Industry Day - Initial Presentation.pptx

Industry Day Conference COMET

DD MMM 2020

Rob Bennett

NASIC/XOQ

937-522-6285 robert.bennett.42@us.af.mil

UNCLASSIFIED

UNCLASSIFIED

NATIONAL AIR & SPACE INTELLIGENCE CENTER

Communicate NASIC’s mission and upcoming requirements to industry Answer questions from industry Obtain feedback from potential offerers

Purpose

Discover and characterize Air, Space, Missile, and Cyber threats to enable full-spectrum multi-domain operations, drive weapon system acquisition, and inform national defense policy.

NASIC’s Mission

Provide Information Technology support services that enable scientific and technical intelligence production and dissemination for the USAF, DoD, and national level intelligence efforts.

COMET Program Mission

Communications Focal Point/Service Desk Support/Touch Maintenance Accounts Management Defense Logistics Agency Disposition Services Support Factory Support Software Administration/Installation/License Management Other agency information systems such as MNIS/US BICES/SG Network Services Infrastructure Engineering and Installation Datacenter Operations Windows/Unix/Linux System Administration Storage and Enterprise Backup Services

VTC Operations Multimedia Hardware Support Software Vulnerability Testing Systems Engineering Information Technology Service Management Configuration Management Support Cybersecurity Infrastructure as a Service and Cloud Operations Platform as a Service Operations Database Management Enterprise Application Server Software Administration Physical Access Control System & Intrusion Detection System Operations and Support

Requirement

UNCLASSIFIED

UNCLASSIFIED

National Air & Space Intelligence Center (NASIC) requires contract support for Information Technology support services that enable scientific and technical intelligence production and dissemination for the USAF, DoD, and national level intelligence efforts.

This support includes:

Communications Focal Point/Service Desk Support/ Touch Maintenance/Factory/DLADS/Software

UNCLASSIFIED

UNCLASSIFIED

Requirement:

Central customer facing support for all IT related support for over 4,200 internal & thousands of external customers.

Key Technologies:

An assortment of desktop platforms: various operating systems (Windows/Linux/Unix) 400+ COTs & GOTs software packages Single-use & multi-function devices/plotters/3D printers Numerous monitoring tools Accounts management across multiple tools/systems Service Manager/Remedy support tools Other agency information systems such as MNIS/US BICES/SG Windows/Linux/Unix Administrative tools/tasks

Critical Information:

First response for 180+ incidents/service requests daily (26,000+ tickets annually).

NASIC human sensor focal point assisting in the identification of issues, problems, or cyber incidents.

First line recall of personnel for afterhours facility issues, problem identification for databases, servers, circuits, accounts, PKI / Tokens, software and incident handling.

Knowledge experts in noncommon platforms to include, desktops, printer, servers, cloud-based technology, database, software and networks.

Requirement:

Supports network operations branch in the management of network, voice, cryptographic equipment and firewalls.

Key Technologies:

Cisco networking equipment operating IOS/IOS-XE, NX-OS, and ACI code Dell networking equipment (MASINT mission support) Brocade/Ruckus networking equipment Palo Alto firewalls Type-1/2 encryption devices Cisco UCM voice and Unity Voice mail

Critical Information:

300+ networking devices with over 3000 VoIP’s, Reliability 99.9%.

Network Services Support

Primary point of contact for designing, installing, and repairing network cabling within the main NASIC campus, and supporting the NASIC facility moves.

Key Technologies:

Cabling includes single-mode, multi-mode (50 and 62.5 micron), Multi-Fiber Termination Push-on (MTP), & copper cabling AutoCAD and MS Visio for documentation

Critical Information:

2,000+ desktop moves per calendar year.

100 service requests per month.

5-10 design requests per month.

Infrastructure Engineering & Installation Support

Supports the data center manager with network cabling, PDU cabling, and server installations. Assists with inventory, documentation, access management and facility HVAC monitoring. Provides hardware support for physical servers and storage.

Key Technologies:

The data centers comprise 20,000 square feet adhering to the TIA-942 Tier-3 standard operating 24x7x365 Oracle, Quantum, Dell servers and storage Aperture Vista Management Application

Critical Information:

20+ equipment installs per month, 1,120 physical servers.

