C-2 OSD Environment Document.pdf

02 AUG 2010

HQ0034-10-R-0046

ATTACHMENT C-2

OSD ENVIRONMENT DOCUMENT

The purpose of this document is to describe in detail the history, design, functionality, and technical environment of the OSD CIO and supported components.

1.0 OBJECTIVE

The Office of the Secretary of Defense (OSD) Chief Information Officer (CIO) is responsible for designing, constructing, implementing, and maintaining common IT services for OSD Principal Staff Elements (PSEs). OSD CIO is seeking contractors to provide Information Technology Support for OSD.

This document defines the technical environment for OSD CIO and supported OSD components.

2.0 BACKGROUND

OSD is the principal staff element of the Secretary of Defense in the exercise of policy development, planning, resource management, fiscal, and program evaluation responsibilities. The mission, functions, and organization of OSD are given in the OSD Organizations and Functions Guidebook, which can be found at http://odam.defense.gov/omp/pubs/GuideBook/ToC.htm.

The OSD CIO is responsible for designing, constructing, implementing, and maintaining the common IT for OSD. OSD CIO also provides advice and assistance to OSD and other senior managers to ensure that IT is acquired and information resources are managed in a manner that implements the policies and procedures of legislation, including the Paperwork Reduction Act and the Clinger-Cohen Act, and the priorities established by OSD.

The U.S. Army Information Technology Agency (ITA) is OSD’s Internet service provider and has operations and maintenance responsibility for OSD network connections. ITA also provides several Pentagon-wide enterprise IT services to OSD CIO including: DNS, DHCP, OCSP, anti-virus updates for servers and workstations, network time sync, and SPAM filtering. The Defense Continuity Integrated Information Network (DCIN) provides OSD data storage and backup on a wide area Storage Area Network (SAN).

OSD is comprised of several components. Currently many of the OSD components are responsible for 1) providing unclassified and classified mission application development and support and 2) primary user initial contact and general client-side support. These components require common IT support for their mission applications.

Several OSD offices will relocate from offices around the National Capitol Region (NCR) to the DOD/BRAC 133 project at Mark Center in Alexandria VA. OSD CIO expects BRAC office relocations to start in June 2011. OSD CIO will assist OSD customers moving to Mark Center and will continue to support these customers after the relocation.

OSD CIO is an organizational component within Washington Headquarters Services (WHS). The OSD Chief Information Officer is the director of OSD CIO. OSD CIO manages the OSD Enterprise and associated IT services.

For the purposes of Enterprise management, OSD CIO consists of:

• Administration & Personnel Management Division (A&PMD)

• Enterprise Engineering (ENGR) Division:

o Service Design o Applications Management o Service Transition o Change Management o Enterprise Test and Development

• Enterprise Operations (OPS) Division:

o Service Desk o Desk Side Support o Enterprise Monitoring Services o Server Operations o Security Operations o Problem Management o Logistics Support o Desktop Operations

• Governance & Division Information Assurance (G&IA) Division:

o Configuration Management o Certification and Accreditation o Risk Management o Threat Response o Training and Education

• Resource Management (RMD) Division

• Continuity of Operations (COOP) Division

Administration and Personnel Management includes the office of the CIO and issues IT related policies and guidance. It also has responsibilities for physical and personnel security, IT strategic planning, and IT budgeting.

ENGR provides the staff to coordinate, design, build, test and transition new Enterprise IT services and changes to current Enterprise IT services. ENGR coordinates with appropriate OSD Net divisions and customers to ensure Enterprise IT services meet usability, security and supportability requirements.

OPS maintains Enterprise IT services. Management of the overall OSD network is a responsibility that is shared with the other CIO offices and the OSD Components. OPS provides service desk support, desk side support, server management, and logistics support.

GIA Governance and Configuration Management is in charge of Enterprise change control, primarily managed through the Enterprise Configuration Control Board (ECCB). The OSD CIO IA group manages Enterprise and Component interaction with enclave boundary security services, including those provided by the US Army Information Technology Agency (ITA); OSD-wide IA policies and procedures; and compliance with DoD and Federal requirements such as NIPR/SIPR Connection Approval Processes (CAP) and Federal Information Security Management Act (FISMA) reporting. GIA also provides security design, operational risk management, certification and accreditation, and threat management services.

Resource Management Division handles IT infrastructure acquisitions.

