SECTION 402 SECURITY REQUIREMENTS.pdf

LHA 10

6 APRIL 2023

SECT. 402 1 SECT. 402

SECTION 402

SECURITY REQUIREMENTS

402a. Definitions 5 Adjustable parameter.– Parameters, data and configuration settings which are intended to be adjustable in order to configure the application for ship use and which do not modify the software or firmware. Adjustable parameters are not considered software for the purpose of these requirements.

Developmental software.– Software and firmware which is developed for this 10 contract, or previously developed software and firmware developed for another application that is modified for this contract.

Field programmable device.- An electronic device or embedded system with software or firmware which can be modified without disassembling the device or return to its manufacturer. 15

402b. General

This section supplements the installation requirements of other sections of these specifications.

Shipboard Secure Electrical Information Processing Systems (S/SEIPS), that 20 support the spaces defined herein that process National Security Information General Service (GENSER)/Collateral Information shall comply with the installation criteria of IA PUB-5239-31, Information Assurance Shipboard Red/Black Installation.

Shipboard Special Access Program Facility (S/SAPF).- S/SAPFs shall comply 25 with the requirements of Joint Air Force, Army, Navy Manual 6/9 (JAFAN 6/9) and with letter, Technical Requirements for Shipboard SAPF Spaces OPNAV/N89-0088-10 dated 7 September 2010.

Shipboard Sensitive Compartmented Information Facility (S/SCIF).– S/SCIFs shall comply with the requirements of Chapter 6, Section D of Intelligence 30 Community Directive (ICD) 705, Technical Specifications for Construction and Management of Sensitive Information Facilities.

Secure Room (SR).- SRs shall comply with the requirements of Exhibit 10A of

SECNAVINST M-5510.36.

Controlled Access Area (CAA).– CAAs shall comply with the requirements of 35 publication, Information Assurance PUB-5239-22, Section 4.

Restricted Access Area (RAA).– RAAs shall comply with the requirements of publication, Information Assurance PUB-5239-22, Section 4.

402c. Secure space categories 40

The secure spaces and their respective categories are:

Shipboard Special Access Program Facility (S/SAPF)

a. Air Planning Room and ACE SI Briefing Room

Shipboard Sensitive Compartmented Information Facility (S/SCIF) 45

a. EXPLOT

b. Joint Intelligence Center

c. Imagery Processing and Interpretation Center

d. Ship Signal Exploitation Space No. 1 and No. 2

e. TACRON 50

SECT. 402 2 SECT. 402

Secure Room (SR)

a. Chart Room

b. Training Equipment Room

c. Debark Control Center

d. Electronic Warfare Equipment Room 5

e. Meteorological Room

f. Radio Transceiver Room No. 1

g. Radio Transceiver Room No. 2

h. Radar Room No. 1

i. Radar Room No. 2 10

j. Radar Room No. 3

k. LAN Node Room No. 1

l. The contiguous spaces formed by the boundary of the Supporting Arms Coordination Center, Passageway at Frames 69-73 (starboard), Tactical Air Control Center, Amphibious Air Traffic Control Center, Landing Force 15 Operation Center, Flag Plot, Flag Briefing and Planning Room, and athwartship Passageway at Frame 77 (port)

m. Combat Information Center

n. C4I Equipment Room No. 2 and C4I Equipment Room No. 1

o. Computer Room & Data Processing Center 20

p. Squadron Operations Office

q. Landing Force Communications Office

r. The contiguous spaces formed by the boundary of the Joint Communication Center, Joint Communication Annex, Data Processing Annex, Radio Division Office and Radio Equipment Annex 25

s. Combat Systems Maintenance Central/Trouble Ticket Area

t. Landing Force Registered Publications Office

u. Squadron Ready Room

v. Registered Publications Office

w. SAR DET Briefing Room 30

x. Combat Cargo and Troop Embarkation Office

y. LAN Node Room No. 2

z. Avionics COMSEC Repair Shop

aa. Battalion Staff Admin Office

bb. Node Room No. 4 35

cc. Print Shop & Photo Lab

dd. UAS Control Center

ee. Aviation Storeroom (Secure)

