GSM-O_II_Site_Visit_Consolidated_Brief_110718_Final.pptx

Rules of Engagement GSM-O II Site Visits

6-9 Nov 2018

Danielle Mazander Contracting Officer 6 Nov 2018

UNCLASSIFIED

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Rules of Engagement & Conduct During Site Visits Avoid communication with DISA Global/onsite staff (Government and contractor) during/before/after tours to minimize disruption to DISA Global mission Tour Guides will stay “on script” and all discussion/questions/comments during individual tours will be documented and shared among all interested parties Private/one-on-one conversations between Government and any one offeror are not permitted (includes post-visit social events) All questions/comments must be submitted in writing (notecards provided or email) Provide/send to Shannon Sanders at shannon.k.sanders3.civ@mail.mil Questions may be submitted through COB November 13, 2018

1 Nov 18 -- 1428

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DEFENSE INFORMATION SYSTEMS AGENCY

The IT Combat Support Agency

/USDISA

@USDISA

www.disa.mil

DISA Global Operations Command Command Brief COL Lisa D. Whittaker Commander October 2018 Overall Classification: UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED// FOR OFFICIAL USE ONLY

UNCLASSIFIED// FOR OFFICIAL USE ONLY

UNCLASSIFIED// FOR OFFICIAL USE ONLY

Disclosure Disclaimer "The information provided in this briefing is for general information purposes only. It does not constitute a commitment on behalf of the United States Government to provide any of the capabilities, systems or equipment presented and in no way obligates the United States Government to enter into any future agreements with regard to the same. The information presented may not be disseminated without the express consent of the United States Government. This brief may also contain references to United States Government future plans and projected system capabilities. Mention of these plans or capabilities in no way guarantees that the U.S. Government will follow these plans or that any of the associated system capabilities will be available or releasable to foreign governments."

Globally-Focused Operational Command

One Command; two locations Scott AFB, IL and Hill AFB, UT Shared 24x7 operations and security of the DISN Globally connected enterprise virtual watch desk (EVWD) Proactive posture for 100% always on capability

World-Class Facility Orion Operations Center is the largest DoDIN and DCO 24x7 Operations Center in DoD and US

Lead for DoDIN Ops and Defense Unique Operational Command assigned only to DISA

Integrated Team of Professionals (Assigned, OPCON’d, Aligned, Direct Supported) Who Civilian Joint Multi-Component Contractors What DoDIN Ops

DCO

Intelligence Capability Delivery Supporting DoD/White House CCMDs Services Agencies

UNCLASSIFIED// FOR OFFICIAL USE ONLY

LINES OF EFFORT

Operate DISA’s enterprise infrastructure and services Secure and defend DISA’s enterprise infrastructure and services Sustain DISA’s enterprise infrastructure and services Maintain, train, and enable both the organization and its professional and resilient workforce

MISSION

Conduct Department of Defense Information Networks (DoDIN) Operations and Defensive Cyberspace Operations (DCO) of DISA's enterprise infrastructure and services for the Department of Defense (DoD) in support of the joint warfighter

VISION

The DoD’s premier globally-focused DoDIN and DCO trusted provider

Operate – Secure – Defend – Sustain

UNCLASSIFIED// FOR OFFICIAL USE ONLY

UNCLASSIFIED// FOR OFFICIAL USE ONLY

UNCLASSIFIED// FOR OFFICIAL USE ONLY

VISION

The DoD’s premier globally-focused DoDIN and DCO provider

VISION

The DoD’s premier globally-focused DoDIN and DCO trusted provider

Enabled by expertly trained and certified professionals ready to take on both today and tomorrow’s challenges and opportunities Postured to support our constantly evolving networks and services in response to the exponentially increasing cyber threat Duty Inspire Service Accountability

Powered by the core values of the Military Services and …

UNCLASSIFIED// FOR OFFICIAL USE ONLY

UNCLASSIFIED// FOR OFFICIAL USE ONLY

UNCLASSIFIED// FOR OFFICIAL USE ONLY

LINES OF EFFORT

Operate DISA’s enterprise infrastructure and services Secure and defend DISA’s enterprise infrastructure and services Sustain DISA’s enterprise infrastructure and services Maintain, train, and enable both the organization and its professional and resilient workforce

VISION

The DoD’s premier globally-focused DoDIN and DCO trusted provider

MISSION

Conduct Department of Defense Information Networks (DoDIN) Operations and Defensive Cyberspace Operations (DCO) of DISA's enterprise infrastructure and services for the Department of Defense (DoD) in support of the joint warfighter

UNCLASSIFIED// FOR OFFICIAL USE ONLY

Center for Operations “Named” Operations Support Service Operations “Operate & Defend DISA’s Enterprise Infrastructure and Services” Responsive CCMD Support Crisis Action Teams Cyber Operations team work – NSA & JFHQ-DoDIN Future Operations - Campaign Support Plan A-ISR, NC3, GMD, Presidential Msn

Synchronizing Day-to-Day Operations across the DISA Enterprise Battle Rhythm Synchronization DIR/DCIRs Orders ASI Coordination DCC-JDOC Synchronization Weekly Senior DCO Synch Monthly Ops updates Quarterly Readiness - DRRS Reporting , Updated METs

Computing Networks Field Offices

C2 of the DISA Enterprise

Coalition CCMDs Military Services Agencies DODIN Operations

DCO

ORION

Computing & Storage

DISN/Enterprise Services

Challenges Increasing Incident Counts; Decreasing Resources Automation/Tools End to End Service Management

“ONE ENTERPRISE”

Linking DISA to Warfighting Requirements

CENTCOM

EUCOM

PACOM

NORTHCOM/

SOUTHCOM

USCYBERCOM

AFRICOM

CENTCOM

Defends the Worlds Largest Military Network Against:

- Phishing Attacks Daily

- Web Attacks Daily

- DoS & DDoS Attacks Daily

- Scans & Probes Daily Rapid Development & Implementation of Countermeasures

- Active CM’s Deployed w/in 3 Mins

- 1.7M Active Blocks Preformed (SharkSeer,WCF,ACL)

- 80 active and passive CM Deployed Daily

- 83% of all Email Traffic is Mitigated

- 27% of all Internet Traffic is Mitigated Integration of Cutting Edge DCO Technologies and Capabilities

- JRSS & SharkSeer Operationalization

- DODIN CPT Engagement/Employment/Training Defensive Cyber Operations

OPS

ITIL Implementation:

- Incident/Problem Management

- Global Service Desk

- Performance Management Operationalizing Senior Leader Communications Governance – Assessing Operational Risk (NRRB) CCC Re-Alignment Global Service Desk Operations Critical Infrastructure Protection

DEFEND

COMMAND & CONTROL (C2)

