IEG Portfolio (Scenario A and B) US-NATO Information Sharing (UNIS) TEM6 2 December 2009 Leon Schenkels NC3A Core Applications Core Enterprise Services (CAT7) NATO UNCLASSIFIED NATO UNCLASSIFIED

What is the IEG Manages and secures information services in between NATO and external organisations. (Supports multiple interoperability scenarios). Supports core and functional AIS services interoperability based on agreed standards. Provides flexibility, scalability and high availability. Complies with NATO policies, Major references: Infosec Technical and Implementation Directive for the Interconnection of Communication and Information Systems. NATO interoperability Directive (chapter 7) Guidance document on the implementation of gateways for information exchange between NATO and external CIS communities. NATO UNCLASSIFIED NATO UNCLASSIFIED

What are the IEG scenarios NATO standardised approach to cross domain information exchange Several scenarios A: NS ↔ NS (Enclave) B: NS ↔ NATO Nation Secret C: NS ↔ Mission Secret D: NS ← (↔) NNN/IO Supports Core and Functional services NATO UNCLASSIFIED

IEG Architectural Approach IEG developed as discrete components supported by generic infrastructure. Advantages: Re-uses the core services infrastructure Accreditation tasks are simplified (fewer components). Maintainable (minimises the number of additional proxies) NATO UNCLASSIFIED NATO UNCLASSIFIED

Information Exchange Gateway case A+B Symmetric IEGs NATO Nation N A T O B P D B P D Z Z MTA MTA DSA DSA WEB Proxy Proxy WEB IDS IDS NATO UNCLASSIFIED NATO UNCLASSIFIED

IEG Scenario B (RIEG) NATO UNCLASSIFIED

Phased approach to NATO RIEGs Phased increase in security protection Step 1 (Scenario A implementation) Build network level infrastructure (Firewall, IDS) Local/central management as required Add web proxy services first, then email (through Email Upgrade project). May require some waivers for IATO Step 2, 3 etc (Scenario B Implementation) Add formal messaging and directory services Directory Services for Email may be added by Email Upgrade project (GAL Sync) Add other services when authorised e.g. TDL IDS = Intrusion Detection System IATO = Interim Authorisation to Operate GAL = Global Address List TDL = Tactical Data Link NATO UNCLASSIFIED NATO UNCLASSIFIED

Case A IEG Project Status Case A IEG Project - Authorisation for 6 NATO Regional IEGs & 18 National IEGs Stage 2 Authorisation Request 3Q07 Contract award 2Q08 Regional IEGs installation completed 2Q09 National Site Surveys commence 3Q09 National IEGs installation begins 1Q10 Final Acceptance Test 4Q10 RIEG connection to NGCS depends on Packet Transit Components being updated to re-route traffic through IEGs NATO UNCLASSIFIED NATO UNCLASSIFIED

Scenario B IEG Planning Project Future Milestones Validation of technical solution – 3Q09 TBCE developed – 4Q09 TBCE screened by WGNTE – 1Q10 Contract Signed – 4Q10 Service Transition/Installation Commences – 1Q11 Project Completion – 4Q13 TBCE = Type “B” Cost Estimate NATO UNCLASSIFIED NATO UNCLASSIFIED

Email Upgrade Email Upgrade – Programmatic Proposals received – Oct 2007 Price evaluation completed – Dec 2007 Technical evaluation commencement – Mar 2008 Contract award - 2Q09 Compliance Tests – 4Q09 Commence deployment in – 2Q10 Complete deployment in – 3Q10 NATO UNCLASSIFIED NATO UNCLASSIFIED

