIFs), or secure buildings should not count against the 25-percent occupancy rule.

MCA projects are funded for SIPRNET installation to the battalion level and higher.

SIPRNET installation exceptions below battalion level include Explosive Ordinance

Detachment (EOD), Military Intelligence (MI), and Special Operations Forces (SOF) companies and platoon/detachment facilities. Space for secure SIPRNET TRs will be designed and installed for all facilities authorized for SIPRNET, as well as for Company

Operating Facility (COF) and Tactical Equipment Maintenance Facility (TEMF) for future use.

FOR OFFICIAL USE ONLY

3.1.3 General Guidance for Building Rehabilitation and Retrofit – SRM

Numerous profiles for the installation of SIPRNET in existing facilities are included in the tables provided in Appendix D for use as general guidance in design and estimation. The quantities in the tables reflect the guidelines from the Mission Command (MC) Networks and Systems/Network Operations Service List.

For buildings that do not fit into the profiles in Appendix D, up to five SIPRNET drops will be engineered and installed for those buildings accommodating personnel in the grade/rank of O-5/Lieutenant Colonel and above (or the civilian equivalent) with command responsibilities.

Use the same design criteria specified in Section 3.1.2 when programming funding for and designing of SIPRNET access in SRM projects.

3.1.4 Medical Facilities

Hospitals and medical facilities, whether existing or new construction, will be provided only one SIPRNET drop per building due to Geneva Convention and Law of Armed Conflict

(LOAC) issues (see Category 510 in Appendix E).

The SIPRNET access in medical facilities may not be used for Command and Control (C2) or for intelligence gathering. SIPRNET use will be limited to the exclusive purpose of retrieving and transmitting medical information

3.2 Connectivity Areas of Responsibility

3.2.1 General

SIPRNET implementation and access spans from the individual user up to the global

SIPRNET Wide Area Network (WAN). The responsibility for operating, maintaining, and implementing such access is divided into three main areas of responsibility, each by a different organization (i.e., Defense Information Systems Agency [DISA], NEC, and tenant/user).

The areas of responsibility between the following three agencies correspond roughly to the size of the network: WAN, Metropolitan Area Network (MAN)/CAN, LAN. Refer to

Figure A-1 for a depiction of the various network sizes and to learn how these networks interrelate.

Each of the three areas of responsibility must be addressed for a successful implementation of SIPRNET access. Figure A-2 depicts a high-level view of the overall user-to-WAN reach of the SIPRNET, with the three areas of responsibility delineated.

3.2.2 DISA-Managed

Figure A-3 shows an expanded view of the DISA-managed portion of the SIPRNET. This drawing represents a composite of multiple design options and will not apply to every situation. This drawing is intended to give the reader a conceptual view of various configurations, architectures, and security designs, as described in the ARs, Security

Technical Implementation Guides (STIGs), and other policy documents.

Memorandum, U.S. Air Force Judge Advocate, 14 April 2004.

FOR OFFICIAL USE ONLY

As DISA manages and controls the circuit bringing SIPRNET access into the post, DISA also manages all of the equipment associated with the circuit. Although controlled by

DISA, the near-end equipment used to terminate the circuit at the post is located in one of the NEC facilities on post. Figure A-3 does not show an all-inclusive list of equipment, but only a representation of the types of equipment.

As indicated in Figure A-3, SIPRNET traffic is delivered from the DISA Global Information

Grid (GIG), through COMSEC to the NEC SIPRNET POP using a variety of transmission methods, ranging from point-to-point serial circuits to fiber optic Synchronous Optical

Network (SONET) channels. When providing SIPRNET connectivity to a post, DISA will provide the proper circuit for the bandwidth requested. The requesting agency in this case, the NEC, must fund all costs associated with the provisioning of the circuit, including equipment and labor costs for equipment installed at both ends of the circuit. In lieu of providing the funding, agency requesting the circuit may elect to provide the equipment directly to DISA and the equipment must be that specified by DISA during the circuit engineering process.

Funding must still be provided to DISA for the installation-related costs.

The circuit conditioning equipment and encryption device are typically located on the post in a NEC-controlled facility, even though they are DISA assets. The demarcation line between the DISA and NEC responsibilities is typically the Red-side connection on the encryption device used between the SIPRNET WAN and the NEC-controlled equipment.

