Attachment_1_Security_Cooperation_Information_Portal_(SCIP).pdf

Attachment 1

Security Cooperation Information Portal (SCIP)

12 Feb 2016

SCIP has unique security features suitable for use by U.S. personnel and foreign customers who communicate with it via the commercial internet.

- It is hosted in a Defense Information Systems Agency (DISA) “De-Militarized Zone”

(DMZ) on the boundary between the commercial internet and DoD’s data network known as the NIPRNET.

- It uses two-factor authentication for international customers, employing the RSA SecurID token credential to provide one-time passcode determined by algorithm on a 60-second basis, which is used in conjunction with a user-assigned PIN.

- It uses DoD Common Access Cards (CAC), State Department Smart Cards, and VeriSign

ECA certificates for two-factor authentication by U.S. government civilian, military, and contractor personnel.

- It has fine-grained permission controls, so users generally can only view a fraction of the data or employ a fraction of the system’s functionality, depending upon their “need to know”.

- It employs Secure Sockets Layer (SSL) encryption on all user-to-SCIP communications.

SCIP consists of seven physical servers, using a Microsoft Windows 2003/2008 operating systems, with full migration to W2008 during CY2013:

- A database server hosting an Oracle 11g DataBase Management System (DBMS).

- A web server hosting the Microsoft IIS web server software, Apache Tomcat, and the

Oracle Web Center Interaction (WCI) Portal software.

- An applications server hosting custom applications. Application is written in Java or in the .Net infrastructure.

- A security server hosting RSA ClearTrust security software.

- A token server, supporting authentication by RSA SecurID token users.

- A communications server, for all SFTP and Web Services traffic

- An analytics server, to allow the administrators to monitor web, portlet, and web page usage.