RBS Concept of Operations 2018.pdf

CONOPS FOR RBS FEMA

i

Federal Emergency Management Agency

Risk Management Division

Concept of Operations

Reinsurance Broker System (RBS) ii

Contents

1. Purpose

2. Insurance Catastrophe Models and Tools

2.1. Microsoft SQL Server-based software..……………………………………..4

2.2. R-based software………………………………………………………. 4

3. System Architecture

3.1. Software on the RBS Environment…………………………………… 7

3.2. Components of the RBS Environment……………………………… 7

3.2.1. AIR Touchstone RDP………………………………………. 8

3.2.2. RMS RiskLink RDP………………………………………… 8

3.2.3. KatRisk & Data Processing in R……………………………. 8

3.2.4. Additional Components 9

4. System Security

4.1. Access Control…………………………………………………………….. 10

4.2. Security Monitoring and Protection………………………………… 10

4.2.1. Activity and Event Monitoring………………………………. 11

4.2.2. Patching……………………………………………………… 11

4.2.3. Vulnerability Scanning……………………………………… 11

4.2.4. Database Scanning…………………………………………… 11

4.2.5. Anti-Virus…………………………………………………… 11

4.2.6. IDS/IPS and Firewall…………………………………………. 11

4.2.7. Multi-Factor Authentication…………………………………. 12

4.2.8. Contingency Planning (DR)……………………………… 12

Purpose The purpose of this Concept of Operations (ConOps) document is to outline the requirements and design for the Reinsurance Broker System (RBS), which is used by the National Flood Insurance

Program’s actuaries and catastrophe modelers. The National Flood Insurance Program (NFIP) offers flood insurance in the United States to public and private entities. The NFIP is operated by the US Federal Emergency Management Agency (FEMA).

RBS will run third-party vendor catastrophe models, proprietary actuarial models, as well as other tools to perform reinsurance analytics in support of the NFIP Reinsurance Program and rate development.

Insurance Catastrophe Models and Tools The use of probabilistic catastrophe models is common practice in the (re)insurance industry.

These models are sophisticated tools that consist of three main components: a hazard module that represents the risk of various natural hazards (e.g., inland flood, flooding related to storm surge);

a vulnerability module that assess the damageable of buildings based on physical characteristics such as construction material, building use, building age and building height; and a financial module that applies policy terms such as deductibles and limits. These tools provide a standard way for the industry to measure, manage and compare catastrophe risk for various policies and insurance portfolios.

The input to these catastrophe models is detailed information on the policies of an insurance portfolio, including location information (street address, latitude and longitude, etc.), building values, building characteristics and insurance policy terms. The output of the models is probabilistic loss levels, generally expressed as return period years. The losses can be expressed on an aggregated portfolio level (countrywide) and/or detailed basis, such as geography or any risk or hazard category (e.g., aggregated loss by flood zone).

The output of the catastrophe models can be used in various post-processing tools, which can combine and blend modeled output, as well as include output from non-modeled sources of loss

(e.g., flood from precipitation, which is not contemplated in any commercial catastrophe model).

This modeling output can be used to anticipate how reinsurers will view the NFIP risk and to estimate expected reinsurance pricing.

FEMA Network

Reinsurance Broker System (RBS)

Data

Augmentation

& Processing

Catastrophe (Flood)

Model Analysis

• RMS RiskLink

• AIR Touchstone

• KatRisk

• CoreLogic RQE

Post-

Processing &

Exhibit

Creation

Secure FTP Raw Data from NFIP

(contains PII)

Secure FTP Catastrophe Modeling Aggregated Results

(no PII)

Figure 1: High-Level Data Workflow

Secure FTP Server

RMS RiskLink Clusters

AIR Touchstone Clusters

KatRisk Model (R Scripts)

Reinsurance Broker

System (RBS) Microsoft Azure Government Cloud

FEMA Network

CoreLogic RQE Cluster

Figure 2: Data Flow

2.1 Microsoft SQL Server-based software

As depicted in Figure 2, natural catastrophe models are hosted on the platform and some operate using SQL servers. Installation, maintenance and troubleshooting of Microsoft SQL Server and

SQL Studio facilitates use of these models.

The models develop deterministic and probabilistic loss estimates for Inland Flooding; Hurricane

Precipitation and Storm Surge.

2.2 R based tools

Some natural catastrophe models operate using R scripts via the secure FTP server.

3. System Architecture RBS is built in the Microsoft Azure Government cloud, utilizing their Infrastructure as a Service

(IaaS) offering. IaaS is required due to the high-computation needs of the vendor catastrophe models (i.e., multiple servers with 16-core processors and upwards of 128 Gigabytes of RAM) as well as detailed server configuration specifications specific to each vendor.