3.2.3 NEC-Managed

Figure A-4 shows an expanded view of the NEC-managed portion of its SIPRNET connectivity. This drawing represents a composite of multiple design options and will not apply to every situation. This drawing is intended to give the reader a conceptual view of various configurations, architectures, and security designs, as described in the ARs, STIGs, and other policy documents.

As indicated in Figure A-4, between the Red-side of the DISA-controlled encryptor and the

SIPRNET POP distribution router, there is a suite of network security equipment. The local

NEC will determine the actual type, quantity, and configuration of the equipment (per DISA policy ), as it is responsible for the network security of everything behind the Red-side of the encryption device (termed an “enclave” from the WAN perspective of DISA).

Collectively, the routers, firewalls, and other equipment are referred to as the NEC

SIPRNET POP. The extension of SIPRNET service to tenants/users from the SIPRNET

POP is the main concern of the majority of SIPRNET expansion projects and this document.

The following lists four basic scenarios for these SIPRNET expansion projects:

a. Scenario 1 - The first and most common scenario is the military installation where a NEC (or other service provider) has a SIPRNET POP and uses the existing CAN for extending the service to the tenant/user that is also located on the military installation.

DISA Memorandum, Process for Use of Site Support Task, Enclosure 1, Paragraph 4.

DISA Network Infrastructure STIG, Section 2.1.

FOR OFFICIAL USE ONLY

Although this scenario will cover the majority of implementations, other solutions may be required to meet the tenants’ exact mission needs.

b. Scenario 2 - In the second scenario, a remote U.S. military or Government user that is not on the military installation needs SIPRNET service from an existing SIPRNET

POP on the military installation (i.e., an off-post extension). Typically, this scenario involves a small user group (1-20 users), but may be employed for larger groups. To implement this scenario, coordinate the physical security requirements of the SIPRNET network equipment at the remote user location with the SIPRNET service provider, such as the NEC on the military installation where the circuit will originate. Although this scenario involves a local, off-post circuit extension under the control of the NEC, it must be coordinated with the DISA Connection Approval Office (CAO) prior to implementation.

When DISA approves the extension of this service, the originating POP (the NEC) provides and controls the address space used at the remote user location and is responsible for accounting for the certification of this new location (documenting the network configuration). Note the use of private IP address space (10.0.0.0, 172.16.0.0, 192.168.0.0, etc.) is not allowed on SIPRNET networks.

c. Scenario 3 - In the third scenario, the user requires SIPRNET access in a non-military environment, such as in an off-post Contractor’s facility. This scenario is similar to the previous scenario except for the affiliation of the remote user. Again, the user must address the physical security requirements for the SIPRNET network equipment that is located at the user’s location. The type of network security equipment required must be coordinated with the SIPRNET service provider, such as the NEC on the military installation where the circuit originates. As the remote user is not a military or Government unit, a Government agency must sponsor the SIPRNET connection.

d. Scenario 4 - In the fourth scenario, the user needs a SIPRNET dial-up capability for limited use by a very small group of users. Dial-up SIPRNET is an inexpensive means to provide SIPRNET access to those who require limited service using commercial telephone lines. Users gain access by dialing a DISA communications server using a Secure

Data Device (SDD)-1910 or Secure Terminal Equipment (STE). If dial-up service is required, the user should coordinate directly with DISA. Dial-up access is restricted to

Government or military personnel only and is not available for Contractor personnel.

Figure A-6 depicts a simplified account of a dial-up connection from the tenant to the DISA server.

3.2.3.1 Post/Station Transport

Although encryption devices will be required in most situations, connectivity between the

NEC SIPRNET POP and the remote user location may be provided in various ways. The following paragraphs note three of the more prevalent methods of connectivity:

DISA Network Infrastructure STIG, Section 2.3.

DISA Network Infrastructure STIG, Section 2.8.

DISN Connection Process Guide, Paragraph 2.1 and Enclosure C.

