Draft Existing FOH_IT Systems_Architecture and Configuration.pdf

Existing FOH IT Systems, Architecture, and Configuration Draft

C.2.2 Existing FOH IT Systems, Architecture, and Configuration

The Contractor shall manage operations, maintenance, and the continuous enhancement of all FOH IT systems and services, as well as support any third-party replacement or modernization to achieve the target end state of the FOH IT environment as directed by the Government. The existing FOH IT Systems, Architecture, and Configuration is described below.

C.2.2.1 Network and Network Services

• FOH is running a blend of Windows Server and Red Hat Enterprise Linux (RHEL) servers. Legacy software is running on Windows servers primarily; however, FOH has shifted its architecture to run mostly on the RHEL platform.

• High-availability/High-traffic application systems make use of web forms and content switches, as well as cluster-based zero-trust architectures.

• Some Local Area Networks (LANs) may make use of secure wireless solutions. To date, these have been implemented with Cisco equipment.

• Virtual Private Network (VPN) is provided via GlobalProtect client version 6.2.0-89 for (Health and Human Services/Information Technology Steering Committees/Office of the Chief Information Officer (HHS/ITSC OCIO).

• Authentication services for systems accessed from remote sites are managed by the Health and Human Services Access Management Services (HHS AMS) service utilized for FedHealth and STM. FOH is in the process of identifying a multi factor authentication (MFA )solution for remote desktop access RDP access for MERITS . AMS is an Identity Assurance Level Three (IAL3) Authenticator Assurance Level Three (AAL3 ) identity provider that is a separate page with a consistent interface that controls access to both FedHealth and FOH Service Tracking and Management System (FSTM). AMS is provided by an internal vendor supported by contractors.

Users are redirected to AMS in order to authenticate via IAL3/AAL3 credentials and are not allowed to proceed to the target application if any lower-level credential sets are presented.

Personal Identification Verification (PIV) provides level 3 credentials.

C.2.2.2 Network and System Administration

• FOH systems are hosted as Infrastructure as a Service (IaaS) in the HHS Cloud-Managed

Application Hosting Center (C-MAHC) operated by OCIO. Relational Database Services (RDS) is in the works and S3 is active but being used in an IaaS fashion until logging is stood up. The system shall then be hybrid IaaS/PaaS (Platform as a service).

• All FOH systems are on virtual machines with production and staging environments on HHS hosted Amazon Web Services (AWS) instances. The production and support environments (staging, quality assurance (QA)) are Amazon AWS EC2 (Elastic Compute) instances that are managed by an outside cloud vendor. All systems are either Microsoft Windows Server or RedHat Enterprise Linux. Each instance is set up with internal and external configurations to control access depending on use case. When RDS is stood up, it will act as a serverless solution.

• Development environments are also hosted on HHS managed AWS hosts. There is no fail-over environment.

• Backups are performed by HHS via a ComVault solution in the C-MAHC.

• Corporate Anti-Virus protection, a Zenoss solution, is supported by HHS in the

C-MAHC.

• Patch management and configuration compliance is the shared responsibility of FOH IT and HHS. FOH IT provides for the Application layer up, while HHS OCIO manages everything below the Application layer, including the OS layer.

• All FOH assets reside on the HHS general support network managed by OCIO. FOH asset security is the shared responsibility of OCIO and FOH IT. Tenable Security Center (OCIO- managed) is used to analyze security vulnerabilities in both instances. This system identifies known and zero-day vulnerabilities, plus provides security risk assessments, enabling security best practices, policy enforcement, and regulatory audits.

C.2.2.3 Cybersecurity

• FOH receives Information Systems Security Officer (ISSO) and Information Systems Security Manager (ISSM) services through an Interagency Agreement with OCIO’s Enterprise Security Services line of business for FOH systems which are all categorized as Moderate systems.

• ISSO services are carried out in accordance with the HHS ISSO Designation Memo which includes Authority to Operate (ATO) support, system security documentation maintenance/review, risk management, incident management, account/access control management, security consulting, systems Plan of Actions and Milestones (POA&M) management, (Enterprise Performance Life Cycle) EPLC/ Software Development Lifecycle (SDLC) security support, and continuous monitoring.