OPERATE

1,400 Mil, 5,600 Civ and 8,000 Contractors in 21 States, 7 Countries, 1 U.S. Territory ~11.3B Budget DISA Provides, Operates and Assures:

$24B Enterprise, 9 Core Data Centers >1000 Enterprise Apps, Worldwide Transport >700 Teleport Missions, >40 RPA Flights

EVENTS

Events/day DCO Events / day >10M Alarms >20 Critical Auth SVC Interruptions >1,800 Trouble Calls Exercises Operations CPT Employment >500 Sensors >798M Events >300M Active Blocks Events requiring Orders

INCIDENTS

ACTIONS

>3,100 Tickets >300 Changes 45 Orders Tracked >30 Cybersecurity incidents ~13 Phishing Attacks >80% Emails Blocked Incidents / Day DCO Incidents / day Compliance Monitoring Critical Issues Orders Tippers / Counter Measures 10 Worked 7 Published 3 Received 27/79 DoD’s Cyber Forward Edge of the Battle Area 3M+ Users Defended 161 CSSP Customers 300 TB of Data/38M E-mails Processed

30+ Named Operations, support to virtually all DoD members - OUR GOAL = 100% Mission Assurance

INTERNET

DoDIN

DISA Enterprise Day in the Life of DISA Operations

DEFEND

COMMAND & CONTROL (C2)

OPERATE

1,400 Mil, 5,600 Civ and 8,000 Contractors in 21 States, 7 Countries, 1 U.S. Territory ~11.3B Budget DISA Provides, Operates and Assures:

$24B Enterprise, 9 Core Data Centers >1000 Enterprise Apps, Worldwide Transport >700 Teleport Missions, >40 RPA Flights

EVENTS

Events/day DCO Events / day >10M Alarms >20 Critical Auth SVC Interruptions >1,800 Trouble Calls Exercises Operations CPT Employment >500 Sensors >798M Events >300M Active Blocks Events requiring Orders

INCIDENTS

ACTIONS

>3,100 Tickets >300 Changes 45 Orders Tracked >30 Cybersecurity incidents ~13 Phishing Attacks >80% Emails Blocked Incidents / Day DCO Incidents / day Compliance Monitoring Critical Issues Orders Tippers / Counter Measures 10 Worked 7 Published 3 Received 27/79 DoD’s Cyber Forward Edge of the Battle Area 3M+ Users Defended 161 CSSP Customers 300 TB of Data/38M E-mails Processed

30+ Named Operations, support to virtually all DoD members - OUR GOAL = 100% Mission Assurance

INTERNET

DoDIN

DISA Enterprise Day in the Life of DISA Operations 1000+ AD Mil, Civ and Contractors in 4 States 100% of DoDIN 100% of RPA/GCN missions 85% Critical ASIs 1200+ (50%) Trouble Calls 220+ Incident Tickets per day 64 Network Changes Majority of Critical Issues require DISA Global action Execute 3 DTOs, 1 EWL, 2 WCF 95% of CSSP Customers Defended

JFHQ-DoDIN - DISA Command Structure

LNOs

COORDINATION

MILDEPS

USCC

DOD CIO

TACON

Agencies *

Marines* MARCYBER

Army* ARCYBER

Navy* FLTCYBER

Air Force* AFCYBER

OPERATIONS

SUPPORT

LEGEND

LNOs

DISA

JFHQ-DoDIN 2-color Shading = Dual-Hatted *For DO/DCO Mission

TACON

ADCON

Coord Direct Spt

OPCON

Direct Report Ecosystem

Joint DoDIN Operations Center (JDOC)

J8 J5/J7 J3 J2

LE/CI

FBI

NSA

DHS

IC

Service CYBER Component CMDs

CCMDs

OPCON

OPCON

Direct Support Coord

ADCON

ADCON

Direct Report

Director of DISA Ops

USN

USA

USMC

USAF

CDR JFHQ / Director DISA J1/J4

J6(CIO)

Service NOSCs, IPNs, CDCs , B/P/C/S, CPTs, Tactical NOSCs

OPS COS

J9

Deputy CDR – JFHQ

Vice Deputy Special Staff (SJA, PAO, etc..)

Enterprise Services Computing Environment Mission Assurance Networks

(DISN)

Field Offices DISA Global

OPCON

DISA Command Center (DCC) White House

UNCLASSIFIED// FOR OFFICIAL USE ONLY

Insider Threat DISA Global Integrated C2 and Mission/Functions Process Improvement Process Improvement

ERS/DMP

Engineering Defense Operations C2 SIPR Core Defense

CSSP

DMZ

Web (WAF), REL & FED DMZ JRSS and JMN Named Missions

UC NOC

DSN, DRSN, GVS, EVoIP

AISR

NOC

TRANSPORT

NOC

OTH, ODXC, MSPP, ATM, PROMINA, CIENA

ASI

Gateway Services

STEP/ TELEPORT

Mission Assurance

Physical/ Logical Diversity Implementation Major Network Changes to Boundary

IAP, WCF, NFG

REL, FED DMZ

Cyber Strategy Initiatives Unified Capabilities Mission Integration

Require-ments Ecosystem Defense Quality Assurance

IAP

WCF

NOC

Contingency & Exercise Planning Mobility Gateway

DMUC,DECTK, DMCC

MHS, MDA, NC3

NOC

GSD-S

(Service Desk)

COOP

Planning DNS Ops G-Root

NOC

IT&A

Performance Management Change Management Configuration Management Service Transition Risk Management Command & Agency strategy

JRSS

Process Improvement

CSAAC

DevOps IT Support DoD NIC NOC

COL

Net Assurance POA&M tracking OSS Mgt

Boundary Cell Transport Cell Network Operations Centers CPT Scott & COL NA DCO Plans and Programs Operational Engineering UC Services Cell JRSS Cell

IP

NOC

NIPR/SIPR

Commercial Vendor

NOC

OSS

NOC

Operational Impact Analysis Tool Development, Innovation and Integration Acropolis O&M Network Impact Assessments Centaur Ops Mission and Project Planning Core Transport (NIPR & SIPR, Optical) Coalition MNIS

APAN

DECCs DISANet Public Key Infrastructure

(PKI)

DMCC & DECTK

CAP

DoDIN Boundary Defense IAP, DDoS, WCF

JRSS

NOC

GCN

NOC

Dev Ops Problem Mgt

DMCC & DECTK

Gateway Services

STEP/ TELEPORT

Process Improve-ment

ASI

Strategic Defense Programs Adaptive/Deliberate Planning PMO Liaisons

UNCLASSIFIED// FOR OFFICIAL USE ONLY

ASO Oracle Advanced Security Option ATM Asynchronous Transfer Mode COOP Continuity of Operations CSSP Cyber Security Service Provider. Previously CNDSP or CNSP.