Data Center Operations Support

Admin support of enterprise services, storage/operating systems, service/operating system migrations.

Critical Information:

300+ networking devices with over 3000 VoIP’s, Reliability 99.9%.

Windows/Unix/Linux System Administration & Storage and Enterprise Backup Services

UNCLASSIFIED

UNCLASSIFIED

Key Technologies:

SAN

VMWare Microsoft

RHEL

Exchange Solaris/Unix

MS Windows Remote Desktop Services

SCCM

Sharepoint

HBSS/ENS

Dell Hitachi

IBM

Provide Center-wide Video Teleconferencing (VTC) Support.

Key Technologies:

Cisco Codecs VCWizard scheduling system Crestron control system

Critical Information:

Contract will provide support for 8 room-based VTC systems requiring scheduling, facilitation, conflict mitigation, and customer training/interaction.

VTC Operations

Provide Center-wide Multimedia Support to include the installation, configuration, and maintenance of multimedia technology.

Key Technologies:

Digital video and audio switches System controllers Audio reinforcement Camera systems Displays VTCs and DVTCs Cable TV

Critical Information:

Contract will provide support for NASIC’s Auditorium, 16 Corporate Conference and VTC Rooms and approx. 85 additional small to medium size Conference Rooms across the facility.

Multimedia Hardware Support

Provide technical support to ensure all NASIC software meets security, interoperability, and usability standards before utilization on the Enterprise Architecture including: software vulnerability scanning, research in support of Certificate to Field (CTF), NASIC DevSecOps container orchestration and software quality assurance, assist help desk in software installation/licensing issues, NIST 800-53 software security control answers, and review and track software Plans of Actions & Milestones (POA&M).

Key Technologies:

Assured Compliance Assessment Solution (ACAS) DevSecOps (e.g. Kubernetes, Docker, Pivotal, Harbor, Claire) VMWare Virtual Machine

Critical Information:

Essential knowledge of Key Technologies with emphasis on VMWare and ACAS, appropriate certifications (IAT II), knowledge of NIST 800-53 Risk Management Framework fundamentals.

Software Vulnerability Testing

Research, test, evaluate, and recommend technical solutions to fulfill customer requirements. Maintain a development, testing, and integration environment and utilize it to test upgrades, integration, installation, implementation, and deployment of current and future key products and technologies. Documentation of all research, testing, and recommended designs. Test cutting edge technologies and practices to improve and secure production systems.

Key Technologies:

Microsoft-based systems and software, Linux systems and software, VMware, AWS, network services (DNS, LDAP, AD, HBSS, ACAS, Tanium, InfoBlox, F5, etc.), specialized software, physical and software-defined networks (Cisco, Ruckus, Cisco ACI, NSX, etc.), hardware evaluations (Dell, HP, etc.), storage systems (Dell EMC, VMware vSAN, AWS S3, etc.), modernization efforts, new technologies.

Critical Information:

Resources act as Tier IV-expert support for the operational branches. Technical research and documentation are key aspects of job performance.

Systems Engineering

Participate in technical reviews, teams, and discussions to plan, support, and execute all systems engineering requests.

Perform Assist and/or advise on installation, configuration, troubleshooting, technical assistance, and/or training in response to customer requirements for the IT environment Analyze security and regulatory compliance and make recommendations to ensure compliance, and minimize security risks, and prevent or detect insider threats.

Draft/coordinate/update design, architecture, implementation, and security documentation and artifacts including engineering references, implementation instructions, and security compliance documentation Build, present, and publish guardrails for approved architecture solutions and standards Design,Design, develop, and implement plan secure designs for new or existing systems. Ensure that the design of hardware, operating systems, and software applications meets cybersecurity requirements for the system.

Research, evaluate and provide feedback on problematic IT architecture, operations, and cybersecurity trends and patterns.

Work with system engineers and administrators to jointly solve cybersecurity problems.

Develop IT architectures and designs to conform with capacity, performance and cybersecurity integrity and availability requirements. Designs will conform to DoD Architecture Framework standards.

Assist to dDevelop, /maintain, /coordinate, and /update system engineering processes and procedures related to configuration management and architecture standards and changes.

Support systems integration between current and new services, operating systems, servers, and applications as required.

Provide engineering technical support and documentation for upgrades, integration, installation, implementation, and deployment for current and future Microsoft products.

