FA8134-27-D-BXXX DD Form 254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

FOR OFFICIAL USE ONLY

PROGRAM PROTECTION PLAN FOR THE

VC-25B PROGRAM

Version 3.0

15 August 2018

Prepared By: AFLCMC/WV

Wright-Patterson AFB, Ohio

Distribution Statement F: Further dissemination only as directed by the VC-25B Program Office (AFLCMC/WV), 2590 Loop Rd West, Bldg 558, Rm 017 Wright-Patterson Air Force Base (AFB), OH 45433-7142 or higher DoD authority.

Destruction Notice: Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

THIS PAGE INTENTIONALLY LEFT BLANK

FOREWORD

VC-25B

PROGRAM PROTECTION PLAN

This Program Protection Plan (PPP) provides program protection guidance for the VC-25B Program effort. This plan provides the Program Manager (PM) and program associated personnel, including Boeing and its subcontractors, a tool to protect the program from inception to demilitarization.

The purpose of this plan is to identify critical elements of the program, classified or unclassified, which require protection to prevent unauthorized disclosure or inadvertent transfer of Critical Program Information (CPI) as defined in Department of Defense Instruction (DoDI) 5200.39, 28 May 2015. This plan incorporates risk management and threat-based countermeasures to provide cost-effective protection of the program throughout the acquisition life cycle and operational life.

This PPP is effective immediately and is designed for use by all program participants, field activities, and matrix support personnel at all Air Force and Boeing locations. This plan is exempt from mandatory disclosure under the Freedom of Information Act.

The Office of Primary Responsibility for this plan is AFLCMC/WV. Additional copies, questions, concerns or recommended changes regarding this plan may be forwarded to:

AFLCMC/WV

ATTN: Program Manager 2590 Loop Road West, Building 558 Wright-Patterson AFB OH 45433-7142

APPROVED BY:

ELLEN M. LORD Date Under Secretary of Defense for Acquisition and Sustainment

THIS PAGE INTENTIONALLY LEFT BLANK

Contents

1.0 Introduction – Purpose and Update Plan

1.1 Technology/System Description

1.2 Program Protection Responsibilities

2.0 Program Protection Summary

2.1 Schedule

2.2 Critical Program Information, Critical Functions and Components Protection

3.0 Critical Program Information and Critical Components

3.1 Identification Methodology

3.2 Inherited CPI/CC

3.3 Organic CPI/CC

4.0 Horizontal Protection

5.0 Threats, Vulnerabilities, and Countermeasures

5.1 Threats

5.2 Vulnerabilities

5.3 Countermeasures (CM)

5.3.1 Anti-Tamper

5.3.2 Cybersecurity

5.3.3 Software Assurance (SwA)

5.3.4 Supply Chain Risk Management

5.3.5 System Security Engineering

5.3.6 Countermeasures

6.0 Other System Security Related Plans and Documents

7.0 Program Protection Risks

8.0 Foreign Involvement

8.1 Defense Exportability Features

9.0 Processes for Program Management and Implementation of PPP

9.1 Audits/Inspections

9.2 Engineering/Technical Reviews

9.3 Verification and Validation (V&V)

9.4 Sustainment

9.5 Demilitarization (DEMIL)

10.0 Processes for Monitoring and Reporting Compromises of CPI

11.0 Program Protection Costs

12.0 Acronyms

Appendix A (Security Classification and Declassification Guide).................................................. A Appendix B (Counter Intelligence Support Plan) ........................................................................... B Appendix C (Criticality Analysis) .................................................................................................. C Appendix D (Anti-Tamper Plan) .................................................................................................... D Appendix E (Cybersecurity Strategy) ............................................................................................. E Appendix F (VC-25B OPSEC Plan) ............................................................................................... F Appendix G (VC-25B Integrated Threat Assessment) ................................................................... G

List of Figures

Figure 1.1-1: Notional VC-25B Aircraft Figure 2.1-1: VC-25B Program Planning Schedule as of 17 July 2018 Figure 7.0-1: VC-25B Program Protection Risk Cube

List of Tables

Table 1.0-1: PPP Update Record Table 1.1-1: Program Information Table 1.2-1: Program Protection Responsibilities Table 2.1-1: VC-25B Program Protection Events Table 2.2-1: CPI and Critical Components Countermeasures Summary Table 3.2-1: Inherited CPI/CC Table 3.3-1: Organic CPI/CC Table 5.1-1: Threat Products References Table 5.3-1: Vulnerabilities and Countermeasures Table 5.3.3-1: Application of SwA CM – Development Processes Table 5.3.3-2: Application of SwA CM – Operational System Table 5.3.3-3: Application of SwA CM –Development Environment Table 5.3.6-1: Program CM/Security Activities Table 6.0-1: Other VC-25B System Security Related Plans and Documents Table 7.0-1: VC-25B Program Protection Risk Matrix as of 2 July 2018 Table 8.0-1: Foreign Involvement Summary

1.0 Introduction – Purpose and Update Plan

This Program Protection Plan (PPP) is a risk-based, comprehensive plan that captures the program’s Critical Program Information (CPI); Critical Components (CC); threats and vulnerabilities to the CPI and CC; countermeasures (CM) selected to ensure enhanced protection of the CPI and CC; implementation guidance for selected CM; and processes and procedures for ensuring CM are assessed and monitored for effectiveness. The definitions of CPI and CC for the VC-25B program are consistent with the definitions found in DoDI 5200.39, Critical Program Information (CPI) Identification and Protection Within Research, Development, Test and Evaluation (RDT&E), and DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks. This plan is intended to be used by Department of Defense (DoD), Boeing, and its subcontractor personnel directly supporting the VC-25B Program at all locations where VC-25B CPI and CC are stored, processed, handled, transmitted, or tested from the present time until system demilitarization (DEMIL).

