SIPRNET_Tech_Guide_Ver5 1 .0_11AUG2008.pdf

FOR OFFICIAL USE ONLY

DEPARTMENT OF THE ARMY

UNITED STATES ARMY INFORMATION

SYSTEMS ENGINEERING COMMAND

FORT HUACHUCA, ARIZONA 85613-5300

TECHNICAL GUIDE FOR THE INTEGRATION OF

THE SECRET INTERNET PROTOCOL ROUTER

NETWORK

(SIPRNET)

VERSION 5.0

THIS DOCUMENT IS AN INFORMATION TECHNOLOGY

SYSTEMS SECURITY ENGINEERING GUIDE ONLY.

ALL DESIGNS MUST BE COMPLETED IN ACCORDANCE WITH

ALL POLICIES, REGULATIONS, AND STANDARDS LISTED IN

THE REFERENCES SECTION.

AUGUST 2008

FORT DETRICK ENGINEERING DIRECTORATE

Distribution C Distribution authorized to U.S. Government agencies and their contractors only, for administrative or operational use, August 2008. Refer other requests for this document to Director, U.S. Army Information Systems Engineering Command, Fort Detrick Engineering Directorate, ATTN: AMSEL-IE-DE, Fort Detrick, MD 21702-5047.

Technical Guide for Integration of SIPRNET August 2008 ii

DISCLAIMER

The use of trade names in this document does not constitute an official endorsement or approval of the use of such commercial hardware or software. Do not cite this document for advertisement.

CHANGES

Refer requests for all changes that affect this document to:

USAISEC, ATTN: AMSEL-IE-DE, Fort Detrick, MD 21702-5047.

DISPOSITION INSTRUCTIONS

Destroy this document when no longer needed. Do not return it to the organization. Safeguard and destroy this document with consideration given to its classification or distribution statement requirements.

iii

TECHNICAL GUIDE FOR THE INTEGRATION OF

THE SECRET INTERNET PROTOCOL ROUTER

NETWORK

(SIPRNET)

VERSION 5.0

AUGUST 2008

U.S. ARMY INFORMATION SYSTEMS ENGINEERING COMMAND

FORT DETRICK ENGINEERING DIRECTORATE

Distribution C Distribution authorized to U.S. Government agencies and their contractors only, for administrative or operational use, August 2008. Refer other requests for this document to Director, U.S. Army Information Systems Engineering Command, Fort Detrick Engineering Directorate, ATTN: AMSEL-IE-DE, Fort Detrick, MD 21702-5047.

iv

FOR OFFICIAL USE ONLY

TABLE OF CONTENTS

Page

1.0 THE DEFENSE INFORMATION SYSTEMS NETWORK (DISN)

2.0 SECRET INTERNET PROTOCOL ROUTER NETWORK INTRODUCTION

3.0 THE TECHNICAL GUIDE FOR THE INTEGRATION OF SIPRNET

4.0 REFERENCES

4.1 National Security Agency (NSA) Publications

4.2 Department of Defense (DOD) Publications

4.3 Defense Information Systems Agency (DISA) Publications

4.4 Department of the Army (DA) Publications

4.5 Miscellaneous Publications

5.0 MAJOR PARTICIPANTS AND RESPONSIBILITIES

5.1 U. S. Army Information Systems Engineering Command (USAISEC)

5.2 Designated Approving Authority (DAA)

5.3 Directorate of Information Management (DOIM) Responsibilities

5.4 Information Management Officer (IMO) Responsibilities

5.5 Joint Responsibilities

6.0 PLANNING AND PROGRAMMING

6.1 Definition of Terms

6.2 Project Goals

6.3 Protection of Sensitive Information in Areas with Varying Access Control

7.0 CONNECTIVITY

7.1 Areas of Responsibility

7.2 DISA-controlled SIPRNET Assets

7.3 DOIM-controlled SIPRNET Assets

7.4 Tenant-controlled SIPRNET Assets

8.0 TECHNOLOGY OPTIONS AND APPLICATIONS

8.1 Protected Distribution System (PDS)

8.2 Individual/Mobile Encryptor

8.3 Classified Secure Wireless LAN (Classified SWLAN) Solution

8.4 Thin Client Solution

8.5 Video Teleconferencing (VTC)

8.6 Multicast through Inline Network Encryptors (INEs)

8.7 Voice over Secure Internet Protocol (VoSIP)

9.0 OPERATIONS

9.1 Information Assurance (IA)

9.2 Equipment Security

10.0 SIPRNET EQUIPMENT OPTIONS

10.1 General

10.2 TACLANE KG-175 Family

10.3 Sectera KG-235

10.4 RedEagle KG-240 Family

v

FOR OFFICIAL USE ONLY

Page

10.5 AltaSec KG-250 Family

10.6 KOV-26 Talon

10.7 Serial and Bulk Encryptors

10.8 Wireless Equipment

10.9 Thin Client Equipment

11.0 SUPPORT

12.0 BASIC SIPRNET PROCESS FLOWCHART

13.0 COST MODEL FOR PROJECTING SIPRNET EXPANSION OR NEW

SERVICES

Appendices Appendix A. SIPRNET User Connection Flow Chart ....................................................... A-1 Appendix B. PDS Design Process .......................................................................................B-1 Appendix C. SIPRNET Site Survey Checklist ....................................................................C-1 Appendix D. Gross Estimation Tool for SIPRNET (PDS)................................................. D-1 Appendix E. Future Estimation Tool...................................................................................E-1 Appendix F. Figures and Drawings .....................................................................................F-1 Appendix G. User Allocation and Distribution Tables ...................................................... G-1 Appendix H. SIPRNET for New Military Construction .................................................... H-1 Glossary. Acronyms and Abbreviations ..................................................................Glossary-1

Attachments

Attachment 1. Sample Standing Operating Procedures for SIPRNET Connection ......Att-1-1 Attachment 2. Updated Installation Guidelines for Secure Wireless Local Area Networks................................................................................................Att-2-1