Provide high-level (Ttier- 4) troubleshooting and remediation for all Microsoft productscurrently deployed systems and technologies Provide expert-level Group Policy analysis, design, configuration and management to support configuration management, cybersecurity, and availability requirements.

Support systems engineering branch for cybersecurity integration including role-based access control, DISA Security Implementation Guidance (STIG) implementation, OS deployment configuration, and preparing and presenting presentations, papers, and documentation, as required.

Integrate and support new and emerging technologies such as high-performance cluster computing, cloud integration, desired configuration management, automation, and database management.

Provide functional area reports weekly, summarizing work accomplished, work planned, and important issues occurring during the week.

Automate all tasks using approved automation tools to include Desired State Configuration, Aansible, /puppet, /chef, /Terraform, orm YMAL/etc.

Install, configure, test, and maintain network components including switches (including Cisco and , Brocade, and Force10), firewalls (Cisco and Palo Alto), load balancers haproxy and F5), and related network components in non-productiondevelopment, test, and integration environments Provide state-of-the-art techniques for designing, developing, modifying, and troubleshooting highly complex networks. Subject matter expert on emerging network technologies Serve as a senior member of the team responsible for the planning and development of a robust, scalable, and highly available network infrastructure hHave knowledge of network and web related protocols (e.g. IPv4 and IPv6, TCP/IP, UDP, HTTP, HTTPS, SSL, TLS, DNS, routing protocols including OSPF and BGP) Provide expert support, analysis and research into exceptionally complex security problems and challenges Ensure that the architecture and design of information systems are functional and secure Provide expert support for Information Technology in areas of information systems architecture, telecommunications systems design, architecture, implementation, information systems integration, software development, security engineering, and communications and network systems management Continuously evaluate enterprise processes and adopt automation and self-service capabilities in engineered solutions to improve service delivery

Requirement:

Design and upkeep of IT Service Management platform(s) including workflow creation, automation, orchestration, dashboards, customer-facing self-service portal, data management, system patching and data validation. Assist process owners with creation of workflows and dashboards. Provide Tier IV support for ITSM system troubleshooting and remediation.

Key Technologies:

Microsoft System Center Suite ServiceNow IT Infrastructure Library

ASP.NET

C# Visual Studio SQL Server Reporting Service

Critical Information:

Works with IT Service Owners to implement and support requested ITSM processes.

IT Service Management

Perform installation, configuration, troubleshooting, technical assistance and/or training in response to customer requirements for the IT Service Management tool (Currently Microsoft’s System Center Service Manager [SCSM] with plans to move to ServiceNow IT Service Management module) Develop, test, and troubleshoot scripts written in Microsoft Powershell.

Support performance monitoring and situational awareness ‘dash-boarding’ for IT systems and processes within the ITSM tool Draft/coordinate/update design, architecture, implementation, and security documentation and artifacts including engineering references, implementation instructions, and security compliance documentation Assist with modifying NASIC’s self-service portal, XML management packs, and service workflows in SCSM and ServiceNow Assist with Standard Operating Procedure development and publish to shared repository Plan, install, configure, and troubleshoot ITSM tool and integration with other reporting/management tools:

Operating systems for monitoring ITSM Servers (SQL, SCCM, SCSM, ServiceNow) Microsoft System Center Orchestrator and Integration Packs Non-Microsoft third-party service management products (Provance or zenoss) Cloud systems to include AWS, Azure, VMware, etc.

Create, modify, and troubleshoot web dashboards Microsoft Internet Information Server (IIS) using hypertext markup language (HTML), ASP.NET, C#, and Visual Studio.

Create and modify web-based reports in SQL Server Reporting Services (SSRS).

Provide high-level (Ttier- 4) troubleshooting and remediation for all MicrosoftITSM products and technologies on an ad-hoc basis IAW established procedures and processes.

Automate all tasks using approved automation tools within the ITSM tool to include ServiceNow, /aAnsible, /puppet, /chef, /Terraform, YAML/ etc.

Assist in the automation of monitoring and alerts from enterprise services to CFP Continuously evaluate ITSM processes and adopt automation and self-service capabilities to improve service delivery

Requirement:

Support NASIC in the refining and executing of CM processes, propagation of CM culture, and growing of CM to a mature state laden with repeatable industry best practices in order to provide enduring rigor. Assisting w/ development of CM policy, processes, and tools.