Continuity of Operations develops continuity requirements for OSD CIO; develops, maintains, and exercises Continuity Plans that maintain OSD CIO and OSD Enterprise Network Mission Essential Functions; provides continuity policy guidance to OSD Enterprise Network Components; ensures OSD CIO alternate sites are established to meet the continuity requirements of OSD CIO; and supports the Continuity requirements of OSD Enterprise Network Components.

2.1 USER POPULATION LIST

See”OSD User Population List” spreadsheet attachment.

2.2 THE CURRENT SERVICE CENTER MODEL

The enterprise service center coordinates with the distributed service desks to provide call center and desk-side support to end users. The distributed service desks are co-located within OSD components/organizations to provide high customer focus expected from the users.

The enterprise service center and the distributed service desks provide IT support to some of the most senior officials and their staffs in the Department of Defense. Desk-side support for executives is the rule as opposed to the exception. User issues must be immediately addressed and quickly resolved.

Customers and Workstations Supported: The contractor shall provide direct IT service desk support for approximately 3,000* users of approximately 3,900* unclassified workstations and 3,400* workstations other than unclassified. Classification levels for workstations other than unclassified are up to and including TS\SCI. The Government will provide limited on-site office space at the customers' locations.

Approximately 40%* of OSD CIO customers are located in Sensitive Compartmented Information Facilities (SCIFs). Other user groups maintain local IT help desks; see table below for details.

2.3

Work is being provided by several different contractors/contracts, which are administered by different contracting agencies. The below table represents the existing contract vehicles for the DA&M IT community. The below table represents the existing contract vehicles for the DA&M IT community:

Table 2‐1. Existing Service Contract Vehicles

Office Contract # Contract Type Company

Estimated Cost

(in millions)

OSD CIO DAAB07‐03‐DB011 T&M Galaxy Scientific Corp $10.3

OSD CIO HQ0034‐08‐F‐1181 FFP AttivaSoft $0.5

OSD CIO HC1013‐06‐P‐2862 T&M CACI $130.0

OSD CIO

W91QUZ‐06‐D‐

FFP CACI $24.0

AT&L HC1013‐06‐P‐2196 FFP

Engineering Systems Consultants, Inc

$0.5

AT&L HQ0034‐07‐C‐1004 FFP Vertical Integrations, Inc $15.2

PA GS‐10F‐0052M T&M LLH & Assoc., LLC $2.4

PA&E GS07T00BGD0034 CR Computer Sciences Corp (CSC) $39.2

P&R DCA200‐00‐D‐5021 FFP BAE $4.2

POLICY

W74V8H‐04‐D‐

CPFF Applied Information Sciences (AIS) $42.3

ITMD HQ0034‐09‐F‐3225 FFP Catapult Technology LTD. $8.9

ITMD HQ0034‐09‐F‐3296 FFP

Advanced Systems Development

(ASD)

$8.7

ITMD HQ0034‐09‐F‐3200 FFP Kadix Systems, LLC $0.9

3.0 OSD ENTERPRISE DESCRIPTION

The OSD Enterprise NIPR, SIPR, JWICS and SAP environments consists of approximately 15,500 workstations (desktops and laptops), the vast majority of which are Windows XP SP2 with a number of Apple systems (approximately 45 Apple iMacs and Macbook Pro) and 1,803 servers (Windows 2008, 2003, 2000, Solaris 9, RedHat, Linux, Mac Server and includes VMWare servers). Most enclave boundary devices (such as switches and firewalls) are managed by ITA. OSD Enterprise servers are primarily located in the Pentagon, Crystal City, and two alternate sites (locations are undisclosed). The OSD NIPRNET Enterprise is a MACIII – Sensitive Enclave.

3.1 ENTERPRISE SYSTEM CAPABILITIES

The Enterprise provides communications capabilities to the OSD CIO and Level 2 Service Desk support to OSD and its subordinate directorates, and Level 1 Service Desk support to select Components (e.g., NII, I, IO, NA).