The VC-25B Program Office will review the PPP as necessary in accordance with (IAW) applicable acquisition guidance and policy prior to each program technical review or once every three years, if not otherwise updated. All reviews of this document will address findings from loss or compromise of CPI and CC. PPP revisions are captured in Table 1.0-1. The VC-25B Program Protection Working Group (PPWG) will lead all PPP updates, with support from Mobility Directorate Security Office personnel. Other stakeholders, such as Air Mobility Command or VC-25B Program contractors, may provide recommendations for updates to the

PPWG.

Table 1.0-1: PPP Update Record

Revision # Date Changes Approved By

1.0

2 April 2015 None – Component Approved Draft PPP Assistant Secretary of the Air Force (Acquisition)

2.0 4 April 2016 Updated for MS B Decision USD (AT&L)

3.0 15 August 2018 Updated for PDR USD (A&S)

1.1 Technology/System Description

The VC-25B Program Office will deliver two new aircraft to meet the requirements for the President to execute the three roles of 1) Head of State, 2) Chief Executive, and 3) Commander-in-Chief. The Boeing 747-8 aircraft will be uniquely modified to provide the President, staff, and guests with safe and reliable air transportation with the equivalent level of communications capability and security available in the White House. The modifications to the 747-8 aircraft will include an electrical power upgrade with dual auxiliary power units that are usable in flight, a mission communication system, executive interior, military avionics, self-defense system, autonomous enplaning and deplaning, and autonomous baggage loading. In addition to the aircraft modifications, this effort will involve VC-25B aircraft design, test, evaluation, and certification; pre-operational support; design and delivery of key end-user items, such as test benches and ground support equipment; aircraft paint; and final aircraft delivery preparations.

The notional VC-25B design concept is depicted in Figure 1.1-1. The current status of VC-25B Program information is provided in Table 1.1-1.

Figure 1.1-1: Notional VC-25B Design Concept

Table 1.1-1: Program Information

Program Name

Acquisition Category

(ACAT) Level

Risk Management Framework Mission Assurance Category

Last Milestone

VC-25B ACAT I

Confidentiality: High Integrity: High

Availability: High MS B – September

1.2 Program Protection Responsibilities

Table 1.2-1 below identifies the AF parties responsible for various program protection efforts for the VC-25B Program. These personnel represent the current members of the PPWG, a multi-disciplinary team responsible for program protection throughout the VC-25B Program life cycle.

Overall responsibility lies with the PM who has delegated execution responsibility to specific

Subject Matter Experts (SMEs). Program protection questions relating to a particular subject area should first be directed to the SME for that discipline. More general program protection questions can be directed to the PPWG Lead or the Systems Integration (SI) Integrated Product Team (IPT) Lead.

Table 1.2.1: Program Protection Responsibilities

Title/Role Name Organization DSN Phone Email

VC-25B PM Col Kevin Massie AFLCMC/WV 986-5342 kevin.massie@us.af.mil

Chief Engineer Mr. Robert Fookes AFLCMC/WV 785-1641 robert.fookes@us.af.mil

Mission Systems IPT Lead Mr. David Moenter AFLCMC/WV 986-9382 david.moenter@us.af.mil

PPWG Lead 2d Lt Collette Foster AFLCMC/WV 713-1059 collette.foster.1@us.af.mil

SI IPT Lead Maj Steven Orzel AFLCMC/WV 713-1073 steven.orzel@us.af.mil

Avionics Technical Lead Mr. Mark Phillips AFLCMC/WV 785-8530 mark.phillips@us.af.mil

Flight Deck Lead Mr. Mark Gregory AFLCMC/WV 785-1402 mark.gregory.5@us.af.mil

Mission Communication System Lead

Mr. Matthew Smearcheck AFLCMC/WV 785-1775 matthew.smearcheck@us.af.mil

Anti-Tamper Lead Mr. Robert Copeland AFLCMC/WV 674-7933 robert.copeland@us.af.mil

Cybersecurity Engineer Mr. John Howard AFLCMC/WV 785-0150 john.howard.45@us.af.mil

Software Assurance (SwA) Lead Mr. Brian Thomas AFLCMC/WV 785-4894 brian.thomas.56@us.af.mil

Air Vehicle Lead Engineer Mr. Tony Deliberato AFLCMC/WV 785-0746 tony.deliberato.2@us.af.mil

Supply Chain Risk Management (SCRM) Lead

Mr. Fredrick Day AFLCMC/WV 986-9362 fredrick.day.2@us.af.mil

Contracting Officer Ms. Ashlee Green AFLCMC/WV 986-9539 ashlee.green.1@us.af.mil

Chief of Security Mr. Frank Maguire AFLCMC/WLOS 986-6214 frank.maguire@us.af.mil

Counter-Intelligence Support

Special Agent Eric Knueven AFOSI 10 FIS 257-3000 eric.knueven@us.af.mil

Intelligence Support Mr. Robert Hart 21st Intelligence Squadron 986-7628 robert.hart.15@us.af.mil

2.0 Program Protection Summary

2.1 Schedule

Figure 2.1-1 below represents the VC-25B planning schedule, as of 17 July 2018. The VC-25B formal schedule will be established with the Acquisition Program Baseline planned for December 2018.

Figure 2.1-1: VC-25B Program Planning Schedule as of 17 July 2018

Program protection-specific events for the VC-25B Program are listed in Table 2.1-1. As the system design matures, additional CPI and CC may be identified, and the PPP will be updated with the new information.

