Attachment 14 - LAN SOP.pdf

Special Communications Mission Solutions Division

NAWCAD-WOLF

Research, Development, Test and Evaluation Network

Standard Operating Procedures

12 February 2020

Version 12.1

SCMS RDT&E Network SOP SCMS-LAN-SOP-12FEB2020

P a g e 1 | 13

Change History

Date Version Remarks

12 Feb 2020 12.1 Updated document and added change history table

P a g e 2 | 13

Table of Contents.

Approval Sheet

1. INTRODUCTION

1.1 References

2. NETWORK

2.1 SCMS LAN Team

2.2 Government LAN Team Lead

2.3 Requesting Technical Support - LAN Trouble Reports

2.4 Printers

2.5 LAN Team Hours of Operation

2.6 Navy Marine Corps Intranet (NMCI) Equipment

3. STANDARD ARCHITECTURE (HARDWARE/SOFTWARE)

Table 1. Workstation Minimum Requirements

3.1 Portables

3.2 Smart-phones

4. LICENSING

4.1 Workstations

4.2 Shareware/Freeware

5. NEW WORKSTATIONS

6. NEW HARDWARE PERIPHERALS AND SOFTWARE

6.1 Trade Agreement Act (TAA)

7. PROPERTY TAGGING

8. NETWORK ACCOUNTS

8.1 New User Accounts

8.2 Inactive Accounts

8.3 Removal of Accounts

8.4 Change in Employer Status

9. NAMING CONVENTIONS

9.1 User Accounts

9.2 Workstations

9.3 E-Mail Addresses

9.4 Network and Phone Jacks

9.5 Printers

10. COMMON ACCESS CARD (CAC) LOGON

10.1 Logon

10.2 Logoff

11. INTERNET ACCESS, USAGE AND MONITORING

12. BACKUPS

12.1 Network

12.2 Workstations

12.3 Previous Versions

13. NETWORK DRIVES

13.1 Inappropriate Files

13.2 Restricting Directories

14. E-MAIL

14.1 Personal Folders (PST)

15. REMOTE ACCESS (WEBMAIL AND VPN)

16. COMPUTER MOVES AND EXCESS EQUIPMENT

17. NETWORK DIAGRAM

18. SECURITY

18.1 Accreditation

18.2 Reporting Suspected Violations

18.3 Network Ports/Connection Approval

P a g e 3 | 13

Approval Sheet

Approved By:

Kory Bennett Date Information Systems Security Officer (ISSO), SCMS

Kory.Bennett Inserted Text

Kory.Bennett Typewritten Text

11FEB2020

P a g e 4 | 13

1. INTRODUCTION

All personnel who have been granted user accounts on the Special Communications Mission Solutions (SCMS) Division Research Development Test and Evaluation (RDT&E) Network must conform to Standard Operating Procedures (SOP). This helps to ensure that hardware/software is compatible, which allows for efficient troubleshooting and proper use of assets.

This SOP pertains to Government Funded Equipment (GFE) and Contractor Funded Equipment (CFE) connected to the SCMS RDT&E Network only. Computers not in SCMS buildings and not connected to the RDT&E Network are not be supported by the SCMS LAN Team and are not governed by this SOP.

This SOP is a dynamic document in which input from the customer is solicited to ensure that efficient, secure network operation is provided to SCMS customers. For brevity, the SCMS RDT&E Network will be referred to as ‘the network’ from this point forward in this document.

1.1 References

19 USC 2501-2581 - Trade Agreements Act (TAA) FAR 25.4 - Federal Acquisitions Requirements-Trade Agreements FAR 52.225-5 - Trade Agreements FAR 25.001(c)(2) - Substantial Transformation SAAR-N, OPNAV 5239/14 (Rev X)

2. NETWORK

2.1 SCMS LAN Team

The SCMS LAN Team is available to provide technical support to personnel using the network. The LAN Team is located in Building 8185, Rooms 321. The primary phone number is 301-995-8818.

A variety of management tools are in use to ensure network assets are in compliance with DoD and site security requirements and regulations, as well as network administration, security and auditing purposes. Network security includes monitoring workstation hardware and software inventory, file sharing, file permissions, file ownership, system auditing, event log management, and asset utilization by SCMS customers.