The Enterprise managed devices include:

• Mail servers

• Domain Controllers

• Data storage servers

• File servers

• Blackberry Servers

• Remote Access Servers

• Web Servers

• Application Servers

• Proxy Servers

OSD Enterprise managed services include:

• Email account management

• EVault and File Vault archiving management

• Blackberry management

• Remote access/VPN management

• File shares

• Print

• Active Directory domain and Organization Unit (OU) management

• DNS, WINS, DHCP, and SMTP (where applicable) management

• Web, Application, and Database Hosting

• Workstation (Desktop and Laptop) Management

• Security Support Tools

• Test and Development Environments

• Continuity of Operations (COOP), backup, and recovery

• System Management and Performance monitoring

• Service Desk

• Enterprise incident response support

• Enclave boundary security management in conjunction with ITA

The OSD Enterprise is managed in a Windows 2003 Active Directory environment (Currently upgrading Windows based servers to 64-bit Windows 2008). The OSD Active Directory forest is installed with a root domain that has a fully qualified domain name (FQDN) of osd.mil and a NetBIOS name of OSDROOT. This domain is considered an “empty root” consisting of only Domain Controllers (DC) and the primary Certificate Authority (CA). There are no external trusts established to OSDROOT. All DCs in this domain are registered name servers (NS) in the Start of Authority (SOA) record for osd.mil. The forest root domain, as well as the Resource domain, spans three different networks. Each of these networks are at different locations which are connected via high-speed links (i.e. 100 Mbps or greater).

Together, these three networks comprise the Core Site.

The Resource domain is a child domain to the OSDROOT domain. It has a NetBIOS name of RESOURCE. The RESOURCE domain hosts all of the enterprise resources to include user accounts, workstations, servers, and printers. The RESOURCE domain is organized into multiple OUs many of which have sub-containers. The two OU structures that are most relevant to this document are the Components OU and the Member Servers OU.

Components OU is made up of multiple sub-OUs which are OSD Component specific. Each OSD Component has an OU container, within the Component OU, bearing its name. Within each of these OSD Component specific OUs is a standard set of sub-containers for holding the Component’s user and computer objects or accounts. The Member Servers OU also has multiple sub-containers. However, these OUs are organized by server function and/or role rather than component specificity. Each OU within the Member Servers OU is named according to the function or role its server objects fulfill. For example, there are there is a File Services OU which all enterprise file servers are homed.

It is important to note that migration of Components to the Enterprise is an on-going process. At the time of writing this description, all supported Components have had their user accounts and email migrated and standard services consolidated (to include DNS, WINS, DHCP, SMTP, file shares, selected backups, remote access, monitoring, and printing). However, migration of non-enterprise applications has not occurred for most Components.

3.2 ENTERPRISE CORE SERVICES DESCRIPTION

3.2.1 DOMAIN SERVICES (AD, WINS, DNS, DHCP)

There is a single Active Directory forest spanning the entire National Capital Region (NCR) and alternate sites (for failover capabilities). This forest consists of three native Windows 2003 domains. The root domain is empty; user and computer accounts reside in a single domain. A third domain hosts all “external” users that require access to OSD resources (but are not OSD employees).

OSD currently supports both Wins and DNS for Enterprise naming resolution. For DNS, OSD servers support both internal and external services. Firewall blocks prevent any external lookup traffic from hitting the internal boxes.

The Enterprise WINS boxes also host a large number of DHCP scopes. Most workstation subnets are supported by this service and have redundant helper addresses pointing to multiple DHCP servers.

Scopes are active on all boxes with "IP conflict resolution" enabled to provide redundancy without causing duplicate IP’s.

Users are issued DoD Common Access Cards (CAC) and have the ability to authenticate via the CAC (exceptions to the use of CAC authentication are documented and tracked by OSD CIO IA through Active Directory). The CAC authentication service is provided through a set of hardware devices and published DOD certificates. OSD privileged users authenticate via user name and strong passwords (15 characters or more using 3 of 4 character types). Service accounts are restricted from interactive logon.

3.2.2 MESSAGING

A primary responsibility of the Enterprise is to manage the e-mail authentication accounts and the Exchange servers, on NIPRNET, to include:

• Account activation

• Deactivation of unused mailboxes

• Continuity of e-mail service

• Interconnectivity between Outlook e-mail and the Blackberry Handheld device

• Evault and PST mail stores

The Enterprise AD e-mail system allows users to communicate, disseminate messages, and transmit work files between users and locations.

1. Exchange Servers - The OSD CIO Operations has the operational and maintenance responsibility for all Exchange e-mail servers that provide service to the OSD enterprise. As with all new services or upgrades Enterprise Engineering is responsible for drafting operational and maintenance guides prior to trasitioning the systems\services to Operations. OSD CIO Operations is then responsible for developing the specific SOP for systems and user documentation pertaining to maintenance of the servers. Exchange servers route e-mail messages, authenticate user logons, store and archive individual user e-mail messages, and store user account settings. Exchange servers were recently upgraded to Exchange 2007 operating on 64-bit Windows 2008.

