Existing FOH IT Systems Architecture and Configuration 2023-2024.pdf

Existing FOH IT Systems, Architecture, and Configuration (2023-2024)

Network and Network Services FOH is running a blend of Windows Server and Red Hat Enterprise Linux (RHEL) servers. Legacy software is running on Windows servers primarily; however, FOH has shifted its architecture to run mostly on the RHEL platform.

High-availability/High-traffic application systems make use of web farms, as well as cluster based, zero-trust architectures.

VPN access is supported via Pulse Secure (SA 3300) for FOH-specific applications and using GlobalProtect client for HHS/ITSC access.

Web proxy services are provided via Squid Proxy. Reverse proxy services are provided via Apache.

Authentication services for systems accessed from remote sites are managed through Microsoft Active Directory and PSC’s AMS service.

Network and System Administration FOH systems are hosted as PaaS in the HHS Cloud-Managed Application Hosting

Center (C-MAHC) operated by OCIO and Sev1Tech.

All FOH systems are on virtual machines with all environments on Sev1Tech hosted

Amazon Web Services instances.

Backup is performed via Sev1Tech services.

Corporate Anti-Virus protection is supported via Sev1Tech services.

Application patch management and configuration compliance is the responsibility of FOH

IT. Sev1Tech provides patching support for the operating systems and infrastructure.

All FOH applications ride on the HHS general support network managed by the Office of the Chief Information Officer (OCIO). FOH asset Security is the responsibility of FOH IT.

Tenable Nessus (OCIO managed) is used to analyze security vulnerabilities. These systems identify known and zero-day vulnerabilities, plus provide security risk assessment, enabling security best practices, policy enforcement, and regulatory audits.

Application Hosting Residual web hosting is performed using Apache on RHEL or IIS on Windows Server host platforms.

Application hosting is done as shared (multiple applications on the same machine), dedicated (one web/application server per system), or load balanced across a “farm” of web servers as applicable.

Data services are provided via Microsoft SQL Server and RHEL Maria DB. FOH also makes extensive use of Microsoft Windows SQL Server Reporting Services.

Advanced data system configurations make use of replication &/or log shipping to help balance system performance and provide for redundant systems.

Application Development Legacy corporate applications are developed as ASP.Net applications. Systems are developed as secure n-Tiered web applications using the ASP.Net 4.0 framework and C# Code.

The application FMERITS was developed in Visual Basic 6.

All FSTM development is done in Visual Studio.

Microsoft Access is used as the front end and connects to a MS SQL server.

The FOH IT code repository may be stored in Team Foundation Server (TFS) and/or a local instance of GitHub.

Infragistics ASP.Net library is a commercial component used in the FOH billing application FSTM.

FOH makes use of a number of automated test tools:

o EndUnit is used to test new code o MOK is used for database testing o Puppet may be utilized as an automated integration tool o Icinga may be used as a service monitoring tool

Office and Health Center Desktops/Laptops Desktop hardware is provided and supported by HHS / OCIO.

There are limited business applications that utilize a few non-OCIO PCs. In these cases, FOH uses the following standard applications on client PCs:

o Windows 10 o Microsoft Office Desktop (Word, Excel, PowerPoint, Outlook) o Adobe Acrobat Reader o Internet Explorer o McAfee Enterprise VirusScan 8.5i (with ePolicy Orchestrator) o Java Runtime Environment o Adobe Flash Player

FOH uses the following specialized applications.

o Adobe Acrobat Professional is provided by FOH IT on an as needed/approved basis, based on approval from the staff manager o These applications are provided by OCIO on an as needed/approved basis, based on approval from the FOH IT Director:

• Microsoft Project

• Microsoft Visio

Label printers are provided by FOH for use in FOH clinics and labs Document scanners are provided for high-volume scanning FOH will provide the systems and tools as Government Furnished Equipment (GFE).

Any new tools requested by the Contractor must be approved by the CTI Director prior to use.

FCS – Real Time Framework for Management (RTFM) Puppet may be used for updates.

Icinga is used for service monitoring.

NXLog is used as a log aggregation tool.

Squid Proxy may be used to fulfill proxy to internet for servers.

MySQL is running databases for the tools on those servers.

FCS – FOH Service Tracking and Management System (FSTM) Users access the system using a web browser. The use of HTTPS helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

The browser makes a request to the server via HTTPS and receives relevant responses.

Microsoft SQL Server provides the database technology for the applications. The SQL

Servers are scalable. Currently there is a core database server; Data Mart server for reporting; a reporting server; and one is dedicated for queued reports. Each server may be scaled with additional processors, memory and/or storage devices as needed.

The web servers are hosted on the Secure Subnet; this area of the network is isolated from the Internet by the External Firewall.

The Windows based IIS web server provides an application hosting platform for the ASP.Net application. Note: the system is designed so that in the event traffic gets to be excessive for one web server to support, it will be possible to scale to multiple web servers.

The Windows SQL Server platform serves as the database that supports the ASP.Net applications. The system is designed to use multiple database servers; one for the core data system, one for SQL Reporting Services, and one to provide a data mart for queued reports to be developed from. In the event that this component needs to be scaled, more processors, memory and/or storage devices will be added to those platforms.

The web server is hosted on a platform provided by the CMAHC.

Users that access the FSTM application do so via an HTTPS connection. The use of

HTTPS helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

Users access the data system via a Microsoft Internet Explorer 11 browser.

FCS – FOH Medical Evaluation/Requirements Information Tracking System (FMERITS) The operating system for FMERITS is Microsoft Windows. Visual Basic 6 provides an interactive communications interface between users and FMERITS.

The source code for the programs that process FMERITS data is developed in Visual

Basic and Transact-SQL (TSQL).

Internal FOH users access the FMERITS application via the OCIO Virtual Private

Network (VPN) connection to a terminal server via Active Directory dual factor authentication.

For external users, the Pulse Connect Secure appliance, located in the CMAHC, requires dual factor authentication. User data is routed through a firewall to the PCS device and then to a Microsoft Terminal server on the Local Area Network (LAN).

ITIO manages the firewalls and routers that connect the FMERITS system to the Internet. Once the user gains access to the Terminal Server, they can access the FMERITS application through a desktop shortcut. The desktop application connects to the SQL database and to a file server that are located behind a secure subnet firewall.

The FMERITS sub-components share authentication, and are all accessed by accessing the FMERITS application, then using a dashboard to connect to the sub-component that needs to be used.

FCS -- FedHealth FedHealth is a web-based system that is accessed by all authorized FOH personnel.

FedHealth is built upon the COTS products and development of the FedHealth System under another Contract.

RHEL is utilized for all FedHealth systems.

Maria DB is used for data storage.

An Amazon Web Services (AWS) load balancer is used between 2 front-end web servers to moderate incoming traffic.

A secure file transfer system is utilized to transfer files securely to non-HHS personnel.

FOH Staff Portal Website (Staff Portal) The FOH Staff Portal is a SharePoint site hosted by OCIO, but configured and managed by FOH IT.

A secure file transfer capability is used to link external FOH users to non-sensitive data on the Staff Portal.

Staff Portal is not designed to store PII/PHI.

FOH Public Website (Public Web) The Public Web consists of one RHEL server. Users access the data system via HTTPS in a modern web browser.