FOR OFFICIAL USE ONLY

a. Alternative 1 – Traversing the existing CAN. The SIPRNET circuit travels from the NEC POP to each End User Building (EUB) over the existing CAN infrastructure in encrypted (Black) form. This is referred to as tunneling, and this is discussed in more detail in Section 3.6. Traversing the existing CAN is the preferred method of inter-building transport.

b. Alternative 2 – Using a dedicated cable path. Dedicated cable pairs, either copper or fiber, may be used to extend SIPRNET service in the encrypted (Black) form. This method does not use the post cable infrastructure in an efficient manner, so it is not the preferred method. As the information is encrypted, the use of a PDS is not required.

c. Alternative 3 – Using an exterior PDS. As the information being transmitted is not encrypted (it is Red or plain text), a PDS is required. An exterior PDS between buildings is an expensive method for inter-building transport, especially if there are multiple buildings, or the buildings are not immediately adjacent to each other. The SIPRNET service is extended in unencrypted (Red) form, eliminating the cost of the COMSEC devices;

however, the PDS cost may more than offset the COMSEC cost. In addition, physical security checks and procedures are required to ensure the exterior PDS remains secure. For these reasons, an exterior, hardened carrier PDS is not a preferred method of transport between buildings.

3.2.4 Tenant/Local/User-Managed

Figure A-5 shows an expanded tenant/user-managed portion of the SIPRNET connection drawing. This drawing represents a composite of multiple design options and will not apply to every situation. This drawing is intended to give a conceptual view of various configurations, architectures, and security designs, as described in the NSTISSIs, ARs, STIGs, and other policy documents.

A port on each building’s unclassified network switch (EUB switch) is reserved for the encrypted (Black) side of the encryption device. Connect the Black side of the encryption device to the reserved switch port using either a fiber optic or Ethernet cable. If the encryption device is located in a room other than the TR, such as an office, the encryptor cable can use the existing building cable distribution infrastructure (i.e., cable trays) to the

TR to connect the reserved switch port.

The Red tenant router is optional equipment and is only required if a Virtual Private

Network (VPN) is required to pass traffic between two Red enclaves separated by a pair of

Inline Network Encryptors (INEs) and the traffic is of a type that does not get passed by the

INE.

Distribution of the SIPRNET service from the switch to the users normally occurs via a PDS that is determined by the physical locations it must traverse. Section 3.4 discusses this subject in detail.

NSTISSI 7003, Annex B, Paragraphs 4a(1)(d) and (e).

FOR OFFICIAL USE ONLY

3.3 Access Areas

3.3.1 General

There are three types of access areas: Controlled Access Area (CAA), Limited Controlled

Area (LCA), and Uncontrolled Access Area (UAA). The type of access area and the local threat environment determine the type of PDS and other supplemental security measures required to protect the classified information transiting the area

Local threat levels are designated as low, medium, or high. The exact designation of the threat level for each specific geographical area is contained in a classified National Security

Agency (NSA) document (Information Assurance Technical Capabilities Report) and is beyond the scope of this unclassified document.

3.3.2 UAA

A UAA is an area over which no personnel access controls are or can be exercised.

In short, it is an area that is open to the public. There are no personnel controls that ensure only authorized personnel are allowed into the area or those personnel entering the area have a security clearance. This is the least secure of the types of access areas.

A hardened carrier PDS is required for the transmission of all unencrypted, classified information through a UAA at any threat level.

3.3.3 LCA

An LCA is an area with a PDS traversing through it where exploitation of the PDS is not considered likely or where legal authority to identify and remove a potential exploitation exists.

If the area has some personnel access controls (i.e., it is not a UAA), yet does not meet the definition of a CAA, then it is an LCA. A Government or military facility with a locked door where a visitor, once admitted to the facility, can roam unescorted is an example of an

LCA. A hardened carrier PDS is required for the transmission of all unencrypted Secret or higher classified information through an LCA at any threat level.

3.3.4 CAA

A CAA is an area in a facility that is under direct physical control within which unauthorized persons are denied unrestricted access. If unauthorized personnel are granted access, they are escorted by authorized persons or are under some form of continuous physical or electronic surveillance.

A CAA does not automatically qualify for or may not be rated for the open storage of classified material.

Use a simple carrier PDS in lieu of a hardened carrier PDS in a CAA. The distribution system for unencrypted SIPRNET within a Secret CAA may be constructed of the same

NSTISSI 7003, Annex B, Table B-1.

NSTISSI 7003, Annex A Paragraph g.

NSTISSI 7003, Annex A Paragraph d.

NSTISSI 7003, Annex A Paragraph b; AR380-27.

FOR OFFICIAL USE ONLY

materials as a simple PDS for unencrypted SIPRNET in a Confidential CAA, but it is not a

PDS; therefore, the additional inspection requirements for a PDS do not apply. Coordinate physical security and procedural issues with the proper, local physical and information security personnel.