2. Blackberry Wireless Service – The Enterprise is responsible for the coordinated operation of both the Blackberry Enterprise Server (BES) and Blackberry Handheld devices – both admin functions and user assistance – to include harmonious synchrony and operation with Enterprise E-mail. OSD CIO Enterprise Engineering drafts the operational guide prior to transition of any major changes\upgrades to this service. OSD CIO Operations is responsible for:

• Drafting admin and user documentation and policy documents pertaining to maintenance of the BES and use of the Blackberry Handheld Device.

• Operational and maintenance responsibility for all BES that provide service to the OSD customers.

• Creating, managing, and deleting user Blackberry accounts and for configuring user mailboxes to transmit e-mail messages to the Blackberry Handheld Device.

Wireless access to Exchange is provided through Blackberry. Two global Blackberry clusters support up to 2000 combined users. Interactive Global Address Lookups and attachment conversion are provided by a server hosting Meta Message.

3.2.3 REMOTE ACCESS SERVICES (RAS)

ITA has the operational and maintenance responsibility for all RAS in the OSD enterprise. RAS enables users to access the OSD network, files, and e-mail system via an OSD-provided laptop from a location other than their worksite (i.e., home, temporary duty location, another OSD work location, etc). Both CISCO IPSEC and Juniper SSL VPN technologies are used for connectivity.

3.2.4 FILE AND PRINT

OSD has an initial total capacity of 8 TB for user and organizational file data. All of this data is accessible through a single Active-Directory Integrated DFS name space. Beneath the root, all files are organized into one of the four following areas:

1. Home – all user home data resides under this root. Individual home directories are grouped into folders named for their organization (e.g., policy/johnstok). These folders generally hold data that is only utilized by the owner. However, users have sufficient rights to grant access to others on an as-needed basis. This data are limited to word documents, power point presentations, spreadsheets and other types of office documents.

2. Org – each organization has a folder within this root for data that is shared by its employees.

Each Component has the flexibility to organize its contents. In addition to standard office documents, file share-based applications also reside here (depending on the required disk resources and performance).

3. PST – each user has a folder within this root specifically for pst files.

4. Shared – a separate area provides space for coordination between components. The majority of this data are project or task driven.

3.2.5 BACKUP AND DISASTER RECOVERY

A full backup of enterprise servers and user data is performed during the weekends (Saturday or Sunday depending on scheduling) except for specific static data repositories such as software volumes, data warehouse, and indexes; a full backup of static data repositories is performed monthly. Full backups are sent offsite for long-term storage. Incremental backups for enterprise servers and user data are performed Monday through Friday and are scheduled to run between 6:00 pm and 6:00 am. Customers may request daily incremental backups and weekly system state backups for specific mission applications. The retention period is 7 years for backup data.

Data Classification Estimated Monthly total

File Total

Apps Total

Exchange Total

Sent to Long Term Storage

SBU 170 terabytes (TB) per month

90 TB 30 TB 50TB 35TB

SECRET 70 TB per month 40 TB 10 TB 20 TB 10 TB Other than SECRET 24 TB per month 5 TB 1 TB 18 TB ---- Enterprise Test and

Development (ET&D) 11 TB per month ---- ---- ---- 4 TB

OSD has implemented Veritas NetBackup Enterprise 5.1 MP6 software and SAN-based technologies to provide backup and disaster recovery functions. Application data such as Microsoft SQL, Oracle, Microsoft Exchange and Lotus Notes are backed up using Veritas BetBackup plug-in client agents thru which the application data is streamed to backup tape or virtual tape (disk). This hardware and software installation provides restoration in the following situations:

• Recover from accidental file deletions -- the most common need for backups is to recover from user errors and accidents.

• Recover from application errors -- bad data or processing faults may make it necessary to restore application data to a known good state.

• Restore a prior state of the system -- changes to the application environment such as applying patches or upgrades may have a negative impact on a production system.

• Recover from hardware failure -- hardware faults can cause data errors or more likely crash the system.

• Recover from loss of system or site -- commercial applications and operating environments may be recoverable from vendor media, however, application data and customization recovery require a sound backup.

The backend storage for all critical systems (with significant data requirements) is the EMC Storage Area Network. The SAN is comprised of two hardware devices: the backend disks hosted on a Symmetrix and the fibre connectivity provided by a Connectrix. This infrastructure has instantiations at all remote sites and provides real-time synchronous replication of all critical data.