Microsoft Azure Government was chosen because the facility is an isolated data center in the continental United States (Boydton, VA, with a disaster recovery backup site in Des Moines, IA), has achieved a Provisional Authority to Operate (P-ATO) certification under the US Federal Risk and Authorization Management Program (FedRAMP) and is operated by screened US employees. In addition, utilizing cloud infrastructure will give reinsurance brokers the flexibility to only consume computational resources during periods of active analysis.

Figure 3 below shows the Application Architecture diagram.

AIR

Touchstone v5

Cluster

RMS RiskLink v17 Cluster

KatRisk SoloKat/

ESRI Server

Domain Controller Cluster (HA)

Encrypted Cloud

Storage

Client Machine (Model Access Point)

Microsoft Azure Government Cloud Environment

RBS User GFE Laptop

Application Server

(IIS)

Analysis Manager (HPC Head Node)

Analysis Engine (HPC Compute Node)

Analysis Engine (HPC Compute Node)

Analysis Engine (HPC Compute Node)

Database Server

Database Server/ Job Manager

Analysis Server

Analysis Server

Analysis Server

Firewall & IPS/IDS Barracuda Virtual Appliance (HA)

Secure FTP Server

Splunk Server Nessus Scanner

McAfee ePO Server

RMS RiskLink v18 Cluster

Database Server

Analysis Server

Analysis Server

Analysis Server

Client Machine (Model Access Point)

AIR

Touchstone v6

Cluster

Application Server

(IIS)

Analysis Manager (HPC Head Node)

Analysis Engine (HPC Compute Node)

Analysis Engine (HPC Compute Node)

Analysis Engine (HPC Compute Node)

Database Server

Client Machine (Model Access Point)

Client Machine (Model Access Point)

Resource

Servers

Database Server

Analysis Server

Application Server

CoreLogic RQE v18 Cluster

Client Machine (Model Access Point)

Analysis Manager (HPC Head Node)

KatRisk SpatialKat

Figure 3: RBS Architecture

Cat Vendor 1

Cat Vendor 2

Cat

Vendor 3 Cat

Vendor 3 v2

Cat

Vendor 4

3.1 Software on the RBS Environment

The RBS environment will have the following software programs/components installed.

User Software:

• AIR Touchstone: Catastrophe modeling software including US inland flood and US coastal storm surge models

• RMS RiskLink: Catastrophe modeling software including a US coastal storm surge model

• KatRisk: Catastrophe modeling software (consisting of R scripts and hazard data without a dedicated UI) including a US inland flood model

• CoreLogic RQE: Catastrophe modeling software including a US inland flood model

• Microsoft SQL Server 2016: Relational database software

• Microsoft HPC Pack 2012 R2: High Performance Computing software that acts as a job manager for AIR Touchstone

• Apache Tomcat 8: Open-source web-application server required for CoreLogic RQE

• Java 1.8: Required for CoreLogic RQE

• Microsoft Office 2010 (64-bit): Professional productivity software including Microsoft

Word, Excel, Office and PowerPoint

• R and R Studio: Statistical programming language

• Python: Scripting programming language

• Notepad++: Enhanced text editor

• ESRI ArcGIS Desktop: Mapping software for creating maps and adding geographical information to data

• ESRI ArcGIS License Manager: Allows managing/software of licenses for ESRI ArcGIS desktop software

Security Software:

• McAfee ePolicy Orchestrator (ePo) o McAfee Anti-Virus o McAfee HIPS

• Nessus Professional

• Splunk

• Dell Foglight

• Barracuda NextGen Firewall F-Series for Microsoft Azure, Level 4

3.2 Components of the RBS Environment

For large insurance portfolios such as that of the NFIP, computational efficiency of the vendor catastrophe models can be enhanced by utilizing multiple high-end servers to run analyses. Each model is configured in a Remote Distributed Processing cluster or RDP. Each vendor has different specifications on required server functions. Unless otherwise specified, all servers in the RBS environment are running Windows Server 2012 R2 as their operating system (OS).

3.2.1 AIR Touchstone RDP

AIR’s Touchstone model requires at minimum an application server, an analysis manager (HPC head node), an analysis server (HPC compute node) and a database server (running Microsoft

SQL Server 2016). In the RBS environment, there will be three analysis servers, which allows for more simultaneous analyses and/or more cores to be dedicated to each analysis.

AIR Touchstone requires Microsoft HPC Pack 2012 R2, which acts as the job manager for

Touchstone.

In addition to the RDP components, there will be a client machine, which acts as the user interface (UI) to access Touchstone, allowing users to import exposure, run analyses and view exposure and results through the Touchstone software front-end application. This client machine is shared for all three vendor catastrophe models and also has other useful software installed such as Microsoft SQL Server Management Studio, Microsoft Office and Notepad++.

3.2.2 RMS RiskLink RDP

RMS’s RiskLink model can be run on a single desktop machine or server; however, in order to run multiple simultaneous analyses and/or large analyses, it is best to separate the database server from the analysis server in order to gain computational efficiency. The RBS environment will consist of a database server (which will also act as the job manager) and three analysis servers.

