J-9_Cybersecurity_Requirements_N0002417R2207.pdf

TOWING, SALVAGE, AND RESCUE SHIP (T-ATS)

CYBERSECURITY REQUIREMENTS FOR CONTROL AND

COMMUNICATIONS SYSTEMS

27 October 2016

N00024-17-R-2207

ATTACHMENT J-9

DEPARTMENT OF THE NAVY

PROGRAM EXECUTIVE OFFICE, SHIPS

WASHINGTON, DC 20376

N00024-17-R-2207 Attachment J-9

CYBERSECURITY REQUIREMENTS FOR CONTROL AND COMMUNICATIONS SYSTEMS

1. GENERAL

The Contractor shall apply cybersecurity measures to all Contractor-furnished information technology associated with control systems. For purposes of this contract, information technology is defined as any equipment or interconnected system or subsystem of 5 equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. Control systems include all hardware and software included in machinery control systems, bridge systems, navigation systems, dynamic positioning systems, and exterior communication systems. 10

The Contractor shall ensure that development of all control and communications systems adhere to software secure coding best practices, and that control systems are configured in accordance with applicable Security Technical Implementation Guides (STIGs) published by the Defense Information Systems Agency.

Before delivery, the Contractor shall assess and mitigate cybersecurity vulnerabilities in 15 the control systems. The assessment shall include:

a) Enumerating platforms, software flaws, and improper configurations;

b) Execution of checklists and test procedures; and

c) Measuring vulnerability impact.

The Contractor shall analyze vulnerability scan reports and results from security control 20 assessments, identify false positives with rationale and remediate identifiable vulnerabilities.

The Contractor shall adjudicate with the Government any cybersecurity measure that causes timing, performance, or availability failures of control system requirements stated elsewhere in this specification.

2. DOCUMENTATION

The Contractor shall document control and communication systems as follows:

a) Provide a mapping of

1) software to

2) hostname to 30

3) Internet Protocol address(es)(with subnet mask)(or non-IP address) to

4) functional area/enclave to

5) Virtual Local Area Network (VLAN) to

6) hardware to

7) location aboard the ship. 35

b) Diagram of all networked systems - show hardware, hostname, IP addresses, type of connection (such as, TCP/IP via cable/fiber, RS-232)

c) Purpose or function of each piece of hardware, software, and hostname (in the case of virtual servers)

d) Ports, protocols, and services used to communicate between components 40

e) Configurations of firewalls, routers, switches, and other network-related equipment The Contractor shall provide an inventory by system of installed hardware and software by version.

3. REMOVAL OF UNNECESSARY SERVICES AND PROGRAMS

The Contractor shall install or enable, as applicable, only those applications, ports, protocols, services, and functions necessary for designed capabilities of a given control system.

Control systems shall use enforcement mechanisms (such as, application whitelisting or equivalent technology) to prevent unauthorized software from executing on the systems. The Contractor shall provide a listing of services required for any computer system running control 5 system applications or required to interface the control system applications. The listing shall include all ports and services required for normal operation as well as any other ports and services required for emergency operation. The listing shall also include an explanation or cross reference to justify why each service is necessary for operation.

The Contractor shall verify and provide documentation that all services are patched to 10 current status.

The Contractor shall provide appropriate software and service updates and/or workarounds to mitigate all vulnerabilities associated with the product and to maintain the established level of system security.

The Contractor shall remove and/or disable all software components that are not required 15 for the operation and maintenance of the control system prior to Factory Acceptance Testing.

The Contractor shall provide documentation on what is removed and/or disabled.

4. HOST INTRUSION DETECTION SYSTEM

The Contractor shall provide a configured host intrusion detection system (HIDS) and/or 20 provide the information to configure a HIDS to include, but not be limited to, static file names, dynamic file name patterns, system and user accounts, execution of unauthorized code, host utilization, and process permissions sufficient for configuring the HIDS.

The Contractor shall configure the HIDS such that all system and user account connections are logged. This log will be configured such that an alarm can be displayed to the 25 operator if an abnormal situation occurs.

The Contractor shall recommend a configuration for the HIDS in a manner that does not negatively impact the operating system function.

5. INTRUSION PROTECTION SYSTEM 30

The Contractor shall employ McAfee Host Intrusion Prevention System protection where it is compatible with the information system. If the system is not compatible with the McAfee Host Intrusion Prevention System, the Contractor shall employ malicious code protection mechanisms at control system entry and exit points to detect and eradicate malicious code.

Means shall be provided to update the malicious code protection mechanisms to identify the 35 latest malicious code. The Contractor shall configure malicious code protection mechanisms to perform real-time scans of files from external sources at control system entry/exit points as the files are downloaded, opened, or executed; and prevent confirmed additions of executables/binaries from executing without interfering with real-time operation of the control systems. The malicious code protection mechanisms shall prevent the download and execution 40 of Mobile Code from outside the control systems boundary.