Tables Table A-1. SIPRNET Access Checklist ............................................................................. A-3 Table C-1. SIPRNET Site Survey Checklist .......................................................................C-1 Table D-1. Gross Estimation Tool for SIPRNET (PDS).................................................... D-1 Table G-1. User Allocation and Distribution at Brigade HQ BCTs................................... G-1 Table G-2. User Allocation and Distribution at Battalion BCTs........................................ G-2 Table G-3. User Allocation and Distribution at Division HQs .......................................... G-3 Table G-4. User Allocation and Distribution at Corps HQs............................................... G-4 Table G-5. User Allocation and Distribution at School Commandant and U.S. Army

Engineer School................................................................................................ G-5 Table G-6. User Allocation and Distribution at Depot Commander and Production

Operations......................................................................................................... G-6 Table G-7. User Allocation and Distribution at Garrison Commander and Garrison

Directorates....................................................................................................... G-7 Table H-1. SIPRNET for Military Construction ................................................................ H-1 vi

FOR OFFICIAL USE ONLY

Page Figures

Figure A-1. SIPRNET User Connection Flow Chart.......................................................... A-1 Figure F-1. SIPRNET Top Level Architecture....................................................................F-1 Figure F-2. Example of LAN, CAN, MAN, and WAN.......................................................F-2 Figure F-3. SIPRNET High-level Overview .......................................................................F-3 Figure F-4. DISA-controlled SIPRNET Assets ...................................................................F-4 Figure F-5. DOIM-controlled SIPRNET Assets..................................................................F-5 Figure F-6. SIPRNET Dial-up Example..............................................................................F-6 Figure F-7. Tenant-controlled SIPRNET Assets .................................................................F-7 Figure F-8. Secure-only ISDN or IP VTC...........................................................................F-8 Figure F-9. Non-secure/Secure ISDN or IP VTC................................................................F-8

Trade Name Disclaimer The use of trade names and references to specific equipment in this document does not constitute an official endorsement or approval of the use of such commercial hardware or software. The report, in presenting the success or failure of one (or several) part number(s), model(s), under specific environment and output requirements, does not imply that other products not herein reported on are either inferior or superior. This document may not be cited for advertising purposes.

FOR OFFICIAL USE ONLY

TECHNICAL GUIDE FOR THE INTEGRATION OF SIPRNET

1.0 THE DEFENSE INFORMATION SYSTEMS NETWORK (DISN)

1.1 The Non-classified but Sensitive Internet Protocol Router Network (NIPRNET) and Secret Internet Protocol Router Network (SIPRNET) are Department of Defense (DOD) internetworks which provide unclassified and classified computer networking service for official DOD business. These networks are part of the Defense Information Systems Network (DISN) Global Information Grid (GIG).

1.2 The DISN provides a wide range of information services to DOD users, including voice telephony, formal messaging, data networking, and video. Today, each of these services is largely provided by independent and duplicative transmission and switching infrastructures.

2.0 SECRET INTERNET PROTOCOL ROUTER NETWORK INTRODUCTION

2.1 The security challenges confronting DOD information technology resources are multiplying rapidly with the exponential growth of interconnected systems for producing and exchanging data and information. Network interconnectivity is increasing, and the threats to information technology are becoming more sophisticated and diverse. The DOD systems have become inherently more vulnerable to surreptitious access and malicious attacks. The fast-paced advances of technology drive DOD reliance on commercial technologies and services. However, many of these solutions may offer only minimal defense against the Information Warfare threat activity and must be augmented by Information Systems Security disciplines and focused management decisions to ensure protection of DOD information technology resources.

2.2 The SIPRNET is the Department of Defense’s largest interoperable Command and Control (C2) data network, supporting the Global Command and Control System (GCCS), the Defense Messaging System (DMS), collaborative planning, and numerous other classified Warfighter applications. It is a system of interconnected computer networks used by DOD to transmit classified information (up to and including information classified as SECRET//NOFORN) by packet switching over the Transmission Control Protocol (TCP)/Internet Protocol (IP) protocols in a “completely secure” environment. All data transmitted on the SIPRNET between secure facilities must be provided the appropriate level of protection for National Security Information (NSI).

2.3 The SIPRNET requirements for the modular deployed force in garrison are expanding in regard to their need to “work and train in garrison as they fight” and to “plug and play” into and out of the garrison environment.

2.4 The SIPRNET infrastructure on most Power Projection Platform (PPP) sites is still lacking. Installations are only now starting to realize the requirements for future SIPRNET upgrades to support the new Modular Force requirements in garrison.

2.5 Requirements to protect sensitive mission data for combat leaders in the Continental United States (CONUS) require that SIPRNET transport is provided to the wall plate down to the battalion level. Additionally, this transport must now be engineered to provide the Quality of Service (QoS) capabilities to accommodate the SIPRNET IP video, collaboration tools, and Voice over Internet Protocol (VoIP) capabilities that these units use in battle preparation and training.

FOR OFFICIAL USE ONLY

2.6 Finally, this transport must be engineered to allow for the extension of these services throughout the Directorate of Information Management (DOIM) SIPRNET infrastructure.

Increased requirements will also demand increased SIPRNET connectivity into the GIG.

2.7 The wide area network (WAN) transport capability (between installations) must support collective training communications connectivity, which would allow a Divisional Tactical Operations Center (DTOC) at Fort “X” to maintain battle control through its installation SIPRNET infrastructure, across the DISN SIPRNET into Fort “Y’s” SIPRNET infrastructure, and then into the Fixed Tactical Internet supporting a Brigade Combat Team (BCT) maneuver in Fort “Y’s” training range.

2.8 The WAN transport capability must also support the communications connectivity of a virtual task force of all assigned forces across the DISN SIPRNET to support planning, collaboration, and rehearsals in CONUS or extended to outside CONUS (OCONUS), if required.