The U.S. Army Network Enterprise Technology Command (NETCOM) has specified CAA construction requirements in Paragraph 38 of NETCOM Regulation 380-5 for CAAs that fall under its jurisdiction. Consult with local physical, information, and G2 security personnel and the cognizant Commander to determine CAA accreditation requirements.

3.3.5 Open Storage Area

An open storage area is a secure room or vault that meets the physical security standard specified in Paragraphs 7-13 and 7-14 of AR 380-5 and is accredited by the cognizant physical security office and Commander.

A PDS is not required inside an open storage area for classified data cabling at or below the security level of the open storage area. Use standard cable distribution methods and maintain Red/Black cable separations, as established by the supporting USACTTA.

The preferred method of safeguarding classified material is to secure it inside a General

Services Administration (GSA)-approved safe. Designation of an open storage area will only be approved when storage in a GSA-approved safe is not feasible due to size, shape, or volume of the material stored.

In short, the use of open storage areas is not the preferred method of securing classified material.

The Commander is responsible for designating an area as restricted or controlled to safeguard property or resources, such as the classified material or information, for which the

Commander is responsible.

To be designated as an open storage area, the selected area must be designated as such by the Commander and meet the appropriate physical security standards. A physical security inspection and/or a security engineering survey is required as part of the approval process.

Upon successful completion of the inspection and recommendation from the physical security personnel, the Commander may designate in writing that an area is approved for open storage at a given classification level.

The physical security construction standards for a secure room, open storage area at the

Secret level are as follows:

a. The floor, walls, and ceiling shall be made of permanent construction materials that offer resistance to, and evidence of, unauthorized entry into the area. In addition, the walls shall extend from the true floor to the true ceiling. The wall extensions may also be made with 18-gauge wire mesh or expanded steel screen, if the permanent walls do not extend from true floor to true ceiling.

AR 380-5, Paragraph 7-12.

DOD Reg 5200.08-R, Paragraph C3.2.4 and AR 190-13, Paragraph 6-3.

FM 3-19.30, Chapter 11.

AR 380-5, Section 7-13 Paragraph b and Section 7-20.

FOR OFFICIAL USE ONLY

b. The doors to the area shall be substantially constructed of wood or metal. Wood doors shall be solid throughout. The hinge pins of doors that swing outward from the area

(i.e., the hinges are accessible from outside the area) shall be pinned, brazed, or spot-welded to prevent their removal.

c. The access door into the area shall be equipped with a built-in combination lock, such as the CDX-09.

CDX-07 and CDX-08 lock parts are no longer manufactured;

therefore, these locks should not be installed on new installations. Doors, other than the access door, shall be secured from inside the area to prevent entry from outside. Key-operated locks that can be accessed from outside the area are not authorized.

d. If there are windows in the secure area where the window’s bottom is less than

18 feet from the ground or that are easily accessible from a nearby object (such as a tree or fence), then the windows shall be covered with material to help prevent forced entry and raise the physical strength to a level at least equivalent to the surrounding walls. Typically, metal bars or wire mesh screening is used to accomplish this. The method of securing the covering over the windows is part of the security system, so it shall also provide a protection level at least equivalent to the walls. In short, the fasteners shall be inaccessible from outside or be non-removable.

e. Windows which might reasonably afford a view of the classified information inside the area shall be made opaque or be equipped with blinds, drapes, or other coverings.

f. Any openings into the room, such as for air conditioning ducts or vents, are required to be less than 96 square inches. If larger than 96 square inches, the opening shall be hardened to resist penetration

. Openings that exceed 96 square inches and have at least one dimension that does not exceed 6 inches do not require hardening. The basic method used to harden the opening is to break up the opening into a number of smaller openings, rather than cover it over or just reduce the size.

g. An Intrusion Detection System (IDS) (i.e., Integrated Commercial Intrusion

Detection System [ICIDS] alarm system) is required.

h. Physical security construction requirements vary from one location to another and are more stringent at OCONUS locations. Contact the local physical security and G2 offices to determine the threat level and physical security construction requirements that pertain to a specific location.

Fed Spec FF-L-2740A with Amendment 1 and Federal Qualified Products List QPL-FF-

L-2740-8.

AR 380-5, Section 7-20, Paragraph d(1).