6. SYSTEM AND INFORMATION INTEGRITY

The control systems shall monitor inbound and outbound communications traffic for unauthorized activities or conditions. Monitoring shall be done at the entry/exit points and 45 selected points at the intra-system network taps. The control systems shall employ integrity verification tools to detect unauthorized changes to the software, firmware and run-time behavior. The controls systems shall provide alerts when compromise or potential compromise occurs that changes the certified/qualified baseline configuration, to include software, hardware, firmware and run-time behavior. When compromise or potential compromise is detected, the control system shall be configured to disable network access by the component and notify the 5 Administrator.

If the control systems employ a network, the network shall implement the DoD’s Host Based Security System (HBSS), if compatible.

7. CHANGES TO FILE SYSTEM AND OPERATING SYSTEM PERMISSIONS 10

The Contractor shall configure hosts with “least privilege” file and account access and provide documentation of the configuration. The Contractor shall configure the necessary system services to execute at the least user privilege level possible for that service and provide documentation of the configuration.

The control systems shall enforce access restrictions and support auditing of the 15 enforcement actions. The control systems shall prevent the installation of unauthorized software using detection/enforcement mechanisms (for example, hash authentication or equivalent technology) and validate authorized software being installed on the system.

The control systems shall provide alerts when the unauthorized installation of software is detected. The control systems shall prohibit user installation of software without explicit 20 privileged status.

8. HARDWARE CONFIGURATION

The Contractor shall disable, through software or physical disconnection, all unneeded communication ports and removable media drives, or provide engineered barriers, and provide 25 documentation of the results. The Contractor shall password protect the BIOS from unauthorized changes unless it is not technically feasible, in which case the Contractor shall document this case and provide mitigation measures.

The Contractor shall configure the network devices to limit access to/from specific locations, where appropriate, and provide documentation of the configuration. 30

The Contractor shall configure the system to allow the system administrators the ability to re-enable devices if the devices are disabled by software and provide documentation of the configuration.

9. INSTALLING OPERATING SYSTEMS, APPLICATIONS, AND THIRD-PARTY 35

SOFTWARE UPDATES

The Contractor shall have a patch management and update process. The Contractor shall remove previous versions of software and firmware as part of the update process. The Contractor shall provide notification of known vulnerabilities affecting Contractor-supplied or required Operating System, application, and third-party software within a pre-negotiated period after 40 public disclosure.

For any hardware or software items that are required to be serviced or repaired remotely, the Contractor shall isolate the item prior to non-local maintenance and diagnostic services, and shall sanitize the item with regard to potentially malicious software before removal and after the service is performed before reconnecting the item to the control system. 45

The Contractor shall recommend spare parts for the controls systems as part of the

Vendor-Recommended Spares listing to be able to maintain and repair the systems within 24 hours of a failure.

All information assurance (IA) and IA-enabled information technology products (e.g.

servers, operating systems, routers, firewalls) shall be those that are on the approved National Information Assurance Partnership (NIAP) list. 5

10. FIREWALLS

The Contractor shall provide firewalls and firewall rule sets between network zones or provide firewall rule sets if the firewalls are not provided by the Contractor. The Contractor shall provide firewall rule sets and/or other equivalent documentation. The basis of the rule set shall 10 be “deny all,” with exceptions explicitly identified by the Contractor.

The Contractor shall change default passwords during implementation. Likewise, unnecessary default accounts shall be deleted or deactivated during implementation. No password shall be hardcoded into system files. The Contractor and its subcontractors shall assist the Government in changing delivered passwords upon completion of the installation. 15

11. IDENTIFICATION AND AUTHENTICATION

The control systems shall uniquely identify and authenticate organizational users. The control systems shall implement multifactor authentication for access to administrator accounts.

The control systems shall implement replay-resistant authentication mechanisms for network 20 access to administrator accounts. If the control system has role-based privileges, the system shall be configured with a minimum of a User role and an Administrator role. Security functions, such as account creation and configuring permissions, shall be limited to the Administrator role.

The control systems shall implement replay-resistant authentication mechanism for administrator accounts. 25

The control system shall uniquely identify and authenticate all devices before establishing local and network connections. The control system authenticates any devices not a part of the configuration before establishing local or network connections using bidirectional authentication.

For password-based authentication, the control systems shall: 30

a) Enforce minimum password complexity of mixed case sensitivity, minimum 15 characters, mix of upper-case letters, lower-case letters, numbers, and special characters;

b) Enforce at least 8 changed characters when new passwords are created;

c) Store and transmits only cryptographically-protected passwords; 35

d) Prohibit password reuse for 5 generations;

e) Require password reset every 60 days; and

f) Allow the use of a temporary password for system logons with an immediate change to a permanent password.

User accounts shall be locked out after 5 failed logon attempts; locked-out accounts shall 40 be disabled until it is reset by an administrator or until the lockout duration for the account has expired.