2.9 These modular force requirements (during the planning, mobilization, and deployment phases of operations) at PPP sites require a robust, 24x7, DOIM SIPRNET infrastructure which is manageable, defendable, and reliable. As more reach-back mission support traffic is moved to the SIPRNET, this same robustness will be required to support Power Support Platform (PSP) installations. Unfortunately, this capability does not yet exist at most PPP/PSP installations.

2.10 As the requirements grow, the installation must have the capacity to dynamically manage bandwidth, provide network perimeter defense, enforce network policy, and security patch management for the installation and the resident modular force infrastructure.

Initiatives are currently underway which will address the use of Top Level Architecture (TLA), Active Directory (AD), Continuity of Operations Plan (COOP), High Assurance Internet Protocol Encryptor (HAIPE), and Internet Protocol Version 6 (IPv6).

2.11 Top Level Architecture (TLA)

2.11.1 Although the TLA is not the main subject matter of this publication, it is a critical part of security. The SIPRNET TLA should be separate from and mirror the NIPRNET TLA. Even though SIPRNET is an encrypted network in itself, an isolated demilitarized zone and firewall give additional protection, to include control of internal users of the system.

2.11.2 Figure F-1 depicts a typical SIPRNET TLA design at this point in the engineering process. Further guidance is forthcoming, but documentation has neither been completed nor formalized at this time.

3.0 THE TECHNICAL GUIDE FOR THE INTEGRATION OF SIPRNET

3.1 This document is an information technology systems security engineering guide for communicators supporting the Warfighter. The technical guide may be used to assist Army personnel in developing access solutions for SIPRNET connectivity to support the Warfighter’s increased use of secure networking and methods of interfacing with secure information technology in CONUS. In no way does this guide override or minimize the requirements of the national policies, regulations, and standards contained in the references listed in Paragraph 4 or any other policies, regulations, or standards.

FOR OFFICIAL USE ONLY

3.2 Although the document may contain some information that may be useful in the OCONUS environment, the exact specifications and requirements in that theater may differ from the CONUS theater. This document is not intended for use as a technical guide for OCONUS implementation; however, coordination is currently underway with OCONUS entities to develop an OCONUS addendum. THIS DOCUMENT IS NOT INTENDED FOR

USE AS A TECHNICAL GUIDE FOR TACTICAL SIPRNET IMPLEMENTATION.

3.3 With the fast-paced and continual increase of SIPRNET requirements, it is imperative for implementation to be completed in a standardized method. This document provides technical solutions for establishing or expanding secure data networks at the SECRET level.

This information will help communicators quickly and efficiently engineer and implement solutions for SIPRNET requirements. The guide provides communication planners with cost information; facility engineers with environmental control and electrical requirements;

and network managers with methods of implementing SIPRNET core network services.

3.4 Although this guide includes many facets of the SIPRNET, it will focus on the technical aspect of SIPRNET access and the procedural processes. The SIPRNET user community is comprised of many support structures. The interfaces to each of the systems must be carefully coordinated. The object of this guide is to identify all steps which must be completed to acquire new service or expand the local SIPRNET access.

4.0 REFERENCES

4.1 National Security Agency (NSA) Publications

a. Committee on National Security Systems (CNSS) 4009, National Information

Assurance (IA) Glossary, June 2006, http://www.cnss.gov/Assets/pdf/cnssi_4009.pdf.

b. CNSS 7000; TEMPEST Countermeasures for Facilities (U), May 2004 (C/NF).

CNSS, Index of National Security Systems Issuances, January 2008, http://www.cnss.gov/Assets/pdf/CNSS-INDEX.pdf.

c. CNSS Instruction (CNSSI) 3029, Operational Systems Security Doctrine for TACLANE (KG-175), May 2004 (U/FOUO).

d. CNSSI 3034, Operational Security Doctrine for the SECNET 11 Wireless Local Area Network Interface Card, April 2004 (U/FOUO).

e. CNSSI 3035, Operational Security Doctrine for the RedEagle KG-245 In-Line Network Encryptor (INE), March 2007 (U/FOUO).

f. CNSS IDOC-009-06; Interim Operational System Security Doctrine for the TACLANE-GigE KG-175A, September 2006 (U/FOUO).

g. CNSS IDOC-017-06, Interim Operational Security Doctrine for the SecNe-54 Secure Wireless 802.11 a/b/g Local Area Network (SWLAN) Encryptor, September 2006

(U/FOUO).

h. Email, NSA Office of IA Policy, Subject: CNSSP No. 10, 2 May 2008.

i. Information Assurance Technical Surveillance Global Standoff Capabilities Report

(U), 01 November 2004 (S/NF).

j. Memorandum, SELCL-ID-P3, Subject: Operational Security Doctrine for Trunk

Encryption Devices (TEDs) NSTISSI 3022, 23 December 2003 (FOUO).

http://www.cnss.gov/Assets/pdf/cnssi_4009.pdf http://www.cnss.gov/Assets/pdf/CNSS-INDEX.pdf

FOR OFFICIAL USE ONLY

k. Memorandum, SELCL-ID-P3, Subject: Changes to CNSS Instruction No. 3029 – Operational Security Doctrine for the TACLANE (KG-175), 30 June 2006.

l. Memorandum, SELCL-ID-P3, Subject: Interim Operational Security Doctrine for the SecNet-54 Wireless Local Area Network, IDOC-017-06, 14 August 2007 (FOUO).

m. Memorandum, SELCL-ID-P3, Subject: U.S. Army Implementation of IDOC-009-06, Interim Operational Security Doctrine for the TACLANE-GigE KG-175A, 6 February 2008 (U/FOUO).

n. National Security Telecommunications and Information Systems Security Committee (NSTISSC) Advisory Memorandum (NSTISSAM), TEMPEST/2-95, RED/BLACK Installation Guidelines, 12 December 1995.

o. NSTISSAM TEMPEST/2-95A, Amendment to TEMPEST 2/95, 03 February 2000.