These devices are directly supported by PENREN. This includes all daily operational duties and systems troubleshooting. OSD is consulted when determining the overall storage size and performance requirements. In addition, OSD works closely with PENREN during normal operations and upgrades to ensure proper functionality, sizing and throughput. The BDR infrastructure is centrally located in the Pentagon room BG849.

DCIN storage is replicated to site 1 or site 2 using SRDF or Symmetrix Remote Data Facility. Veritas Clustering allows servers to failover to site 1 or site 2 and then reconnect to the DCIN storage located at site1 and site 2 for continued operations

Mission critical servers such as Exchange, SQL, and Blackberry are stored on multiple servers contained within Veritas cluster server architecture for node failover in the event one of the servers in the cluster goes offline. The clusters are also tied across the MAN to the alternate site clusters for site to site failover.

3.2.6 WEB, APPLICATION, AND DATABASE HOSTING

The OSD community relies on business line applications to perform standard daily operations. As these are implemented across numerous different platforms and software packages, a flexible hosting environment is used.

SharePoint - By using the provisioning capabilities of SharePoint, developer communities create work spaces with customized permission and content. Boxes are provided for internal (intranet) or external customers. Depending on the application, users can authenticate externally or internally with their standard username and passwords

SQL clusters - a large amount of OSD application utilize Microsoft SQL Server as a backend database repository.

For applications that cannot be co-hosted (due to permissions, loading, specialized software/OS, maintenance schedules, etc.), the software is placed onto Vmware Esx virtual machines. OSD has deployed a large number of high capacity servers each with the ability to host 30 - 60 VM’s. In these cases, OSD provides support for the entire VM. The option is provided to have the virtual boxes clustered (either locally or remotely) using Veritas Volume Replicator.

In addition to providing application hosting, OSD-CIO also supports full applications that have enterprise applicability.

Remedy is the common Service Desk tool that is used by all component customer support personnel. A development team has also provided a significant amount of customizations including hardware tracking, configuration management workflow, customer notifications, satisfaction surveys, etc. Users can access Remedy through its web interface or the standard Win32 client. Both the mid-tier and backend dedicated SQL infrastructure are globally clustered. A project is underway to upgrade the current Enterprise Remedy to Remedy ITSM version 7 and add a Configuration Management Database (CMDB) module for managing the change, release and configuration management processes. Plans are to then subsequently upgrade Remedy to 7.6.

Citrix is provided for all users for secure remote access and hosting widely used legacy or desktop applications. A single farm exists for internally and externally generated requests. External traffic is required to pass through a Citrix Secure Gateway. Users browse to a web site which, after validating the user credentials, presents available applications to the user and opens an encrypted tunnel with the target Citrix server. Internal traffic is able to hit the servers directly without requiring additional encryption (over the standard Citrix 128 bit client security).

Supported Custom Applications The following custom applications (i.e., not COTS or GOTS from outside OSD) are deployed to the OSD Enterprise environment and are dependent on enclave IA controls for all security functions (COTS and non-OSD GOTS applications are in the Software List):

• System Effectiveness Analysis Simulation (SEAS)

• Joint Mission Area Analysis Tool (JMAAT)

• PDR Position Tracker

• OUSD(I) Content Management Portal (https://extranet.itis.osd.mil)

• OSD CIO Enterprise Portal (https://osdportal.osd.mil/default.aspx)

Numerous custom Microsoft Access database are used by Components and are hosted on the OSD Enterprise file server. These databases rely entirely on enclave security controls and are managed by the individual Component office that developed the database.

The overall OSD infrastructure is overseen by the ECCB. Changes to the Enterprise system are controlled through the ECCB.

3.2.7 WORKSTATION (DESKTOPS AND LAPTOP) SUPPORT

OSD Enterprise Engineering develops the enterprise baseline and provides both syspreped and a Universal Imaging Utility (UIU) Norton Ghost images to the OSD Service Desks on a quarterly basis for all classification levels. The UIU is used to handle any driver for any workstation platform. Currently the OSD Service Desks add Component specific standard applications\configurations (if required) to a syspreped Ghost Image and then add the UIU.

The enterprise baseline consists of Windows, standard applications (i.e. Office 2007, IE 7, Adobe Acrobat, Blackberry Manager, QuickTime, and Java), patches and security updates (per JTF IAVA s and STIGS along with OSD CIO specific requirements).

There is a project to upgrade all workstation Windows based systems to the Federal Desktop Core Configuration (FDCC) 64-bit Windows 7 version.

