Attachment B - Enterprise_Cloud Security Architecture Strategy.docx

Department of Veterans Affairs Cloud Security Strategy

Version 1.0 July 27, 2018 - Draft Enterprise Cybersecurity Architecture Office

Protect Veterans and VA data from cloud security threats while enabling VA’s business and technology initiatives to serve our Veterans

Office of Information SECURITY Enterprise Cybersecurity Architecture Office

Cloud Security Strategy | 6

1 Introduction The Department of Veterans Affairs (VA) envisions the VA Enterprise Cloud (VAEC) as a business enabler that will efficiently provide Veterans, their dependents, VA employees and contractors, and VA partners with innovative, Veteran-focused services, applications, and access to information on demand using Veteran-preferred devices and technologies. The VAEC will become the foundation of an agile, interoperable, scalable, and secure cloud computing environment that can adapt to evolving business needs. Using the VAEC as the foundational computing platform, VA will be able to adopt and integrate new technologies that continue to improve services to our Veterans. New technologies include mobile, data sharing platforms, connected devices, data analytics, and software-defined infrastructure.

The VA cloud computing environment and associated technologies provide great benefits to serve our Veterans, at the same time, they introduce new cybersecurity risks to the VA environment that must be proactively addressed. VA must evolve current cybersecurity capabilities to address evolving security threats and adequately secure the VA cloud environment.

2 Purpose The purpose of the VA Enterprise Cloud Security Strategy is to define a strategic plan that enables the use and benefits of cloud services and technologies while protecting Veterans and VA data. The VA Enterprise Cloud Solutions Office (ECSO) has developed and delivered the VA Cloud Strategy (FY18 and FY19). This cloud security strategy addresses the cloud security aspects and concerns of the VA Cloud Strategy (FY18 and FY 19), and both documents combined provide a comprehensive strategy for the secure adoption of cloud and associated technologies. This strategy supports the secure evolution of the VAEC that:

· Includes a multi-cloud environment (AWS, Azure, etc.)

· Integrates Public Clouds, Community Clouds, Private Clouds, and Hybrid Clouds

· Integrates Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS)

· Incorporates shared security responsibilities with the cloud services providers

· Considers the rapid evolution of cloud service offerings and technologies

· Satisfies Federal Risk and Authorization Management Program (FedRAMP) and VA policies and requirements

· Incorporates revised security policies, processes and procedures, including the Assessment and Authorization (A&A) of cloud services

· Incorporates security requirements to adequately secure the VA cloud environment

· Facilitates collaboration and communication among all security stakeholders

· Supports and aligns with VA cloud adoption and initiatives 3 Strategic Context The VA Cloud Security Strategy supports VA’s business and technologies strategies to perform its mission to serve our Veterans. This strategy supports the VA 2018-2024 Strategic Plan, the VA Comprehensive IT Plan, the President’s Plan for IT Modernization 2017, and the VA Cloud Strategy (FY18 and FY 19). On December 9, 2010, the Office of Management and Budget (OMB)released a plan to reform Federal information technology initiatives: 25 Point Implementation Plan to Reform Federal Information Technology Management. In this plan, Point 3 created the “Cloud First” Policy, which requires U.S. Federal Agencies to use cloud-based solutions whenever a secure, reliable, cost-effective, cloud option exists.

All U.S. federal information systems must comply with the Federal Information Security Management Act of 2002 (FISMA). The Federal Risk and Authorization Management Program (FedRAMP) applies FISMA to cloud computing systems. On December 8, 2011, OMB released the Security Authorization of Information Systems in Cloud Computing Environments, also known as the FedRAMP Policy Memo. The FedRAMP Policy Memo requires that all Federal Agencies meet the FedRAMP requirements for all Agency use of cloud services, with the exception of cloud services that are private cloud deployments (i.e., the cloud environment is operated solely for the use of their organization); and the private cloud is implemented on premise (i.e., within a Federal facility); and the Agency is not providing cloud services from the cloud-based information system to any external entities (including bureaus, components, or subordinate organizations within their agencies). This strategy supports the “Cloud First” Policy, and associated FISMA and FedRAMP requirements.

Strategic VA IT Initiatives This strategy supports IT initiatives defined in the VA Comprehensive IT Plan including Infrastructure, Data Center to Cloud Transition, the Trusted Information Sharing (TIS) Platform, Interoperability & Data Standardization, and Analytics initiatives. These initiatives demand a robust and secure cloud computing environment to provide the required infrastructure to support a very distributed and connected environment; the environment to host Veterans and VA data, legacy and modern applications; the platform to enable data sharing and interoperability with other platforms and service providers; and a high-performance computing platform that can analyze data to support and improve VA’s decision-making process.

VA Technologies To support and enable strategic IT initiatives, VA is introducing or planning to introduce new technologies to its environment, including cloud, mobile, application programming interfaces (APIs) and sharing platforms, Internet of Things (IoT), data analytics, and software-defined infrastructure. While these technologies provide great benefits to perform VA’s mission and support our Veterans, they also introduce new risks that must be addressed. To address these risks, while supporting and enabling VA IT initiatives and technologies to serve our Veterans, this strategy has identified twenty-two (22) required capabilities, presented in Section 6.