Controlled Access Area (CAA) 40

a. Tactical Logistics Center

Restricted Access Area (RAA)

a. Primary Flight Control Station

b. Pilot House 45

c. CO Sea Cabin

d. Navigator Stateroom

e. Explosive Ordnance Disposal Work Center

f. Troop Disbursing Office

g. Troop Guard Office 50

h. CO & FSM Office “A” CO

i. CO & FSM Office “B” CO

j. CO & FSM Office “C” CO

k. CO & FSM Office “D” CO

l. CO & FSM Office “E” CO55

SECT. 402 3 SECT. 402

m. CO & FSM Office “H & S” CO

n. Battalion Commander Cabin

o. Commanding Officer Cabin

p. Officer staterooms

q. Troop Officer staterooms 5

r. Troop Officer bunkrooms

s. Battalion Operations Officer Stateroom

t. Squadron Operations Officer Stateroom

u. Squadron Commander Cabin

v. Wardroom Messroom 10

w. Wardroom Lounge No. 1

x. Wardroom Lounge No. 2

y. Engineering Officer Stateroom

z. Amphibious Group Commander Cabin

aa. Chief of Staff Cabin 15

bb. Landing Force Logistic Officer Stateroom

cc. Landing Force Operations Officer Stateroom

dd. Landing Force Executive Officer Cabin

ee. Ship Executive Officer Cabin

ff. Commanding Officer Office 20

gg. Landing Force Commanding Officer Cabin

hh. GCE Staff Operations & Plans Office

ii. Landing Force C4 Service Center

jj. Flag Communications Office

kk. Landing Force Communications Office 25

ll. Battalion Logistics Office

mm. Squadron Logistics Office

nn. Squadron Admin Office

oo. AIMD Office

pp. Air Department Office 30

qq. Engineering Department Office

rr. Operations Department Office

ss. Electronic Material Office

tt. Supply Officer Office

uu. Supply Department Office (ADMIN) 35

vv. Combat Systems Office

ww. Legal Office

xx. Flag Admin Office

yy. Deck Department Office

zz. Dental Records Office 40 aaa. Medical Storeroom (Portable Equipment) bbb. SMO & Flight Surgeon Office ccc. LCPO Office ddd. Medical Records Office eee. Landing Force Staff Admin Office 45 fff. MAA Office ggg. Troop Chaplain Office hhh. Sergeant Major Stateroom

iii. Master Chief Petty Officer Stateroom

SECT. 402 4 SECT. 402

402d. Installation Foundations and required cables shall be installed for all units of a secure electrical information processing system. The Contractor shall install all units of equipment except that the Government reserves the option to install classified equipment when the Contractor is advised accordingly. 5

402e. Quality assurance

Prior to or concurrent with Builder's Trials, a visual TEMPEST inspection of installed components of secure electrical information processing systems will be performed by the Government by a qualified Field Technical Authority 10 (FTA) for determination of compliance with IA PUB-5239-31, Information Assurance Shipboard Red/Black Installation Publication.

402f. Cybersecurity The following cybersecurity requirements shall apply to the Contractor-15 furnished systems: Hull, Mechanical and Electrical (HM&E) LAN, Machinery Control System (MCS), and other systems to the extent cybersecurity requirements are specified herein.

402f1. Account management and authentication 20 The system shall have defined cybersecurity user groups with access to cybersecurity functions described in this section. Cybersecurity user groups shall be cybersecurity administrator, cybersecurity user, and cybersecurity auditor.

Cybersecurity administrators shall have capabilities which include, but are 25 not limited to, configuring privileges, add and remove users from groups, associate security attributes with subjects and objects, configure cybersecurity functions, view and download cybersecurity logs, manage cybersecurity log storage, and view and acknowledge cybersecurity alarms.

Cybersecurity administrators shall require two-person authentication. 30 Cybersecurity users shall have privilege to view cybersecurity logs, view and acknowledge cybersecurity alarms, and execute other cybersecurity functions other than those reserved for cybersecurity administrators.