Efforts are underway to implementing Microsoft Application Virtualization (App-V) into the environment. Initial applications virtualizes will be high-cost items such as Microsoft Visio and Project.

Efforts are planned to virtualize all Component specific standard applications/configurations that will permit a single image to be deployed throughout the enterprise with the abiliy to then apply the virtual applications/configurations as required. Microsoft App-V is expected to help solve some of the non-standard application management and licensing requirements. App-V is being implemented as a high-availability service.

Currently Microsoft Systems Management Server (SMS) infrastructure is being upgraded to Microsoft System Center Configuration Manager 2007. This is the key tool for managing and patching the workstations (desktops and laptops) in the environment. Plans are to take full advantage of the the new capabilities: Extensions for Security Content Automation Protocol (SCAP), Disired Configuration Management (DCM), Operating System Deployment (OSD), Network Access Protection (NAP), and Wake On LAN (WOL). SCCM will be integrated into the Remedy upgrade to 7.x scheduled to be deployed in May. SCCM is also deployed to all Microsoft based servers. Many reports and dashboards are developed to meet oversite requirements (i.e. Microsoft True-up, patch management, software license management, etc.). SCCM is a high-availability service.

ScriptLogic Desktop Authority 7.8 is used as the login method for all workstations except through VPN.

It is also used as an alternative method for deploying specific configurations and software. GPOs are also used to and apply STIGs and standardize the enterprise configuration. Desktop Authority is a high-availability service.

OSD CIO Enterprise Engineering uses Symantec Wise Package to develop a pack for deployment regardless of the deployment method.

All systems have robust Anti-Virus protection which is updated daily by OSD CIO Enterprise Engineering. Mobile Armor DataArmor is required on all laptops as the required Data-at-Rest solution.

The infrastructure service is also currently managed by OSD CIO Enterprise Engineering. Anti-Virus and DataArmor are high-availability services.

Random Password Manager (RPN) is used to automatically randomize passwords for any Microsoft, Lnux/UNIX, and MAC OSD accounts, including the built-in guest and Administrator account, which adhere to DoD’s policy regarding password specifications.

OSD refreshes approximately 33% to 25% of the workstations per year. OSD CIO Enterprise Engineering and Operations currently support the Desktop Refresh project for OSD CIO and direct OSD CIO supported OSD Components. Plans are for the OSD CIO to deploy workstation to OSD CIO and all OSD Components as a project.

SIPRNet Comon Access Card (CAC) is a new project to implement similar capabilities as the NIPRNet

CAC.

SME PED provides a secure NIPR\SIPR blackberry communication as proof of concept as directed by the

SECDEF.

3.2.8 SECURITY SERVICES

OSD CIO Enterprise Engineering builds and deploys while OSD CIO Operations maintains the infrastructure for OSD CIO IA required security tools. McAfee Host Based Securty System (HBSS) has recently been upgraded and deployed to all workstations and servers.

Guidance Software Encase is a series of forensic software products used to support civil/criminal investigations, network investigations, data compliance and electronic discovery. Current efforts are underway to upgrade the Guidance Software Encase infrastructure from version 5.x to 6.0 to support Windows 2008 using SQL 2005.

Bit9 Application Whitelisting is being worked as a project for near term implementation. Whitelisting technology will proactively harden and ensure integrity of the computing environment by identifying all software on all workstations at all times, track software and configuration changes as they happen and compare configurations to approved baselines.

Graded Authentication is being implemented to meet OSD requirements for an enterprise authentication system to provide authentication, authorization, single sign-on, federated identity management, and identity and access management services for various applications, systems, and hosts across the enterprise.

Webwasher is being imiplemented to replacement for forward web proxy/content filtering. Webwasher provides a higher level of protection against web-based threats than the current Websense/ISA solution.

3.2.9 OSD ENTERPRISE TEST AND DEVELOPMENT (ET&D) ENVIRONMENTS

The OSD Enterprise includes a testing environment that replicates the production Enterprise. OSD Enterprise Engineering provides full testing support and remote network access to the ETD from any location on the OSD backbone. The ETD-managed environment on the NIPRNET network consists of Windows 2008, Windows 2003, and VMware ESX servers that provide capabilities for multiple OSD missions. In addition, the network will include numerous Virtual Windows and Linux servers as well as Windows 2000 and XP desktops. There is also connectivity to the Pentagon backbone network, for transmission and automated processing support. The connectivity to the network is controlled by ITA.

ITA has responsibility for the Pentagon backbone network.

