COMBINED FEDERATED BATTLE LABORATORIES NETWORK
(CFBLNet)
Guide
Version 1.0
DOCUMENT CONTROL AND TRACKING METADATA
Security Classification
Unclassified
Access Status
Usage Condition
Publicly Releasable
Scheme Type
CFBLNet Documentation Control and Tracking Scheme
Scheme Name
See Guide, Annex G, CFBLNet Document Management
Title Words
CFBLNet Guide
Function Descriptor
Sponsor/User Guide
Activity Descriptor
Implementation and Guidance
Event Date
Agent Type
Agent Name
Agent Details
Event Type
Event Description
Sep 17
C-EG Chair
LtCol J. Trepka
Review, Approve, Sign
CFBLNet Guide, Version 1.0
Authority
The CFBLNet Executive Group (C-EG) signs and issues this publication on behalf of the CFBLNet Senior Steering Group (C-SSG). The provisions of this document shall govern the conduct of all activities performed on the infrastructure or by the CFBLNet community, subject to the respective laws and military regulations of the participants’ nations.
Amendments
The CFBLNet Guide is amended when the following occurs: the C-SSG makes a decision or provides direction that necessitates an amendment; or when the C-EG determines that there is a need to amend the CFBLNet Guide between C-SSG Meetings. In both cases the Secretariat will generate the text of the proposed amendment to the Chair of the C-EG, and then circulate the amendment to the C-EG Members for endorsement. Once all Members have endorsed the amendment, the Secretariat will amend and/or re-issue CFBLNet Guide.
Effective Date
This issue of the CFBLNet Guide is effective on date of signature by the C-EG.
APPROVAL
The CFBLNet Guide is hereby approved by the C-EG.
______________________________________
LtCol John Trepka (date)
USA Joint Staff/J6
USA DoD C-EG Representative and Chair
With concurrence and endorsement from:
Wg Cdr David Harvey, RAF
CCEB Washington Staff
CCEB C-EG Representative
Mr. Brian Christiansen
NATO Communications and Information Agency
NATO C-EG Representative
TABLE OF CONTENTS
CHAPTER 1 INTRODUCTION.. 7
CHAPTER 2 OVERVIEW... 8
2.1 Description. 8
2.2 Management Structure. 8
2.3 Membership. 9
2.4 Initiatives. 9
2.5 Security. 9
2.6 Network Architecture. 10
2.7 Network Control Centers (NCCs) 10
2.8 Change Management. 10
2.9 Incident Management. 10
Chapter 3 - CFBLNET SECURITY AND INFORMATION ASSURANCE.. 11
3.1 Introduction. 11
3.2 Legal Framework. 11
3.3 Classification of Information. 12
3.4 Cryptographic Separation. 12
3.5 Information release between Mission Partners. 12
3.6 Handling of Commercial Information. 13
3.7 Security Architecture. 13
CHAPTER 4 – INITIATIVES. 14
4.1 CFBLNet Initiatives. 14
4.2 Initiative Participation. 14
4.3 Time Taken to Approve an Initiative. 14
4.4 Resources. 14
4.5 Initiative Dispute Resolution. 14
4.6 Initiative Termination. 15
4.7 Security aspects of the Initiative. 15
4.8 Legal Framework. 15
CHAPTER 5 – INITIATIVE STAFFING PROCESS. 16
5.1 General. 16
5.2 Initiative Staffing Process. 16
CHAPTER 6 - NETWORK OPERATIONS AND SERVICES. 19
6.1 Infrastructure. 19
6.2 CFBLNet Sites. 19
6.3 NETWORK SERVICES OVERVIEW... 19
ANNEX A – Terms of Reference.. 21
A.1 CFBLNet Senior Steering Group (C-SSG) 21
A.2 CFBLNet Executive Group (C-EG). 21
A.3 CFBLNet Secretariat. 21
A.4 CFBLNet Mission Partner Lead Representative. 21
A.5 Information Management Working Group (IMWG) 22
A.6 Initiatives Working Group (IWG) 22
A.7 Network Working Group (NWG) 22
A.8 Security Working Group (SWG) 22
A.9 Multinational Security Accreditation Board (MSAB) 22
Annex B: CFBLNet Security aspects, security accreditation and CIS security. 24
B.1 Generic Security Requirements and Interconnection of Enclaves. 24
B.2 Interconnection Scenarios. 24
B.3 BPS Requirements for Connections to the Internet. 25
B.4 Requirements for Connections of Domains or Enclaves of Different Releasability. 26
B.5 BPS Requirements for Back-End Connections to National Systems. 26
B.6 Encryption/Tunnelling Requirements. 26
B.7 Classified Enclaves Interconnection Requirements. 27
B.8 Use of Unevaluated/Unapproved Devices. 27
B.9 CIIP Security consideration. 27
