10 - Enclave AISS Industry Day.pdf

Headquarters Air Mobility Command

Unrivaled Global Reach for America…ALWAYS!

CCX

Version

4-01-05

AMC MAF C2 ENCLAVES

AMC/A6CI

2 Unrivaled Global Reach for America…ALWAYS!

AMC MAF C2 Enclaves Production

MAF C2 Enclaves provide Distributed Infrastructure for

AMC’s C2 Systems

• GDSS

• MEIS

• ACFP

• COINS

• CAMPS (Future)

AISS’s role is critical to the MAF C2 Enclaves as they provide the following support functions:

• Level 3 O&M, CM, Engineering, Modernization, Fielding, Testing, Integration, etc – See the PWS

3 Unrivaled Global Reach for America…ALWAYS!

Secure Mobility Air Force (MAF) C2/ITV Data

Assured Service Availability

Secure Physical Network

Proactive C2/ITV Systems Management

Enables Distributed Operations

Implement USTRANSCOM and AMC Operational Requirements

AMC MAF C2 Enclaves

4 Unrivaled Global Reach for America…ALWAYS!

External Enclave Boundary

External Enclave Boundary

• Enclave Firewalls, protects the enclaves from unauthorized connections

• Centrally managed from

Scott AFB

• Enclave VPN, provides secure communication between all enclaves

• Enclave IDS, currently managed by the AF

• Preparing to field

USTRANSCOM IDS solution

5 Unrivaled Global Reach for America…ALWAYS!

Enclave DMZ

Wide Area Load Balancing

Enclave DMZ

• F5 Global Traffic Manager directs users to the closest or best-performing enclave

• Key contributor to assured service

• SMTP Relay facilitates data exchanges using Mail protocol

• Supports existing legacy data exchanges

6 Unrivaled Global Reach for America…ALWAYS!

Local Load Balancing & XML

Gateways

Local Load Balancing &

XML Gateways

• F5 Local Traffic Manager provides a virtualized pool of server resources

• Supports CAC authentication

• Performs SSL offloading

• XML Secure Gateway supports AMC’s Enterprise

Services

• Content inspection/validation for message payloads

• Protection from Denial of

Service Attacks and Access

Control

7 Unrivaled Global Reach for America…ALWAYS!

Management Services

Management Service Network

• Enterprise Management of

Internal Enclave and Network

Assets (ESM)

• Uses AF Standard NetIQ to perform systems management and monitoring, aligning operations with mission and performance priorities

• On-Line Certificate Status Protocol

(OCSP) Proxy Gateway for CAC validation with failover to local

Certificate Revocation List (CRL) cache during network outages

• Private Active Directory to manage users and computers associated with

MAF enclave systems, services and applications

8 Unrivaled Global Reach for America…ALWAYS!

Security Management

Security Management Network

• Security Management of Internal

Enclave and Network Assets

• Collection servers, uses SPLUNK product, for audits of all local servers and network devices

• Deploys DoD HBSS ePO servers at

Scott and McConnell enclaves, with agents for distribution of AV software and policy updates at other locations

• Support additional tools, ISS Scanner, to assess and monitor devices on a network for vulnerabilities

9 Unrivaled Global Reach for America…ALWAYS!

Data Storage

Data Storage

• Storage system, EMC NS-480, with advanced failover and fully automated storage tiering to multiprotocol environments

• Connectable to multiple storage networks via network-attached storage (NAS), iSCSI, Fiber Channel storage area network (SAN), and

EMC Celerra Multi-Path File System

(MPFS)

• Deployed with Solid State Cache

Disks used for DB Acceleration

(Mission Critical)

10 Unrivaled Global Reach for America…ALWAYS!

Data Backup & Archive

Data Backup and Archive

• High performance backup solution to meet short backup/recovery windows for 365/24 service level agreement

• Tools for maintaining copies of critical data for regulatory compliance (e.g. DIACAP)

• Recovery and Restore capabilities

• Ability to rebuild location after extended outages or disaster recovery

• Ability to produces recovery tapes and drives for other location in the event of critical failure or outage

11 Unrivaled Global Reach for America…ALWAYS!

AMC Cross Domain

AMC Cross Domain

• TGS Guard

• Current solution

• Uses existing db replication capabilities to move transactions from NIPRNET to SIPRNET

• Transaction files filtered for potential malicious code through a number of venues (tools)

• ISSE Guard

• Future Guard solution

• Performs current capability, plus

Web services

12 Unrivaled Global Reach for America…ALWAYS!

AMC MAF C2 Support Enclaves Government Testing

MAF C2 Support Enclaves (C2SE) provide Testing

Infrastructure for AMC C2 Systems

• GDSS

• MEIS

• ACFP

• COINS

• CAMPS

AISS’s role is critical to the MAF C2 Enclaves as they provide the following support functions:

• Level 1, Level 2, & Level 3 O&M, CM, Engineering, Modernization, Fielding, Testing, Integration, etc – See the PWS

13 Unrivaled Global Reach for America…ALWAYS!

AMC MAF C2 Support Enclaves Government Testing

Scott Enclave

NG

Enclave

CSC

Enclave