Table 2.1-1: VC-25B Program Protection Events

PPP Event Date

PPP

- Service approved 25 June 2015

- Review and update prior to Milestone B Decision 4 April 2016

- Review and update prior to Preliminary Design Review (PDR) 15 October 2018

- Review prior to Critical Design Review (CDR) 150 days prior to CDR

Calendar Year Fiscal Year

Acquisition / Contracting

Logistics / Facilities

Systems Engineering / Test & Evaluation

P R E

R

Environ Impact Stmt (EIS)

PAR Complex Design PAR Complex Construction

FY24 FY25

2019 2020 2021 2022

FY20 FY21

2023 2024

FY22FY19 FY23

Contractor Outfitting

2016 2017

FY16 FY17 FY18

M

DT

Milestones/Key Decision Points

Fabrication / Parts Procurement

OT

DC,

P&ADT Interior/ MCS

DC,

P&A

F A

Engine / IDG

DTPAR #1 Mod - Structures / Elec / MCS

PAR #2 Mod - System Mod

Const AwardDOPAA Release

APU

RAA

PS Deliverables

Sustainment Contract(s)

OA(s) OA SIL Design / Development / Test

Preliminary Design Contract Mod

Pre-MS B Contract (Phase 1)

Comm A/C Contract Mod

IOC FOCMS B IPR

CDR

PAG & AFOTEC Familiarization Deficiency Correction, Paint & Acceptance

Pre-MS B Contract Mod (Phase 2)

PDR

SFRSRR

EMD UCA (Final Design, Mod, Test A/C #1 & 2)

A/C #1 Induction

A/C #2 Induction

ADM

Preliminary Design

EMD

Pre-MS B

Design Prelim. Design

Engine Assy A/C #2

Interior

OTRR

Phase 1

Phase 2

Facilities Ops Ready

As of: 17 Jul 18

RFP

COMBS Operational

Notice of Intent

Fabrication / Parts Procurement Facility Activities

Product Support Planning & Demonstration

Modification Test

RFP PS Deliverables Contract

ADM ADM ADM

EMD Definitization

IPR

(APB)

ADM

PPP Event Date CPI Assessment

- Initial October 2014

- Review prior to MS B Decision 26 January 2016

- Review and update prior to PDR 15 October 2018

- Review prior to CDR 150 days prior to CDR Criticality Analysis (CA)

- Initial October 2014

- Review prior to MS B Decision 4 March 2016

- Review prior to PDR 15 October 2018

- Review prior to CDR 150 days prior to CDR Threat Assessments

- Integrated Threat Assessment Report 2 February 2018

- System Threat Assessment Report (STAR) -- Initial 15 August 2014 -- Biannual update 19 August 2016

- Supply Chain Threat Assessments -- Review prior to MS B Decision 150 days prior to MS B -- Review prior to PDR 150 days prior to PDR -- Review prior to CDR 150 days prior to CDR Anti-Tamper Plan

- Initial 1 February 2016 (SAF/AQ) Cybersecurity Strategy

- Initial 22 April 2015

- Review prior to MS B Decision 25 March 2016

- Review prior to PDR 150 days prior to PDR

- Review prior to pior to CDR 150 days prior to CDR

2.2 Critical Program Information, Critical Functions and Components Protection

The VC-25B PPWG conducted an additional criticality analysis in April 2018 to identify an updated list of CC and CPI. Sections 3.2 and 3.3 of this document provide a summarized list of approved CPI and CC. Further detail can be found in Appendix C (Classified). A summary of countermeasures applied to each CPI/CC can be found in Table 2.2-1.

Table 2.2-1: CPI and Critical Components Countermeasure Summary

# CPI

(Inherited or Organic)

Countermeasures

1 2 3 4 5 6 7 8 9 10 11 12 13

1 Complete Parts List (O) X N/A X N/A X N/A X X N/A N/A N/A X N/A

2 Cryptographic Short Title List (I) I N/A I N/A I N/A I I I I N/A N/A N/A

3 Electrical Load Analysis (O) X N/A X X X X X X N/A N/A N/A N/A N/A

4 Emissions Security Documentation (O) X N/A X X X X X X N/A N/A N/A N/A N/A

5 Encryption Keys (I) I N/A I I I I I I I I N/A N/A I

6 Flight Manuals (O) X N/A X X X X X X N/A N/A N/A N/A N/A

7 GPS Receiver Algorithm (I) I N/A I I I I I I I I I I I

8 Maintenance Manuals (O) X N/A X X X X X X N/A N/A N/A N/A N/A

9 Mission Critical Equipment List Document (O) X N/A X N/A X X X X N/A N/A N/A N/A N/A

10 Mission Communication System (O) X X X N/A X X X X X X N/A N/A X

11 Survivability & Vulnerability Data (O) X N/A X X X X X X N/A N/A N/A N/A N/A

12 Tunnel Router Addressing Tables (I) I I I N/A I I I I I N/A N/A N/A N/A

# CC

1 Auxiliary Power (O) X X X N/A X N/A X X X N/A X X X

2 Electrical Power Generation

(O) X X X N/A X N/A X X X N/A X X X

# CC

3 Encryption Devices (I) I I I I I I I I I I I I I

4 Engine (O) X X X N/A X N/A X X X N/A X X X

5 Environmental Control System (O) X X X N/A X X X X X N/A X X X

6 Fire Protection System (O) X X X N/A X X X X X N/A X X N/A

7 Flight Critical Systems (O) X X X X X X X X X N/A X X N/A

8 Flight Deck (O) X X X X X X X X X N/A X X X

9 Fuel System (O) X X X N/A X X X X X N/A X X N/A

Mission Communication System (MCS) Network Equipment (O)

X X X X X X X X X X N/A X X

11 Primary Electrical Power Distribution (O) X X X N/A X X X X X N/A X X X

KEY

Selection General Countermeasures Trusted Systems Design Countermeasures

X = Implemented I = Inherited CPI with protection already in place

1 Personnel Security 2 Physical Security 3 Operations Security 4 Industrial Security 5 Training 6 Information Security 7 Public Release Requirements:

Freedom of Information Act Exemption

8 STINFO: Distributions Restrictions 9 IA/Network Security 10 Communication Security 11 Software Assurance 12 Supply Chain Risk Management 13 System Security Engineering

Note: VC-25B efforts will comply with the Program Protection Plan(s) for all inherited CPI.

