May 30 th – 31 st, 2007 Chateau Laurier Ottawa

Putting Secure Information Sharing and Access Management Into Practice John Hewie Microsoft Canada Tim Upton Titus Labs Inc.

How do we share information in a secure and cost effective manner that allows for timely and effective access by the right individuals ? How do we move from “need to isolate” to “need to share securely”? Many policies exist that encumber information sharing across department / agency The Challenge

SIPRNET GWAN NSANET(IWS) JIWCS(IWS) Site TS/SI/TK/B Ops Net Stu-III Red Phone JWICS VTC OSINT READOUTMulti-Net(IWS) SecurePolycom The Current Solution

Physical separation is the norm Each network will have its own storage, network, servers and desktops This results in: High total cost of ownership For example, USCENTCOM operates several distinct networks at same classification level but with different caveats Multiple accounts per user Difficult collaboration Duplication of information Complex security management Information sharing via sneaker net or retyping information Today’s Solution - Multiple Everything

SISA - “Secure Information Sharing Architecture” Partnership between Microsoft, Cisco, EMC, Decru and Titus An approach for collapsing many physical networks into virtual “compartments” on one physical network Original goals for military sharing requirements but solution components applicable to anyone who has a need to share information securely. SISA is a secure collaboration framework built upon a single physical network What is SISA?

Demo Title Secure Information Sharing Architecture

Use a single source for authentication: Active Directory Enforce user specific rights and network privileges based group membership Ensure best security protection against known and unknown threats Validate security posture of each host system Automatically enforce system update remediation Consolidated monitoring of computer and network security Secure data at rest and in transit Make it affordable Leverage existing hardware, software and training investments Protect compartmented data within a single IT system Leverage guidance defined in DCID 6-3 P rotection level 3 (PL3) addresses compartmentalization at the same “ security classification” level Approach

Architectural Service Components Access Protection Services End-Device Lockdown and Health Network Protection/ Policy Enforcement Content Protection Services Data Protection Services WatchDog Services Network Path Isolation Application AuthN and AuthZ Document and File Encryption Application Lockdown Data at Rest Isolation and Encryption Intelligent Auditing

Access Protection Services for End-Devices Establish healthy end-devices, protection against malicious code attacks Group Policy, Cisco Security Agent (CSA) Access Protection Services for Networks Port authentication, path isolation, policy enforcement on network devices 802.1x, NAC, Domain isolation (IPSec), VLANs Content Protection Services Collaboration services with protection against inadvertent disclosure of files, documents and s AD, Office, RMS, Titus Labs Data Protection Services Protection of data at rest DECRU, VSANS (Cryptainers) Watchdog Services Intelligent auditing, intrusion attempt detection, anomalous behavior reporting CS-MARS Component Descriptions

Demo Title Content Protection Services

Customer Title US Department of Veterans Affairs

US Veterans Affairs 250,000 users Experienced largest information security breach (26.5 millions records) Issued Request for Proposal: (low hanging fruit of the SISA architecture) “Classification of messages” “Easy to use, non-intrusive” “Interact with Windows RMS” “Deploy in 90 days”

Veterans Affairs Service Components Access Protection Services End-Device Lockdown and Health Network Protection/ Policy Enforcement Content Protection Services Data Protection Services WatchDog Services Network Path Isolation Application AuthN and AuthZ Document and File Encryption Application Lockdown Data at Rest Isolation and Encryption Intelligent Auditing

SISA Key Benefits Tiered approach that delivers multiple layers of security controls Commercial off-the-shelf infrastructure that takes advantage of current investments and skill sets Familiar user interfaces to speed training Authentication at the user, machine, and port levels Network admission control that applies policy-based admission criteria to each endpoint before allowing connection Encryption for stored and in-transit data Cryptographic segmentation of stored data for significant consolidation cost savings Access to stored data based on permissions set in Microsoft Active Directory Digital rights management of and attachments Security monitoring and reporting tools that provide pertinent, actionable information for managers

Where are We? CENTCOM functional prototype completed June 2006 NSA review completed January 2007 Working with SOCEUR for upcoming exercise Working on refresh of the architecture

Want to Know More?