2.2 Government LAN Team Lead

The government employee in charge over the SCMS LAN is:

Kory Bennett Information System Security Officer (ISSO) Building 8185, Room 127 E-Mail: kory.bennett@scms.navy.mil Phone: 301-995-8027

P a g e 5 | 13

2.3 Requesting Technical Support - LAN Trouble Reports

SCMS customers requiring technical support from the LAN team can submit a Trouble Report (TR) using the form on the SCMS Intranet (https://atlas.scms.navy.mil/). From the main Atlas homepage (link provided above), click the LAN Trouble Report button.

Support requests include, but are not limited to, requests for setting-up new workstations, installing software/hardware, printer troubleshooting/toner, connectivity, file directory permissions, new customer account requests and email/distribution group updates.

Upon submitting a new TR, the system assigns a tracking number and sends e-mail notification to the LAN Team. Use this tracking number when referencing the TR.

A history of all Trouble Reports submitted is maintained on the Intranet. This allows the customer to view the status of their TR by simply clicking on the TR number.

Do not submit a new TR to inquire about the status of a previous TR.

The customer may e-mail the member of the LAN Team that their TR has been assigned to for status inquiries. If the LAN Team member assigned to the TR must access the customer’s desktop remotely while the customer is logged into the network the customer will be notified before the action occurs.

LAN Trouble Reports will remain “active” while the issue is being worked by the LAN Team. A LAN Team member may “defer” the TR if they are waiting on a form(s), information, or equipment/material that is needed to complete the TR. Deferred TRs will be updated on a weekly basis to provide customers with status updates. If the LAN Team member is waiting on a form(s) and/or information from the customer they will make every attempt to contact the customer. If the customer does not provide the form(s) and/or information within 30 days of the ticket initiation date, then the LAN Team member will close the ticket. The customer can then submit a new TR once they have obtained the needed form(s) and/or information.

2.4 Printers

All printers must be connected to the network for management by the LAN Team. Locally attached printers must be approved by the ISSO.

Requests for service or toner must be made by submitting a TR.

The LAN Team maintains a list of standard printers that are TAA compliant and authorized for use on the network. If a project/program is considering purchasing a printer to be connected in their project lab, they must first contact the LAN Team for approval to ensure the printer is an acceptable make and model. Failure to do so may result in the printer not being connected to the network. If a printer purchased by a project/program is not an acceptable make or model, it may still be approved for use on the network, however the LAN Team cannot support toner or service requests.

2.5 LAN Team Hours of Operation

The LAN Team is available for support during the following core business hours:

Monday-Friday 7:30 AM to 5:00 PM (Eastern Time Zone)

P a g e 6 | 13

2.6 Navy Marine Corps Intranet (NMCI) Equipment

The LAN Team responsibility for NMCI equipment is limited to the installation of KVM switches to connect NMCI computers and providing toner for NMCI printers. Reminder:

SCMS LAN Team system administrators do not have administrative rights to the NMCI network or NMCI devices. For all other issues concerning NMCI equipment contact the NMCI Call Center at (866) 843-6624.

3. STANDARD ARCHITECTURE (HARDWARE/SOFTWARE)

In order to maintain compatibility using SCMS’s available resources, a standard architecture has been established and is summarized in Table 1 below. The standard hardware architecture noted is the minimum requirements, and must be used when ordering new computers. Additional hardware/software can be ordered as needed, but must be Windows 10 Enterprise Edition 64-bit compatible and must conform to the specifications outlined in this document. Internet support from the manufacturer of the hardware and software must be available.

Table 1. Workstation Minimum Requirements

Hardware Minimum Requirements Software Minimum Requirements

Processor: 64-bit processor (Must be a minimum of Intel Core i7)

Hardware-assisted virtualization capable (i.e. Intel VT or AMD-V)

Hardware-enforced Data Execution Prevention (DEP) must be available and enabled

RAM: Must be a minimum of 16 GB Hard drive: 1 TB 7200 RPM SATA

(M.2 or any Solid State Drive (SSD) not allowed at this time.)

Video Card: GPU minimum of 4 GB of RAM. Must support one of the following formats: HDMI, Display Port (DP), dual monitor capability must be supported

Optical Drive: DVD-RW drive Monitor: Capable of 1920 x 1080 or higher resolution 100/1000 Integrated Network Card USB Keyboard USB mouse CAC Reader – can be integrated into the keyboard or an external USB reader

Windows 10 Enterprise Edition 64-bit

Microsoft Office Professional Plus 2016 (32-bit only)

P a g e 7 | 13

3.1 Portables

Portables are to be used for remote/web access only. The use of laptops and docking stations on the network is prohibited.