3.0 Critical Program Information and Critical Components

3.1 Identification Methodology

The PPWG identified the initial CPI IAW the guidance in Chapter 9 (Program Protection) of the Defense Acquisition Guidebook (DAG); the guidance in AF Pamphlet (AFPAM) 63-113, Program Protection Planning for Life Cycle Management; and the requirements in DoDI 5200.39, Critical Program Information (CPI) Identification and Protection Within Research, Development, Test and Evaluation (RDT&E). The PPWG performed the criticality analysis (CA) using the Office of the Under Secretary of Defense for Acquisition and Sustainment procedures and template. Data from this analysis will be incorporated into the threat assessment, vulnerability assessment, risk assessment, and countermeasure selection for the VC-25B Program.

The CPI and CA will be periodically re-evaluated throughout the Systems Engineering Technical Review process.

The CA examined missions and mission threads based on the PAR CDD. The SMEs conducted a Product Breakdown Structure (PBS)-based CPI assessment process to identify CPI. Each PBS component was evaluated considering the following factors:

• Platform capabilities

• Performance parameters

• Mission-related data

• Design data

• Materials

• Manufacturing processes and equipment

• Design methodologies

• Algorithms

• Support and maintenance concepts

• Reliability, maintainability, and availability

• Supply chains

• Training

• Technical data

• Support equipment locations

• Data libraries

• Test and evaluation techniques and locations

Items identified as a result of these processes were listed as candidate CPI, which included inherited and organic CPI. The candidate CPI was further analyzed by a team of subject matter experts who finalized the current list of CPI in Table 2.2-1. The final list of CPI and exact nomenclature will not be identified until the design has been finalized.

3.2 Inherited CPI/CC

The VC-25B Program selected Boeing to provide the commercial aircraft for the VC-25B System. The subcontractors who will provide interiors and subsystems have been identified, and materiel solutions to specific requirements are being finalized. As design details of the VC-25B System are finalized, the inherited CPI list will be reviewed and expanded as part of VC-25B PPP reviews. All of the VC-25B Program inherited CPIs/CCs will be protected at a level equal to or greater than the requirements of the originating program.

The PPWG will convene at CDR to reevaluate the released design and identify any additional CPI/CC, which have information, data, technologies, and/or systems feeding into the VC-25B System.

Table 3.2-1 summarizes changes in use/protection of the inherited CPI/CC. The VC-25B Program will comply with the VC-25B Security Classification and Declassification Guide (SCDG) (see Appendix A) as well as the SCDG of each item listed (if one exists) in the table below to protect classified information. Currently there are nine total inherited CPI items and six total items of inherited CC. Detail for CPI and CC not listed in Table 3.2-1 can be found in Appendix C (Classified).

Table 3.2-1: Inherited CPI/CC

Inherited Critical Item Parent Program Original Use Planned Use Variation in CMs?

Inherited Program POC

C

PI

Cryptographic Short Title List

National Security Agency (NSA)

As prescribed by NSA Same No

NSA Information Assurance Directorate

NSA/IAD

Encryption Keys Various Protect aircraft data Same No Various

GPS Receiver Algorithms GPS JPO Protect GPS algorithms Same No SMC, GPS

Directorate, LAAFB

Tunnel Router Addressing Tables

Crisis Management System Agency

As prescribed by Executive Airborne

Communications Network

Same No

DISA NSE43 National Programs Division, White House Support Branch

Encryption Devices NSA As prescribed by NSA Same No

NSA Information Assurance Directorate

(NSA/IAD)

3.3 Organic CPI/CC

The Program Office identified 38 total items of organic CC and 7 total items of organic CPI.

Table 3.3-1 outlines the general system in which organic CPI and CC exists; however, a more detailed table is located in Appendix C. The table also shows their physical locations and their traceability to Key Performance Parameters (KPPs) and Critical Technology Elements (CTEs).

As the VC-25B System architecture and design are further developed, the VC-25B Program Office will periodically evaluate the technical baseline to identify new organic CPI/CC and update the VC-25B Organic CC/CPI list accordingly.

Table 3.3-1: Organic CPI/CC

Organic Critical Item

Consequence of Compromise

Status/Date, Justification for Status Change

KPP & CTE

Tracebility

Export Control Areas

Virtual/ Physical Location

PPIP

Exists?

PI

Complete Parts List See Appendix C (Classified)

Added

PPP update

KPPs 2-1, 2-2, 2-3, 2-4, 7 N/A Virtual:

VC-25B PO & BDS

Yes (Draft) SOW: 3.8.5.c

CDRL F025

Electrical Load Analysis

See Appendix C

Emission Security Documentation

Flight & Maintenance Manuals

BDS

Mission Critical Equipment List

System (MCS)

Survivability and Vulnerability Data

VC-25B PO

Auxiliary Power System

2-4, 7 N/A Physical:

Electrical Power Generation

Engine See Appendix C

Environmental Control System

Organic Critical Item

Consequence of Compromise

Status/Date, Justification for Status Change

KPP & CTE

Tracebility

Export Control Areas

Virtual/ Physical Location

PPIP

Exists?