Appendix A CLASSIFICATION GUIDANCE FOR THE CFBLNet.. 29
Chapter 1 Introduction. 29
Guidance. 29
Chapter 2 Security Accreditation. 30
Security Accreditation Authorities. 30
Role of the Mission Partner Accreditation Authority. 31
Role of the MSAB.. 31
Role of the Secretariat. 31
Accreditation Procedures. 32
Overview.. 32
Site Accreditation. 32
Lapse in the Renewal of S-NAECs. 32
Initiative Accreditation. 33
Chapter 3 Communication and Information Systems (CIS) security. 34
ANNEX C - CFBLNet BLACKBONE AND ECLAVE SERVICES. 39
C.1 ENCLAVE Services: 39
C.2 Domain Name System (DNS) 39
C.3 Electronic Mail (E-mail) 39
C.4 Web Services. 39
C.5 Network Time Protocol (NTP) 39
C.6 IP Telephony. 40
ANNEX D GLOSSARY and ABBREVIATIONS. 41
This Guide is intended to support event sponsors and users with practices and procedures of the Combined Federated Battle Laboratories Network (CFBLNet) for planning and requirements purposes.
This document will provide information and guidance on requesting access to the CFBLNet. It aims to provide a greater understanding of the processes and procedures used within the CFBLNet management to improve the quality of CFBLNet services.
The aim of CFBLNet is to provide the infrastructure of choice for research, development, trials, and assessment (RDT&A); exercises, testing and training for CFBLNet Mission Partners to field comprehensive operaChapter 2tional Command, Control, Communication, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR) capabilities.
The changing nature of contemporary and future warfare demands that CFBLNet be capable of evolving to support the integration of all mission partners involved across the spectrum of operations[1]. CFBLNet is open to potential partners – even on temporary basis - in order to react flexible to upcoming events.
CFBLNet is typified as a persistent network utilising practises and procedures in order to deliver a robust and accredited network. CFBLNet does not support operational usage or traffic.
CFBLNet functions under the authority of the CFBLNet Technical Arrangement / Charter.
CFBLNet is a federated multi-national, research, development, training, trials and assessment infrastructure based on an IP backbone network. It also covers the supporting staff, working groups and management structure. The CFBLNet consists of distributed and integrated network architectures of Combined, Joint, and Service infrastructure components (networks, database servers, application servers, client workstations, etc.). These are located within the confines of the various battle laboratories and sites of the participant. Which provide the applications, analytic tool, security devices and communications necessary to conduct initiatives.
Each Mission Partner the CFBLNet provides, manages, supports and is responsible for it’s own national/organizational infrastructure, which collectively form the CFBLNet. The USA Defense Information Systems Agency (DISA), in coordination with the Mission Partners, will centrally coordinate network management. Details of the network and services aspects are contained in Annex C.
The CFBLNet organizational hierarchy is shown in Figure 1; responsibilities are detailed in Terms of Reference Annex A.
Figure 1: Organizational hierarchy
The CFBLNet is a voluntary association of Core CFBLNet Mission Partners (CMP) comprising the USA, NATO[2] and the Combined Communications-Electronics Board (CCEB)[3]. Other Potential[4] Mission Partners (PMP) are encouraged to participate in events through sponsorship[5] by a CMP. Once approved, a PMP will become a Guest CFBLNet Mission Partner (GMP). Mission Partners retain their individual right to participate or not in CFBLNet activities.
The term Initiative is defined as any activity which utilises the capability of the CFBLNet. Initiatives encompass any activity within the research, development, trial and assessment community that requires the use of a network in its execution. All Initiatives require the submission of a CFBLNet Initiative Information Package (CIIP).