The cybersecurity auditor role shall only have the privilege to perform two-person authentication. 35 Each system user shall have unique credentials. Only those users who are authorized shall be able to access cybersecurity functions and data. Upon login, a means shall be provided for a user with multiple group memberships to select the group (role) which shall apply for the current session. An alarm shall be provided to all operator interfaces within the affected system upon 40 five unsuccessful login attempts within a 10 minute period.

The system shall have user authentication. All authenticators and passwords shall be protected using AES or Triple-DES encryption or RSA-based key encapsulation in accordance with the Federal Information Processing Standard (FIPS) 140-2 or other hash algorithm as approved by NAVSEA. Feedback of 45 authenticators shall be obscured.

The system shall uniquely identify processes acting on behalf of users.

Hosts shall only contain changeable passwords. All OEM default passwords shall be changed by the Contractor upon initial power-up.

Two-person authentication shall be required as specified herein. Where two-50 person authentication is required, a second user with Cybersecurity Auditor privilege shall be required to confirm the first person’s login.

SECT. 402 5 SECT. 402

Accounts of users who have not logged in for a period of three months shall be automatically disabled.

Cybersecurity administrators and cybersecurity users shall be automatically logged out after 15 minutes of inactivity.

Where passwords are required for authentication, they shall be a minimum of 5 14 characters, and contain a minimum of two letters, two numbers, and two special characters. Upon creation of a new user account or administrative password reset, the user shall be given a temporary password. The system shall enforce a change from the temporary password to a user-defined password upon the first successful login attempt. A means shall be provided for users to 10 change their password. The system shall prohibit reuse of passwords for 24 password changes. Password changes shall be allowed at most once every 24 hours. The system shall automatically verify that user-defined passwords meet the complexity and reuse requirements.

Data and functionality for which access is reserved to cybersecurity 15 administrators and cybersecurity users shall be hidden from other users.

Cybersecurity functions shall be isolated from non-cybersecurity functions using physical isolation, execution domains, partitions, or similar means.

402f2. Configuration management 20 The following requirements shall apply to developmental software and developmental firmware. These requirements shall also apply to field programmable device firmware and software, and adjustable parameters upon delivery from the OEM and following shipboard installation.

The Contractor shall develop, document, and implement configuration 25 management plans, processes and procedures which shall include:

a. Coordination and oversight by a Configuration Control Board

b. Review and approval or disapproval of changes with specific consideration for security impacts to system integrity

c. Description of the configuration changes and rationale for approval 30 or disapproval of the changes

d. Implementation of approved changes

e. Retention of audit and change records

f. Audits and reviews

g. Physical and logical access restrictions for changes 35

h. Reviews to determine if unauthorized changes have occurred

i. Roles, responsibilities, processes, and procedures

j. A process for identifying configuration management items throughout the development life cycle

k. Security flaws and flaw remediation 40

l. Protection of the plan from unauthorized disclosure and modification

m. Intended function of all ports, protocols, and services

Software and firmware changes shall be approved by the Configuration Control Board prior to implementation. Adjustable parameter changes shall be approved 45 prior to or after implementation.

The Contractor shall monitor and detect unauthorized changes to system configuration. Auditing for unauthorized changes shall occur at least quarterly. Upon detection of an unauthorized change to a system configuration, the Contractor shall notify the Configuration Control Board and NAVSEA. 50

SECT. 402 6 SECT. 402

The Contractor shall measure and maintain statistics on the time between system flaw identification and system flaw remediation. Statistics shall be presented at the Progress Reviews and at Software Design Reviews.

Outdated or superseded versions of software and firmware shall be removed prior to or immediately after installation of new versions. 5

Cryptographic mechanisms used for account management and authentication, data at rest, or software integrity checks shall be placed under configuration management.

Prior to Factory Acceptance Test, or prior to shipboard installation if no Factory Acceptance Test is specified, the Contractor shall document the 10 shipboard and test system configuration baselines. The system configuration baselines shall include hardware, software, firmware, adjustable parameter settings, network settings and addresses, maintenance tools, and software license information.

