1. 1 COPC Shared-Network Infrastructure Brief Prepared for: COPC Working Group for Cooperative Support and Backup (WG/CSAB) October 21 and 22, 2008 Meetings By: COPC/CSAB/JAG-CCM version 1.5-20081020

2. 2 Outline Purpose Overview of JAG-CCM Activities Status COPC Action Items IA Compliance Status Proposed Next Steps

3. 3 Purpose To provide status information on COPC and CSAB CCM action items To provide current IA status of COPC shared-network infrastructure To discuss proposed next steps

4. 4 Overview of JAG-CCM Activities Worked on COPC action items Worked to understand current and evolving IA requirements Worked to understand status of shared-network infrastructure and upgrade paths Participated with Technical Exchange Meetings between NWSTG, AFWA and DISA Partnering with NUOPC Unified Ensemble Operations (UEO) team –Both teams have overlapping objectives

5. 5 Status COPC Action Item 2008-1.12 Background COPC Action Item 2008-1.12: The JAG/CCM is asked to revisit the recommendation for SFTP and make sure that it is a hard requirement for all the sites. Due to overarching restraints from FNMOC, flexibility towards a solution may be limited. The DOD IA need to meet with the PKI to discuss this further. Within 30 days, the JAG/CCM will provide a recommendation on SFTP. (Related to COPC Action Item 2007-2.16) Priority: (H) Advocate(s): Mr. Luis Cano, JAG/CCM Suspense: 30 Jun 08 Status as of 29 July 2008: Closed.

6. 6 Status COPC Action Item 2008-2.12 SFTP Requirement Findings –SFTP is not a hard DoD requirement Types of protocols used driven by DoD IA policies and guidance, e.g. CJCSI 6510.01E Information Assurance (IA) and Computer Network Defense (CND), 15 Aug 07 –SFTP is not a hard NOAA requirement Types of protocols used driven by scientific and data sharing requirements compliant with NOAA and Federal IT management policies and guidance, e.g. NOAA Policy on Partnerships in the Provision of Environmental Information

7. 7 Status COPC Action Item 2008-2.12 Interconnection Security Agreement Findings –No Interconnection Security Agreements (ISA) exist between NOAA and DoD ISAs are required by Federal Information Security Management Act (FISMA) of 2002 and related National Institute of Standards and Technologies (NIST) publications Action item result –NWS provided draft ISA to AFWA, FNMOC, NAVO and NESDIS –Suspense date 12/16 to review and update document

8. 8 Status COPC Action Item 2008-2.12 Encryption Requirement Finding (post action item) –Encryption is a hard requirement Environmental data is considered unclassified but sensitive by Air Force and Navy “Exchange of unclassified but sensitive information between the DOD and other government agencies will be protected using DOD-approved PKI certificates.” CJCSI 6510.01E, section 12.b.

9. 9 Status COPC Action Item 2008-1.13 Background COPC Action Item 2008-1.13: Long-term. Develop a broader security and IT data sharing strategy (IA). The JAG should address the broader agency's missions, including long-term needs, backup procedures, and any estimated bottlenecks. This is an ongoing process of aligning IT with business requirements. (related to COPC Action Item 2007-2.16) Priority: (L) Advocate(s): Mr. Luis Cano, JAG/CCM Suspense: Spring 2009 CSAB meeting. Status as of 18 September 2008: Open.

10. 10 Status COPC Action Item 2008-2.13 NUOPC and CCM Findings –NUOPC has created a team with similar scope as the CCM with considerable overlap

11. 11 Status COPC Action Item 2008-2.13 NWS-AFWA-DISA Technical Exchange Meeting Meeting held August 26-27 2008 Approaches discussed to integrate DoD and NOAA networks Developed Conceptual Enterprise to Enterprise Network Infrastructure

12. 12 Status COPC Action Item 2008-2.13 NWS-AFWA-DISA Technical Exchange Meeting Current Shared Network Infrastructure Conceptual Enterprise to Enterprise Network Infrastructure

13. 13 Status COPC Action Item 2008-2.13 NWS-AFWA-DISA Technical Exchange Meeting Conceptual Enterprise to Enterprise Network Infrastructure compared to current COPC shared-network –Greater bandwidth and information security –Greater network backup capabilities –Greater access to other data sources within NOAA and DoD through enterprise networks –More expensive and complex –Requires greater working relationships amongst partners –Does not exist

14. 14 Status COPC Action Item 2007-2.16 Background COPC Action Item 2007-2.16: The JAG/CCM will develop implementation costs and schedules for the convergence to the new communications protocol due to ports 20 and 21 restrictions. The appropriate NWSTG/TOC representation will attend the spring 2008 COPC meeting. This action item is an extension of COPC Action Item 2007-1.1 [2008-1.12]. Priority: (H) Advocate(s): Mr. Luis Cano, JAG/CCM Suspense: 31 Mar 08 (for Spring CSAB) Status as of 18 September 2008: Open.

15. 15 Status COPC Action Item 2008-2.16 FTP Port Closure Finding: –Air Force and Navy intend to migrate away from FTP –No DoD time-table of when FTP will be disabled at the DoD network perimeter Recommendation –Close action item –Open new action item to encrypt data during transmission IAW with DoD and NOAA policies and guidance Would include migrating away from FTP

16. 16 IA Compliance Status Data SourceData DestinationProtocolNOAA IA Compliant (Y or N) DoD IA Compliant (Y or N) AFWAFNMOCFTPN/AN1N1 AFWANWSTGIP SocketsYN 1,2 FNMOCNWSTGHTTPSYN2N2 FNMOCAFWAFTPN/AN1N1 FNMOCNAVOFTPN/AN1N1 NAVOFNMOCFTPN/AN1N1 NAVONWSTGFTPYN 1,2 NAVONWSTGSFTPYN2N2 NESDISAFWAFTPYN 1,2 NESDISFNMOCFTPYN 1,2 NESDISNAVOFTPYN 1,2 NWSTGAFWAFTPYN 1,2 NWSTGAFWAIP SocketsYN 1,2 NWSTGFNMOCFTPYN 1,2 1.Does not meet DoD unclassified but sensitive encryption requirement 2.Does not meet DoD unclassified but sensitive requirement to use DoD-approved PKI certificates between DoD and other government agencies

17. 17 Proposed Next Steps Merge CCM into NUOPC –Will help provide shared-network and IA solutions faster –Removes duplicate efforts –Will elevate CCM issues to higher level within organizations Necessary to deal with the size of IA problems, shared-network architecture upgrades, resources, processes and management