Each Initiative participant is responsible for implementing CFBLNet Security Management Policies and Procedures in conjunction with their own national/organizational security accreditor.
The network is a closed, wide area communications network linking Mission Partner infrastructures, collectively forming the CFBLNet. The CFBLNet consists of an unclassified Backbone Infrastructure (BlackBone) with persistent and temporary enclaves of various security classifications further information is provided in Annex C.
The CFBLNet has 3 NCCs; located in the USA, Australia and Europe. The CFBLNet is a 24/7-accessible network, however engineering support may not be available outside regional operational hours.
The CFBLNet Change Management staffing process is the means by which CFBLNet Change Request (CCR) are submitted to the Secretariat for approval through the C-EG and tracked to closure. Potential Changes are to be submitted through their national CLR/GLR for consideration.
Mission Partners are responsible to advise the Secretariat of any CFBLNet activity that is not in compliance with CFBLNet policies and practices.
[1] Doctrinally referred to in the literature as “spectrum of conflict.”
[2] All NATO Nations and the Organization
[3] AUS, CAN, NZ, UK, USA
[4] PMPs are encouraged to engage a CFBLNet Lead Representative to explore GMP possibilities.
[5] National coordination, processing and identifying the appropriate level signatory and the international coordination of the Bi-lateral agreement towards a GMP could take up to a year
This chapter provides CFBLNet security information, guidance and references in relation to general CFBLNet operations and for the execution of initiatives. Annex B provides users with the process for certification and accreditation of CFBLNet sites and Initiatives. This will be done in accordance with the charter member Nations/organization Information Systems accreditation policies, directives and processes.
CFBLNet security requirements are based on National and NATO security standards. Failure to comply has the potential to damage the overall security posture should such information fall into the wrong hands.
The CFBLNet, and the Initiatives that are conducted on it (directly or indirectly), will have security significance and some aspects will need to be protected accordingly. Further information can be found in Annex S1.
The common principles for federated Communication and information systems (CIS) security are provided in Annex B, chapter 3.
CFBLNet Sites must be accredited before they can be considered operational.
Note: Timely submission of the national security accreditation certifications is a must in order to allow timely start of the Initiative. Failure to meet this requirement could negatively impact participation in the rest of the Initiative.
CFBLNet users shall hold an appropriate security clearance valid for the duration of the authorized access and have a need to know. It is mandatory that every participant must understand and implement the general security aspects of CFBLNet before use.
CFBLNet security stakeholders are: the Initiative participants, their users, CLR and the National security lead, Security Working Group members, National/NATO Accreditation Authorities (NAAs) and MSAB representatives.
One important thing, often overlooked when completing the security portion of the CIIP, is the identification of the Memorandum of Agreement (MOA) or Information Sharing Agreement (ISA) covering the exchange of classified data between all participating mission partners in each domain or enclave used by the Initiative.
CFBLNet enclaves permit handling, storage and transport of information classified up to and including Top Secret. Data shall be labelled with a releasability caveat determined by the Initiative accreditation, as specified in the CIIP.
Figure 2 visualizes the relation between the underlying BlackBone, enclaves and initiatives and the encryption layer (Z) and potential interconnections between enclaves.
Figure 2: - CFBLNet Architecture Logical view
CFBLNet enclaves are protected by appropriate and approved encryption devices and border protection systems (BPS) for the assurance, as required, of information up to and including the classification level of TOP #ECR#T (TS). #ECR#T and TS Enclaves shall be cryptographically separated from other enclaves by Type 1 / NATO-approved products.
Separation of information domains on the network is achieved through technical and/or procedural means, to enforce the principle of “need to know” as well as ‘need to share’ as governed by the Initiative.
Each of the participating nations and NATO has their own way of protectively marking information for CFBLNet release. The following is a format for protective marking/security caveats: ‘RELEASABLE to [list of mission partners]’
Release of CFBLNet-related information to operate CFBLNet managed infrastructure between two or more mission partners falls, by default, under one of the following documents:
CFBLNet Technical Arrangement;
5 eyes Memorandum Of Understanding ‘CJM3IEM’ managed by the CCEB;
Other applicable Information Sharing Agreements (ISA)[1] to cover the exchange of CFBLNet-related information between the participating mission partners.
