D.0 Industry Day slides -- Redacted Brief.pdf

PKI INDUSTRY DAY

01 APRIL 2025

Unites States Marine Corps

UNCLASSIFIED

PUBLIIC KEY INFRASTRUCTURE

SUPPORT SERVICES REQUIREMENT

• Use of cell phone or recording devices are prohibited.

• Outside food or beverages are not allowed in the Marine Corps Museum.

• Please be mindful when asking questions.

• Information regarding incumbent contractor business decisions, processes, pricing, or manning is proprietary, however historical information is not.

• Questions and answers from this industry day will be publicly posted on SAM.GOV sometime after 01 April 2025.

Introduction & Ground Rules

MCINCR Contracting Team

PKI Responsibilities

Requirement Document:

DoDI 8520.02 PKI/PKE Enabling

Program Objective Memorandum Requirement:

USMC Public Key Infrastructure (PKI) program provides the resources, manpower and equipment, dedicated to the management of keys and certificates used by public key-based security services in order to provide strong identification and authentication of both persons and non-person entities for NIPRNet and SIPRNet both garrison and deployed.

• P&I – Plans and Implementation

• COR – Contracting Officer Representative

• RA – Registration Authority

• LRA – Local Registration Authority

Glossary of Acronyms

PKI Lead

GS-14

RA Operations

GS-13

Net Ops

GS-13

Cyber Security

GS-13

PKI COR

GS-13

Operations Chief

SSgt/0639

PKI Organizational Structure

PKI Organizational Chart -- Current

Updated: 20250327

RA Ops

RA Ops Lead

(GG-13)

Implementation Planning Logistics

Procurement

RALRA

I MEF

II MEF

III MEF

HQMC

CPR Lead / RA

(GG-12)

Government Civilian

Active Duty Marine

PKI Organizational Chart

Updated: 20250327

PKI Network Ops

NetOps Lead

(GG-13)

Tier III Tier IITactical

PKI Chief

(SSGT 0650)

Government Civilian

Active Duty Marine

Assistant Data Chief

(SGT 0659)

PKI Lead

(GG-14)

Updated: 20250327

Information Systems Security

Information Systems Security

(GG-13)

Government Civilian

Active Duty Marine

NetOps Engineer

COR

(GG-13)

Updated: 20250327

Government Civilian

Active Duty Marine

Services

• Certificate Validation / Authority Services

• Registration Authority

• Local Registration Authority

• Token Issuance/Management

• Tier II/III PKI SME Support

• Planning & Implementation

• Cyber Security

PKI Services And Relationships

Relationships

• DoD/NSS PKI

• MARFORCYBER/MCCOG

OPCON

• DC IC4/CY Program Manager

Glossary of Acronyms

•C4/CY – HQMC DC(I) C4/CY

•OMMC – Operations and Maintenance/Marine Corps •PMC – Procurement/Marine Corps •NSS: National Security Systems

RAs are personnel authorized by the DoD Program Management Office to:

• Approve the revocation of any certificate.

• Perform third-party encryption key recovery supporting legal/criminal investigations and/or FOIA requests with written authorization

• Approve issuance of certificates to network Non-Person Entities (NPE)

• Register and approve issuance of organizational code-signing certificates

PKI Registration Authority (RA) Operations

Business Services:

• NIPR & SIPR Token Issuance &

Management

• Token PIN Resets

• Certificate approval & revocation

• PKI Help Desk

PKI Registration Authority (RA) Operations

Audited by JFHQ-DoDIN Tri-Annually SIPR RA Audit: 19-22 Sep 22 NIPR RA Audit: 09-13 Sep 24

PKI RA SIPR Token Issuance (TMS)

Questions?

Operates and maintains USMC Enterprise capabilities:

• USMC Microsoft Certificate Authorities

• Two USMC Offline Root CAs (1 NIPR/1 SIPR)

• Domain Cryptographic Logon

• 802.1x/Comply-to-Connect Device Authentication

• Mobile Device Authentication for non-Purebred capable accounts (e.g. Duty Phones)

PKI Network Operations

• Certificate Validation Infrastructure (CVI):

• Provides revocation checks for DoD and USMC issued certificates

• Line of defense to prevent access by users whose PKI credentials have been terminated

• Certificate Revocation List Distribution Points (CRL-DP) for 802.1x

• USMC PKI Virtual Desktop Infrastructure

• CAC Pin Reset Capability

• NEATS Token management

Tier II/III PKI support for garrison and tactical Deployed Support (e.g. Tactical Training, DGSITS)