3.2 Smart-phones

The SCMS LAN does not support smart-phones or tablets.

4. LICENSING

4.1 Workstations

The SCMS LAN Team is responsible for providing and maintaining the software and licenses for SCMS Government workstations connecting to the network. The SCMS LAN Team does not supply specialized software.

The SCMS LAN Team is not responsible for maintaining the software or licenses for contractor or project assets. All contractor licensing will be provided by the contractor to be installed by the SCMS LAN Team system administrators only.

It is the responsibility of the customer to provide legally licensed copies of any other software that is to be installed on their workstations. This includes supplying the media and any required license key/serial numbers for the software. In the case of a site license, the customer must have a copy of the site license, as well as, the number assigned from the site license allotment. For any software that has reached end of life, the contractor must provide the LAN team with a current version within 7 (seven) business days of being notified.

Failure to provide the LAN team with the required software and keys may result in removal of the end of life product from the workstation, or temporary removal of the workstation from the network.

Before the software can be allowed on the network, the ISSO must approve it for installation. Some common examples of software that are the responsibility of the customer to license are:

Operating System Microsoft Office Professional Plus (32bit only) Microsoft Project Microsoft Visio Adobe Acrobat Pro/DC Adobe PhotoShop AutoCAD

4.2 Shareware/Freeware

The ISSO must approve any shareware/freeware for use on workstations residing on the network. The ISSO maintains a current list of approved shareware/freeware.

5. NEW WORKSTATIONS

Orders for new workstations (GFE/CFE) connecting to the network must conform to the above standards for hardware and software. Approval for the procurement of GFE and CFE workstations must be obtained from the ISSO prior to ordering.

P a g e 8 | 13

Please ensure that all new workstation requests have been checked against the Standard Hardware and Software Architecture listed in Section 3 prior to requesting approval. When the new workstation arrives please submit a TR for initial system set-up and installation on the network.

6. NEW HARDWARE PERIPHERALS AND SOFTWARE

New hardware peripherals and software to be installed on a workstation connecting to the network must compatable with the Standard Hardware and Software Architecture listed in Section 3 and receive approval from the ISSO prior to ordering. Please submit a TR when new peripherals arrive for installation by the LAN Team. A network administrator will install hardware and software, ensuring proper licensing has been obtained and compatibility with the network. All additional hardware and software considered essential to project operations will need to be submitted to the LAN Team for testing and evaluation.

Once tested and approved it will be installed.

No personal software or hardware will be installed on any workstation connected to the network.

6.1 Trade Agreement Act (TAA)

The Trade Agreements Act is applicable to all Schedules. “In exercising its authority under FAR Part 25, Foreign Acquisition, purchases by Ordering Activities are restricted to either U.S.-made or designated country end products. A U.S.-made product can be either:

1) an article that is mined, produced, or manufactured in the United States,

2) an article that is substantially transformed in the United States into a new and different article of commerce with a name, character, or use distinct from that of the article or articles from which it was transformed. (FAR 52.225-5)

3) When an item consists of components from various countries and the components are assembled in a designated country, the test to determine country of origin is substantial transformation.” (FAR 25.001(c)(2)).

7. PROPERTY TAGGING

All workstations and peripherals are given an SCMS inventory sticker with barcode and/or a Naval Air Warfare Center Aircraft Division (NAWCAD) project tag.

All equipment shall be marked with the appropriate level classification sticker, either Unclassified or Secret.

8. NETWORK ACCOUNTS

A user account is required in order to gain access to resources on the network, including file shares, printers and the Intranet. All requests to add a new user account or to remove an existing user account must be made via a SCMS LAN TR. This request can only be made by SCMS government personnel.

8.1 New User Accounts

A customer must have a SAAR-N (SAAR-N OPNAV 5239/14) form signed by the SCMS ISSO and on file at NAVAIR before an SCMS account can be requested. In addition, the

P a g e 9 | 13 customer must have a current certificate showing they have completed the DoD Cyber Awareness Training. Requests for new user accounts should include the following information for the new customer:

First name, last name, and middle initial Government code or Company name Start date Building and Location (onsite/offsite) - if onsite please provide room number Phone number Privileges required (access to restricted project shares, email distribution groups) Common Access Card (CAC), Personal Identification Verification (PIV) card, or

Electronic Certificate Authority (ECA) ID number.