COL Columbus OH CAP Cloud Access Point DECTK DoD Enterprise Classified Travel Kit DMCC DoD Mobility Classified Capability DMUC DoD Mobility Unclassified Capability DMP Data Management Plan DNS Domain Named Service DMZ Demilitarized Zone ERS Enterprise Recursive Service G-Root One of the root servers for the www maintained by the DoD. There are a total of 13 root servers for the www.

GCN Ground-Based Midcourse Defense (GMD) Communications Network GSD Global Service Desk OSS Operational Support System IAP Internet Access Point IT&A Initial Test and Acceptance JMN Joint Information Environment Management Network JRSS Joint Regional Security Stack MSPN Multi-Service Provisioning Network MSPP Multi-Service Provisioning Platform NIC Network Information Center NOC Network Operations Center OOB Out of Band Management Network ODXC Optical Digital Cross-Connect OTH Optical Transport Hierarchy OTS Optical Transport System OSS Operational Support System PMO Program Management Office POA&M Program, Objectives, and Milestones UC Unified Capabilities WAF Web Application Firewall WCF Web Content Filtering

DISA Global’s Role in Cyber Operations

CCMD/S/A

TACTICAL EDGE

Ecosystem

DoDIN

STEP/ Teleports (13 Sites)

DNS

G-root

Inspect 7M outbound Block 19M incoming

Acropolis

500+ Sensors FPCAP (Noesis) Netflow (Silk) IDS (SourceFire) DDoS (Arbor)

2,500 User Applications

EEMSG

17,000 Circuits IP Core

TELEWORK /

MOBILITY

INTERNET

Data Tap

Firewall

NIPR

NIPR Federated Gateway/ CAP

200 TB /day

IAP

(10 Sites)

Commercial Cloud

COALITION

CAP

NFG

JRSS

48 Stacks

48 Stacks

UNCLASSIFIED// FOR OFFICIAL USE ONLY

CAP Cloud Access Point DEE Defense Enterprise Email DNS Domain Name Service IDS Sourcefire Intrusion Detection System EEMSG Enterprise Email Security Gateway FPCAP Nicksun Full Packet Capture IAP Internet Access Point UC Unified Capabilities

VISION

The DoD’s premier globally-focused DoDIN and DCO trusted provider

MISSION

Conduct Department of Defense Information Networks (DoDIN) Operations and Defensive Cyberspace Operations (DCO) of DISA's enterprise infrastructure and services for the Department of Defense (DoD) in support of the joint warfighter

LINES OF EFFORT

Operate DISA’s enterprise infrastructure and services Secure and defend DISA’s enterprise infrastructure and services Sustain DISA’s enterprise infrastructure and services Maintain, train, and enable both the organization and its professional and resilient workforce

DISA Global Strategy

UNCLASSIFIED// FOR OFFICIAL USE ONLY

UNCLASSIFIED// FOR OFFICIAL USE ONLY

From Lines of Effort to End State

Operate Secure & Defend Sustain Enable Mission Assurance Incident Management Exercise Planning Boundary/Mid-Tier Defense Network Assurance Enclave Defense

CNDSP/CDSP/CSSP

Performance Management Problem Management Configuration Management IT&A Future Planning Mission Support Workforce Development Globally Synchronized Responsive Execution

Unity of Effort

Alignment with Mission Partners and HQ End State

UNCLASSIFIED// FOR OFFICIAL USE ONLY

Integrated / Mission Focused / Threat Specific / Responsive

Integrating Missions & Unity of Effort Defensive Cyber Ops

Real Time Analysts and Countermeasures (Passive and Active Defense, Detect, Analyze, Mitigate, Hunting, Countermeasures) Triage analytics and Incident Response across the DoDIN Perimeters

DISA Global NA, COL NA, DoD NIC, CPTs

Capability Delivery

Problem/Configuration Management (Implement, Configure, Secure, Sustain & Maintain) Provide engineering/trend analysis, modeling, performance, QA, IT&A, change and problem mgt for DoDIN Ops

Operational Engineering, Centaur Ops DoDIN Ops

Incident Management (Operate, Maintain, Secure, Mission Assure) Synchronization of NetOps through Incident Management

DISA Global Operations

Network Assurance Mission Assurance Positive CM/CC enabling NA and MA

C2

INTEL

Operations

UNCLASSIFIED// FOR OFFICIAL USE ONLY

/USDISA

@USDISA

www.disa.mil

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

UNCLASSIFIED// FOR OFFICIAL USE ONLY

UNCLASSIFIED// FOR OFFICIAL USE ONLY

Active-Active Global Operations and Security DoD Continuous Operations Supporting Warfighters Worldwide Craig Ord Chief, Operational Engineering 6-7 November 2018

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Active-Active Defined Always on, continuously available operational and security capabilities, where a fault in a single location does not affect the ability of DISA Global Operations Command to continue to perform seamlessly in another location with zero downtime.

Continuously available or Active-Active operations will ensure uptime of the DoD Information Network vice recovery.

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Active-Active Near-Term Objectives Improve survivability of globally delivered DISA and DISN services Provide improved security and enable defense of the DISN Improve operational responsiveness to the customer Integrate defensive cyber operations (DCO) mission and capabilities Enhance information flow through eliminating situational awareness (SA) stovepipes

UNCLASSIFIED

Active-Active Attributes

One Command; two locations Shared 24x7 operations and security of the DISN Globally connected enterprise virtual watch desk Proactive posture for 100% always on capability End user services transfer to other OC orgs COOP planning, training, and operations activities are significantly reduced

FY18

FY20

FY19 Implement Active-Active Operations

Global Operations and Security – Timeline

FY19

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Global Operations and Security – IOC Active-Active IOC (Q4 FY18) Full global DISN operations, with workload shared across two sites, as well as the ability to operate and secure the network from one location if the other is not available.

DGOC-W Capabilities 24x7 watch floor operations Minimally manned JRSS NOC (24x7 for Ops; 16x5 for Tools) Boundary cell support (Tiers 1 and 2) Incident management (O&M and OSS) Limited problem management, change management and network impact assessment capabilities Defensive Cyber Operations

AISR

DGOC-W Connectivity

OSS/DCN

DRSN

DSN

Unclass/Class DISANet

PUSHKEY

EVoIP/ECVoIP DGOC-W Personnel Civilian – 66 billets Military – 24 billets Contractor ≈ 100 personnel

* Majority of leadership (Site Lead, XO, Ops Chief, Mil Dep)

* Limited support staff

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Global Operations and Security – FOC Active-Active FOC (Event Driven) Integrated operations and security into a single fully converged operational environment that spans across both the DISN and the DISA Computing Ecosystem, regardless of the physical locale or particular service.