Prior to shipboard execution, all executable software and firmware including 15 that which is embedded in equipment shall be verified to match the OEM’s intended version by bitwise comparison, checksum, or other method as approved by NAVSEA. Non-field programmable devices, and field programmable devices with analog or discreet signal interface(s) to MCS, SCS, or the HM&E LAN, shall be exempt from these verification requirements. 20

402f3. Contingency planning and incident response The Contractor shall develop, maintain, document, and provide to the Government, all the shipboard and test system configuration baselines, to recover from hardware or software malfunction. The system configuration 25 baselines shall include the installation procedures, field programmable device firmware and software, adjustable parameter settings, network settings and addresses, maintenance tools, and software license information, as applicable.

For developmental software and developmental firmware, the Contractor shall establish two physically separated storage sites in different buildings to 30 safeguard the systems’ computer software backup during development. Both storage sites shall have the same security safeguard measures which shall include access rules, physical protection and protection against environmental conditions.

402f4. Data at rest Data mining prevention and detection shall be provided to include, but not limited to, limiting the types of responses provided to database queries;

limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases; and generating an alarm 40 when atypical database queries or accesses occur.

Cybersecurity log files shall be accessible only to cybersecurity users and cybersecurity administrators. Cybersecurity users shall be restricted to read-only access. Cybersecurity tools, logs, and data shall be protected using AES or Triple-DES encryption or RSA-based key encapsulation in accordance with the 45 Federal Information Processing Standard (FIPS) 140-2 or other hash algorithm as approved by NAVSEA. Cybersecurity logs shall be marked with the following default distribution statement:

Distribution Statement D: Distribution authorized to Department of 50 Defense (DOD) and DOD Contractors only; (Critical Technology and

Vulnerability Information) (19 April 2016). Other requests for this document shall be referred to Commander, Naval Sea Systems Command.

SECT. 402 7 SECT. 402

Means shall be provided for an operator with cybersecurity administrator privilege to modify the distribution statement. The modified distribution statement shall then be used for all subsequent data marking.

The system shall verify the integrity of software and firmware upon installation, boot-up, and prior to execution. The system shall protect the 5 integrity of the boot firmware by verifying the integrity and authenticity of all updates to the boot firmware prior to applying changes to the boot devices and preventing unauthorized processes from modifying the boot firmware.

402f5. Execution environment 10 The system shall have separate processing domains and allow configuration of allocation by privilege. The system shall prevent users from executing software that requires a higher privilege level than assigned to the user. The system shall be capable of limiting the number of concurrent sessions to a configurable number for account types and privilege levels. System or 15 component adjustable parameters shall reflect the most restrictive mode of operation without impact to system functionality.

The system shall provide the means for assigning security attributes to information in storage, in process, or in transmission. The system shall use whitelisting for a deny-all, permit-by-exception approach for allowing 20 execution of authorized software programs only. The system shall detect the presence of unauthorized hardware, software, and firmware components within the system, and generate an alarm. The system shall monitor the integrity of security software, firmware, and information by using parity checks, cyclical redundancy checks, cryptographic hashes, or other means as approved by NAVSEA. 25 Upon detection of an integrity violation, the system shall generate an alarm.

The system shall separate user functionality, including user interface services, from information system management functionality. Cybersecurity functions shall be isolated from non-security functions.

The system shall use priority protection and quotas to prevent lower-30 priority processes from delaying or interfering with higher-priority processes.

The system shall use deny all/permit-by-exception at managed interfaces to deny network communications traffic by default and allow network communications traffic by exception only. The system shall maintain a separate execution domain for each executing process. The system shall verify correct operation 35 of cybersecurity functions. The system shall perform cybersecurity function verification upon command by user with appropriate privilege and upon startup.

The system shall perform an integrity check of software, firmware, and information upon system startup and installation of new hardware, software, or firmware. The system shall verify only validated code is executed during the 40 boot processes of devices within the system. The Contractor shall verify the integrity and authenticity of all updates to the boot firmware prior to applying changes to the boot devices. The system shall prevent unauthorized processes from modifying the boot firmware.