The database server will be running Microsoft SQL Server 2016.

In addition to the RDP components, the user will access the UI for RiskLink via the client machine, as described in the AIR Touchstone section. This will allow the user to import exposure, run analyses and view exposures and results.

3.2.3 KatRisk & Data Processing in R

In addition to the AIR and RMS RDP environments and the client machine which allows user access to both of these models, the RBS environment will contain one other server dedicated to data processing and cat modeling. This server will be utilized to run R and R Studio, which will be used for data management process such as portfolio data augmentation. In addition, this server will be used to execute the R scripts that make up the KatRisk flood model.

3.2.4. CoreLogic RQE

CoreLogic’s RQE model requires three components for an RDP cluster: a database server, an application server and an analysis server. RQE also requires the installation of Apache Tomcat, as well as Java 1.8. The database server will be running Microsoft SQL Server 2016.

3.2.5. Additional Components

In addition to the servers that run the catastrophe modeling software that is at the core of RBS, there are several additional servers that manage security and support functions for the RBS environment.

• Firewall Servers: Two servers (for High Availability) utilizing a custom Linux image created by Barracuda

• Domain Controllers: Two servers (for High Availability) which control the Active

Directory

• Secure FTP Server: One file server for passing files securely into and out of the RBS boundary, as well as storing RBS work-product

• Resource Servers:

o McAfee ePO: One server managing McAfee ePolicy Orchestrator o Splunk: One server managing Splunk installation o Nessus/Foglight: One server managing Nessus vulnerability scanning tool and

Foglight. This server also hosts the ESRI ArcGIS License Manager software.

System Security

4.1.Access Control

Marsh and McLennan Companies (MMC), of which Guy Carpenter is a subsidiary, currently sets corporate technology security policies that apply all MMC hardware and information systems.

While the RBS environment will not be hosted in an MMC-operated data center, it is still required to adhere to all security protocols set forth by Marsh Global Technology Infrastructure

(MGTI), as well as those dictated by the Department of Homeland Security (DHS) and FEMA.

RBS servers will only be accessed by authorized federal and contractors who have gone through the badging process and are US citizens. The domain controller within the RBS environment will ensure that only accounts of individual with authorization will be able to access these servers. In addition, many of the access control security requirements will be controlled by

Group Policy Objects (GPOs) within active directory.

System administrators will have access to log into all RBS servers, while general users will only have access to log into the client machine and the KatRisk server. In addition, users will have administrative rights to attach and detach databases on the SQL servers, as this is required for use of the catastrophe models. The catastrophe models do require the use of a service account to communicate between RDP components; however, these service account credentials will be known only to system administrators and will have the added protection of not being able to be used for login to servers.

Authorized federal contractors will access RBS servers via their government-furnished laptops

(GFEs). These laptops will utilize PIV-based identification for logon.

The RBS servers will be accessed via a secure VPN tunnel between the FEMA network and the

Microsoft Azure data center. In addition, there will be a whitelist of only IP addresses originating from authorized computers connected to the FEMA network.

4.2. Security Monitoring and Protection

The virtual machine servers in the Azure environment will start with the baseline Windows 2012

R2 Server image used for all MMC servers. This image will be customized to work in the cloud and meet FEMA requirements for ATO certification.

The reinsurance broker’s technical management will coordinate all security management and monitoring with the assigned FEMA ISSO and ensure monitoring, auditing/logging/event management, scanning, and patching/remediation is conducted and scheduled in accordance with DHS 4300 and the relevant FEMA guidance.

4.2.1. Activity and Event Monitoring

• Windows native logging, Active Directory logging and SQL logging will all be enabled

• Splunk will be used to monitor logs and set alerts

4.2.2. Patching

• Windows OS native updating will be utilized for patching

• This will be automated via PowerShell scripts

4.2.3. Vulnerability Scanning

• Nessus Professional will be used for vulnerability scanning

4.2.4. Database Scanning

• Dell Foglight will be used for database scanning

4.2.5. Anti-Virus

• McAfee anti-virus will be used

4.2.6. IDS/IPS and Firewall

• The environment will inherit this protection for the underlying infrastructure and network from Azure

• The RBS environment will have an edge firewall and IDS/IPS protection via Barracuda solution

• For the IaaS servers, host-based protections will be also instituted o McAfee HIPS in monitor-only mode (since prevention mode stops our applications from running)

4.2.7. Multi-Factor Authentication

• Multi-factor authentication to log into servers on RBS using PIV-credentials is planned and should be implemented in the summer of 2018.

4.2.8. Contingency Planning (DR)

• Utilize geo-redundant storage for user file storage and backup storage

• Configure SQL native backups to do weekly fulls and nightly incrementals to the geo-redundant storage

• Once each VM is built out and tested, do a sysprep and take virtual images which will be placed in custom marketplace or geo-redundant storage