Will involve building a new facility at Hill AFB

/USDISA

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Mr. Clayton Peters Division Chief, Operations DISA Global Operations Command Cyber Operations Division (DG3) November 2018

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DEFENSE INFORMATION SYSTEMS AGENCY

The IT Combat Support Agency

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Our Mission

Lead, Manage, Maintain, Operate, Defend, Secure, and Execute the centralized management of Global DoDIN net-centric services in support of COCOMs, Services, and DoD Agencies DISA Global Cyber Operations Division

UNCLASSIFIED

DISA Global Operations – DG3 Organizational Layout

DODIN

Transformation Branch

PEOPLE

PROCESSES

TECHNOLOGY

Cybersecurity Branch

Current

Current

DG31

DG32

DG33

Operations Division (East) Scott AFB

Operations Division (West) Hill AFB

IOC

Continuous Synchronization

Coordination

UNCLASSIFIED

Cybersecurity

Cyber Fusion / Countermeasures CPT Support JRSS DCO Support CSSP Integration

Core Missions / Mission Areas

Core Missions

DODIN Transformation

Incident Management Manage 88% DoDIN Operations Cybersecurity detection and response activities Mission Assurance

-- RPA/MDA/DHA/AISR/IAP/DEE

Enterprise Email Mail Security Gateway (EEMSG) DECCs / Enterprise Applications Cross Domain Solutions NIPRNet Mobility

Enterprise Netops Management De-conflict Network Enterprise Impacts Persistent C2 Netops Awareness Enterprise Netops Management Intra/Inter Agency Coordination IAP Net Defense CNDSP Level II Support Contract Quality Assurance Mission / Exercise Support Knowledge Management Mange IAPs Globally Enterprise Email Mail Security Gateway (EEMSG) JRSS Management DCO Mission CPT Msn Engagement Support Tactical Gateway Access Tactical Mission Director (TMD) Manage COOP Knowledge Management (KM) Mission / Exercise Support New Mission Integration NetOps Tools Support Contract Quality Control DISA Global Ops Training Mgr

Current Operations Branch

Global Enterprise Defensive Cyber Operation Branch (COL NA)

DoD Network Information Center (DoD NIC) Manages DNS Services .mil .smil .sgov Maintains g-root Maintains “whoIs” database

(OPCON to DISA Global) Mission Areas (OPCON to DISA Global)

ERS/DMP

Operations C2 DODIN Boundary Cell DISA Global Integrated C2 and Mission/Functions SIPR Core Defense

CSSP

X 102

DMZ

Web (WAF), REL & FED DMZ JRSS and JMN Named Missions

UC NOC

DSN, DRSN, GVS, EVoIP

AISR

NOC

TRANSPORT

NOC

OTH, ODXC, MSPP, ATM, PROMINA, CIENA

ASI

Gateway Services

STEP/ TELEPORT

Mission Assurance

Physical/ Logical Diversity Implementation Major Network Changes to Boundary

IAP, WCF, NFG

REL, FED DMZ

DECTK, DMCC

Cyber Strategy Initiatives Unified Capabilities Mission Integration Requirements Ecosystem Defense Quality Assurance

IAP

WCF

NOC

Contingency & Exercise Planning Gateway Services

STEP/ TELEPORT

Mobility Gateway

DMUC,DECTK, DMCC

MHS, MDA, NC3

NOC

GSD-S

(Service Desk)

COOP

Planning DNS Ops G-Root

NOC

IT&A

Performance Management Change Management Configuration Management Service Transition Risk Management Command & Agency strategy

JRSS

Process Improvement & Initiation PMO Liaisons

CSAAC

DevOps IT Support DoD NIC NOC

COL

Net Assurance POA&M tracking OSS Mgt

Boundary Cell Transport Cell Network Operations Centers CPT Scott & COL NA DCO Plans and Programs Capability Delivery

IP

NOC

NIPR/SIPR

Commercial Vendor

NOC

OSS

NOC

Operational Impact Analysis Tool Development, Innovation and Integration Acropolis O&M Network Impact Assessments Centaur Ops Mission and Project Planning Core Transport (NIPR & SIPR, Optical) Coalition MNIS

APAN

DECCs DISANet Public Key Infrastructure

(PKI)

DMCC & DECTK

CAP

DoDIN Boundary Defense IAP, DDoS, WCF Insider Threat

JRSS

NOC

GCN

NOC

Dev Ops Problem Mgt

UC Services NOC JRSS Cell

DG3 Weighted Effort Areas

UNCLASSIFIED

DISA Global Operations Command C2

Agencies *

Marines* MARCYBER

Army* ARCYBER

Navy* FLTCYBER

Air Force* AFCYBER

LEGEND

NON-DISA

DISA

DCO / NETOPS

*For DO/DCO Mission

TACON

Coord

OPCON

LE/CI

FBI

NSA

DHS

IC

Service CYBER Component CMDs

Coord

NTWK PRODUCT LINE

NTWK MGT TM

DISA ECOSYSTEM

OPS CTR

Joint DoDIN Operations Center (JDOC) DISA Command Center (DCC)

CSSP

Customers

NAVAL NTWK WARFARE CMD

DCO / NETOPS

24th AF (624th OPC CTR) 33rd NWS / 26th NOS

DISA Global White House Communications Agency (WHCA) DISA Field Offices Internet Service Provider(s) (ISP) Vendors Defense Information Technology Contracting Organization DITCO Mission Assurance Combatant Commands (CCMDs) Theater DISA NetOps Centers (DNC)

JRSS PMO

Joint Migration Team(s) Joint Service Provider (JSP) Coord

NETCOM Fusion Center / ACOIC / RCCs

CENTAUR OPS

COL-NA

DoD NIC

COAST GUARD

NAVY

AIR FORCE

ARMY

CDR JFHQ / Director DISA

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Areas for Continual Improvement

Contractor Surge Ability / Quicker Issue Resolution

Synchronization / Integration between and within Task Orders that Support the Tiered O&M of the JRSS Environment

Government and Contractor Teaming (Unity of Effort)

/USDISA

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Unity of Effort in Cyberspace Protecting the DODIN 24x7… Mr. Paul West Cybersecurity Branch Chief 7 Nov 18 DISA Global’s

DODIN Key Terrain Security & Defensive Points

DODIN

CCMDs/SERVICES/AGENCIES

TACTICAL EDGE

The IAP’s process 505 Billion Packets/day; of that, 73% is SSL encrypted 27% of all inbound traffic is actively blocked by IAP defenses 30 Cyber Incidents are discovered & report daily 653 Active & Passive Countermeasures are deployed daily 83% of all e-mail message traffic is malicious and blocked daily

2,500 User Apps

UC

ECOSYSTEM

DEE

EEMSG

ZND

GL

SiLK

McAfee

IAP

IP CORE

17,000 Circuits

DMP/ERS

DNS

G-root

47M Scans & Probes 29M Phishing & Spam Messages 194M Cyber Attack Attempts

164 DOS/DDOS

Attack Attempts

EMAIL

FLOW

(48 SITES)

STEP / Teleport (13 Sites)

Century Link

UNCLASSIFIED

DEFENSE-IN-DEPTH & Scrubbing DODIN Traffic

APAN

SiLK CenturyLink

CYCLOPS

NetFlow

McAfee Commercial Intel Sources

GTI

0-Day Malware Heuristics Rep. Data

Open Sensor Platforms Commercial Cloud Providers

NGX-PAC

NGS-EUR

INTERNET ACCESS POINT ACL

BREAK & INSPECT

WINDOW

WEB CONTENT FILTER

SH RKSEER

W.P.