NSTISSC Instruction (NSTISSI) 3022, Operational Security Doctrine for Trunk Encryption Devices (TEDs) KG-81, KG-94 Family, KG-95 Family, KG-194 Family, and KIV-19 in Stand-Alone Applications, July 1999 (U/FOUO).

p. NSTISSI 7003, Protective Distribution Systems (PDS), 13 December 1996 (U) http://www.cnss.gov/Assets/pdf/nstissi_7003.pdf

q. NSTISSC Policy (NSTISSP) 10, National Policy Governing Use of Approved Security Containers in Information Systems Security Applications, 21 July 1999 (U).

4.2 Department of Defense (DOD) Publications

a. Assistant Secretary of Defense (ASD) Memorandum, Subject: Use of Commercial Wireless Local Area Network (WLAN) Devices, Systems, and Technologies in the Department Defense (DoD) Global Information Grid (GIG), 2 June 2006.

b. Department of Defense Directive (DODD) No.C-5200:19; Control of Compromising Emanation (U), 16 May 1995 (C).

c. Military Handbook (MIL-HDBK-) 419A, Grounding, Bonding, and Shielding for Electronic Equipment and Facilities, 29 December 1987.

d. MIL-HDBK-1013/1A, Design Guidelines for Physical Security of Facilities, 15 December 1993.

e. Military Standard (MIL-STD-)188-124B; Military Standard Grounding, Bonding and Shielding for Common Long Haul/Tactical Communication Systems including Ground Based Communications-Electronics Facilities and Equipments, 01 February 1992.

f. MIL-STD-188-124B, Notice 3, DoD Interface Standard Grounding, Bonding and Shielding for Common Long Haul/Tactical Communication Systems including Ground Based Communications-Electronics Facilities and Equipments, 18 December 2000.

4.3 Defense Information Systems Agency (DISA) Publications

4.3.1 Security Technical Implementation Guides (STIGs)

a. Collaboration STIG, Collaboration Security Technical Implementation Guide, Version 1, Release 1, 15 March 2007, http://iase.disa.mil/stigs/collaboration_stig_v1e1.zip.

b. DSN STIG, DoD Telecommunications and Defense Switched Network Security Technical Implementation Guide, Version 2, Release 3, 30 April 2006, http://iase.disa.mil/stigs/stig/dsn-stig-v2r3.pdf.

http://www.cnss.gov/Assets/pdf/nstissi_7003.pdf http://iase.disa.mil/stigs/collaboration_stig_v1e1.zip http://iase.disa.mil/stigs/stig/dsn-stig-v2r3.pdf

FOR OFFICIAL USE ONLY

c. Enclave STIG, Enclave Security Technical Implementation Guide, Version 4, Release 2, 10 March 2008, http://iase.disa.mil/stigs/stig/enclave_stigv4r2.pdf.

d. Network Infrastructure STIG, Network Infrastructure Security Technical Implementation Guide, Version 7, Release 1, 25 October 2007, http://iase.disa.mil/stigs/network_stig_v7r1_20071025.pdf.

e. VoIP STIG, Internet Protocol Telephony & Voice Over Internet Protocol, Version 2, Release 2, 21 April 2006, http://iase.disa.mil/stigs/stig/VoIP-STIG-V2R2.pdf.

f. VTC STIG, Video TeleConference Security Technical Implementation Guide, Version 1, Release 1, 8 January 2008, http://iase.disa.mil/stigs/vtc_stig_v1r1_010807_final/pdf.

g. Wireless STIG, Wireless Security Technical Implementation Guide, Version 5, Release 2, 15 November 2007, http://iase.disa.mil/stigs/wireless_stig_v5r2.pdf.

4.3.2 Connection and Process Guides

a. Defense Red Switch Network (DRSN) VoSIP Connection Guide, 26 February 2008.

b. SIPRNET Customer Connection Process Guide, 11 July 2008.

4.4 Department of the Army (DA) Publications

a. Army Regulation (AR) 25-1, Army Knowledge Management and Information

Technology, 15 July 2005, http://www.army.mil/usapa/epubs/pdf/r25_1.pdf

b. AR 25-2, Information Assurance, 14 November 2003, http://www.army.mil/usapa/epubs/pdf/r25_2.pdf

c. AR 190-13, The Army Physical Security Program, 30 September 1993, http://www.army.mil/usapa/epubs/pdf/r190_13.pdf

d. AR 190-16, Military Police Physical Security, 31 May 1991, http://www.army.mil/usapa/epubs/pdf/r190_16.pdf

e. AR 380-5, Department of the Army Information Security Program, 29 September 2000, http://www.army.mil/usapa/epubs/pdf/r380_5.pdf

f. AR 380-381, Special Access Programs (SAPS) and Sensitive Activities, 21 April 2004, http://www.army.mil/usapa/epubs/pdf/r380_381.pdf

g. AR 381-14, Military Intelligence, Technical Counterintelligence (U), 30 September 2002 (C).

h. AR 420-1, Army Facilities Management, Chapter 4, Army Military Construction and Non-Appropriated-Funded Construction Program Development and Execution, 12 February 2008, http://www.apd.army.mil/pdffiles/r420_1.pdf.

i. Department of the Army (DA) Pamphlet (Pam) 415-28, Guide to Army Real Property Category Codes, 11 April 2006, http://www.army.mil/usapa/epubs/pdf/p415_28.pdf.

j. Memorandum, DAMI-CD, subject: Army Responsibilities for Protected Distribution Systems, 16 August 2007.

k. U.S. Army Information Systems Engineering Command (USAISEC) Fort Detrick Engineering Directorate (FDED), Technical Guide for the Installation Information Infrastructure Architecture, March 2006.