Fire Protection System See Appendix C

Flight Critical Systems

Flight Deck System See Appendix C

Fuel System See Appendix C

System (MCS)

Primary Electrical Power Distribution

Based on updated CPI/CC analysis conducted by the PPWG, the following CPI/CC have been removed, combined, and/or reorganized within Table 3.3-1: COTS MCS Network Equipment, COTS MCS Operator Control Station, COTS MCS Transmit and Receive Systems, COTS MCS Passenger Interface Systems, and COTS Processing Chips. This analysis reflects a greatly improved understanding of the VC-25B technical baseline and its design heading into PDR.

4.0 Horizontal Protection

Due to programmatic sensitivities and consistent with other Presidential platforms, the VC-25B Program Office will not include its CPI in the Acquisition Security Data Base (ASDB).

5.0 Threats, Vulnerabilities, and Countermeasures

5.1 Threats

Table 5.1-1 identifies threat products used by the VC-25B Program, as well as the organization that produces the product. Unclassified documents will be kept on the VC-25B Program’s Enterprise Information Management system. Associated threats to CPI and CC are outlined in Appendix C (Classified).

The Program Office will ensure threat documents are up to date and the latest information is available to the program. General threat documents, such as the Defense Security Service’s (DSS) Targeting U.S. Technologies, will be reviewed during PPP updates for any new threats to the VC-25B Program. The PPWG will be responsible for requesting and receiving counter-intelligence threat products supporting the VC-25B Program. The AF Office of Special Investigations (AFOSI) 10th Field Investigations Squadron, National Air and Space Intelligence

Center (NASIC), and the Defense Intelligence Agency Threat Assessment Center (DIA TAC) are responsible for supporting threat product requests. AFOSI will generate and provide an Integrated Threat Assessment (ITA), and the DIA TAC will generate and provide an all-source counter-intelligence supply chain threat assessment for CPI/CC. These products will be used by the VC-25B PPWG to assess program threats, identify risks and vulnerabilities, and develop and implement appropriate security CM.

Table 5.1-1: Threat Products References

Title of Program- Specific or

Other Threat Products Used

Classification Document Date

Organization Producing the

Product

Reference/Link to

Formal Threat Reports

STAR Secret 2016 NASIC Located in VC-25B

Program Office, WPAFB

Threat Trends Affecting

U.S. Major Defense

Acquisition P 2013

Secret //FGI GBL

SWE

TWN//NOFORN

2013 DIA

Information Operations

Capstone Threat Assessment:

Computer k

Secret

NOFORN 2013 DIA

Integrated Threat Assessment

Secret 2018 AFOSI

Supply Chain Threat Assessments

Worldwide:

Capabilities for

Adversarial

Through the DoD

Secret 2012 DIA

Title of Program- Specific or

Other Threat Products Used

Classification Document Date

Organization Producing the

Reference/Link to

Supply Chain

Vulnerabilities of Firewall Devices

Secret

NOFORN 2012 DIA

Vulnerabilities of Operating

Systems and Web Browser Software

Unclassified 2012 DIA

Other Threat Documents

Targeting U.S.

Technologies: A

Trend Analysis of Cleared Industry

Reporting

Unclassified 2017 DSS

Note: To request access to threat products, contact the VC-25B PPWG Lead.

The VC-25B Program will identify threats using the STAR, ITA, and subject matter expertise.

The DIA TAC request for information submission process will be routed through the Trusted Systems and Networks (TSN) focal point at Wright-Patterson Air Force Base.

5.2 Vulnerabilities

A specific CPI/CC vulnerability assessment will be conducted IAW AFPAM 63-113 Chapter 4 and documented in Appendix C, which is classified. Additionally, system vulnerability will be an agenda topic at risk management meetings. Finally, the VC-25B EMD Statement of Work (SOW) contains requirements for Boeing to provide SCRM IAW the most current version of the National Institute of Standards and Technology Special Publication (NIST SP) 800-53. This document contains descriptions and examples of general vulnerabilities throughout the system life cycle.

Software vulnerability checks will be accomplished through implementation of software development processes employing state-of-the-practice software and security engineering methods, quality control processes, and validation techniques to minimize flawed or malformed software.

The VC-25B Program Manager and the PPWG are responsible for continually evaluating potential vulnerabilities for CPI and CC. Vulnerabilites to CPI and CC will be identified at each update to the PPP in order to ensure proper protection of newly identified CPI or CC.

Vulnerability assessments will occur at the frequency in which CPI and CC are evaluated, at each system technical review, or every three years.

Vulnerabilities have been identified, prioritized, and placed in the sequence order, from most important to least, based on consequences to loss or compromise. These vulnerabilities are identified below in Table 5.3-1.

5.3 Countermeasures

The PPWG identified countermeasures to protect CPI and CC based off of the results of the threat and vulnerability assessment. The PPWG selected appropriate and cost effective countermeasures for each CPI item or CC.

The SOW includes language to ensure Boeing provides SME support to the PPWG.

Additionally, the PPWG will ensure provisions are included in VC-25B Program contracts for protection of CPI and CC. Boeing will identify its measures necessary to protect CPI and CC in their Program Protection Implementation Plan (PPIP).

Countermeasures focus on protecting CPIs and CCs against the developed threats throughout the span of VC-25B activity and their subsequent evolution in the acquisition life-cycle. The selected countermeasures were chosen to address specific vulnerabilities and will be tailored to respond to changes in the threat environment. Table 5.3-1 describes the countermeasure for each identified vulnerability.

Security countermeasures for VC-25B activities have been developed to address the key vulnerabilities of the activities being supported, to protect classified and sensitive unclassified information, and comply with regulatory requirements and instructions. Classified CPI will remain such until declassified as specified in the appropriate SCDG.