AGENCY

BASE

Boundary (Tier I) Mid-Section (Tier II)

DMP/ERS

BREAK & INSPECT

FULL PACKET CAPTURE

Data Enrichment

ACROPOLIS

Enclave/Endpoint (Tier III)

CSSP

78 CSSP Customers

ENCLAVES & ENDPOINTS

ZND

GL

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DISA Global – Enabling Cyberspace Operations

JP 6-0 “Joint Communications System” & JP 3-12 “Cyberspace Operations”

Network Focused – Threat Agnostic DoD Information Network Operations

ACTIONS:

- Secure

- Configure

- Operate

- Extend

- Maintain

- Sustain

KEY POINTS:

- Goal is to “Prevent All Threats”

- Threat Informed / Intel Consumers

- CIO Statutory Actions Not Included (Overlap)

- Framework enabling most DOD Missions

Power Projection – Effects Generation Offensive Cyberspace Operations

KEY POINTS:

- Foreign Cyberspace

- Support of CCDR & National Objectives

Internal Defense Measures (IDM)

- Pro-Active Threat Hunting

- Internal Countermeasures Response Actions (RA)

- Externally Focused

- Foreign Cyberspace Capability Preservation – Threat Specific Defensive Cyberspace Operations

ACTIONS:

- Defend the DODIN

KEY POINTS:

- Targets Active / Imminent malicious activity

- Executed when Security Measures are:

GOAL:

- Defeat Threats

- Re-establish Security

INTELLIGENCE & THREAT INDICATORS

CYBERSPACE OPERATIONS

CYBER OPERATIONS SPT

• Integrates w/USCYBERCOM

• Coordinate/Plan Actions ISO Cyber Ops

• Advises Leadership on Cyber Ops COAs *Requires: CYBER & OPS SMEs

CYBER THREAT ANALYSIS

• Consumes Threat Intelligence

• Correlates Anomalous Activities

• Fuses Intel & Data to ID Actors *Requires: CYBER & INTEL SMEs

COUNTERMEASURES

• Utilize TTPs to Stop/Mitigate Threats

• Minimize Friendly Force Impediment

• Maximize Costs to Threat *Requires: CYBER SMEs

CYBER SECURITY WATCH OFFICERS

• C2 “Secure & Defend” Actions

• Cyber Event Analysis/Tracking/Reporting

• Cyber Real-time Threat Advisor *Requires: CYBER & C2 SMEs “Complies with CDRUSCYBERCOM direction, through the commander of JFHQ-DODIN, to execute DODIN operations and DCO-IDM missions at the global and enterprise level, within DISA-operated portions of the DODIN. “ “Complies with CDRUSCYBERCOM direction, through the commander of JFHQ-DODIN, to execute DODIN operations and DCO-IDM missions at the global and enterprise level, within DISA-operated portions of the DODIN. “

Threat Intelligence & Cyber Capabilities Integration IC / Cyber Reporting “Operations & Intelligence” Counter- Measures Real-Time Analysis Cyber Threat Analysis

Intelligence Enrich Threat Data Correlation Increase Cyber SA High Fidelity Analytics Content Development

CYBER THREAT ANALYSIS

Adversary TTP/Behavioral Analysis:

• Understand the Threat

Discovery Operations:

• Identify/Report Threat Presence

• Creation of unique Indicators of Compromise

• Recommend Follow-On Countermeasure Actions

COUNTERMEASURES

Detection & Mitigation Actions:

• Develop/Implement Detection Content from Threat Reporting

• Develop Mitigation Strategy

• Recommend Active & Pre-Emptive Tailored Response Actions

REAL-TIME ANALYSIS

Front Line Defense:

• 24x7 Monitoring & Incident Response

CTA & CM Enable RTA By Providing:

• Automated Alerting/Countermeasures

• Threat/Event Context

• Increase Threat & Situational Awareness

• High Fidelity Malicious Activity Alerting

Intelligence Community

Law Enforcement

Service Cyber Commands

Partner Network Defenders

UNCLASSIFIED

Combatant Commands

USCENTCOM

USEUCOM

USAFRICOM

USPACOM - USFK

USNORTHCOM

USSOUTHCOM

USSOCOM

USTRANSCOM – JCSE

USSTRATCOM – BMDS Training Sites

DISA Enclaves Anti-Drug NETWork Classified Connection Approval Office Defense Information Technology Contracting Organization DISA Information Systems Center Defense Messaging System Eagle Labs Training Center DISA Risk Management Executive DISA Headquarters Joint Interoperability Test Center Joint Spectrum Command Joint Staff Support Center Global Command and Control System DISA Local Control Center DISA National Capital Region DISN – Leading Edge Services Joint Staff Support Center

Carnegie Mellon University Defense Acquisition University Defense Contract Audit Agency Defense Finance & Accounting Service Defense Media Activity Defense Microelectronics Activity Defense Technical Information Center Satellite Communications Department of State DoD Education Activity DoDNIC Defense Health Agency Defense Prisoner Accounting Agency Global Air Transportation Execution System

MNIS

United States Unified Health Services

DISA-Sponsored Cleared Defense Contractors Northrop Grumman Newton-Saber Apriva Stanley

SAIC

Apptis Lockheed Martin Computer Science Corporation General Dynamics Info Technology Global Defensive Cyber Ops Mission CSSP Subscriber Protection Core

IAPNET

SharkSeer Web FireEye

JRSS

SIPR Core DMZs

WEB, B2B

FED, REL, NIPR

DECCs Cross Domain Solutions (CDES) Global DNS Server (G Root) Acropolis Public Key Infrastructure (PKI)

DMCC/DEC-TK

Defense of Enterprise Email NIPR Hardening Enterprise Mail Security Gateway

(EEMSG)

FireEye Zero Day NetDefense (ZND) Domain Name Service (DNS) Enterprise Recursive Services (ERS) .mil Proxy (DMP) Web Content Filter (WCF) Gateways

Defense Industrial Base Network Multi National Information System Tactical Mission Support

TELEPORT/STEP

DISA Global DCO Centers Scott CPTs

CPT 90 (USN; FGGM)