Commercial and Non-Military agencies/companies who are Mission Partner sponsored to connect must adhere to National/Organizational Military Security and installation standards. Commercial and Non-Military agencies/companies installations need to be isolated/protected from other networks based CFBLNet policy. Each nation/organization has a different caveat for protecting commercial information; it is the Initiative participant’s responsibility to address appropriately.
Note: Security accreditation is a fundamental part of all Initiatives whether you use CFBLNet or other infrastructures. Consult your national security accreditation authority for advice.
CFBLNet security architecture is based on persistent and temporary enclaves which are used simultaneously by other Initiatives. The Initiative security architecture must be addressed in the CIIP.
Note: It is important to address single or multi-domain enclave architectures, cross domain requirements and/or multiple classification and/or releasability aspects. Guidance and processes related to general and specific initiative CFBLNet security aspects including interconnection scenarios and BPS requirements are provided in Annex B.
Figure 3 visualises some possible security aspects and scenarios for CFBLNet
[1] Or other legal document as required.
All Initiatives require the submission of a CIIP to gain approval to use the CFBLNet. There are two types of CIIP.
CFBLNet Initiative can be originated by a Mission Partner (CMPs and GMPs). GMP Sponsorship as a rule should be started long before an Initiative submission, however, if time constraints dictate Sponsorship can run concurrent with an Initiative submission, noting that successful Sponsorship is a prerequisite for any Initiative or site approval.
The time taken to approve a CFBLNet Initiative will depend on the complexity both from and engineering and security perspective. A simple initiative may be approved in less than 20 working days whilst a more complex Initiative may take in excess of 90 working days.
In exceptional circumstance the CFBLNet approval process may be expedited to meet immediate operational demands: Contact your Country/Organizational Lead Representative in the first instance.
Participants in Initiatives are responsible for bearing their own costs to participate in each Initiative. The costs of the portion of the network and applications provided are borne by the Initiative participants.
Mission Partners are responsible for establishing their own Mission Partner (National) Point of Presence (PoP) and supporting infrastructure and for connecting the PoP to the CFBLNet at a mutually agreeable PoP.
Any dispute arising among the Initiative participants will be resolved in consultation with the CMP Lead Representative (CLR) and/or GLRs and CFBLNet Secretariat. If necessary, an issue may be referred to the CFBLNet Executive Group (C-EG) for resolution. A dispute may not be referred to any individual, national or international tribunal, or other Third Party for settlement except as noted above.
An Initiative may be terminated at any time by the unanimous written consent of all the CMPs (GMPs impacted must be considered) involved in the Initiative who will consult at the appropriate level prior to a decision to terminate an Initiative. Initiative participants may withdraw from an Initiative following consultation at an appropriate level to ensure that such a withdrawal is conducted in an equitable manner.
An Initiative participant may be disconnected from an Initiative by their national/organizational lead should they fail to comply with CFBLNet policies and security requirements.
The CFBLNet Security Working Group (SWG) considers an Initiative proposal based on its published CIIP and any other details provided. The CIIP addresses the security aspects of the Initiative and, for that reason, is a major input for the SWG to make a recommendation to the C-EG for approval for the Initiative to execute.
The issue of releasability, exploitation and further reuse of classified Initiative data is not covered by the CFBLNet Technical Arrangement and, from a legal point of view, needs to be addressed formally before the Initiative is able to proceed. An MOA/ISA needs to be in place and effective for the complete duration of the Initiative it is covering.
Interconnections. The security portion of the CIIP is mandatory to provide an accurate picture of all the interconnected enclaves and cross domain boundary/networks to be used by the Initiative. Interconnection of a CFBLNet enclave with a non-CFBLNet enclave poses additional threats against the confidentiality, integrity and availability of CFBLNet information as well as the integrity and availability of the CFBLNet as a whole. The SWG will assess the level of risk associated to such interconnections
Timelines. Since some security requirements (such as those derived from Cross-Domain architectures or scenarios involving new Mission Partners) can have a major impact on the Initiative network architecture, the Initiative Lead is encouraged to liaise with the SWG as soon as possible in the CIIP drafting process so as to defuse any issue related to security (that could be raised later during the formal CIIP review).