Table 5.3-1: Vulnerabilities and Countermeasures

Type Details Countermeasures Unrestricted access to technical information

• CPI information is transferred daily between and among the various participants. While not all CPI is classified, it is required to be protected in accordance with DoDI

5200.39. Documents and

electronic media containing VC-25B activity information and CPI are generated, used, and stored at Boeing and Government facilities. The increase in the volume of this information can increase the possibility of loss or compromise. Much VC-25B activity containing classified and unclassified information is generated, processed, or stored on computer systems and electronic storage media. Removable storage media can easily be lost, misplaced, copied, or either intentionally or unintentionally removed from secure areas.

• The volume of transfer of classified and CPI data must be kept to the minimum in order to manage VC-25B efforts and limit the potential for compromise. The Secret Internet Protocol Router Network (SIPRNet) will be used to access and transmit classified automated VC-25B information. All Government activities generating, processing, or storing CPI or materials must comply with this requirement. Exceptions to existing policy and procedures will be kept to a minimum. VC-25B CPI will be protected IAW appropriate security classification guidance; AFI 16-1404, The Air Force Information Security Program; DoD 5220.22-M, National Industrial Security Program Operating Manual; DoD 5400.7-R – Air Force Manual (AFMAN) 33-302, Freedom of Information Act Program; NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations; and other appropriate directives. The VC-25B SCDG is contained as Appendix A. These protection measures include:

• Security classification management

• Marking classified material

• Safeguarding

• Access control measures

• Disposition and destruction

• Compensatory measures

• Transmission and transportation

• Security orientation and continuing education

• Actual or potential compromise of classified information inquiries assessment

• Security program management oversight

• Subcontracting

• Security clearance requirements

• Distribution F restriction on technical documents

• Operations Security (OPSEC)

• The operational need for regular transfer of classified and/or CPI will be accomplished through applicable security guidelines.

• The more frequent the need to transfer classified and/or CPI data, the higher the probability for accidental loss, misplacement, compromise, or disclosure.

To minimize this risk, strict adherence to existing data transfer and courier policy and procedures must be followed. This is best accomplished through regular security education and awareness and heightening awareness of all program personnel on required procedures. All couriers will be briefed at least annually on their requirements for carrying classified data and prompt reporting of loss, theft, or compromise.

• All electronic storage media will be handled and protected in accordance with the appropriate security classification guides and appropriate information security requirements. Periodic searches of employee hand-held items will be accomplished by security management.

• Removable storage media used to process classified information must be clearly marked with the highest classification for which it can be used and, if appropriate, be brought into accountability.

• All classified information will be subject to the information security program management requirements to ensure compliance with Executive Order 13526, Classified National Security Information.

Insufficient industrial security

• The incorporation of security requirements into the AF’s contracting

• Security protection requirements will be incorporated into all contracting activities. Government procedures and protection measures process is inconsistent and in many cases, uncoordinated. This situation results in unrealistic budgeting of security requirements that develop in later acquisition phases as unplanned cost growth and security retrofits. Activity schedules are impacted as activities slip due to security “showstoppers.”

• A number of factors combined together place industry activity at particularly high risk. The proliferation of the foreign economic espionage threat targeting private industry, the geographic dispersal of facilities and personnel throughout the US, growing numbers of employees being laid off due to defense budget cuts, and disgruntled employees all present a formidable security challenge that can tax security resources beyond their capacity if not planned for and managed carefully.

instructions for preparing DD Forms 254, Contract Security Classification Specification, will ensure Boeing is provided quality acquisition security, program protection, and classification management guidance.

• Security management of prime and subcontractor activity will be evaluated during Program Management Reviews, Program Protection Surveys, under the guidance of AFPAM 63-113, para 4.8.1, and through coordination with regional Defense Security Service (DSS) offices.

Classified CPI, in the hands of Boeing, its subcontractors, and vendors will be protected as prescribed by the appropriate security classification guide, the NISPOM, the appropriate contract DD Forms 254, and this plan. Enforcement of Boeing security requirements is the responsibility of the AFLCMC/WV contracting officer.

Unsecure communications

• VC-25B communications are conducted over the telephone and internet. The overwhelming majority of these communications are transmitted over unprotected, open, commercial lines susceptible to interception.

Insecure facsimile machines are exploitable by

• In order to prevent the compromise of classified information, a secure fax machine, secure telephone equipment (STE), or other secure means will be used when classified CPI is transmitted or discussed between the organizations involved with VC-25B efforts. STE keys will be controlled, but available to all cleared personnel to facilitate use of secure communications. Controlled unclassified data will be sent via secure

Signal Intelligence collectors. Signals are as easy to intercept as a telephone call, require no transcription from a recording, and unlike voice that sometimes cannot be completely understood by a native speaker, are on paper exactly as they are sent.

communications methods only.

Encrypted e-mail will be used when sending unclassified information relating to CPI via the internet.

Access to critical information and

OPSEC

indicators

• Data contained in SOWs, Statements of Objectives, and other acquisition documents at Boeing and Government sites may pose OPSEC concerns.

• A VC-25B OPSEC critical information list has been tailored to satisfy specific protection requirements. This complies fully with AFI 10-701, Operations Security (OPSEC) and the VC-25B OPSEC Plan. The VC-25B OPSEC Plan identifies all VC-25B Critical Information. The VC-25B OPSEC Plan is attached in Appendix F.

Proximity of foreign visitors and contacts

• Foreign government representatives visiting facilities housing VC-25B activity, other Government offices, or Boeing may be inadvertently exposed to VC-25B activity and technical information. This exposure may compromise company proprietary, Government classified, FOUO, and export controlled material.

• AFLCMC/WV, other Government organizations and Boeing will adhere to approved visit procedures for the facility being visited. Foreign visitors will be clearly identified as such. All information to be discussed and/or presented during official visits will be reviewed IAW with the VC-25B Communications Plan and approved prior to the presentation and/or distribution.