CPT 91 (USA; Ft. Gordon) CPT 92 (USAF; Scott AFB) CPT 93 (USN; Hawaii)

CPT 94 (USN; FGGM)

CPT 95 (USMC; Scott AFB) Columbus Net Assurance Centaur Ops Pensacola NAS St. Louis Columbus Coalition Networks Cloud Access Points

Defensive Cyber Operations (DCO) & CSSP DISA DCO/CSSP Mission Sets

/USDISA

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DISA Global Operations Command Operational Engineering Division AKA Infrastructure & Services AKA Capability Delivery AKA Lifecycle Management AKA Tier 2/3 Mr. Craig Ord Operational Engineering Division Nov 2018

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Topics Mission Org Scope Priorities

From Lines of Effort to End State

Operate Secure & Defend Sustain Enable Mission Assurance Incident Management Request Fulfillment Boundary/Mid-Tier Defense Network Assurance

CSSP

Performance Management Problem Management

IT&A

Future Planning Mission Support Workforce Development Global Synchronized Execution

Unity of Effort

Alignment with Mission Partners and HQ End State DG4 Primary DG4 Supporting

UNCLASSIFIED

Infrastructure & Services Division (DG4)

DG42

Infrastructure Branch Mr. Vogel

DG43

Mission Support Branch Mr. Wade

DG44

IT Support Branch Mr. Bruns

CONUS Core Transport Infrastructure (DWDM, ODXC, Promina, MSPP) Long Haul Point-to-Point RPA /MDA/AISR/C2BMC Mission Assurance Network Impact Assessments DISN Config Mgmt DISN Circuit Activations NIPRNet / SIPRNet / MPLS Core Global DoD Boundary (IAP/WCF/NFG)

SIPR REL / FED DMZ

DISN Converged Access

N-JRSS, S-JRSS

Pushkey, DCN, JMN Class & Unclass VoIP Core Mobility Gateway DECTK Gateway

Conduct engineering analysis, modeling, testing, installation Operate and Maintain management networks Performance and trending analysis Network modifications, Change Management Quality Assurance (QA) Mission Assurance Provide Information Technology (IT) Circuit Activation

Core Missions Mission Areas

DG41

Services Branch Mr. Fahsl DISA Global IT DISANet/LAN/GPON Data/AV/VTC/Phone Operational Support System Joint Mgmt System

DMUC/DMCC

ADMISS/ARDMISS

Tech Support Center (TSC) SharePoint Admin DISN Performance Tactical Modeling Performance Evaluations Node Commissioning Technical Assistance Visits (TAVs) DISANet/HBSS/PKI Command Cybersecurity Information Assurance Mgmt

DG45W

Inf & Services Branch Mr. Lin Division Chief Mr. Craig Ord Advanced Analytics Cybersecurity Compliance Incident & Problem Management System Administration Support for DG41/2/3/4 sustainment missions Change Mgmt (global MITs) Engineering Desk

ID53 (OPCON)

Centaur Ops Mr. Matzer Sensor Infrastructure Management Data Transport Mgmt Acropolis Mgmt ACAS / HBSS Compliance

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Infrastructure & Services Mission: Plan, engineer, implement, and provide technical support for enterprise infrastructure in direct support to joint warfighters, national-level leaders, and other mission and coalition partners across the full spectrum of global operations

DISN Managed Assets Focus on successful change with correlation, SA, & proper authorization

Changes managed monthly

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DISN Asset Management GLOBAL (73%) IP Transport UC 3887 4016 2394 EUR (15%) IP Transport UC 932 1081 91 PAC (9%) IP Transport UC 667 630 52 SWA (3%) IP Transport UC 231 177 30 Alt Routes 42705 42736 42767 42795 42826 42856 396 411 251 499 501 627 RF 42705 42736 42767 42795 42826 42856 650 458 434 560 642 627 IT & A 42705 42736 42767 42795 42826 42856 121 96 43 182 109 88 IP OE 42705 42736 42767 42795 42826 42856 364 373 965 427 595 716 UC OE 42705 42736 42767 42795 42826 42856 18 22 15 13 19 0 TO5 42705 42736 42767 42795 42826 42856 0 22 58 43 21 45 Total 42705 42736 42767 42795 42826 42856 1549 1382 1766 1724 1887 2103

Core OTN 2017

Diversity Links 7 & 12/13 Link 40 ECD FY17 TOT-A Core Access and Bandwidth Protection Link/Trunk protection Circuit protection interoperability Keeping DISA Global involved early & often minimizes operations and schedule risk

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DISA Global Command Priorities (DG4)

1) Supporting our Real World Mission 24x7 - Multiple ongoing OPS (OPR: DG3, Monday Ops) Activating 100G optical; 10 times increase in bandwidth Activating 6000+ new optical route miles; improving routes/diversity Activating Optical CDC/ Eliminating Optical SPOFs; dramatic performance increase Improving AISR diversity/performance/tech refresh Boundary & JRSS Cell Standup QA identifying power issues impacting operations of the DODIN

2) Supporting our Command's Inspections/Assessments (OPR: All) Supporting CSSP Assessment Preparations –4 Metrics Supported Accreditation Assessments- 6 Assessments Successfully Completed DGOC’s 1st CCORI

3) JRSS Operations / Migrations / Operator Training (OPR: DG3, Monday Ops) Establish JRSS Tier II Government & Contractor Supporting JRSS Vulnerability Management –Reviewing ACAS Scans

4) DGOC survivability / 3rd Route off-base / Supporting Scott AFB Customer survivability (OPR: DG4, OE Monthly) Completed three new paths on-base Working w/ IE for new path external to base

5) Fully developing our Boundary and JRSS Cells on the OPS floor (OPR: DG3, Monday Ops) Hired 6, training in-progress, engaged on JMT oversight & integrating “Tier II”

6) Process Improvement Initiative (OPR: DG2, PIE) Lead: Release & Deploy, Problem Management, Vulnerability Management; Support: 13 Others

7) Getting our hiring actions completed [still things we can do] (OPR: DG1, CMD & Staff) Completed 19 hiring actions

8) Supporting multiple IPTs at HQs regarding the bright future of our Command (OPR: All) Lead: Active-Active, Problem Management

9) Supporting multiple IPTs here and at HQs regarding the various NETOPS and DCO tools we require (OPR: DG2, PIE) DevOps Standup & Integration Director’s Tools Initiative

10) Bringing DISA Army Reserve Element (ARE) personnel onboard / NSA LNO / Tier III Spt / DevOps spt / 7th SC(T) (OPR: All) Championed / achieved: IP Cisco FE, UC Cisco FE, Juniper FE, Cienna FE In-progress: Palo Alto, NetScout