Service Delivery Points

• MCB Quantico – Primary Site MCEN-N/S

• MCB Pendleton – Secondary Site MCEN-N/S

• OCSP Services – Internal MCEN-N only

PKI Network Operations

Quantico Camp Lejeune Kanehoe Bay Raven Rock

Pendleton Kansas City Camp Foster

Responder

• Pulls CRL (Certificate Revocation Lists) from DoD/NSS/USMC PKIs

• Requires a Hardware Security Module (HSM) for database signing/integrity

• Builds OCSP database

• OCSP database is pushed/pulled to Repeaters

• Does not serve responses to customer requests

Repeater

• Local copy of Responder OCSP database

• Serves customer requests

Desktop Validator

• Client component of EVA

• Provides fault tolerant user experience (e.g. auto-rollover) between local services, DMZ services and DISA supporting validation

• Allows “good per user configuration” option when OCSP services are unreachable

Tactical Support

• Provides support for “Compact CRLs” to USMC Tactical PKIs which conserves bandwidth

PKI NetOps OCSP

• Two CAs per enclave (Quantico/Pendleton)

• Auto failover

• Requires a Hardware Security Module (HSM) for private key protection

• Provides automatic enrollment of Domain Joined assets:

• Domain Controller (DC)/Key Distribution Center (KDC) certificates for user cryptographic logon

• MS Remote Desktop Protocol certificates for servers/workstations

• Device certificates for Comply-to-Connect and VPN access

• Mobile device certificates for watch stander/duty smart-phones

(Android Only)

• MCEN-N and MCEN-S PKIs are separate with their own, unique, offline

Root CAs

PKI NetOps – USMC PKI (MS ADCS)

PKI Cybersecurity Vulnerability Management

• ACAS Scanning

• Patching Remediation Quarterly Security Technical Implementation Guide Reviews DOD/NSS PKI Security Policy reviews System ISSO for Registration Authority Workstations

PKI Plans & Implementation

• Reviews and processes PKI waiver and exemption requests for Marine

Corps Systems.

• Purebred Mobility Support

• Manages Marine Corps Local Purebred Registration Agents

• Marine Corps LRA Audit Support

• Marine Corps LRAs are audited bi-annually

• Reviews and processes NIPR/SIPR Trusted Agent Nominations

• Trusted Agents are the “external face” of Marine Corps PKI, responsible for validating/verifying

NIPR/SIPR token requests and issuance

• End users must submit token requests via local TAs

• 339 NIPR and 693 SIPR TAs across 173 commands/organizations

• Token shipping

• Manages Marine Corps CAC PIN Reset Trusted Agents

PKI SME Support S-3 Operations

• Develop and track compliance to PKI Operational Directives

MARCORSYSCOM

• Provide PKI technical support to application owners

• Migrating systems to integrate and use PKI for Identification and Authentication

DCI C4/CY

• Review of policy, documents, and briefs for USMC Functional Manager

Support to MCCOG A&A

• Provide PKI SME support (i.e. review documentation) for appropriate PKI implementation

Marine Corps Tactical Training

• DGSITs and unit training

PKI Projects

• Commercial Solutions for Classified (CSfC)

• PKI SME support for MCSC/NIWC CSfC Program

• Modernized “Only-Locally-Trusted” PKI

• Provides for a common, ubiquitous PKI OLT Certificate Authorities support all non-person entity certificate requirements for garrison and tactical

• Support “Algorithm Evolution” and Post-Quantum Cryptography

• NIPRNet Enterprise Alternate Token System

• Horizon Virtual Desktop (VDI) supporting NIPR/NEATS Trusted Agents

• DMDC NIPRnet Enterprise Alternate Tokens System/ALT Issuance Management System (NEATS/ATIMS)

• Web application supporting enrollment & issuance of ALTs

• PKI P&I – Migration of current legacy system TAs to new application

• Legacy ATIMS retires 2025

• “Algorithm Evolution”

• Transition to 4096-bit key length/SHA2-512 beginning Oct 2026

• Gap solution for quantum resistant cryptography in the mid-2030’s

PKI Related Strengthening of Cryptographic Logon aka “Certificate Pinning”

• By Sep 2025, all AD User Objects will require mapping of DoD/NSS user certificates to accounts

• When a user gets a new CAC or requires multiple certificates for logical access the AD User Object will require updating to “pin” the user certificate to the AD account

• Requires engineering effort to automate the process

Commercial Solutions for Classified

• Program managed by PEO-D

• USMC PKI operates and maintains the PKI supporting CSfC

Closing Remarks