This review process will take into consideration issues of classification, proprietary, export controlled, and FOUO restrictions.

Data transfer at symposia and conferences

Symposia and technical conferences attended by US citizens where technical papers and other sensitive and/or export controlled materials are discussed, distributed, or otherwise freely exchanged represent a significant threat to critical US technologies.

Information may be

• All materials proposed for discussion, presentation, and/or exchange at symposia and technical conferences will be subject to review through the VC-25B Communications Plan.

published in open sources without consideration of its sensitivity. This vulnerability is exacerbated when the technical community attends the symposia or technical conference.

Access to data via electronic media

• The threat of computer viruses presents a high risk vulnerability to VC-25B computer users that may deny service if systems are infected and potentially shut down. Recovery from virus infections may result in extensive down-time, damaged system features, and/or lost/unrecoverable data.

• The proliferation of networks and continued connectivity of Automated Information Systems (AIS) increases the risk of unauthorized and potentially undetected penetration if not controlled properly. Access control becomes a high risk security vulnerability if not planned for, managed, implemented, and audited regularly.

• Computer-based activities will be governed by the requirements of Public Law 100-235, Computer Security Act of 1987. AIS security will be performed in compliance with AFI 33-202, Network and Computer Security, all other applicable AFI 33-Series requirements, and Chapter 8 of DoD 5220.22-M, NISPOM, for Boeing. Additionally, unclassified DoD information not approved for public release on non-DoD Information Systems will be protected in accordance with DoDI 8582.01, Security of Unclassified DoD Information on non- DoD Information Systems, Enclosure 3, and the VC-25B SCDG. All automated information systems processing classified information, from laptops to minicomputers, will be accredited.

Facility EMSEC (Emissions Security --formerly known as TEMPEST) vulnerability assessment/risk assessments will be completed where required, by current DoD EMSEC policy and necessary countermeasures or procedures implemented. Authorization of special requirements such as open storage of classified media, local area networks, or data encryption will be coordinated through AFLCMC/WLO Security. Multi-user systems will be audited to detect unauthorized entry. All systems will be periodically examined to ensure data integrity, absence of viruses, and adherence to approved operating principles. The AFLCMC PAR

Directorate’s Information System Security Officer/Information Assurance officer (ISSO/IAO) is responsible for the implementation and management of computer security countermeasures.

• Information assurance training will be conducted under the direction of the ISSO/IAO. Training will include using the system, awareness of access control features, proper handling, and storage of software media.

Inadequate security knowledge & awareness

• Lack of security awareness or knowledge of existing policy or procedures poses a real threat to all VC-25B activities. Lack of knowledge provides opportunity for compromise when personnel are unaware of their responsibilities and the repercussions for non-compliance. Negative education programs that emphasize non-compliance penalties and unjustified operational obstacles encourage working around the system to get work accomplished, increasing the potential for violations.

• A positive security education and awareness program is the most cost effective security countermeasure of any protection effort. Without an education program, VC-25B personnel will be unaware of those areas designated for protection. Accordingly, the plan will be rendered ineffective and the allocated protection resources wasted.

• Education and awareness will be given high priority and emphasized at all levels.

Training will include the basic mandatory, as well as specialized subjects, and will be tailored to satisfy the individual needs of integrated product teams and individuals within the VC-25B organization.

• OPSEC training will be conducted by the Program Office and Boeing.

risks

• The US is vulnerable to major disruptions in foreign supplies that could make it impossible for US warriors, warships, tanks, aircraft, and missiles to operate effectively. Such supply disruptions could be caused by many factors. Poor manufacturing practices in offshore factories could

• DoDI 5200.39 requires the supply chain related to all CPI be assessed to determine if an adversary has the capability and intent to affect it in a manner that compromises the military effectiveness of the given platform, weapon system, or network. These assessments would be accomplished under the provisions for SCRM and counterfeit parts prevention, as well as inclusion of specified requirements for supplier anonymity, produce problem-plagued products. Substandard manufacturing could be inadvertent, could be part of a deliberate attempt to cut costs and boost profits, or could be intentionally designed to damage US capabilities. Many military parts are Commercial off the Shelf (COTS) which can lack the quality control and traceability necessary to ensure parts used in the defense supply chain meet the rigorous standards vital to national security. Faulty and counterfeit COTS parts are already taking a toll on readiness in several defense sectors.

• Natural disasters, domestic unrest, or changes in government could cut or halt production and exports from foreign factories and mines. Foreign industry could also sharply raise prices or reduce or stop sales to the US. These changes could be caused by political or military disputes with the US, by the desire of foreign nations to sell to other countries, by the need to attract foreign investment and production, or by foreign nations wanting to keep more of the raw materials, parts, and finished goods they produce for their own use.

foreign sources of supply, and security production assurance. The identification of the supply chain and its risk management will be accomplished by the VC-25B Program Office during Preliminary Design and Engineering and Manufacturing Development. Such documents include the VC-25B Counterfeit Prevention Plan (CDRL B096) and the Integrated Logistics Support Plan (CDRL F054).

Technical exploitation in

• Each year, the DoD invests billions of dollars to

• AT. See Appendix D operational environment develop and produce sophisticated weapon systems and technologies to maintain military superiority. As such, these weapons and technologies are highly sought after and at risk of exploitation when exported, stolen, or lost or damaged during combat or routine missions. Such exploitation can weaken US military advantage on the battlefield and erode the US industrial base’s technological competitiveness in the international marketplace.

AT encompasses the systems engineering activities intended to prevent and/or delay exploitation of critical technologies in US weapon systems. These activities involve the entire life-cycle of systems acquisition, including research, design, development, implementation, and testing of AT measures.