The CFBLNet Initiative staffing process is the means by which an activity is supported for execution on the CFBLNet. It encompasses the entire life-cycle of an Initiative and has been developed with the intent of balancing the opposing requirements of ease-of-use against the required detail to meet staffing actions including certification and accreditation.
This Chapter provides the procedure for Mission Partners to follow in order to gain approval to use the CFBLNet. A flow diagram of the CFBLNet Initiative staffing process that encompasses all steps is shown in Figure 4.
The CIIP is generated through the CFBLNet Productivity Tool (CPT) located at http://nc3a.info/cfblnet. The Secretariat can provide advice if support is required. Once the CIIP is submitted by the CLR, members of the CFBLNet organization that are actively involved with the Initiative approval process should action or approve each step.
IMPORTANT: Steps 9 and 11 cover security accreditation for Site(s) and Initiative(s). These need to commence during the early stages of the process. Security accreditation formalities commence at Step 0 and run in parallel to achieve timely security endorsement.
Step 0 - Create Initiative Proposal
Step 0 - SME Brief as required
When requested the Initiative Lead in consultation may be asked to conduct a briefing to the various CFBLNet WGs to address any issues of concern.
Step 0 – Initiate and deliver Security Accreditation
Security accreditation formalities commence at Step 0 and run in parallel to achieve timely security endorsement. Underpinning Security Packages will need to be developed and approved prior to Multinational Security Accreditation Board (MSAB) Security Endorsement.
Step 1 – CLR or GLR Submits the draft CIIP
The Initiative Lead CLR or GLR will submit to the CFBLNet Secretariat the draft version of the CIIP, ensuring that the information contained is current, accurate and complete.
Step 2 – CFBLNet Secretariat records and disseminates CIIP
Upon receipt of a draft submission, the CFBLNet Secretariat will review the draft submission and inform the WG chairpersons that a new/modified CIIP is being staffed for approval and will disseminate accordingly (web, email etc.).
Step 3 – 5 Working Groups (NWG, IWG and SWG) Consider Initiative details
Each of the CFBLNet working groups will consider the Initiative proposal based on the most recent version of the CIIP and any other details provided through the Initiative briefing. Working Group may seek further clarification as required from the participants
The remaining steps are detailed in Figure 4.
Figure 4: Initiative Staffing Process
The CFBLNet infrastructure is a closed, wide area communications network linking Mission Partner infrastructures, collectively forming the CFBLNet. Comprehensive Network Operations and Services information as well as the CFBLNet Level 0 Topology is in Annex C of this document.
Operational control of all network devices must conform to the CFBLNet Manual. CMP/GMPs are responsible for providing connectivity between their national sites and an agreed upon national/organizational Point of Presence (PoP) which will serve as their connection point to the CFBLNet.
Initiative Participants can establish connectivity via any approved security accreditation in accordance with Annex B.
CFBLNet sites are those operational participant sites accredited through the CFBLNet security process and approved by the C-EG. Each NWG member will provide an up-to-date list of new/existing sites on his/her national WAN at each CMM for informational purposes. This list does not need to include individual national/organizational Initiative sites as this is the Nation’s prerogative. The NWG is not part of the site approval process.
National/Organizational Point Of Presence. A CFBLNet national/organizational POP is a CFBLNet site that provides a point of connectivity between different national/organizational management and administrative domains. The establishment of a peering relationship between two PoPs is arranged with the consent of the CMP/GMP involved.
Each Mission Partner maintains and operates agreed levels and types of network services for the CFBLNet permanent components to facilitate Initiatives. These network services inter-operate with other Mission Partners services to provide a collective network community.
Core Network Services
Core network services are robust, reliable and stable services, which have been developed and deployed on the CFBLNet permanent components to support Initiatives. They are managed and supported directly by the Mission Partners
An Initiative sponsor may request to deploy additional network services required to support activities specific to that sponsors requirements. Internet Protocol (IP) Address Space
IP address spaces and Border Gateway Protocol (BGP) Autonomous System (AS) numbers are allocated by the CFBLNet Community for each requirement.
Figure A-1: Organizational Structure of the CFBLNet
The C-SSG is a flag level group that provides overall direction for CFBLNet activities. There is one representative from each Principal participant. The C-SSG provides the leadership and executive oversight on all CFBLNet matters.