3.3 SYSTEM USER DESCRIPTION AND CLEARANCE LEVELS

The primary users of the OSD Enterprise are staff of the OSD organization. All persons who have access to, or are users of, the Enterprise have a security investigation, such as the National Agency Check (NAC), or hold a minimum of a Secret clearance. Individuals are granted access to data on a need-to-know basis. Users are government employees or contractor personnel.

The network infrastructure is administered and operated by contractors, who report to OSD government management staff, principally the OSD CIO. Access to all information repositories that may contain US Government proprietary information is controlled by Discretionary Access Control (DAC) mechanisms that limit access to OSD employees and preclude access by contract personnel.

Domain privileges are divided according to Component and are focused on the particular functional mission (legal, medical, public affairs, etc) of each Component. Users are restricted to accessing data within their own functional domain or organizational unit.

It is the responsibility of the Component providing user network access to review the appropriate security credentials of each user prior to granting a network domain account. To preclude unintentional access or dissemination of classified material on the unclassified network, classified and unclassified data are segregated on entirely separate networks (either on the SIPRNet or NIPRNet) and each must be accessed by separate workstations and using separate accounts on each network. Users cannot access unclassified file servers on their SIPRNet workstation or using their SIPRNet account, and vice versa.

Components are tasked with ensuring that users have the appropriate clearance before being granted access to the Enterprise resources. OSD CIO Enterprise Engineering creates the mailboxes and maintains the e-mail services, but the need-to-know and clearance authorization is performed by, and is the responsibility of, the individual Components.

4.0 SOFTWARE AND HARDWARE LISTS

This section includes installed software on servers, desktop/laptop computers and peripherals. For software, the lists include the names of all software, approximate number of users and software maintainer. For hardware, the lists include the types of hardware, applicable server and device IP Addresses, name of owner/maintainer, including numbers and types of all terminals, servers, hubs, routers, switches, etc. Installed software is identified in the Approved Software List (ASL).

Most servers run Windows Server 2000/2003/2008; however there are 112 Linux servers and 58 Unix servers.

Enterprise Core Servers Summary:

Category NIPR SIPR Total Backup Management 19 4 23 Blackberry 14 0 14 Citrix 42 25 67 Database 26 7 33

DNS 1 1 2

Domain Management 34 25 59 EMail 52 10 62 Enterprise App 49 16 65 Evault 12 0 12 Fax Server 1 0 1 File Management 38 6 44 Monitoring 5 4 9

OCSP 6 1 7

Parking Lot 7 5 12 Print Management 22 14 36 REL Domain 0 2 2 Security 81 15 96 Server Management 18 8 26 Virtual Management 59 5 64

VPN 5 0 5

Total 491 148 639

NIPR Breakout

Category Physical Virtual Total Backup Management 18 1 19 Blackberry 9 5 14 Citrix 0 42 42 Database 22 4 26

DNS 0 1 1

Domain Management 16 18 34 eMail 47 5 52 Enterprise App 12 37 49 Evault 9 3 12 Fax Server 1 0 1 File Management 27 11 38 Monitoring 5 0 5

OCSP 2 4 6

Parking Lot 1 6 7 Print Management 0 22 22 Security 12 69 81 Server Management 6 12 18 Virtual Management 58 1 59

VPN 1 4 5

Total 246 245 491

SIPR Breakout Category Physical Virtual Total

Backup Management 3 1 4 Citrix 0 25 25 Database 4 3 7

DNS 0 1 1

Domain Management 15 10 25 eMail 10 0 10 Enterprise App 2 14 16 File Management 4 2 6 Monitoring 4 0 4

OCSP 1 0 1

Parking Lot 2 3 5 Print Management 0 14 14 REL Domain 0 2 2 Security 3 12 15 Server Management 5 3 8 Virtural Management 4 1 5 Total 57 91 148

OSD CIO provides server hosting for certain component application servers. While the component is responsible for the application, OSD CIO is responsible for patching the operating system and ensuring that the server is online.

Component Application Server Summary:

Category NIPR Physical NIPR Virtual SIPR Physical SIPR Virtual Total AT&L Legacy 13 46 1 25 85 AT&L Mission 11 64 4 20 99

DTSA 1 4 0 6 11

LA Mission 0 1 0 0 1 NII Mission 23 8 7 0 38 Policy Mission 4 9 1 12 26 RA Mission 0 2 0 0 2 Total 52 134 13 63 262

WORKSTATIONS/LAPTOPS SUMMARY:

Number of workstations and laptops by hardware type, OS, and maintainer/owner; refer to table below:

Workstation/Laptop Type OS Number Issued Maintained By Dell Laptops (e.g., Latitude D410)

Windows XP SP2 ≈ 1933 (includes:

511 CIO

OSD CIO Service Desk*

Dell and Gateway Workstations (e.g., Optiplex GX620, GX520, etc.)