The Contractor shall install and test software updates prior to being 45 executed on the ship. This testing shall verify that no malicious code is in the software update prior to installation onto a shipboard execution environment.

SECT. 402 8 SECT. 402

The system shall use structured messages between software modules or system components. The system shall restrict inputs to only trusted sources and approved formats. The system shall check the validity of messages to verify specified definitions for format and content of the structured messages.

Invalid messages shall be ignored by the system. The system shall generate an 5 alarm when invalid inputs are received and shall reject the invalid inputs.

The system shall generate a detailed error message in addition to the alarm.

The error message shall provide information necessary for corrective action, to include input message, location and time of input, and user attributes. The error message shall be logged and displayed only to logged-in cyber 10 administrator and cyber user accounts.

The system shall use security safeguards to protect memory, including data execution prevention and address space layout randomization.

402f6. Interfaces 15

402f6.1 Physical interfaces.- Physical interfaces which are not necessary to satisfy the requirements specified herein, and which are not secured within a lockable enclosure, shall be removed or disabled, except where required to facilitate maintenance, commissioning, or as otherwise approved by the 20 Government.

Maintenance ports which are not secured within a lockable enclosure and cannot be logically disabled when not in use shall be physically secured as follows:

a. Ethernet maintenance ports shall be secured with PadJack SVE RJ45 25 Lock, or equal.

b. USB maintenance ports shall be secured with PadJack USB Port Lock and Seal, or equal.

c. DB9 maintenance ports shall be secured with PadJack D-Sub DB9 Port Lock and Seal, or equal. 30

d. DB25 maintenance ports shall be secured with PadJack D-Sub DB25 Port Lock and Seal, or equal.

e. DB26 maintenance ports shall be secured with PadJack D-Sub DB26 Port Lock and Seal, or equal.

f. All other maintenance ports shall be secured with a device as 35 approved by NAVSEA.

402f6.2 Logical interfaces.– Functions, ports, protocols and services which are not necessary to satisfy the requirements specified herein shall be removed or disabled. Maintenance ports shall be logically disabled when not in use, where 40 feasible. All devices connected via Ethernet port shall be authenticated.

402f6.3 Wireless communication.- Wireless communication capabilities shall not be used. Wireless access ports shall be removed or disabled.

402f7. Cybersecurity logging The system shall log the following events:

a. Account creation

b. Account modification

c. Account enabling 50

d. Account disabling

e. Account removal

f. Execution of privileged functions

SECT. 402 9 SECT. 402

g. Password change

h. Failed access attempt

i. Privileged access use

j. Privileged file access (success and failure)

k. Integrity violation 5

l. Successful and unsuccessful logins

m. Invalid input alarms and associated error messages

n. File creation

o. File deletion

p. Log record deletion 10

Each log record shall contain time and date of occurrence, type of event, system and component where the event occurred, outcome of the event, identity of any individuals or subjects associated with the event.

The system shall provide sufficient storage for the expected volume of log 15 records for a minimum of 12 months. The system shall generate an alarm if log storage exceeds 90 percent of capacity. If capacity is exceeded, the system shall overwrite the oldest records first. The capability to extract reports of logging event records shall be provided. A common log record format shall be used. Means shall be provided to view log records filtered by the log record 20 parameters.

All systems and equipment which are required to have security event logging shall use internal system clocks to generate the time stamp. Internal system clocks shall be synchronized with the HM&E LAN time server at system startup and at least once every four hours thereafter. 25 Cybersecurity users shall have read-only access to log files. Cybersecurity administrators shall have full access to log files. A record of log file deletions and log record deletions shall be stored in a separate deletions file. Deletion of this deletions file or any of its content shall be prohibited. 30

402f8. Physical protection Cybersecurity management functions shall be physically or logically separated from other user functions except as specified herein or as approved by NAVSEA. 35 Enclosures for equipment which provide storage or processing for cybersecurity data shall be lockable.

Where padlocks are used to fulfill physical protection requirements they shall be in accordance with Sect. 604.