http://iase.disa.mil/stigs/stig/enclave_stigv4r2.pdf http://iase.disa.mil/stigs/network_stig_v7r1_20071025.pdf http://iase.disa.mil/stigs/stig/VoIP-STIG-V2R2.pdf http://iase.disa.mil/stigs/vtc_stig_v1r1_010807_final/pdf http://iase.disa.mil/stigs/wireless_stig_v5r2.pdf http://www.army.mil/usapa/epubs/pdf/r25_1.pdf http://www.army.mil/usapa/epubs/pdf/r25_2.pdf http://www.army.mil/usapa/epubs/pdf/r190_13.pdf http://www.army.mil/usapa/epubs/pdf/r190_16.pdf http://www.army.mil/usapa/epubs/pdf/r380_5.pdf http://www.army.mil/usapa/epubs/pdf/r380_381.pdf http://www.apd.army.mil/pdffiles/r420_1.pdf http://www.army.mil/usapa/epubs/pdf/p415_28.pdf

FOR OFFICIAL USE ONLY

l. USAISEC Technology Integration Center (TIC), TR No. AMSEL-IE-TI 07-063, Design Guide for the Implementation of Wireless Technologies, May 2007.

m. U.S. Army Network Enterprise Technology Command (USANETCOM) Best Business Practice (BBP) for Wireless Security Standards, Version 1.26, 11 August 2006.

4.5 Miscellaneous Publications

a. American National Standards Institute/Telecommunications Industry Association/ (ANSI/TIA) 607-A-2002, Standard Commercial Building Grounding (Earthing) and Bonding Requirements For Telecommunications, 22 October 2002.

b. Department of State Composite Threat List, distributed semi-annually.

c. Director of Central Intelligence Directive No. 6/9, Physical Security Standards for

Sensitive Compartmented Information Facilities, 18 November 2002.

d. Headquarters, U.S. Air Force/Joint Affairs (JA) Memorandum, Subject: Medical

Use of Encrypted Phone Systems and SIPRNET, 14 April 2004.

e. U.S. General Services Administration (GSA) Federal Specification FF-L-2740A, Locks, Combination, 12 January 1997; Amendment 1, 25 May 2001.

5.0 MAJOR PARTICIPANTS AND RESPONSIBILITIES

5.1 U.S. Army Information Systems Engineering Command (USAISEC) USAISEC serves as one of the Army’s major communications engineering and implementation organizations and offers its services to DOD agencies on a reimbursable basis. Services range from performance of site surveys, development of the Technical Analysis and Cost Estimate (TA/CE) with List of Materials (LOM), procurement of materials, implementation and configuration of systems, and testing of completed installations.

In order to ensure that all information is gathered in an organized and complete manner, USAISEC has adopted the use of the site survey checklist attached in Appendix C.

5.2 Designated Approving Authority (DAA)

a. The DAA is normally at the Regional Chief Information Officer (RCIO) for most Army posts and is at the General Officer/Senior Executive Service level.

b. The DAA is responsible for approving all local campus area network (CAN) and circuit connectivity for the site.

c. In association with approval, the DAA legally accepts (and agrees to mitigate) the risk associated with the system.

5.3 Directorate of Information Management (DOIM) Responsibilities

a. The DOIM is responsible for obtaining all systems accreditation.

b. The DOIM will provide the required SIPRNET IP addresses.. This includes the procurement of any new IP subnets from DISA, as required.

c. The DOIM is responsible for configuration of the existing CAN to pass SIPRNET service to remote buildings, as required.

d. The DOIM is responsible for the implementation of any new circuits required for the installation or expansion of SIPRNET service.

FOR OFFICIAL USE ONLY

e. The DOIM is responsible for the procurement of encryption devices through the Communications Security Logistics Activity (CSLA) and coordination with the local Communications Security (COMSEC) Custodian.

f. The DOIM is responsible for coordinating with the COMSEC Custodian for the procurement and issue of encryption key material and key material loading devices.

g. The DOIM Information Assurance Manager (IAM) is responsible for the overall security of the network. Items will include security oversight, vulnerability assessments, IA Vulnerability Alert (IAVA) compliance roll-ups, as well as other areas.

h. The DOIM, in conjunction with the Information Management Officers (IMOs), is responsible for the procurement, installation, and configuration of application software to be installed on end-user computer resources.

i. The DOIM is responsible for ensuring that Black-side connectivity through the facility local area network (LAN) and the post CAN is available for all encryption devices, as required.

j. The DOIM is responsible for coordination with the Directorate of Public Works (DPW) in the completion of any agreements for site preparation issues (space, power, outlet locations, etc.).

5.4 Information Management Officer (IMO) Responsibilities

a. The IMO in each location is responsible for maintaining the physical and information security of the SIPRNET access.

b. The IMO is responsible for ensuring only the proper equipment is used on the SIPRNET connections. Since all personal computers (PCs) connected to the SIPRNET become classified devices, the removable hard drives or laptops (if used) must be stored in approved security containers during non-duty hours if open storage is not approved.

c. The IMO, in conjunction with the DOIM, is responsible for the procurement, installation, and configuration of application software to be installed on end-user computer resources.

d. The IMO, in coordination with the DOIM, is responsible for updating the applications and the installation of all software patches.

5.5 Joint Responsibilities

The DOIM, IMO, and tenant must coordinate the extension of the SIPRNET drops, ordering of equipment, and overall accountability for the system. To assist with responsibilities, requirements, and documentation, an example of a Standing Operating Procedure (SOP) for SIPRNET at a given location has been included as Attachment 1.

6.0 PLANNING AND PROGRAMMING

6.1 Definition of Terms

6.1.1 Controlled Access Area (CAA). A CAA is an area, such as a building or room, under direct physical control within which only personnel cleared to the level of the information being processed are authorized unrestricted access. Entrance to, and exit from, the CAA must be controlled to ensure only properly cleared personnel have such access. All other personnel are either escorted or are under continuous physical or electronic surveillance. A CAA is not necessarily a secure area that is approved for the open storage of classified

FOR OFFICIAL USE ONLY

material, but an area approved for open storage of classified material is by definition a CAA.

