Cloud Computing Mission Owner Security Requirements Guide

Specific individuals or entities must be appointed by the DoD Mission Owner’s Authorizing Official (AO) to establish plans and policies for the control of privileged user access (to include root account credentials) used to establish, configure, and control a Mission Owner’s Virtual Private Cloud (VPC) configuration once connected to the DISN. These individuals or entities established and manage Least-Privilege Attribute-Based Access Control (ABAC) accounts and credentials used by privileged DoD users and systems to administer and control DoD cloud service offering configurations. This role is intended to operate at all DoD information Impact Levels. However, it may not apply to some SaaS solutions where DoD account owners are not required to use the CSP’s Identity and Access Management (IdAM) system to administer user accounts and service configurations.

DoD users on the Internet may first connect into their assigned DISN Virtual Private Network (VPN) network before accessing DoD private applications. A CSE may be composed of an array of cloud service offerings from a particular CSP. The DISN security architecture provides connectivity to the cloud service environment to the users. The architecture mitigates potential damages to the DISN and will provide the ability to detect and prevent an attack before reaching the DISN. CSP Infrastructure (dedicated to DoD) located inside the B/C/P/S “fence line” (i.e., on-premises) connects via an ICAP. The architecture of ICAPs may vary and may leverage existing capabilities such as the IA stack protecting a DoD Data center today or perhaps a Joint Regional Security Stack (JRSS). On the other hand, an ICAP may have special capabilities to support specific missions, CSP types (commercial or DoD), or cloud services. CSP infrastructure (shared with non-DoD or dedicated to DoD) located outside the B/C/P/S fence line that connects to the DODIN/NIPRNet does so via one or more BCAPs. The BCAP terminates dedicated circuits and VPN connections originating within the CSP’s network infrastructure and/or Mission Owner’s virtual networks. All connections between a CSP’s network infrastructure or Mission Owner’s virtual networks that is accessed via or from the NIPRNet/SIPRNet must connect to the DODIN via a BCAP. For dedicated infrastructure with a DODIN connection (Levels 4-6), the Mission Owner will ensure a virtual security stack is configured IAW DoDI 8551.

This architecture mitigates potential damages to the DISN and will provide the ability to detect and prevent an attack before reaching the DISN. All traffic bound for the Internet will traverse the BCAP/ICAP and IAP. Mission applications may be Internet facing; Internet facing applications can be non-restricted or restricted (requiring CAC authentication). DoD users on the Internet may first connect into their assigned DISN Virtual Private Network (VPN) network before accessing Mission Owner enclave or private applications.

Impact Level 6 is reserved for the storage and processing of classified information. Impact Level 6 information up to the SECRET level must be stored and processed in a dedicated cloud infrastructure located in facilities approved for the processing of classified information, rated at or above the highest level of classification of the information being stored and/or processed.

Without coordinated reporting between cloud service environments used for DoD mission, it is not possible to identify the true scale and possible target of an attack. protect Mission Owner enclaves and applications hosted in an off-premise cloud service offering and may be deployed within the cloud service environment, the MeetMe Point, cloud access point, or supporting Core Data Center (CDC). When the infrastructure has direct Internet access, implement virtual IDPS capabilities configured in compliance with the applicable DoD STIG or SRG. The Mission Owner and/or their CNDSP must be able to monitor the virtual network boundary and report/integrate with Tier 1. For dedicated infrastructure with a DODIN connection (Levels 4-6): implement IPS that monitors and works with the virtual security infrastructure (e.g., firewall, routing tables, WAF, etc.) to protect traffic flow inbound and outbound to/from the virtual network to the DODIN connection.

Operating systems handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). A CSP may offer one or more services or methods to accomplish this. Data-at-rest encryption may help mitigate issues with data/information spillage.