• System Security Engineering (SSE). The purpose of SSE is to eliminate, reduce, or control, through engineering and design, any characteristics that could allow deployment of systems with operations security deficiencies. All VC-25B efforts will follow the SSE processes. SSE requirements include:

• Provide technical data and analysis in support of CPI Identification, criticality analysis, and Vulnerability Assessments.

• Conduct program protection surveys, as necessary.

• Design and implementation of cryptographic features and information assurance (IA) countermeasures in accordance with applicable directives.

• Support development of the Cybersecurity Strategy, to include operational concepts and implications related to operations, key management, and data transfer.

• Identify IA required equipment and media.

5.3.1 Anti-Tamper

The PM and Chief Egineer are jointly responsible for developing an AT plan for the VC-25B Aircraft. The Air Force Life Cycle Management Center Avionics Integration and Software Systems Branch (AFLCMC/EZAS) will assist the Program Office in defining AT requirements for the VC-25B Aircraft. AFLCMC/EZAS will be the liaison with the AF AT lead and the AF AT Executive Agent. For further information, please contact the VC-25B Program Office regarding the AT plan.

5.3.2 Cybersecurity

The Program Office is responsible for facilitating and obtaining the Cybersecurity Assessment and Authorization (A&A) for the VC-25B System. The VC-25B System includes two information processing boundaries, each with its own Authorizing Official (AO): the Platform Information Technology (PIT) and the Mission Communication System (MCS). Cybersecurity for the VC-25B System will employ the Risk Management Framework (RMF) described in DoDI 8500.01 for an Executive-level system characterized in NIST SP 800-60 vol2 and will implement the applicable security controls published in NIST SP 800-53 rev4. The VC-25B Cybersecurity Strategy is in Appendix E.

5.3.3 Software Assurance (SwA)

The Program Office is responsible for overseeing SwA for the VC-25B System.

All software developed for the VC-25B System will be developed in accordance with RTCA DO-178 [Rev B or C as AC20-115D provides] and is subject to FAA certification as identified in Section 3.1 of the VC-25B Software Development Plan (SDP). All software (developed and COTS) procured for the program is obtained through approved supplier contracting where limited or no viable alternatives are available outside of the existing 747-8 or military off the shelf capabilities to satisfy VC-25B system requirements.

SwA will be accomplished through implementation of software development processes employing state-of-the-practice software, system safety, security engineering methods, quality control processes, and validation techniques to minimize flawed or malformed software. This includes monitoring, validating, and testing all software artifacts to assure software pedigree IAW DO-178 as described in section 3.7.4.3 of the VC-25B SDP.

Boeing will perform design and code inspections IAW the VC-25B SDP section 3.6.1 Software Development Process. This process addresses software requirements, software design, software coding, and software verification and integration. When software development takes place at supplier facilities, where supplier processes are used, system integration and test will be performed by Boeing.

Boeing will develop software builds as outlined in the VC-25B SDP section 3.7 which address methods and standards for both reusable and new developed software products. Boeing will be responsible for maintaining a list of cleared US citizens that have access to the software development environment.

A Failover Multiple Supplier Redundancy (FMSR) refers to situations where identical code for a failed function will most likely suffer the same failure as the original. For redundancy in software, therefore, a completely separate implementation of the function is needed. This independence reduces the probability that the failover code will be susceptible to the same problem. The AF will analyze Boeing’s plans regarding FMSR as described in the VC-25B SDP section 3.7.4.1.2.

The AF will analyze Boeing’s plans regarding VC-25B System Software Assurance, monitor execution, participate in working group meetings and select supplier reviews and audits, and review and disposition SW Assurance related CDRLs (e.g., F047 Non-Standard Usage Ports, Protocols, and Services (PPS) Report; F048 Chain of Custody Report; F050 Cybersecurity

Vulnerability Analysis Report).

The AF will analyze Boeing’s coding standards and whether their plans limit the size and functions of individual system elements. The AF will analyze Boeing’s VC-25B System software architecture designs to determine the extent of their limits, content, and visibility of each system element. Each system element should have a particular function and strictly perform that function. The AF will analyze the extent the architectures and coding standards work simultaneously to minimize adverse consequences as described in the VC-25B SDP sections

3.8.6.2 and 3.8.8.

Applicable SwA requirements will be included in all VC-25B Program contracts. Boeing will provide SwA information that supports the AF assessment of software assurance; traces to any residual risks; and assists in the population of Table 5.3.3-1, Table 5.3.3-2, and Table 5.3.3-3.

The metric “p/a” in the tables below indicates “Planned” as a percentage followed by “Actual” as a separate percentage.

Table 5.3.3-1: Application of SwA CM – Development Processes

Development Process

Software (CPI, critical function components, other software)

Static Analysis planned/actual

(p/a) (%) Design Inspect

Code

Inspect p/a (%)

Common Vulnerabilities and Exposures

(CVE)

Attack Pattern

Enumeration and

Classification

(CAPEC)

Weakness and Enumeration

(CWE)

Pen

Coverage

Developmental CPI Software (SW)

N/A

Developmental Critical Function SW

100/0 Two Levels 100/0 100/0 100/0 100/0 No 100/0

Other Developmental SW

None One Level

100/0 100/0 100/0 100/0 No 100/0

COTS CPI and Critical Function SW

No No No 0 0 0 No With

Integrated Tests

COTS (other than CPI and Critical

Function) and Non- Developmental Item

(NDI) SW

No No No 0 0 0 No With

Integrated Tests

Table 5.3.3-2: Application of SwA CM – Operational System

Operational System

Failover Multiple Supplier

Redundancy

(FMSR) (%)

Fault Isolation Least Privilege System Element Isolation

Input Checking / Validation SW Load Key

CPI SW N/A

Critical

Function SW 50 All All Yes All All