Key Technologies:

Microsoft ITSM ServiceNow

Critical Information:

Broad technical understanding, strong interpersonal and organizational skills.

Configuration Management Support

Technical Support of critical Cybersecurity capabilities that provide NASIC Intelligence missions assurance their information is protected from unauthorized access and manipulation and it is available to NASIC employees, partners, and consumers where and when it is needed. Services include audit configuration and event management, end-point protection, anomalous network activity review, network intrusion and malware behavior reviews, Security Information and Event Management (SIEM) configuration and review, NIST 800-53 RMF security controls, Firewall review and approval, STIG review and implementation, and expert support to Information System Continuous Monitoring activities.

Key Technologies:

HBSS

Elastic (ELK) Stack Palo Alto Firewall NIST 800-53 RMF and accompanying NIST procedures

XACTA

SCAP Compliance Checker Assured Compliance Assessment Solution (ACAS)

Critical Information:

Require skillset in Active Network Defense, Incident response, Vulnerability Management, NIST 800-53 Risk Management Framework, Boundary Protection, understanding of Cloud and DevSecOps environments, IAM I/IAT II, diverse technical background.

Cybersecurity

Oversight of VMware and Cloud Infrastructure as a Service offerings. Design and testing of VMware vRealize suite including self-service automation portal, system blueprints, virtual networks. Coordination and collaboration on Cloud resource design, administration, and usage.

Key Technologies:

On-premises VMware including vRealize Suite.

Cloud-based AWS offerings on GovCloud, SC2S, and C2S.

Critical Information:

Work in tandem with system administrators and data center operations to provide Tier III support of IaaS platforms.

Infrastructure as a Service and Cloud Operations

Manage the VMWare environment to provide virtual resources to all NASIC missions as approved by the NASIC governance process Provide maintenance, administration, update, configuration, integration, and documentation of the IaaS and cloud environments Maintain the self-service portal to provide virtual resources to approved missions using (VVMware vRealizeR suite of tools and integration with ServiceNowAutomation) Maintain VM blueprints (configuration, STIG, patching) for deployment ion the IaaS environment Monitor operations of the virtual environment (vRealizeVR Operations) Install, configure, maintain, and operate cloud-based servers (VMware, AWS, Azure, Google, etc.)

Build and maintain non-pivotal base images (imagestreams, templates, Terraform/YAML, Ansible) Develop image change workflows and standards for development and scientific base images (Chef, Puppet, Ansible, DevSecOps) Monitor and manage cloud services (VMware, AWS, Azure, Google) Design and implement cloud services for performance and autoscaling Monitor runtime behavior of the services Manage IaaS and cloud service availability Request quotas and manage IaaS and Cloud resource limits. Recommend additional hardware resources for on premises IaaS system.

Proactively evaluate IaaS and cloud applications, services, hardware, and software Manage and design cloud environments (AWS, Azure, Google) Assist with Pprovisioning, operatione, and maintaimaintenance ofn cloud systems (Linux, Windows, AWS, Azure, Google) Assist with data migration to/from cloud providers (AWS, Azure, Google) Design and build scalable cloud solutions Build and manage bootstrapping automation Design and automate cloud compute (EC2) storage (S3, Glacier) and resource monitoring Manage IaaS and cloud tenant provisioning, isolation, and capacity (VMware NSX, VPC and Security group management) Design, manage, and implement quotas and Role Based Access Control (RBAC) Manage Enterprise cloud orchestration components (Puppet, Ansible, Chef, Kubernetes, Docker, and Terraform) Apply security controls to cloud technologies (manage secrets, secure CI/CD pipeline, Secure Infrastructure as Code (IaC), container security) Define, implement, and tune detective capabilities to detect and remediate malicious activities (cloud based container vulnerability scanning tool) Conduct continuous monitoring solutions to validate systems against security baselines Manage and design IaaS and cloud security policies Manage and design IaaS and cloud security package (coordinate w/16AF) Manage cloud task order (coordinate quarterly modifications, provide monthly status reports) Manage cloud resource utilization (VMware vRealize Operations, AWS cost explorer, utilization reports and alerts, manage resources across on-premises clusters and cloud-based VPCs) Manage cloud identity and access management (IAM policies) Design, deliver, and maintain automated deployments (vRealize Automation, Terraform, Ansible) Provide automation-oriented strategic support and advisory services Build tools and create Infrastructure as Code (IaC) solutions in a DevSecOps environment Continuously improve IaaS and Cloud processes and solutions to be scalable and highly available Implement automated detection and alerting of anomalous behaviors Design and maintain deployment pipelines (standards, quick starts, and templates)