5 DCMO

597 NII, NA, IO

147 ODA&M

155 OMC

518 OUSD(I))

Dell (GX520, GX755) and Gateway (4650) (Workstation)

Windows XP SP2 ≈ 140 OSD DOT&E Service Desk

Dell Laptops (D630, D610, D600, C400)

Windows XP SP2

PowerMac G5 (Workstation)

Mac Tiger OS = 2

Dell Workstations (Precision

360) Windows XP SP 2 ≈ 250

OSD PA Service Desk

Dell Laptops (D630, D620, C610, C640)

Fujitsu Lifebook (S Series Laptops)

Apple Workstations (Power MAC G5) Mac Tiger OS ≈ 10

Apple PowerBook Laptop G3 ≈ 4 Gateway Workstations (e.g., 6500, 6300, 4300, etc.) Windows XP SP2 ≈ 1956

OSD Policy Service Desk

Dell, Compaq, Sony Laptops (e.g., Latitude, Evo, and Viao) Windows XP SP2

Dell Optiplex (GX270) and Gateway Profile 5.5 Workstations Windows XP SP2 ≈ 100

OSD P&R Service Desk

Dell Latitude Laptops (e.g., D600, D610, etc.) Windows XP SP2 ≈ 200

Tablet PC’s (Fujitsu T4010D) Windows XP Tablet PC Edition ≈ 75

Dell Optiplex Workstation Windows XP SP2 ≈ 80 OSD LA Service Desk Dell Laptops (e.g., Latitude D410 Windows XP SP2 ≈ 257

OSD RA Service Desk

Dell and Gateway Workstations (e.g., Optiplex GX620, GX520, etc.)

Dell Workstations (e.g., GX520/620, etc.) Windows XP SP2 ≈ 2227 OSD AT&L Service Desk

Dell Laptops (e.g., Latitude)

* Includes OSD CIO, ODA&M, NII, I, IO, NA, OMC, DCMO Service Desk support.

SOFTWARE:

The Enterprise COTS are formally approved or listed within the Evaluated Products List (EPL), and GOTS software. The OSD CIO, in coordination with Enterprise system administrators, must be notified via the ECCB before any executable file types are placed on any Enterprise device.

General users cannot load executables to their workstations. Run and add/remove program capability has been disabled at the user level through AD Group Policy. The Enterprise servers have password and privilege protection. GOTS executables and source code are always acquired directly from the originating government agency. COTS products are purchased from approved vendors and manufacturers. Once media is inside the Enterprise facilities, media is only accessible by staff.

NETWORK DEVICES:

ITA owns and manages network infrastructure devices including routers, switches, firewalls, and IDS.

5.0 CONNECTIVITY

5.1 CABLING

Describes what types of cabling and wireless devices are being utilized (e.g., Category 6 STP, fiber cabling, etc.):

• Category 6 STP

• Fiber cabling

• Blackberry wireless devices

5.2 NETWORKING TECHNOLOGY AND PROTOCOLS

Describes what network protocols and technologies are being utilized, e.g., Ethernet, Token Ring, TCP/IP, AppleTalk, etc.:

• Gigabit Ethernet

• TCP/IP

6.0 ESTIMATED LIFECYCLE

OSD Policy Bulletin 18 “Lifecycle Standards for OSD IT Equipment” specifies the minimum lifecycle for IT equipment:

• Desktop PCs: three years

• Laptops: three years

• Monitors: six years

• Printers: four years

• Multi-page Scanners: four years

• Uninterruptible Power Supplies (UPS’s): three years

• Servers: three years

• Auxiliary Storage Systems (e.g. Storage Area Networks (SAN’s), Back-up Systems, Near-Line

Systems, Disk Arrays, Tape Libraries): five years

• Lifecycles for other IT equipment will be addressed on a case-by-case basis as required

Refresh for equipment listed above depends on available funding. Equipment is not replaced solely by age; a business case is required for each procurement project. The current direction in OSD is to extend minimum lifecycles to four years. OSD Policy Bulletin 18 is review on an annual basis and may be updated to include a minimum four year lifecycle.

[end]