The C-EG is the executive body that provides policy and decision-making on behalf of the C-SSG. They are primarily a staff level management group that is directly responsible for the determination of CFBLNet requirements and uses, and for the development of standards and procedures to satisfy combined C4ISR Initiative requirements.
The CFBLNet Secretariat supports management of CFBLNet activities.
Mission Partners consist of the Core Lead Representative (CLR) and Guest Lead Representative (GLR). The Mission Partner facilitates the participation of the Mission Partners in CFBLNet. Membership to the Mission Partner Lead Representative community is open to CLRs and GLRs
The IMWG is the CFBLNet Working Group which manages the process of creating, developing and changing CFBLNet policy, guidance and advertising documentation, throughout the whole of the documents life cycle.
The IWG is the CFBLNet Working Group by which the process of running Initiatives on CFBLNet enclaves is steered, throughout the whole process from the initial submission, the Initiative organization, its execution and the final reporting.
The NWG is the CFBLNet Working Group by which centralized network engineering and system operations are coordinated in order to support the execution of Initiatives on the CFBLNet. The NWG develops guidance provided to those engineers and technicians who render technical support for connectivity over the CFBLNet.
The SWG is the CFBLNet Working Group where security and information assurance issues for the CFBLNet are coordinated in order to support the execution of Initiatives on the CFBLNet.
The Multinational Security Accreditation Board (MSAB) is a multinational body that exists to facilitate and endorse the security accreditation of interconnected information systems. The MSAB provides a process of mutual recognition of security accreditation to ensure a holistic approach to the security of coalition information including those networks and enclaves established under the auspices of the CFBLNet.
This Annex provides detailed information on security aspects of CFBLNet in general, enclave and initiative specific.
Initiative Requirement. The requirement for interconnecting an enclave to another enclave shall be formally stated by the requesting Mission Partner. The Initiative requirement shall identify, as a minimum, the classification and releasability of the information to be exchanged.
Security Requirement. Prior to implementation of the interconnection, the security requirement shall be established and documented in accordance with the requirements of the Core CFBLNet Mission Partners (CMP) sponsor Accreditation Authorities.
Risk Assessment/Risk Management. The interconnection shall be subject to the requirements of the Mission Partner Accreditation Authorities for risk assessment and risk management; and shall be subject to on-going risk management/monitoring.
Figure B-1 illustrates the various interconnection scenarios for which Boundary Protection and encryption requirements have been defined by the Security WG (SWG) and endorsed by the MSAB. Initiatives relying on other interconnection scenarios shall refer back to the SWG who will provide further guidance on a case by case basis.
Figure B-1: Interconnection scenarios for Initiatives running over the CFBLNet
Boundary Protection Services (BPS) is a generic concept that provides security services (through tools, processes and procedures) needed whenever an enclave interfaces with another. These services can be provided by any of a number of tools and devices, such as firewalls, encryption devices, routers, filters, guards, proxy servers, etc., either alone or in combination. The requirements for BPSs are addressed in each interconnection architecture.
#ECR#T and TS enclaves cannot be directly connected to the internet. However, indirect connection to the Internet can be considered if this connection is compliant with the connecting Nation’s policy and all participating Nations of a given Initiative are informed of and endorse this connection.
The minimum Boundary Protection Requirements for connecting an UNCLASSIFIED Network to the Internet are:
Initiatives with a requirement to connect domains or enclaves of different releasability shall refer back to the MSAB Reps of the Mission Partners involved in the Initiative, who will provide further guidance on a case by case basis. The CFBLNet SWG should be fully engaged at the early stages of the discussion and will provide recommendations to the MSAB.
The minimum Boundary Protection Requirements for connecting a #ECR#T Network to a National #ECR#T System are:
The Minimum Encryption/Tunnelling Requirements for sending Unclassified information from an Unclassified Domain through the Blackbone or the Internet are:
The Minimum Encryption/Tunnelling Requirements for sending Classified information from a #ECR#T Domain through an Unclassified domain, the Blackbone or the Internet are:
National evaluation and/or approval to use the cryptographic unit to encrypt classified information (up to the required level);
Other initiatives with a requirement to send classified information from a #ECR#T Domain through another #ECR#T Domain but with a different releasability scheme shall refer back to the MSAB Reps of the Mission Partners involved in this Initiative who will provide further guidance on a case by case basis. The CFBLNet SWG should be fully engaged at the early stages of the discussion and will provide recommendations to the MSAB.