4 Mission and Vision Mission

Protect Veterans and VA data from cloud security threats while enabling VA’s business and technology initiatives to serve our Veterans

Vision

A safe, secure and resilient VA cloud-based system that enables and supports the modernization of VA’s IT environment. VA’s cloud-based system protects all assets from evolving security threats, automates security functions, provides complete and automated security posture visibility, and continues to support VA’s mission even under an attempt or successful compromise of VA cloud assets

5 Goals To enable Mission and Vision, this strategy has defined the following strategic goals:

· Goal 1: Revise VA security policies, processes and procedures to support the transition to a cloud-based environment

· Goal 2: Protect VA assets in the cloud from evolving cybersecurity threats

· Goal 3: Monitor and provide complete cybersecurity visibility of the VA cloud-based environment

· Goal 4: Expand VA response and recovery capabilities to incorporate the VA cloud-based environment

· Goal 5: Incorporate new technologies and technical solutions to ensure the security and resilience of the VA cloud-based environment

· Goal 6: Incorporate and integrate agile and automated security methods across VA’s system development lifecycle to continually deliver secure cloud applications and capabilities (Secure DevOps)

· Goal 7: Develop and train VA’s OIT cybersecurity workforce to be able to acquire, plan, build, operate and maintain the VA cloud-based environment 6 Cloud Security Functions and Capabilities To define cloud security objectives, this strategy uses the VA Enterprise Security Architecture (ESA) Framework that it is based on the National Security Agency (NSA) Community Gold Standard Framework Version 2.0. The VA ESA Framework includes four overarching cybersecurity functions: Govern, Protect, Detect, and Respond & Recover. Each function defines cybersecurity capabilities and activities to adequately secure VA’s cloud environment. The VA ESA Framework follows and aligns with the the NIST Cybersecurity Framework. Table 1 shows VA Cloud Security Functions, Capabilities, and associated cloud security objectives.

Table 1 – VA Cloud Security Functions, Capabilities and Objectives

GOVERNANCE

Understand Mission – Understand Environment – Policy and Engagement – Portfolio Management – Acquisition – Secure Lifecycle – Training

· Establish VA security policies, processes and procedures that support cloud execution

· Understand threats and risks to Veterans information and VA data in a cloud environment

· Establish VA Risk Management Framework (RMF)/FedRAMP process for cloud-based systems (IaaS, PaaS, SaaS)

· Establish VA acquisition and portfolio management processes for cloud services

· Incorporate cloud security to the VA system lifecycle (VIP, FedRAMP/RMF and DevOps)

· Define and document cloud security roles and responsibilities including VA and CSPs

· Provide cloud security training for VA personnel that acquire, plan, design and implement, operate and maintain cloud environment and cloud-based systems

PROTECT

Physical – Network – HW/SW – Configuration Management – Data – Identity Management – Attribute Management – Credential Management – Logical Access Control

· Verify cloud service providers physical security

· Secure configuration of VA network architecture, network boundary protection, and ports/protocols/services management for the VA cloud environment

· Track VA cloud-based assets, establish VA baseline and manage changes in a cloud environment, manage vulnerabilities of cloud-based assets

· Secure VA data at rest, in-use, and in-transit from/to the cloud

· Manage Identity and Access to cloud services

DETECT

Security Evaluations – Physical Enterprise Monitoring – Intrusion Detection and Prevention – Network Enterprise Monitoring

· Evaluate cloud-based system security (vulnerability scans, Blue/Red Team assessments)

· Verify cloud physical facility access and monitoring

· Perform intrusion detection and prevention in a cloud environment

· Perform enterprise network connection and configuration monitoring in a cloud environment

RESPOND and RECOVER Incident Response – Contingency and Continuity Management

· Expand existing incident response and recovery processes to incorporate cloud-based systems

· Expand existing contingency and continuity management processes to incorporate cloud-based systems

7 Implementation VA will use an incremental approach that continuously evolve the required cloud security functions and capabilities to address risks and support VA business and IT initiatives. The implementation of each capability requires a three-pronged approach that involves people, processes and technologies. For each capability, VA will identify and assess technologies that can improve the security and resilience of the VA cloud environment. Figure 1 shows the notional approach to continually improve and expand VA’s cloud security capabilities, as required.

Figure 1 – Continuous Implementation of VA Cloud Security Capabilities (Notional) 8 Key Challenges The execution of this strategy presents a few challenges that the VA must address. The move to a cloud computing environment is a paradigm shift in the way that VA will provide IT services, and it requires that policies, processes, procedures, people, and technologies support and align with the evolution of its IT environment. The successful execution of this strategy requires full executive support and a robust governance model that enable the synchronized implementation of the required cloud security capabilities. Another key success factor is a workforce trained and skilled in planning, designing, implementing and operating cloud security functions, including new and emerging cloud security technologies to secure Veterans and VA data and establish a resilient cloud environment.

image6.png image1.png image2.png image3.png image4.png image5.png