The term “Secret CAA” refers to a CAA in which all personnel are cleared to the Secret level or higher, or are escorted by someone who is. Details regarding the use of a protected distribution system (PDS) in a CAA are located in Paragraph 7.4.5.1.

6.1.2 Limited Control Area (LCA). An LCA is the space surrounding a PDS within which exploitation is not considered likely or for which no legal authority exists to identify or remove a potential violation. All SIPRNET data cables passing through an LCA must be contained within a hardened distribution system. Details regarding the use of a PDS in an LCA are located in Paragraph 7.4.5.2.

6.1.3 Uncontrolled Access Area (UAA). A UAA is an area either external or internal to a facility in which no control of personnel access exists. All SIPRNET data passing through this type area must be enclosed in a hardened distribution system. Details regarding the use of a PDS in a UAA are located in Paragraph 7.4.5.3.

6.1.4 Node. A node is a location from which SIPRNET service is provided and distributed in a facility. It may be located in an equipment cabinet or rack, in a secure room, or inside a GSA safe. It includes all of the equipment used for this function at that location, to include the encryption device, optional router, network switch, power strip, and uninterruptible power supply (UPS).

6.1.5 Drop. A drop is a cable run which connects the node’s network distribution switch to the outlet box at the end user’s location. A drop terminates in a connection inside an outlet box. More than one drop may terminate in an outlet box.

6.1.6 Outlet. An outlet is a termination box at the user location. An outlet may contain more than one connection or drop. An outlet refers to the wall-mounted box at the user location. The box may be a metal lockbox, a plastic raceway box, or any box of similar size and construction.

6.1.7 Connection. The connection is provided by the jack in the outlet box that provides service to a user’s PC or printer. More than one connection may be present in an outlet box.

The jack used to provide the connection may be RJ-45 for copper, straight tip (ST) or Lucent connector (LC) for fiber, or almost any type of industry-standard connector.

6.1.8 Local Area Network (LAN). A LAN is a computer network that spans a relatively small area. Most LANs are confined to a single building or group of buildings. See Figure F-2.

6.1.9 Campus Area Network (CAN). A CAN is an interconnection of LANs within a limited geographical space, such as a school campus or a military base. For example, the data network connecting all buildings at an Army installation is referred to as a CAN. See Figure F-2.

6.1.10 Metropolitan Area Network (MAN). A MAN is a network that interconnects users with computer resources in a geographic area or region. The term is applied to the interconnection of networks (LANs or CANs) in a city or area into a single larger network which may then also offer efficient connection to a wide area network (WAN). For example, the connection of several small CANs located within several miles of each other will form one larger MAN. See Figure F-2.

FOR OFFICIAL USE ONLY

6.1.11 Wide Area Network (WAN). A WAN is a computer network that spans a relatively large geographical area. Typically, a WAN consists of two or more LANs covering cities, countries, and continents. The largest WAN in existence is the Internet. The DISA SIPRNET is considered a WAN. See Figure F-2.

6.1.12 RED. The term RED refers to a signal, wire, text, or information that is classified and unencrypted.

6.1.13 BLACK. The term BLACK refers to a signal, wire, text, or information that is either unclassified, or classified but encrypted, rendering it unclassified.

6.2 Project Goals

The primary goal of a typical SIPRNET project is the expansion of the SIPRNET Red-side infrastructure, extending connectivity to users not collocated with the SIPRNET distribution node. The methodology used to provide the SIPRNET service will vary based upon such factors as the number of users, relative locations and concentrations of users, building layout and construction, and the user/unit level (division, brigade, battalion, etc.).

Several standard designs have been developed and are listed in the paragraphs below. These designs are intended for use as a guideline and may be slightly tailored to meet unique requirements.

6.2.1 Standard Rule of Thumb for Brigade Combat Team (BCT). These figures represent a typical user location requirement:

• Light BCT: 7 buildings, 48 users

• Heavy BCT: 8 buildings, 56 users

• Stryker BCT: 10 buildings, 72 users

6.2.2 General Guidance for New Construction. Beginning with the Fiscal Year 2008 (FY08)-funded projects, Military Construction – Army (MCA) will include more extensive design and installation of SIPRNET drops. SIPRNET will be installed in most, but not all, buildings (see Appendix H). As a general rule of thumb, all private offices will receive one SIPRNET drop (new construction only). In other areas, SIPRNET drops will be designed for approximately 25 percent of the general population. Design of “SIPRNET cafés” is encouraged (see Paragraph 6.2.5) to accommodate the “occasional” SIPRNET user group.

6.2.3 General Guidance for Retrofits, Building Rehabilitations, and the Installation Information Infrastructure Modernization Program (I3MP).

Beginning with the FY08-funded projects, the MCA and I3MP will engineer and install SIPRNET down to the battalion (Bn) level. For installation of SIPRNET in existing facilities, the quantity of drops is not as robust as for new construction.

Numerous profiles for installation of SIPRNET in existing facilities are included in the tables provided in Appendix G for use as general guidance in design and estimation. The quantities in the tables reflect the guidelines from the Command, Control, Communications, Computers, and Information Management (C4IM) Service List. A memorandum signed by the CIO/G6 on 23 March 2007 conveyed the validation of the information and the changes to the list.

For buildings which do not fit into the profiles in the tables, five SIPRNET drops will be engineered and installed for those buildings accommodating personnel in the grade/rank of

FOR OFFICIAL USE ONLY

O-5/Lieutenant Colonel (LTC) and above, or the civilian equivalent, with command responsibilities. An exception to this is hospitals and medical facilities; these will be provided only one SIPRNET drop per building due to Geneva Convention and Law of Army Conflict (LOAC) issues. This same restriction applies to new construction as well (see Appendix H, category 510).