8.2 Inactive Accounts

User accounts that have not been logged on to within 30 days will be disabled. SCMS customers must contact the LAN Team in order to have their account re-enabled. In order to have your account enabled, customers must have a current SAAR-N (SAAR-N OPNAV 5239/14) and current Cyber Awareness Training completion certificate on file.

8.3 Removal of Accounts

Government Project Leads and Contractor Leads will submit a TR to notify the LAN Team when their personnel are leaving. The LAN Team will disable the departing customer’s account on their last day of employment. The Leads may also designate that the departing customer’s files and email be transferred to a designated person. The account will remain disabled for 30 days before it is permanently deleted.

The LAN Team is required to closely monitor account activity and ensure that inactive accounts are removed in a timely manner.

User accounts that have been inactive for 60 days are permanently deleted by the LAN Team.

8.4 Change in Employer Status

If personnel are switching positions from contractor-to-contractor, contractor-to-government, or government-to-contractor, all prior accounts, network access, or resource access will be revoked and new accounts will be created. Email accounts shall not be reused in these instances. New, sequentially numbered, email addresses will be issued for each new account.

Note: In the event that there are two customers with the same name, the middle initial will be used to differentiate.

9. NAMING CONVENTIONS

9.1 User Accounts

SCMS will utilize the following naming convention for user accounts.

firstname.lastname

P a g e 10 | 13

9.2 Workstations

The network workstations are named based on their location using the following standard naming convention.

(Building number)_(room number)_(alphanumeric designator)_(government/contractor designator)

A customer must submit a LAN TR to move/relocate a computer for any reason. This will allow the LAN Team to properly change the computer name to reflect the new location.

The LAN Team is responsible for physically relocating the computer equipment (ONLY) and is responsible for ensuring the device can connect to the network.

9.3 E-Mail Addresses

Only customers who will work onsite in a Division building will be provided a SCMS e-mail address.

Customers who work offsite will not be provided a SCMS e-mail address.

Customers who require access to DOD sites please work with your company to obtain a PIV or ECA certificates. Below links are provided for reference.

DOD ECA Vendors https://iase.disa.mil/pki/eca/Pages/index.aspx

ORC ECA

https://eca.orc.com/

SCMS will utilize the firstname.lastname naming convention for the government customers followed by @scms.navy.mil. For example firstname.lastname@scms.navy.mil.

SCMS will utilize the firstname.lastname.ctr naming convention for contractors followed by @scms.navy.mil. For example firstname.lastname.ctr@scms.navy.mil.

Autoforwarding e-mail is prohibited on DoD networks. The SCMS LAN Team will not forward your SCMS e-mail to any other e-mail address.

9.4 Network and Phone Jacks

SCMS will ensure that all phone and network jack connections adhere to the following naming convention: Distant end number, rack number, patch panel number, and port number.

9.5 Printers

The network printers are named based on location using the following standard naming convention.

(Building number)_(room number)_(printer model)

P a g e 11 | 13

10. COMMON ACCESS CARD (CAC) LOGON

10.1 Logon

A DoD CAC is required to logon to SCMS workstations and also remotely to the network using the VPN. Customers shall not allow others to use their CAC to login to the network under any circumstances. Customers shall not leave their CAC in a workstation unattended.

10.2 Logoff

Users are required to logoff and remove their CAC at the end of each workday.

11. INTERNET ACCESS, USAGE AND MONITORING

Use of any computer or resource on the SCMS RDT&E network is govern by the SAAR-N (OPNAV 5239/14) and the acceptable use policy (DOD 5500.7R) provided by the DOD.

Personnel will be held accountable to adhere to all policies regarding network and internet usage provided by SCMS RDT&E.

Gambling or accessing/storing pornographic material on the network is strictly prohibited.

12. BACKUPS

12.1 Network

All network servers, applications and files are backed up on a daily basis. This will ensure that applications and files on all SCMS servers can be fully restored in case of hardware failure. Your work related data should be stored on a shared drive, such as your personal G:

drive or the X: drive. The files saved to these drives are automatically backed up on a regular basis.

12.2 Workstations

The customer is responsible for regularly backing-up files on their workstation to CDs or DVDs. The LAN Team will not attempt to recover non-work related data stored on your workstation.

12.3 Previous Versions

The LAN Team has implemented a feature that creates snapshots of the network drives at different times during the day. You can use this feature to recover files that may have been deleted. To do so, right click a network folder then select Properties. Click the Previous Versions tab to display a list of available folders with their timestamp. Click the View button to view the contents of the selected folder.

