Attachment_I_-_USGS_CHS_Cloud_Responsibilities_1.pdf
PDF 536 KB Posted
- Attached to
- RFI - Landsat 10 MOC & Ops _ FAQs
- Solicitation number
- DOIGFBO260017
About this file
This is a preliminary presentation document on Cloud Hosting Services (CHS3) cloud security responsibilities for the Landsat 10 mission, a joint USGS and NASA effort.
The document outlines security requirements and responsibilities across three models: the standard cloud shared responsibility model, the CHS shared responsibility model, and the AWS shared responsibility model. Landsat 10 IT systems must comply with Assessment and Authorization (A&A) requirements including the NIST RMF Framework, FedRAMP compliance, FISMA, Risk Identification/Plan of Action and Milestones (POAM), and Continuous Authorization to Operate (ATO) with annual renewal. Systems must implement Zero Trust Architecture (ZTA) and Continuous Diagnostics and Mitigation tools including Hardware Asset Management (HWAM), Security Information and Event Management (SIEM), endpoint protection, and vulnerability management in accordance with mandated timelines. A joint USGS-NASA Agency Security Working Group will oversee implementation. NIST 800-53 Rev5 (or latest) security controls serve as the basis for annual compliance. Landsat 9 is classified as a Moderate Impact System; Landsat Next's security level will be determined through FIPS 199 assessment during phase A.
CHS responsibilities include adhering to FISMA Moderate requirements, ensuring FedRAMP authorization or USGS authorization for approved services, providing networking resources, securing root user access, managing the Enterprise Content Delivery Network-Web Application Firewall (eCDN-WAF), limiting public S3 data access, and enabling core AWS services including GuardDuty, CloudTrail, Config, Control Tower, Direct Connect, IAM Identity Center, Organizations, Systems Manager Explorer, and Route 53. Customer responsibilities encompass data, platforms, applications, identity and access management, operating system configuration, and encryption at multiple levels.
View the file
Other files
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Cloud Hosting Services (CHS3) Cloud Security Responsibilities
The information provided in this presentation is preliminary.
L10 Landsat 10
• Assessment and Authorization (A&A)
- NIST RMF Framework
- Ongoing FedRamp Compliance
- Federal Information Security Modernization Act (FISMA)
- Risk Identification or Plan of Action and Milestones (POAM)
- Continuous Authorization to Operate (ATO) – Annual Renewal
- Evaluation of Controls (Self-Assessment)
• IT systems will leverage modern Security architecture and controls
- I.E. Zero Trust Architecture (ZTA)
• IT systems will require Continuous Diagnostics and Mitigation tools
- Hardware Asset Management (HWAM)
- Security Information and Event Management (SIEM)
- Endpoint Protection
- Vulnerability Management
• In accordance with mandated identification and mitigation timelines
Security Requirements
• Landsat IT Security implementation and review is a joint USGS and NASA endeavor
- A joint Agency Security Working Group will be put in place and will continue to meet through the life of the mission
- All government security standards (e.g., FISMA 2002) and industry practices will be implemented on all IT systems, including MOC systems
- NIST 800-53 Rev5 (or latest) Security Controls will be the basis of annual compliance and adherence to federal security standards
- Security standards for the MOC at GSFC will be a high watermark of USGS and NASA IT Security requirements
• Security Standards for the NASA Exclusive Elements (CSO, FDF, CARA, etc…) comply with there applicable NASA IT Security Requirements
• Landsat 9 Rated as Moderate Impact System for Security Planning and Implementation activities by both Agencies
- Security level not defined for Landsat Next at this time
- A FIPS 199 assessment will be performed as the mission progresses through phase A
Existing Missions IT Security Overview
Cloud Shared Responsibility Model
Cloud Vendor
Responsible for security “of” the cloud
Customer
Responsible for security “in” the cloud
Software
Hardware
Compute Storage Database Networking
RegionsAvailability Zones Edge Locations
Customer Data
Platforms, Applications, Identity & Access Management
Operating System, Network & Firewalls Configuration
Client-side Data Encryption & Data Integrity Authentication
Server-side Encryption (File System and/or Data)
Networking Traffic Protection (Encryption, Integrity, Identity)
CHS Shared Responsibility Model
Cloud Vendor
Responsible for security “of” the cloud
CHS
Responsible for security “of” the CHS environment
Customer
Responsible for security “in” the cloud
Infrastructure Software
Hardware
Compute Storage Database Networking
RegionsAvailability Zones Edge Locations
Organizational Security
Account Provisioning Network Security Data Access
Organizational Network
Direct Connect Transit Network Enterprise WAF Network Logging
Customer Data
Platforms, Applications, Identity & Access Management
Operating System
Client-side Data Encryption & Data
Integrity Authentication
Server-side Encryption (File System and/or Data)
Local System Firewalls Application/System
Logging
Vulnerability Management
• CHS adheres to the Federal Information Security Management Act (FISMA) Moderate and information security requirements in the multi-account environment.
• CHS ensures approved services are FedRAMP authorized or authorized to operate within USGS.
• CHS provides networking resources for all AWS accounts.
• CHS secures every account's root user.
• CHS manages the Enterprise Content Delivery Network - Web Application Firewall (eCDN-WAF) for CHS-hosted applications.
• CHS limits public access to your Amazon S3 data.
• CHS enables and maintains core AWS services to secure and monitor user's AWS accounts. (see following slide)
CHS Responsibilities https://support.chs.usgs.gov/x/twXrAQ https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html https://support.chs.usgs.gov/x/kgNoAg https://support.chs.usgs.gov/x/kgNoAg https://support.chs.usgs.gov/x/kgNoAg https://support.chs.usgs.gov/x/kgNoAg https://support.chs.usgs.gov/x/kgNoAg https://support.chs.usgs.gov/x/kgNoAg https://support.chs.usgs.gov/x/kgNoAg https://support.chs.usgs.gov/x/l4QJAQ
• Authorized IP Addresses
• Core - Amazon GuardDuty
• Core - Amazon Route 53
• Core - Amazon Virtual Private Cloud (VPC)
• Core - AWS Athena
• Core - AWS CloudTrail
• Core - AWS Config
• Core - AWS Control Tower
• Core - AWS Direct Connect
• Core - AWS Health
• Core - AWS IAM Identity Center
• Core - AWS Organizations
• Core - AWS Systems Manager Explorer
• Core - CHS Image Factory
• Core - Enterprise Content Distribution Network-Web Application Firewall
Core Services Managed by CHS
AWS Shared Responsibility Model
Shared Responsibility Model - Amazon Web Services (AWS) https://aws.amazon.com/compliance/shared-responsibility-model/ https://aws.amazon.com/compliance/shared-responsibility-model/ https://aws.amazon.com/compliance/shared-responsibility-model/
| Slide 1: Cloud Hosting Services (CHS3) Cloud Security Responsibilities |
| Slide 2: Security Requirements |
| Slide 3: Existing Missions IT Security Overview |
| Slide 4: Cloud Shared Responsibility Model |
| Slide 5: CHS Shared Responsibility Model |
| Slide 6: CHS Responsibilities |
| Slide 7: Core Services Managed by CHS |
| Slide 8: AWS Shared Responsibility Model |
File details come from the government source that posted it. Updated .