AR 380-5, Section 7-13, Paragraph b(5).

MIL-HDBK-1013/1A, Paragraph 5.6.7.

AR 380-5, Section 7-20 Paragraph e and Section 7-14.

FOR OFFICIAL USE ONLY

3.4 PDS

3.4.1 General

A PDS carrier is used to distribute cabling that transmits unencrypted (plain text), classified information through an area of lesser classification or control.

The type of PDS required is determined by the type of access area the PDS transmits through, as well as the local threat level. The less secure the access area is and the higher the local threat level, the more physical security must be provided by the PDS to the classified cable inside the PDS.

Since PDSs inherently offer greater levels of risk, the use of PDSs should be minimized in

Army facilities and systems. A PDS is not recommended in high threat areas.

The PDS begins at the point where the carrier leaves the Information Processing System

(IPS) container, secure TR, or secure room that houses the building POP and ends at the surface-mounted UDB the user unlocks and opens to access network connections. The portion of the PDS in the middle, the part that carries the classified cabling from one area to another, is known as the carrier.

3.4.2 PDS Purpose

The PDS must provide adequate electrical, electromagnetic, and physical safeguards to deter exploitation. Since PDS is penetrable, given the opportunity and adequate time, a philosophy of detection of attempted penetration is employed.

3.4.3 Simple Carrier PDS

A simple PDS is used for SIPRNET cable distribution within a Confidential rated CAA. A

PDS is not required in a Secret or higher rated CAA.

In a simple PDS, the cables must be in a carrier constructed of any material (e.g., wood, Polyvinyl Chloride [PVC], Electrical Metallic Tubing [EMT], etc.). However, the joints and access points shall be controlled by personnel cleared to the highest level of data handled by the PDS.

The most common carrier used in a CAA is a surface-mounted plastic raceway or subfloor cable tray distribution system.

Use the standard cable management/distribution system to provide an orderly scheme to route the cables, maintain Red/Black cable separation, and maintain separation from power cables.

NSTISSI 7003, Annex A, Paragraph e.

NSTISSI 7003, Table B-1.

AR 380-27, Section 3-1.

NSTISSI 7003, Page 3, Section IV, Paragraph 5.

NSTISSI 7003, Annex B, Table B-1.

NSTISSI 7003, Annex B, Paragraph 4.b(2).

NSTISSAM 2-95, Para 4.5.

FOR OFFICIAL USE ONLY

3.4.4 Hardened Carrier PDS

3.4.4.1 General

A hardened PDS is required for SIPRNET cabling where the PDS transmits an LCA or a

UAA. There are three types of hardened PDSs: hardened carrier, continuously viewed carrier, and alarmed carrier. The following sections discuss these types of PDSs.

3.4.4.2 Hardened Carrier

A hardened carrier is the most common type of PDS. It is so common, the term “hardened

PDS” or just “PDS” is often mistakenly used in lieu of the term “hardened carrier.” The hardened carrier shall be a ferrous metallic conduit or duct. The fittings and connectors shall be made of the same ferrous metal material. All seams and joints of the PDS shall be permanently sealed completely around all surfaces by either welding (continuous or tack) or two part epoxy. High compression fittings (i.e., couplers, box-connectors, etc.) shall be used and sealed with epoxy applied completely around all mating surfaces. The covers of all access points, such as pull boxes (and conduit body covers), shall be sealed likewise (welded or epoxy), unless they are secured with a GSA-approved, changeable combination padlock.

Boxes with pre-punched knockouts are not acceptable and shall not be used in any PDS.

The only changeable combination padlock currently approved by GSA is the Sargent &

Greenleaf model 8077AD.

The hardened carrier most personnel are familiar with is EMT conduit. When using EMT conduit, the fittings, conduit bodies, and connectors shall be made of the same ferrous metal.

The use of cheaper “pot metal” and aluminum-type fittings and conduit bodies are not permitted. Non-metallic fittings shall not be used in any hardened carrier system except when mandated by the USACTTA. A non-conductive break may be required for TEMPEST reasons for some PDSs.

Conduit is defined as a tube, duct, or protected trough used for carrying and routing wires or cabling. Conduit may be round, square, or rectangular. It most commonly is a closed system with only the ends being open for pulling cables through.