• The Contractor’s cybersecurity responsibilities are focused on the applications because the Federal Acquisition Service Cloud Services (FCS) applications are hosted as PaaS in OCIO’s Cloud.

C.2.2.4 Application Hosting

• Web hosting is performed using Internet Information Services (IIS) on Windows 2019, and Apache on RHEL7 Application hosting is shared (multiple applications on the same machine), dedicated (one web/application server per system), or as load balanced web servers. Multi-server balanced configurations use a Cisco content switch, and/or Microsoft Windows content management solutions.

• Data services are provided via Microsoft SQL Server and MariaDB. FOH also makes extensive use of Microsoft SQL Server Reporting Services.

• Advanced data system configurations make use of replication and/or log shipping to help balance system performance and provide for redundant systems.

C.2.2.5 Application Development

• Some corporate applications are developed as ASP.Net applications. Systems are developed as secure n-Tiered web applications using the ASP.Net 4.0 framework and C# Code. The remainder are using Linux Apache MariaDB C JS HTML.

• The application MERITS was developed in Visual Basic 6.

• The FOH intranet (Staff Portal) is running on Microsoft Office SharePoint Online.

• Microsoft Access is used as a “desktop” database in limited cases to develop and integrate with corporate data systems and ETL is handled in a bespoke fashion including cygwin command line tools like AWK, SED, and PERL.

• All Service Tracking and Management System (STM) development is done in Visual Studio. We use VS2005, 2008, and 2013 depending on the server.

• The code repository for STM is in Microsoft Team Foundation Server 2012. We will be redeploying the source code repository as time permits and shall migrate to OCIO Global Information Tracker (GIT) when appropriate.

Datatables.net is a commercial component used in the FOH billing application STM. It is used as the mechanism for replacing the Infragistics ASP.Net library.

C.2.2.6 Office and Health Center Desktops/Laptops

• Desktop hardware is provided and supported by HHS / OCIO.

• There are a number of business applications that utilize non-OCIO Personal Computers (PCs).

• FOH uses the following standard applications on client PCs:

o Windows 11 Enterprise o Microsoft Office 365 Enterprise 16.16731.20810 o Adobe Acrobat Reader 2024.003.20180 o Adobe Acrobat Pro 2024.002.20857 o Microsoft Edge Version 129.0.2792.89 (Official build) (64-bit) o Google Chrome Version 129.0.6668.101 (Official Build) (64-bit) o CrowdStrike Windows Sensor 6.28 7.16.18613.0 o PKWARE SecureZIP 14.50.0010Java Runtime Environment -14.50.0030 o Adobe Flash Player o Cyberlink DVD (if PC equipped with DVD drive) o Laptop images use Endpoint Security to encrypt the entire drive (an HHS requirement).

• FOH uses the following specialized applications. These applications are provided on an as needed/approved basis, based on written approval from the FOH IT Director:

o Microsoft Project 16.0.16731.20810 o Microsoft® Visio® Plan 2 MSO (Version 2308 Build 16.0.16731.20796) 32-bit

• FOH will provide the systems and tools as Government Furnished Equipment (GFE). Any new tools requested by the Contractor must be approved by the FOH IT Director prior to use.

C.2.2.7 FCS - STM

• Users access the system using a Microsoft Internet Explorer browser, using a Transport Layer Security (TLS)/Secure Socket Layer (SSL) connection. The use of TLS/SSL helps ensure that data transmitted between the browser and the web server is not susceptible to interception. Prior to application access, users are redirected to the appropriate AMS server for MFA authentication.

• The browsers running the web application connect to the scalable web server operating with Internet Information Services, and in-turn to the database servers.

• Microsoft SQL Server provides the database technology for the applications. The SQL Servers are scalable. Currently, there is a core database server, Data Mart server for reporting, and a reporting server, one of which is dedicated for queued reports. Each server may be scaled with additional processors, memory and/or storage devices as needed.

• The web servers are hosted on a Secure Subnet in the C-MAHC; this area of the network is isolated from the Internet by the External Firewall and the OCIO network infrastructure.

• The Windows 2019 based IIS web server provides an application hosting platform for the ASP.Net application. Note: The system is designed so that if traffic becomes excessive for one web server to support, it will be possible to scale to multiple web servers.