DG4 Priorities NetOps Cyber Security & RMF IP, Boundary & JRSS Engineering Desk Establish JRSS Tier 2 DGOC Survivability / Standup Filter Management Improve OSS Automation DISANet Service Offerings UC / DLA EVoIP / GSD Integration / GVS Complete 2015/2016 Re-org initiatives (MTOE) Improve Contract Performance and Accountability

UNCLASSIFIED

/USDISA

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

image1.png image2.png image3.png image4.png image5.png image6.png image10.png image15.jpeg image16.png image14.jpeg image17.png image18.jpeg image19.jpeg image20.jpeg image21.jpeg image29.png image30.jpeg image31.jpeg image32.jpeg image33.jpeg image34.jpeg image35.jpeg image36.jpeg image22.jpeg image37.jpeg image38.jpeg image39.jpeg image23.png image24.png image25.jpeg image26.jpeg image27.jpeg image28.jpeg image40.jpg image41.jpg image42.jpeg image43.jpeg image44.png image45.png image46.png image52.png image53.wmf image54.png image55.png image56.png image57.png image58.png image59.jpeg image60.png image61.png image62.png image63.png image64.png image65.png image66.png image67.png image68.png image69.png image70.png image71.png image72.png image47.png image73.png image74.png image75.png image76.png image77.png image78.png image79.png image80.png image48.jpeg image81.png image82.png image83.png image84.png image85.png image86.png image87.png image88.png image89.png image90.png image49.png image50.png image51.png image12.png image91.jpg image92.jpg image7.jpeg image8.png image9.png image93.jpg image94.png image95.png image96.png image97.png image98.png image106.png image107.png image108.png image109.png image110.png image111.png image112.png image113.png image114.png image115.png image116.png image117.png image118.png image119.png image120.png image121.png image122.png image123.png image124.png image125.png image99.png image126.png image127.png image128.png image129.png image130.png image131.png image132.png image133.png image134.png image135.png image100.png image136.png image137.png image138.png image139.png image140.png image141.png image142.png image143.png image144.png image145.png image101.png image146.png image147.png image148.png image149.png image150.png image151.png image152.png image102.png image103.png image104.png image105.png image156.png image157.png image158.png image159.png image160.png image161.png image162.png image163.png image164.png image165.png image166.png image167.png image168.png image169.png image170.png image153.png image171.png image154.png image155.png image172.png image173.png image174.png image175.png image176.png image177.png image178.png image179.png image180.png image181.png image182.jpeg

Microsoft_Excel_Worksheet.xlsx Aggregate Chart

Alt Routes RF IT&A IP OE UC OE TO5 Total

Jan-16 375 974 55 916 8 ERROR:#NAME? ERROR:#NAME?

Feb-16 444 1123 43 397 31 63 2101

Mar-16 364 1367 64 968 6 92 2861

Apr-16 302 1224 158 413 11 78 2186

May-16 459 750 154 368 17 73 1821

Jun-16 298 675 120 416 11 54 1574

Jul-16 308 449 69 521 15 72 1434

Aug-16 489 480 91 504 16 95 1675

Sep-16 465 447 132 569 19 49 1681

Oct-16 445 520 40 561 19 43 1628

Nov-16 518 728 138 328 21 21 1754

Dec-16 396 650 121 364 18 0 1549

Jan-17 411 458 96 373 22 22 1382

Feb-17 251 434 43 965 15 58 1766

Mar-17 499 560 182 427 13 43 1724

Apr-17 501 642 109 595 19 21 1887

May-17 627 627 88 716 0 45 2103

Jun-17 0 0 0 0 0 35 35

Jul-17 0 0 0 0 0 0 0

Aug-17 0 0 0 0 0 0 0

Sep-17 0 0 0 0 0 0 0

Oct-17 0 0 0 0 0 0 0

Nov-17 0 0 0 0 0 0 0

Dec-17 0 0 0 0 0 0 0

Alt Routes 42705 42736 42767 42795 42826 42856 396 411 251 499 501 627 RF 42705 42736 42767 42795 42826 42856 650 458 434 560 642 627 IT & A 42705 42736 42767 42795 42826 42856 121 96 43 182 109 88 IP OE 42705 42736 42767 42795 42826 42856 364 373 965 427 595 716 UC OE 42705 42736 42767 42795 42826 42856 18 22 15 13 19 0 TO5 42705 42736 42767 42795 42826 42856 0 22 58 43 21 45 Total 42705 42736 42767 42795 42826 42856 1549 1382 1766 1724 1887 2103

RF

Circuits Alt Routed Activations RF FSE Trips Equipment Shipments Circuits Groomed Total

Jan-16 926 20 28 0 974

Feb-16 1071 15 37 0 1123

Mar-16 1313 11 43 0 1367

Apr-16 1078 24 34 88 1224

May-16 664 21 44 21 750

Jun-16 559 19 33 64 675

Jul-16 395 12 32 10 449

Aug-16 347 44 89 0 480

Sep-16 385 12 39 11 447

Oct-16 464 18 36 2 520

Nov-16 681 12 35 0 728

Dec-16 576 12 62 0 650

Jan-17 382 14 62 0 458

Feb-17 339 30 65 0 434

Mar-17 443 24 75 18 560

Apr-17 512 41 68 21 642

May-17 464 27 53 83 627

Jun-17 0

Jul-17 0

Aug-17 0

Sep-17 0

Oct-17 0

Nov-17 0

Dec-17 0

Tracked MSS GTMS GTMS? MSS

Source = CDRL A016

IT&A Actions

Activations 42370 42401 42430 42461 42491 42522 42552 42583 42614 42644 42675 42705 42736 42767 42795 42826 42856 42887 42917 42948 42979 43009 43040 43070 926 1071 1313 1078 664 559 395 347 385 464 681 576 382 339 443 512 464 RF FSE Trips 42370 42401 42430 42461 42491 42522 42552 42583 42614 42644 42675 42705 42736 42767 42795 42826 42856 42887 42917 42948 42979 43009 43040 43070 20 15 11 24 21 19 12 44 12 18 12 12 14 30 24 41 27 Equipment Shipments 42370 42401 42430 42461 42491 42522 42552 42583 42614 42644 42675 42705 42736 42767 42795 42826 42856 42887 42917 42948 42979 43009 43040 43070 28 37 43 34 44 33 32 89 39 36 35 62 62 65 75 68 53 Circuits Groomed 42370 42401 42430 42461 42491 42522 42552 42583 42614 42644 42675 42705 42736 42767 42795 42826 42856 42887 42917 42948 42979 43009 43040 43070 0 0 0 88 21 64 10 0 11 2 0 0 0 0 18 21 83 Total 42370 42401 42430 42461 42491 42522 42552 42583 42614 42644 42675 42705 42736 42767 42795 42826 42856 42887 42917 42948 42979 43009 43040 43070 974 1123 1367 1224 750 675 449 480 447 520 728 650 458 434 560 642 627 0 0 0 0 0 0 0