6.2.4 SIPRNET in Existing Facilities

a. Brigade Headquarters (HQ). SIPRNET outlets with RJ-45 connections will be installed at the Brigade HQ. The PDS will be mounted just below the suspended ceiling for ease of visual inspection. A locking cabinet will be installed to secure an encryption device, a multi-port switch, and an UPS. The locking cabinet is not a GSA-approved security container; therefore, new or additional local security procedures may need to be implemented to provide the appropriate level of protection for the classified components.

See Table G-1 for a suggestion of user allocation and distribution at the Brigade HQ for typical BCTs.

b. Headquarters, Headquarters Company (HHC) – Brigade and Stand-alone Company Level Units. One SIPRNET drop will be installed at these elements. Due to the limited user drop requirement, the suggested design uses an Individual Mobile Encryptor (IME) as described in Paragraph 8.2. If an IME is not used, a locking cabinet will be installed in the commander’s office to secure an encryption device and an UPS. The locking cabinet is not a GSA-approved security container; therefore, new or additional local security procedures may need to be implemented to provide the appropriate level of protection for the classified components. A GSA-approved safe is required for storage of the laptop when it is not in use.

c. Battalion Headquarters (Bn HQ). SIPRNET outlets with RJ-45 connections will be installed at the Battalion. The PDS will be mounted just below the suspended ceiling for ease of visual inspection. A locking cabinet will be installed to secure an encryption device, a multi-port switch, and an UPS. The locking cabinet is not a GSA-approved security container; therefore, new or additional local security procedures may need to be implemented to provide the appropriate level of protection for the classified components.

See Table G-2 for a suggestion of user allocation and distribution at the Battalion level.

d. Division HQ. SIPRNET outlets with RJ-45 connections will be installed at the Division HQ in the same fashion as described for a battalion. See Table G-3 for a suggestion of user allocation and distribution at the Division HQ.

e. Corps HQ. SIPRNET outlets with RJ-45 connections will be installed at the Corps HQ in the same fashion as described for a battalion. See Table G-4 for a suggestion of user allocation and distribution at the Corps HQ.

f. School Commandant and U.S. Army Engineer School. SIPRNET outlets with RJ- 45 connections will be installed for the School Commandant and U.S. Army Engineer School in the same fashion as described for a Battalion. See Table G-5 for a suggestion of user allocation and distribution at the School Commandant and U.S. Army Engineer School.

g. Depot Commander and Production Operations. SIPRNET outlets with RJ-45 connections will be installed for the Depot Commander and Production Operations in the same fashion as described for a battalion. See Table G-6 for a suggestion of user allocation and distribution for the Depot Commander and Production Operations.

FOR OFFICIAL USE ONLY

h. Garrison Commander and Garrison Directorates. SIPRNET outlets with RJ-45 connections will be installed for the garrison commander and garrison directorates in the same fashion as described for a battalion. See Table G-7 for a suggestion of user allocation and distribution for the garrison commander and garrison directorates.

i. Battle Command Training Center (BCTC). Normally, a BCTC will be designated as a CAA. However, the design is suitable for installation in either a CAA or UAA. The standard design for a BCTC will include a hardened distribution using a hybrid solution of raceway and conduit for the PDS. The SIPRNET distribution within the building will be carried over fiber optic cable. The fiber cables will be installed in a ferrous metallic raceway. A separate, locked SIPRNET area will be located in the communications room.

The number of outlets is based upon installation requirements ranging from a small BCTC (six outlets) to a large BCTC (40+ outlets). The BCTC must have the ability to handle surge conditions for Joint and Battle Command Training Program (BCTP) exercises which are projected to occur every six months based on the Air Force Generation (ARFORGEN) cycle.

j. General Officer Quarters (GOQ). If a GOQ is being built as new construction under MCA or Unspecified Minor Military Construction Army (UMMCA), one SIPRNET drop will be installed per GO. Due to the limited user drop requirement, the suggested design uses an IME as described in Paragraph 8.2. A GSA-approved safe is required for storage of the laptop when it is not in use. See AR 420-1 for the funding-type breakdown.

6.2.5 SIPRNET Cafés. Common SIPRNET areas should be considered as a means of lowering the number of dedicated SIPRNET outlets. These areas provide a means for organizational SIPRNET access while minimizing the risk and cost of running SIPRNET and PDSs to multiple individual locations. The SIPRNET “café” is ideal for the user who requires SIPRNET connectivity on an intermittent basis. As a general rule, a SIPRNET café should be sized for five percent of the building’s population. The room should be designed as a CAA, following all guidelines in AR 380-5, Section 7. If designed in this manner, the room may also be used for storage of classified documents, laptops, and hard drives, if it is approved for such by the DAA (i.e., accredited for open storage at the Secret level).

6.3 Protection of Sensitive Information in Areas with Varying Access Control

6.3.1 The SIPRNET is the DOD’s primary command and control network. Because of the sensitivity of information and the crucial need for its protection, it is necessary early in the process of SIPRNET planning to identify possible risks that are present in the user environment. This process occurs even before the Request for Service (RFS) or any initial design modeling is performed. Threats vary greatly, depending on the location of the command and sensitivity of the information. The DISN Security Accreditation Working Group (DSAWG) establishes SIPRNET risk levels. However, the local command must strive to make unauthorized access so difficult that an intruder will hesitate to attempt to try to gain access to the sensitive information. If attempts are made, it is necessary to have existing methods in place for discovery and apprehension.

6.3.2 DISA has published the Enclave Security Technical Implementation Guide (STIG) (see references, Paragraph 4.3). This guide contains security regulations and best practices that provide detailed guidance to securely configure elements of a security enclave. This guide also lists other DISA STIGs for each major operating system, Web server, network, and database.

FOR OFFICIAL USE ONLY

6.3.3 Preliminary Requirements and Considerations. The site personnel must be aware of several areas which will impact the design of the effort. The following questions provide a good starting point in setting the design parameters.

a. To what type of environment will the SIPRNET be extended?

(1) Controlled Access Area (CAA)

(a) Number of user drops.

(b) Open storage environment. Physical Security AR 380-5, Chapter 7, Section III.