13. NETWORK DRIVES

Customers can store their work related documents on the network drives. These network drives are backed-up nightly by the LAN Team. Each customer has a G: drive as their personal home directory. No other customer has access to your G: drive. The X: (Projects) and the K: (Common) drives allow project teams to create folders for sharing their project-related documents.

P a g e 12 | 13

13.1 Inappropriate Files

The network drives are not to be used to store personal files or any other non-work related documents including Personally Identifiable Information (PII). The LAN Team performs regular scans of the network drives for inappropriate files and will remove them as discovered. If you wish to keep these types of files you should store them on the C: drive of your workstation. Examples of inappropriate files and documents include:

Music files (MP3, WMA, WAV) Video Files (WMV, AVI, MOV) Personal pictures Contractor - proposals, personnel reports, assessments, resumes Non-work related emails stored in PST files Personal files – taxes, bank statements

13.2 Restricting Directories

Sub-directories on the X: (Projects) drive may be restricted so that they are only accessible by project team members. A TR must be submitted by the project’s government representative to create a restricted directory or grant access to an existing restricted directory. The TR must include a list of personnel with the degree of accessibility (i.e., read, modify, view etc.). Customers will not be provided with “Full Control” permissions to any network drive. Directory permissions will be set only by the LAN Team.

14. E-MAIL

Microsoft Exchange is the e-mail system for SCMS. Microsoft Outlook is the client software utilized to access e-mail. All changes to the Global Address List must be requested by a government representative via a TR.

E-mail is for government business only. Global messages to all building personnel should be used on a limited basis. The allocation of mail storage for each customer is limited to 400 MB. Once 350 MB are used, the customer will receive a warning email. After the 400 MB limit has been reached the customer will no longer be able to send or receive emails.

Network users may access their SCMS e-mail via the SCMS webmail site at https://mail.scms.navy.mil.

14.1 Personal Folders (PST)

Email containing work related data can be archived to Personal Folder (.PST) files on the customer’s home directory (G: drive). These PST files are to be limited to a size of 500MB or less. PST files stored on network drives should not be password protected. If a customer chooses to password protect a PST file stored on a network drive, the LAN Team will not be responsible for recovering its password or data.

Emails containing non-work related data are not to be archived to .PST files on the network drives. If you wish to archive non-worked related data, it must be stored in a separate PST file on the customer’s local C: drive in a folder labeled "Mail". These PST files will not be included in the network backup schedule, and it is the customer’s responsibility to back up this data onto removable media, such as CDs. Loss of personal data is not the responsibility of SCMS, and the LAN Team will not attempt to recover such data from non-network resources.

P a g e 13 | 13

15. REMOTE ACCESS (WEBMAIL AND VPN)

Again, network customers may access their email via the SCMS webmail site at https://mail.scms.navy.mil.

VPN access is available to customers using the SCMS Network Access Page at https://scrnap.scms.navy.mil.

Please note a CAC is required to access both Webmail and the VPN.

In addition, antivirus software and the DOD Root Certificates must be installed on the computer that is connecting to the VPN. The virus definition must be updated and a full scan of the computer must have been completed within the last seven days. If the computer does not meet these criteria, it will not be allowed to connect to the VPN.

16. COMPUTER MOVES AND EXCESS EQUIPMENT

A customer must submit a LAN Team TR to move/relocate a computer for any reason. The LAN Team requires a minimum 72 hours notice for workstation moves.

Contractor-owned computers that are no longer required at SCMS should be returned to the contractor’s office after the computer has been wiped by the SCMS LAN Team.

Government hard drives no longer required will also be wiped by the SCMS LAN Team, then turned over to DRMO. Any other unneeded Government equipment should be sent directly to DRMO by the customer.

17. NETWORK DIAGRAM

Various diagrams of the network are located in Bldg. 8185 Room 321.

18. SECURITY

Network security requirements are covered in SCMS’s Risk Management Framework (RMF) Authorization to Operate (ATO) package.

18.1 Accreditation

The SCMS LAN currently has the authority to operate until August 31, 2021.

18.2 Reporting Suspected Violations

Report suspected network security or misuse to the SCMS ISSO.

ISSO Kory Bennett ext. 5-8027

18.3 Network Ports/Connection Approval

All workstations connecting to the SCMS LAN must go through a connection approval process with NAVAIR 5.4. Under no other circumstance should a customer connect, disconnect or reconnect a workstation from the network.

Any security violations shall be reported.