Attachment 19 - End User Computing

Attachment 19

End User Computing (EUC) Overview The SEC’s End User Computing performs the following functions:

1. Patch/Release Management: Complete overall patch/release management as necessary as well as ensure that necessary routine and emergency operating system; application and security patches; are deployed efficiently and as transparently as possible to Commission workstations. A variety of tools such as, SMS, and BigFix are used to identify, manage as well as monitor vulnerabilities to meet compliancy requirements. All patch/release management processes are completed within the SEC defined change management procedures.

2. End Users Communication: The SEC End-User Computing environment needs to identify issues/concerns within the Commission’s IT community and ensure that relevant issues are addressed at the appropriate level within OIT. Ensure a smooth flow of communication throughout the IT community on issues relevant to the Commission’s information technology programs. Keep IT specialist community informed of all IT issues relevant to the operation and maintenance of the workstation infrastructure.

3. Management of Approved Hardware/Software Lists: EUC addresses requests for new hardware and software on frequent schedule. In order to maintain EUC environmental stability, the approval and management of hardware and software lists are completed.

Management of approved and SEC supported workstation hardware/software lists are maintained through evaluation, testing, and coordinate with the SEC test lab as well as management. All products are reviewed and accepted/rejected for infrastructure use to ensure enterprise architecture standards and business needs of the Commission are met.

4. Application Packaging: Application packaging is completed at the SEC in conjunction with test lab and change management processes/procedures to ensure that applications are consistently deployed with predictable settings and results Commission-wide. Application packages are created with the intention of using SEC application deployment tools such as SMS, BigFix, and in past cases Microsoft Active Directory Group Policy Objects.

Application Packaging and the SEC remote deployment tools help to standardize workstations and provide valuable information for asset reporting.

5. Major Software Releases and Project Implementation: The SEC End-User Computing environment ensures that upcoming releases to major operating systems and office productivity software are planned and introduced into the infrastructure as appropriate.

Necessary tools and assistance is provided to the IT community to ensure that all program and regional offices adhere to SEC standards, processes, and procedures as they apply to workstation software, hardware, IT security, along with asset management releases or implementations.

Infrastructure Management Tools EUC strives to maximize use of infrastructure management tools such as BigFix, McAfee, and Checkpoint to manage as well as stabilize the SEC workstation environment. These tools are used for things such as measurement of workstation compliancy, remote software installations, patch/release management, remote administration and management; as well as reporting on workstation assets. EUC identifies weaknesses in our infrastructure management processes and determines solutions through the use of technology or the implementation of new processes.

1. BigFix: The SEC BigFix environment consists of BigFix workstation agents, multiple BigFix servers and relays; web reporting, as well as administrative management consoles. BigFix technology allows you to analyze the status of configurations, security vulnerabilities, as well as inventories across the entire enterprise and then enforce policies automatically in near real-time. With BigFix, progress of each computer can be tracked as updates and configuration policies are applied, making it simple to gauge the level of compliance across the entire enterprise. In addition, managed computers can be checked for specific attributes, allowing computers to be grouped for action deployments, ongoing policies or asset management. Using the web-based reporting program, audit trails can be set up charting overall activity. BigFix also allows the gathering of a wealth of information such as installed applications, hardware devices, and networking information.

2. McAfee and ePO: The SEC installs McAfee Anti-virus production on supported workstations and centrally manages all McAfee related workstation settings with a centralized McAfee ePO server. This environment allows the SEC to centrally manage workstation anti-virus software, DAT and engine updates, as well as virus scan and update intervals. In addition to the McAfee components above, the SEC installs, supports, maintains, and upgrades the following McAfee components, features, and applications: Antivirus, HIPS, MOVE, DLP, Firewall, NIPS, and Netshield for Filer. The SEC will also support both full disk and media encryption for McAfee.

3. Checkpoint: The SEC secures endpoint devices from threats with Checkpoint full disk and media encryption. This environment allows the SEC to centrally manage work station full disk and media encryption software, to maintain and update SEC policies.

Common Operating Environment The SEC has developed a Common Operating Environment through the use of SMS, BDD and Swimage to deploy a standard and consistent environment across SEC desktops and laptops.

The Common Operating Environment ensures that foundations deployed are operationally sound, consistent with enterprise architecture requirements, and meets the needs of program offices and field offices Commission-wide. Periodic updates are made in this environments driver repository, application updates, and patch levels to ensure that an imaged workstation meets Commission-wide standards for security along with application standards.

The COE will be handled by BigFix beginning late 2015.

Network Scanning The SEC End-User Computing environment provides a complete scanning solution that utilizes eCopy ScanStation OP software integrated with Canon ImageRunner multi-function printer-scanner-fax (MFPs) devices. The solution is compatible with a variety of MFPs such as Richo, HP, Oce, Toshiba, Sharp, and Fujitsu, but is currently used exclusively on Canon devices at the SEC. Software provided components consists of eCopy ShareScan OP Client, eCopy ShareScan OP Admin Console, and eCopy ShareScan OP Services Manager. As a member of the domain it receives security updates and virus protection with existing group policy objects (GPOs). The eCopy software allows for configuration of multiple scanning options such as Scan to Email, Scan to Network Share, and etc. Close integration with Microsoft Exchange and Active Directory provides ease of use and the necessary domain authentication to satisfy security needs.

ScanStation provides a number of connectors that provided API-level integration with document management and other enterprise applications. The installed solution also has the capability of Scan to RightFax and Scan to SharePoint, but those scanning options are not currently being utilized. In addition to network scanning and AD integration the solution also provides Bates Stamping services on a number of scanners spread throughout the SEC.

Security: Scanned documents can be protected by 128-bit encryption. In addition, any security features enabled for the applications that eCopy integrates with are extended to the MFP.

Therefore, users can be required to use network authentication with all domain password policy settings applying. After authentication users are subject to the same functions and access as they would have at their own desktop. In addition eCopy auditing provided an electronic record of all scanning activities.

Integration: ECopy ScanStation connectors provide excellent integration with multiple core applications. For example eCopy ScanStation provides connectors for scan to Microsoft Outlook/Exchange and scan and fax via RightFax. Both applications currently are in use at the SEC and therefore the ScanStation's can be configured to leverage these currently installed solutions.

Maintainability: The eCopy network scanning solution is supported by a five-year software and three-year hardware agreement from time of purchase. Once installed IT Administrators can manage multiple devices from one central location for ease of administration. The central management tool also allows for the configuration of unique departmental requirements.

Coordination of Activities with Other Technical Personnel The End-User Computing staff is responsible for Tier 3 support, problem resolution, and service requests defined as requiring subject matter expertise (SME) or deemed irresolvable by Tier 2.

Tier 3 support includes final problem resolution. If unable to resolve the problem the EUC will:

• Contact and coordinate with the SEC system POC or the appropriate outside contractor.

• Coordinate with the SEC IT Architecture, System Applications, Network Architecture, and Data/NOC Centers Personnel to coordinate, implement, or rollout new end user technology, systems, applications, and hardware. The Tier 3 staff will transfer relevant knowledge back to the Tier 1 and Tier 2 staff in a Government-approved format that will ensure that the Helpdesk is capable of supporting the new systems.

• Perform root-cause analysis of problems deemed mission critical or have recurring negative effects on the SEC Information Technology Infrastructure.