Manage the platform environment to provide automated container operations for NASIC’s micro-service architecture. Provide maintenance, administration, update, configuration, integration, and documentation of the PaaS. Maintain the CI/CD pipeline allowing approved code to move from the unclassified development environment to be run on the classified PaaS

Critical Information:

Work in concert with developers and system administrators to provide Tier III support of PaaS platforms.

Platform as a Service Operations

UNCLASSIFIED

UNCLASSIFIED

Key Technologies:

Linux Containers Pivotal Cloud Foundry Kubernetes Mesosphere DC/OS Konvoy

AWS

VMware

BOSH

Chef Puppet Ansible

Platform as a Service (PaaS) Operations Manage the platform environment to provide automated container operations for NASIC’s micro-service architecture (Linux, Containers, Pivotal Cloud Foundry, Kubernetes, Mesosphere DC/OS, Konvoy) Provide maintenance, administration, update, configuration, integration, and documentation of the PaaS Maintain the CI/CD pipeline allowing approved code to move from the unclassified development environment to be run on the classified PaaS (Chef, Puppet, Ansible) Maintain configuration, STIG, patching for the PaaS Build and maintain base images (imagestreams, templates, Terraform/YAML, Ansible) Manage and monitor platform quotas and resource limits Conduct platform application/test development and assist with user acceptance testing Respond to platform deployment pipeline test failures and application outages Design and build hardware solutions and manage bootstrapping automation (Infrastructure as Code (IaC) tools, Chef, Puppet, Ansible) Perform platform cluster install and manage infrastructure services and scalability (Pivotal Cloud Foundry, Kubernetes, Konvoy) Manage platform authentication and authorization Manage platform tenant provisioning, isolation, and capacity (RBAC, Security group management, quotas) Design and maintain deployment pipelines (standards, quick starts, and templates)

Requirement:

Design, develop, administer and manage databases and middleware servers to sustain and enhance the knowledge management capabilities and intelligence production process.

Key Technologies:

-Database Management:

Oracle 19c, MariaDB, ElasticSearch (in the future MongoDB) Administration, performance tuning, cybersecurity -Enterprise Application Server Software Administration:

WebLogic, OHS, Apache, NGINX Administration, PKI enabling, cybersecurity

Critical Information:

Resources will be used to support the existing DBA team

Database Management & Enterprise Application Server Software Administration

Maintain, administer, & monitor all NASIC Electronic Security Systems and support NASIC’s Security Directorate including system administration, staging, hardware installation, and maintenance certification.

Key Technologies:

Intrusion Detection System:

LINX Predator Elite Access Control System:

SMS StarWatch Critical Information:

Security enterprise encompasses external and internal video surveillance cameras, recorders, client workstations, servers, database, intrusion detection points, visitor management system, badges, badging stations, access control points, and turnstiles.

Physical Access Control System & Intrusion Detection System Operations and Support

NASIC is constructing a new 1,000+ seat facility, expected to be completed in FY23 Facility will require additional physical security, infrastructure, service desk, & touch maintenance support.

NASIC workforce continues to increase annually, adding an average of 100 people per year which will result in continued requirement growth.

Expertise retention critical in technically diverse positions (e.g. DB management, Cybersecurity, IaaS, PaaS).

NASIC continues migration to Hybrid on-premises/cloud reference architecture.

Additional Considerations

FY20 – 25 Modernization LOEs

NASIC/SC FY20 Modernization Efforts

Modernization LOE Mapping

Engineering Review Teams (ERTs)

NASIC Architecture Technology Stack

NASIC

NATIONAL AIR AND SPACE

INTELLIGENCE CENTER

UNCLASSIFIED

image1.jpeg image2.png image3.png image4.jpeg image5.png image7.png image8.png image9.png image10.png image11.png image12.png