(c) Intrusion Detection System (IDS) per AR 380-5 Section 7; AR 190-13

Section 4 through 8; NSTISSI 7003; and NSTISSAM 2-95/2-95A.

(2) Limited Controlled Area (LCA)

(a) Number of drops.

(b) PDS (NSTISSI 7003).

(c) IDS (AR 380-5, Section 7; and NSTISSAM 2-95/2-95A).

(d) Physical security inspection policy (NSTISSI 7003).

(3) Uncontrolled Access Area (UAA)

(a) Number of drops.

(b) PDS (NSTISSI 7003).

(c) IDS (AR 380-5, Section 7; and NSTISSAM 2-95/2-95A).

(d) Physical security inspection policy (NSTISSI 7003).

b. What type of infrastructure will be used?

(1) Point-to-Point Copper and Fiber

(a) If copper/outside plant telephone pairs are available, a serial link may be established using Channel Service Unit (CSU)/Digital Service Unit (DSU) technology. A KIV-7HSA/B may be used to secure the link. The bandwidth limitation of the KIV-7HSA/B solution is a T1 or 1.544 Megabits per second (Mbps) for CONUS WAN connectivity.

(b) A second solution uses single-mode or multimode fiber with fiber optic modems.

(c) Other types of circuits may also be implemented, dependent upon the type and amount of cabling available as well as the current state of technology.

(2) Local CAN distribution (outside plant) may be extended using copper or fiber.

(a) The new SIPRNET building infrastructure will be Category (CAT) 5e or

CAT 6 twisted-pair copper cable or fiber.

(b) A second solution uses single-mode or multimode fiber with media converters and IP encryptors as required.

c. What type of SIPRNET IP traffic will the tenant mission need?

(1) Imagery (high bandwidth use).

(2) E-mail and other small document traffic (low bandwidth).

FOR OFFICIAL USE ONLY

(3) Combined with the number of users, estimated bandwidth usage must be compared with the available bandwidth to determine if a higher bandwidth circuit is needed from the DISA Point of Presence (PoP).

d. What are the tenant mission support requirements?

(1) 8 hours per day/5 days a week.

(2) 24 hours per day/7 days a week.

(3) Most DOIM support staffs do not provide 24/7 support. If 24/7 support is needed and is not available through the DOIM, the tenant may request a dedicated DISA PoP at the location. This option does exist, but may be cost prohibitive. Alternatively, the tenant may request 24/7 support from the DOIM, but again, this option may be cost prohibitive.

e. What is the cost to the tenant for the new SIPRNET network connection service?

(1) Initial cost includes the DISA connection fee (based on bandwidth), DOIM charge-back installation fee, accreditation, etc.

(2) Recurring cost includes monthly charges by the DISA, DOIM, or any other entities.

(3) Monthly costs will be determined in accordance with the Enhanced Planning

Process (EPP). This simplified cost recovery and pricing structure focuses on bandwidth capacity and packages of services rather than usage. Details for the EPP are available at the following DISA web site.

http://www.disa.mil/main/support/epp.html.

f. What is the global threat posture for this geographic location?

(1) Although this is not typically critical for most of the locations within the

CONUS, the tenant security manager and the DAA should be aware of this information.

(2) If this geographical location has been identified as a medium- or high-threat

(and some low-threat) location, the implementation approach must conform to the Standards in the NSTISSAM TEMPEST/2-95, Amendment 2-95A, and CNSSI 7000. A Certified TEMPEST Technical Authority (CTTA) must be consulted to advise on the engineering design. A General Officer/SES will have to sign the approval for funding for TEMPEST issues if the cost is $50,000 or higher.

g. Other considerations and information required for the site survey are included in Appendix C, the SIPRNET Site Survey Checklist.

h. In addition, Attachment 1 provides a sample of an SOP among a tenant, DOIM, and other site personnel. This document may be tailored to meet the exact requirements for coordination, agreements, and paperwork for a specific post/location.

6.3.4 Physical Security Guidance. Details pertaining to physical security requirements for secure rooms are addressed in AR 380-5, Chapter 7, Section III.

6.3.4.1 Secure Room/Communication Closet with Normal Operation. Units whose nodes will operate only during normal business hours (non-24/7) require the following site preparation of their closets to be certified as CAA-rated for open storage at the Secret level (refer to Sections 7-19 and 7-20 of AR 380-5).

http://www.disa.mil/main/support/epp.html

FOR OFFICIAL USE ONLY

a. The walls, floor, and roof must be of permanent construction materials; i.e., concrete block, concrete, plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other materials offering resistance to, and evidence of, unauthorized entry into the area. For new construction, walls should extend from true floor to true ceiling (structural floor to structural ceiling) with permanent construction materials. In existing facilities, walls may also be extended with 18-gauge expanded steel screen or equivalent wire mesh.

b. The access door to the area must be substantially constructed of wood, metal, or other solid material. As a minimum, the door must have a high-security dead bolt lock with a 25-millimeter (1-inch) throw and a cylinder that meets the requirements of the Underwriters Laboratories, Inc., (UL) 437 Standard for Key Locks. In addition, either a GSA-approved changeable combination lock meeting Federal Specification FF-P-110 series requirements, such as a KABA-MAS CDX-09 or a high-security, key-operated padlock meeting Military Specification MIL-DTL-43607J must be used to secure the door. As an alternative, a built-in GSA-approved combination lock, such as the CDX-09 type, meeting Federal Specification FF-L-2740 (see references, Paragraph 4.5) may be used. Under some circumstances, a high-security, tamper-resistant card reader lock could be added to the entry door to provide greater physical protection than the single key or combination entry. The card reader release mechanism must not be a magnetic lock that will release during a power failure. Doors with hinges inside the room (in-swing) are preferred, as the hinges are not accessible from outside the room. The hinge pins of out-swing doors, if used, must be pinned, brazed, or spot-welded to prevent removal. When double doors are used, install an astragal on the active leaf of the door.