402f8.1. HM&E LAN infrastructure All HM&E LAN infrastructure digital signal cables shall be terminated within lockable enclosures, except for end user connections for DCAMS network drops and as otherwise specified herein. HM&E LAN infrastructure external ports, media interfaces, and connections shall be contained within a lockable 45 enclosure except as specified herein or as approved by NAVSEA.

402f8.2. Non-HM&E LAN logic bearing equipment External ports, media interfaces, and connections shall be contained within a lockable enclosure except as specified herein or as approved by NAVSEA. 50

402f9. Software delivery Developmental software and developmental firmware source code shall be delivered. This shall include all software and firmware configuration items that are or that contain developmental software or firmware. 55

SECT. 402 10 SECT. 402

402f10. Non-field programmable devices Non-field programmable devices and field programmable devices with analog or discreet signal interface(s) to MCS, SCS, or the HM&E LAN shall only be subject to this paragraph. Non-field programmable devices containing software or firmware and field programmable devices with analog or discreet signal 5 interface(s) to MCS, SCS, or the HM&E LAN shall be assigned a unique identifier. For such devices, a Firmware Version Description shall be provided.

This documentation shall be updated whenever the software or firmware version changes or the containing device is replaced.

402f11. Laptops, tablets, and similar devices Laptops, tablets, and similar devices used for maintenance, configuration, troubleshooting or similar purpose shall have user authentication as specified in this section. All such devices shall be authenticated when connected to any system, unless otherwise specified herein. Lockable storage shall be provided. 15 Where padlocks are used to fulfill this requirement, the padlocks shall be in accordance with Sect. 604.

402f12. Technical documentation For each system citing Account Management and Authentication as specified in 20 this section, the following documentation shall be provided:

a. Software Requirements Specification (Account Management and Authentication only)

b. Software Design Description (Account Management and Authentication only) 25

c. Software Version Description

For systems citing Configuration Management as specified in this section, the following documentation shall be provided:

a. Configuration Management Plan 30

b. Product Baseline Index

c. Software Version Description

For systems citing Contingency Planning and Incident Response as specified in this section, a Firmware Support Manual shall be provided. 35 For systems citing Data at Rest as specified in this section, the following documentation shall be provided:

a. System/Subsystem Design Description (SSDD)

b. Software Requirements Specification (Data at rest requirements only)

c. Software Design Document (Data at rest requirements only) 40

d. Software Version Description

For systems citing Execution Environment as specified in this section, the following documentation shall be provided:

a. System/Subsystem Design Description (SSDD) 45

b. Software Requirements Specification

c. Software Design Document

d. Software Version Description

e. Software Product Specification

For systems citing Interfaces as specified in this section, the following documentation shall be provided:

a. Interface Requirements Specification

b. Interface Design Description

SECT. 402 11 SECT. 402

For systems citing Cybersecurity Logging as specified in this section, the following documentation shall be provided:

a. System/Subsystem Design Description (SSDD) (Logging only)

b. Software Requirements Specification (Logging only)

c. Software Design Description 5

For systems citing Physical Protection as specified in this section, the following documentation shall be provided:

a. Hardware drawings shall be in accordance with Sect. 085

For equipment citing Software Delivery as specified in this section, the following documentation shall be provided:

a. Software Version Description

b. Software Product Specification

c. Firmware Version Description 15

For HM&E LAN and MCS, cybersecurity requirements, the following documentation shall be provided:

a. Operational Concept Description

b. System/Subsystem Design Description (SSDD) 20

c. Software Requirements Specification

d. Software Design Description

e. Software Version Description

e. Firmware Support Manual

f. System Test Plan 25

g. Test Procedures

h. Factory Test Reports

i. Hardware drawings in accordance with Sect. 085

j. Configuration Management Plan

k. Interface Requirements Specification 30

l. Interface Design Description

m. Product Base Line Index

n. Software Product Specification

o. Factory test notification

Where these documentation requirements duplicate similar requirements for other systems or equipment as specified herein, the documentation may be combined subject to NAVSEA approval.

SECT. 402 12 SECT. 402

THIS PAGE INTENTIONALLY LEFT BLANK