NATO Messaging System - Phase 1 NMS Phase 1 Factory Acceptance Testing complete – Feb 2006 Certification Testing complete – Oct 2006 Alternate Solution Evaluation Compliance Testing complete – Feb 2007 Usability Testing complete – Mar 2007 Evaluation report – Jul 2007 NMS Phase 1 contract amended - April 2009 Phase 1 Amendment coordination Award Amendment contract –1Q09 Regression testing of upgrades – 1Q10 Site surveys and preparations – 3Q09 - 4Q09 Begin Phase 1 deployment (surveys and installation) – 2Q10 – 4Q10 IOC (System Acceptance for Phase 1) – 2Q11 The work listed there is being performed on both sides (NC3A and Contractor) IOC = Initial Operational Capability NATO UNCLASSIFIED NATO UNCLASSIFIED

NATO Messaging System – Phase 2 Phase 2 coordination commencement – 4Q09 Minimize gap between Ph 1 and Ph 2 Subject to successful initial deployment of Ph 1 Replace PKI with NATO PKI, ACP145, Integration into IEG B, Interoperability tests with Nations Identification of Phase 2 Sites Successful system testing of Phase 1 sites Phase 2 Authorization – 3Q10 ACP145 inclusion (if joint standard ratified) ACP133 Edition C inclusion (latest ratified version) IEG Scenario B integration NATO PKI deployment FOC (end Phase 2) – 2Q12 PKI = Public Key Infrastructure NATO UNCLASSIFIED NATO UNCLASSIFIED

NATO Enterprise Directory Service (NEDS) NEDS Project Status Phase 1 completed – Sep 2008 Phase 2 Authorization Request – Nov 2008 Information for Bidders release – 3Q09 Contract Award – 1Q10 Site Surveys – 2Q10 Initial Operational Concept commencement – 1Q11 Final System Acceptance – 2Q11 NATO UNCLASSIFIED NATO UNCLASSIFIED

IEG A project milestones IEG B project milestones IEG C project milestones The IEG portfolio IEG A project milestones IEMS Email DS R-IEG IEG Web NMS Ph 1 NEDS* IEG-C KFOR PTC Enhancements IEG-C+ KFOR N-IEG S.S N-IEG D’ploy N-IEG FOC IEG-B IEMS Email DS NMS Ph 2 ARH BMTA 2009 2010 2011 2012 Now NATO UNCLASSIFIED * Information Provider Only

Discussion ... NATO UNCLASSIFIED

CONTACTING NC3A NC3A Brussels NC3A The Hague Visiting address: Bâtiment Z Avenue du Bourget 140 B-1110 Brussels Telephone +32 (0)2 7074111 Fax +32 (0)2 7078770 Postal address: NATO C3 Agency Boulevard Leopold III B-1110 Brussels - Belgium NC3A The Hague Oude Waalsdorperweg 61 2597 AK The Hague Telephone +31 (0)70 3743000 Fax +31 (0)70 3743239 Postal address: NATO C3 Agency P.O. Box 174 2501 CD The Hague The Netherlands NATO UNCLASSIFIED

Pre-IEGs and Interconnection Scenarios Supported NATO UNCLASSIFIED

Future IEGs and Interconnection Scenarios Supported (partial, only secret level included) NATO UNCLASSIFIED NATO UNCLASSIFIED

IEG-Light Functional requirements Interface requirements Current status: IEG-Light was identified as “quick win” project beginning 2007 IEG-Light is a prototype implementation of an IEG-B for deployment Core Module: 7 SBCs (HDD Raid1), 4 LANs, Cisco FTR, KVM Switch, Monitor IEG-Infrastructure with FTR, FW, IDS IEG-Core with mail, web and directory synchronization Specialized Module: 4 SBCs (HDD Raid1), 2 LANs Stackable with Core Module Optional use for: Functional services TDL VoiP Data Forwarding MIP-DEM Functional requirements Same as static, plus tactic services Interface requirements Same as static, plus circuit switched, plus TACOMS Co-location of interconnected CIS Limited WAN capability Asymmetric gateway architecture NATO protects its own CIS Both CIS NATO operated Performance requirements Smaller as in static, e.g. 150 supported users for NRF Implementation and environmental requirements Small, light weight, low power consumption, rough conditions NATO UNCLASSIFIED NATO UNCLASSIFIED