Secure raceway is a type of conduit with a removable cover (top-cap), enabling cabling to be laid into the conduit rather than pulled through the conduit. The use of a hardened carrier with a removable top-cap cover allows for the future addition of extra cables and expansion of the PDS (referred to as “future adds, moves, and changes”) with minimal effort. This benefit is offset by the requirement to remove the sealing material from the carrier, which may also damage the carrier and require its replacement at added expense. For raceway with a removable cover, the requirement to seal all joints and edges applies to the entire length of the removable cover, as well as to the edges and joints of the fittings. The extra labor involved in sealing both sides of a removable cover for the length of the entire hardened carrier makes this a more expensive solution than standard conduit, such as EMT.

NSTISSI 7003, Annex B, Paragraph 4.a(1).

E-mail, GSA, Mr. Christopher Pollock, 4 May 2010.

FOR OFFICIAL USE ONLY

The DAA can choose to accept the risk of a carrier that has not been permanently sealed with epoxy or another approved method. The epoxy waiver previously granted by the 7 th

Signal Command has been rescinded. The DAA must sign a risk acceptance for each non-compliant PDS. The risk acceptance must reference the USACTTA site-specific threat assessment.

Note1: Local physical security personnel may, at their discretion, override this risk acceptance and require the use of epoxy to seal the secure raceway. It is always an option to increase the security measures.

The conditions for obtaining a risk acceptance from the DAA for permission not to permanently seal the PDS are as follows:

a. The hardened carrier used shall be a secure raceway with a removable top-cap or raceway cover manufactured from ferrous material.

b. The removable top-cap or raceway cover shall be the only portion of the secure raceway to which the site epoxy waiver applies. Remaining components of the PDS carrier shall have epoxy applied.

c. Technicians certified by Holocom Networks must install secure raceway manufactured by Holocom Networks.

d. Legrand Wiremold Data-Fence secure raceway must be installed IAW the manufacturer’s instructions.

e. Legrand Wiremold Data-Fence, secure channel (4 3/4" x 1 3/4", 2” x 2” or 1” x 1”) raceway components and fittings will have epoxy applied at all mating surfaces.

f. Although hardened carrier typically is used inside a building or facility, it may also be used to carry classified cabling between buildings. This is usually a cost prohibitive solution, especially when the PDS must be run between multiple buildings in a point-to-multipoint configuration, such as from an NEC facility to multiple tenant buildings on a military installation. Hardened carrier installed between buildings may be buried or suspended.

Note 2: All horizontal and work area outlet cable distribution within a building/facility routed in a conduit buried beneath a building/facility foundation or routed in conduit within a building/facility foundation or floor slab must be reviewed by the USACTTA and approved by the DAA. The USACTTA review and DAA approval must take place before the building/facility design is complete or issued for new construction (MCA, MCAR, SOF, etc.) projects, SRM projects, or extending SIPRNET access within existing facilities.

g. If buried, the hardened carrier shall be at least 1 Meter (m) below the surface on property owned or leased by the Government. If manholes are used in the carrier distribution system, they shall be secured using a GSA-approved, changeable combination padlock or shall be welded closed. These requirements are for the lower threat

FOR OFFICIAL USE ONLY

environments located in CONUS only. For higher threat environments, the buried, hardened carrier shall also be encased in at least 8 inches of concrete.

h. If the hardened carrier is to be suspended between buildings, it shall be a minimum of 5 m above the surface grade level, and the area the PDS traverses over shall be owned or leased by the Government. In addition, the area containing the PDS shall be illuminated to help deter tampering.

3.4.4.3 Continuously Viewed Carrier

A continuously viewed carrier is a PDS carrier that is under direct, continuous observation

24 hours per day. There must be operational procedures in place to ensure all attempts to disturb the PDS are investigated by security personnel within 15 minutes.

There is no restriction on the type of carrier, so it may be made of any material and does not need to be sealed, as it is a guarded system. The security afforded the classified cabling stems from the quick response by security personnel to any attempt to compromise the carrier.

3.4.4.4 Alarmed Carrier

An alarmed carrier is a carrier protected by an alarm system that is approved by the cognizant COMSEC and/or physical security authorities.

The use of an alarmed carrier as a hardened PDS, therefore, must be closely coordinated with these authorities from the design phase through the installation and certification phases.

Consider the following areas when designing an alarmed carrier PDS:

● Physical topology of the alarm loop circuit from the Alarm Processing Unit…