The Contractor shall ensure that unencrypted static authenticators are not embedded in control systems' applications or access scripts or stored on function keys.

12. SYSTEMS AND COMMUNICATIONS PROTECTION

The control system shall separate user functionality, including user interface services, from management functionality by either physical or logical means. This can be achieved by using different computers, different central processing units, different instances of operating systems, different network addresses, virtualization techniques, or combinations of these or other methods, as appropriate. 5

The control systems shall isolate security functions from non-security functions by controlling access to and protecting hardware, software, and firmware that perform those security functions.

The control systems shall implement residual information protection by preventing object reuse between users of a shared resource. 10

The control systems shall protect against or limit the effects of the following denial of service attacks: consumption of scarce, limited, or non-renewable resources; destruction or alteration of configuration or configuration information; physical destruction or alteration of network components. Compensating controls shall include ensuring a loss of communication results in the systems operating in a nominal or safe mode. The systems shall restrict the ability 15 of individuals to launch denial of service attacks on other components or information systems outside the enclave boundary. Individuals shall not be able to connect and transmit arbitrary information on the transport medium. The control systems shall be managed by establishing usage priorities, quotas, partitioning, and so forth, so that sufficient capacity is available to counter information flooding denial of service attacks. A tool shall be selected and employed to 20 detect indicators of denial of service attacks against the systems and produce information that indicates if sufficient resources exist to prevent denial of service attacks.

Where possible, the control system shall provide a display banner to users that the system is a DOD information system and contains the information contained in Directive-Type memorandum 08-060 “Policy on Use of DoD Information Systems – Standard Consent Banner 25 and User Agreement”. Where possible, the system shall not allow users to proceed until the user accepts the agreement.

13. CONFIGURATION MANAGEMENT

The Contractor shall develop, and document a current baseline configuration at delivery 30 of the control systems to be maintained under configuration control. The Contractor shall review and update the baseline configuration of the control systems as a result of updates and patches.

When patches are required, they shall be tested to determine the potential for and acceptability of identified impacts generated by the patches. The Contractor shall provide the baseline configuration to the Government to maintain an up-to-date, complete, accurate, and readily 35 available baseline configuration of the control systems to support rollback.

The Contractor shall test, validate, and document changes to the control systems before implementing the changes on the operational system. The control systems shall issue audible alerts and notifications if baseline configurations are changed in an unauthorized manner.

For changes to control systems hardware and software configurations, the Contractor 40 shall submit these changes to the Government as part of the Configuration Management. The Contractor shall perform configuration management during system implementation and operation; document, manage, and control the integrity of changes; implement only approved changes to the system; document approved changes to the system and the potential security impact of such changes; and track security flaws and flaw resolution within the system. 45

14. CONTINGENCY PLANNING

Control systems shall contain automated back-up capability that does not cause the system to fail existing timing or performance requirements. System-level information (e.g.

system state information, system data necessary to recover/restore system operation, and user 5 data) shall be included in backups.

The Contractor shall provide system restoration media and procedures to recover or completely rebuild disabled system components using only the material provided and routine backup data.

Back-ups, other historical files, and network storage shall be protected by a Data-At-Rest 10 solution approved by NIAP, such as Microsoft BitLocker.

15. TESTING

The Contractor shall assist the Government in performing cybersecurity testing. The Contractor shall provide on-site attendance and support by knowledgeable subcontractor 15 personnel for all supplied control systems during this testing.

16. AUDIT AND ACCOUNTABILITY

In addition to the other audit requirements identified elsewhere, the control system shall generate audit records for the following events: 20

a) Account creation

b) Account modification

c) Enabling, disabling, and removal actions related to each account

d) Notification to the system administrator

e) Changes to the approved baseline configuration 25

f) Successful and unsuccessful logon attempts

g) Concurrent logons from different workstations

h) All program initiations

i) All direct access to the information system

j) All kernel module load, unload, and restart 30

k) Application-level failures

l) Denial of access resulting from excessive number of logon attempts

m) Data required to audit the possible use of covert channel mechanisms.

n) Privileged activities and other system level access

o) Successful and unsuccessful attempts to access security files. 35

p) Blocking a user ID, terminal or access port, and the reason for the action

q) Activities that might modify, bypass or negate safeguards controlled by the system; and

r) System configuration file changes.

The control system shall generate audit records containing information that establishes 40 what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

The auditing system shall provide an audit reduction and report generation capability that

(1) supports on-demand audit review, analysis, and reporting requirements and after-the-fact 45 investigations of security incidents; and (2) does not alter the original content or time ordering of audit records. The control systems shall provide the capability to automatically process audit records for events of interest based upon selectable, event criteria.

The auditing system shall use internal system clocks to generate time stamps for audit records that can be mapped to Coordinated Universal Time. The audit records shall be logged in one second increments. 5 The audit system shall off-load audit records to an alternate system or media, which shall be capable of storing a minimum of 1 year of audit data.