IT&A

Circuits Alt Routed Equipment Starts Trunk Starts Circuits Groomed Trunks Discoed ASIs Total

Jan-16 16 9 25 5 0 55

Feb-16 3 23 10 6 1 43

Mar-16 5 23 21 12 3 64

Apr-16 7 25 114 12 0 158

May-16 14 31 100 8 1 154

Jun-16 7 13 84 12 4 120

Jul-16 2 16 33 14 4 69

Aug-16 7 10 58 13 3 91

Sep-16 4 11 102 15 0 132

Oct-16 6 27 2 5 0 40

Nov-16 0 34 103 1 0 138

Dec-16 1 19 95 6 0 121

Jan-17 0 15 80 1 0 96

Feb-17 0 20 20 3 0 43

Mar-17 4 11 156 11 0 182

Apr-17 4 19 78 8 0 109

May-17 2 13 71 2 0 88

Jun-17 0

Jul-17 0

Aug-17 0

Sep-17 0

Oct-17 0

Nov-17 0

Dec-17 0

MSS MSS/WOLS MSS MSS/WOLS GTMS

IT&A Actions

Equipment Starts 42522 42552 42583 42614 42644 42675 7 2 7 4 6 0 Trunk Starts 42522 42552 42583 42614 42644 42675 13 16 10 11 27 34 Circuits Groomed 42522 42552 42583 42614 42644 42675 84 33 58 102 2 103 Trunks Discoed 42522 42552 42583 42614 42644 42675 12 14 13 15 5 1 ASIs 42522 42552 42583 42614 42644 42675 4 4 3 0 0 0 Total 42522 42552 42583 42614 42644 42675 120 69 91 132 40 138

Alt Routes

OE O&M Total

Jan-16 187 188 375 418 43 10%

Feb-16 147 297 444 507 63 12%

Mar-16 210 154 364 383 19 5%

Apr-16 161 141 302 366 64 17%

May-16 211 248 459 495 36 7%

Jun-16 138 160 298 347 49 14%

Jul-16 211 97 308 289 -19 -7%

Aug-16 199 290 489 520 31 6%

Sep-16 263 202 465 657 192 29%

Oct-16 249 196 445 383 -62 -16%

Nov-16 353 165 518 485 -33 -7%

Dec-16 293 103 396 486 90 19%

Jan-17 218 193 411 487 76 16%

Feb-17 140 111 251 488 237 49%

Mar-17 251 248 499 489 -10 -2%

Apr-17 326 175 501 490 -11 -2%

May-17 406 221 627 491 -136 -28%

Jun-17 0 492 492 100%

Jul-17 0 493 493 100%

Aug-17 0 494 494 100%

Sep-17 0 495 495 100%

Oct-17 0 496 496 100%

Nov-17 0 497 497 100%

Dec-17 0 498 498 100%

Tracked GTMS GTMS

OE = CDRL A027 NIA

O&M = CDRL A018]

Circuits Alt Routed

OE 42522 42552 42583 42614 42644 42675 138 211 199 263 249 353 O & M 42522 42552 42583 42614 42644 42675 160 97 290 202 196 165 Total 42522 42552 42583 42614 42644 42675 298 308 489 465 445 518

IP OE

Task Orders and Change Requirements DTOs IAP BGP Changes IAP ACL/Whitelist WCF SIPR Proxy ACL Updates Network Advertisements ASI Activities Total

Jan-16 92 128 50 40 41 553 12 916

Feb-16 13 20 1 3 0 343 17 397

Mar-16 186 205 35 59 29 434 20 968

Apr-16 14 11 0 0 0 356 32 413

May-16 19 29 8 3 3 290 16 368

Jun-16 49 52 6 15 4 276 14 416

Jul-16 57 22 21 30 11 323 57 521

Aug-16 81 26 16 10 9 310 52 504

Sep-16 89 18 14 24 15 334 75 569

Oct-16 81 14 17 17 13 362 57 561

Nov-16 12 5 6 5 1 268 31 328

Dec-16 28 11 20 10 4 247 44 364

Jan-17 32 15 22 20 1 228 55 373

Feb-17 242 53 40 104 15 453 58 965

Mar-17 19 4 3 7 0 368 26 427

Apr-17 109 21 20 39 12 306 88 595

May-17 143 39 25 65 10 357 77 716

Jun-17 0

Jul-17 0

Aug-17 0

Sep-17 0

Oct-17 0

Nov-17 0

Dec-17 0

GTMS GTMS GTMS GTMS GTMS GTMS GTMS

UC OE

CCOs NROs DTOs DECTK Kits Total

Jan-16 6 2 8

Feb-16 11 20 31

Mar-16 4 2 6

Apr-16 8 3 11

May-16 10 7 17

Jun-16 6 5 11

Jul-16 14 1 15

Aug-16 11 5 16

Sep-16 10 9 19

Oct-16 16 3 19

Nov-16 19 2 21

Dec-16 12 6 18

Jan-17 7 15 22

Feb-17 10 5 15

Mar-17 7 6 13

Apr-17 12 7 19

May-17 0

Jun-17 0

Jul-17 0

Aug-17 0

Sep-17 0

Oct-17 0

Nov-17 0

Dec-17 0

CCO Page NRO Page GTMS CDRL 175

Acct for in IP OE DTOs

Source = CDRL A027

UC OE Actions

CCOs 42491 42522 42552 42583 42614 42644 10 6 14 11 10 16 DECTK Kits 42491 42522 42552 42583 42614 42644 7 5 1 5 9 3 NROs 42491 42522 42552 42583 42614 42644 DTOs 42491 42522 42552 42583 42614 42644 Total 42491 42522 42552 42583 42614 42644 17 11 15 16 19 19

TO5

IP Transport JRSS Total

Jan-16 34 28 2 ERROR:#NAME?

Feb-16 56 5 2 63

Mar-16 63 24 5 92

Apr-16 31 42 5 78

May-16 45 23 5 73

Jun-16 27 25 2 54

Jul-16 23 49 72

Aug-16 39 52 4 95

Sep-16 28 21 49

Oct-16 31 12 43

Nov-16 14 7 21

Dec-16 0

Jan-17 5 17 22

Feb-17 26 32 58

Mar-17 33 10 43

Apr-17 7 14 21

May-17 27 18 45

Jun-17 33 1 1 35

Jul-17 0

Aug-17 0

Sep-17 0

Oct-17 0

Nov-17 0

Dec-17 0

AARs AARs AARs

TO5 Actions

IP 42705 42736 42767 42795 42826 42856 5 26 33 7 27 Transport 42705 42736 42767 42795 42826 42856 17 32 10 14 18 JRSS 42705 42736 42767 42795 42826 42856 Total 42705 42736 42767 42795 42826 42856 0 22 58 43 21 45 image183.png