• The Windows Server 2019 based SQL Server platform serves as the database that supports the ASP.Net applications. The system is designed to use multiple database servers; one for the core data system, one for SQL Reporting Services, and one to provide a data mart for queued reports to be developed from. If this component needs to be scaled, more processors, memory and/or storage devices will be added to those platforms.

• The web server is hosted on the Screened Subnet – this is an area of the network that is logically isolated from the rest of the FOH application servers and the Health and Human Services Wide Area Network (HHS WAN) by a Virtual Local Network (VLAN) with access controlled via ACLs.

• Since the data system contains Personally Identifiable Information (PII), the database servers are placed on the Secure LAN. The Secure LAN is an area that is logically isolated from the HHS LAN/WAN by an internet firewall within the C-MAHC.

• Users that access the STM application do so via a TLS 1.2 connection. The use of TLS/SSL helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

• Users of the Employee Assistance Program Chart Review Record (EAP CRR) application use Secure Remote access directly to the CRR Terminal Server and have access only to Exchange email to manage distribution of the case audit reports. This application is a data repository.

• The FOH CSS application is used by only a few FOH Staff, who access this application via the Cyber Resilience Review /Central Site System (CRR/CSS) Terminal Server. There are no external users of CSS. This application is a data repository.

• Users access the data system via a Microsoft Edge browser.

• There is limited documentation for FCS- STM.

C.2.2.8 FCS - FOH Staff Portal Website (Staff Portal)

• The FOH Staff Portal is currently hosted in the HHS 365 SharePoint Cloud instance.

• Users that access the Staff Portal application do so via any modern web browser using a TLS/SSL connection. Users must be on the HHS network and authenticate via personal identification verification (PIV) card. The use of TLS/SSL helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

C.2.2.9 FCS - FOH Public Website (Public Web)

• The Public Web consists of one (1) primary Linux RHEL7 server using Apache.

• Users access the data system via a Microsoft Edge browser, managed by Assistant Secretary for

Public Affairs (ASPA) with content and formatting support from the IT support team.

C.2.2.10 FCS - Medical Evaluation/Requirements Information Tracking System (FMERITS)

• The operating system for MERITS is Microsoft Windows. Visual Basic 6.0 (SP6) provides an interactive communications interface between users and MERITS.

• The source code for the programs that process MERITS data is developed in Visual Basic and

Transact-SQL (T-SQL).

• Internal HHS users access the MERITS application via the Microsoft Remote Desktop terminal server application with PIV Authentication for Multi-Factor Authentication (MFA).

• External users are currently unable to access applications without PIV credentials. Extra-agency users are currently unable to access MERITS until a suitable replacement for Pulse Secure is stood up. FOH is currently exploring options for a pulse-secure replacement.

• OCIO manages the firewalls and routers that connect the FMERITS system to the Internet. Once the user gains access to the Terminal Server, user can access the MERITS application through a desktop shortcut.

• The desktop application connects to the SQL database and to a file server that are located behind a secure subnet firewall.

• The MERITS sub-components share authentication, and are all accessed by accessing the MERITS application, then using a dashboard to connect to the sub-component that needs to be used.

C.2.2.11 FedHealth

• FedHealth is a web-based system that is accessible by all authorized FOH personnel. FedHealth is built upon the Commercial off the Shelf (COTS) products.

• Users access the system using an internet browser, using an TLS/SSL connection. The use of TLS/SSL helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

• The browsers running the web application connect to the scalable web server farm operating with Apache web services and in-turn to the database servers.

• Maria database in RHEL provides the database technology for the applications. The Maria DB servers are scalable. Currently there is a core database server; a cloned server for reporting; and one is dedicated for queued reports. Each server may be scaled with additional processors, memory and/or storage devices as needed.

• The web servers are hosted on the Secure Subnet; this area of the network is isolated from the Internet by the External Firewall within the C-MAHC.

• The data system contains PII on the database server on the Secure LAN. The Secure LAN is an area that is isolated from the FOH LAN/WAN by an Internal Firewall.

• The RHEL based Apache provides an application hosting platform for the FedHealth WebChart based application. Note: the system is designed so that if traffic gets to be excessive for one web server to support, it will be possible to scale to multiple web servers.

• End users can send and receive large or numerous files that would not be practical via OCIO provided methods and allow for simple retrieval by recipients. Files are sent via Box secure cloud content management.