All cross-domain interconnections using unevaluated or unapproved devices require a security risk assessment compliant with International Standards (e.g. ISO,17799, ISO27001, ISO27002, NIST800-30) to be conducted by the ‘cross-domain interconnection sponsor’. The following process is to occur:
Interconnections
Aspects of interconnection concerns can be:
The SWG will assess the level of risk associated to such interconnections and will take into consideration factors like:
The rationale for classifying aspects of the CFBLNet is based on the potential damage to national security should such information fall into the wrong hands. The CFBLNet and the Initiatives that are conducted on it will have security significance and some aspects will need to be protected accordingly. The following guidance is provided so that the aspects of CFBLNet and any sensitive parts of Initiatives are protected appropriately.
Guidance
Existence of CFBLNet: UNCLASSIFIED
Purpose of CFBLNet: UNCLASSIFIED
Membership of CFBLNet: UNCLASSIFIED
Specific vulnerabilities and determinations of the Coalition /NATO Vulnerability Analysis Team (CVAT/NVAT) activities: #ECRE# Rel. AUSCANNZUKUS and NATO [and additional Initiative partners when applicable]
Level 0 Topology: UNCLASSIFIED
Systems and Technical Architecture of the CFBLNet: According to the classification of the respective enclave.
IP addresses and specific architecture should be classified in accordance with N/O policy (but cannot be lower than Unclassified Not Releasable to the Internet).
Key Management: According to the classification of the affected enclave
CFBLNet Documentation: UNCLASSIFIED
Initiative Information:
When an Initiative covers a sensitive capability, which requires a higher classification than UNCLASSFIED, an UNCLASSIFIED synopsis must be produced. The Initiative sponsor will determine the appropriate classification of the Initiative.
Funding Issues: National/organizational classification as appropriate.
Routing information for the CFBLNet ‘backbone’ shall be treated as unclassified information as long as the complete IP addresses are not shown.
Commercially Sensitive Material: To be classified in accordance with the respective national/organizational rules and in accordance with the requirements of the commercial interests involved.
Introduction
Accreditation is defined as a formal declaration by a Mission Partner Accreditation Authority that a CIS or network is approved to operate in a particular security mode at a defined classification level approved to operate at appropriate accreditation standards using a prescribed set of safeguards at an acceptable level of risk.
Initiative must also be accredited for a given site in order to use the infrastructure of this site. The following certificates are being used to indicate the accreditation status of Sites and Initiatives:
Security Accreditation Authorities
The authorities involved in the process for gaining accreditation and authority to operate are:
The CFBLNet Secretariat receives CFBLNet security accreditation certificates for record purpose only.
Role of the Mission Partner Accreditation Authority
The Mission Partner Accreditation Authority is responsible for the accreditation of all infrastructure and services located behind its Mission Partner boundary or POP. The Mission Partner Accreditation Authority is final authority in the holistic security accreditation process initiated by the local site Information Assurance (IA) security staff.
When a site has achieved Mission Partner accreditation, the Mission Partner Accreditation Authority makes a formal declaration of this to their MSAB representative and requests the site be certified as an accredited CFBLNet site. This formal declaration takes the form dictated by national or organizational policies.
The Mission Partner is also responsible for ensuring that each proposed Initiative has met similar standards for accreditation, and makes a formal representation of such to their MSAB representative. Any and all security issues raised by the MSAB representative must be satisfactorily addressed by the Mission Partner Accreditation Authority before the MSAB member will further process the site or Initiative request.
Role of the MSAB
The MSAB is the security accreditation endorsement authority for activities executing within the CFBLNet and other Multi-national CIS. The MSAB consists on National representatives or delegates of national and NATO Security accreditation authorities.
The MSAB Chair coordinates the completed Site or Initiative National Accreditation Endorsement Certificates (S-NAEC or I-NAEC) from the Mission Partner Accreditation Authorities, via the relevant MSAB representative.
When a nation without national representation in the MSAB, planning to participate in a CFBLNet initiative, a national Statement of Conformity (SOC) from their NAA to the MSAB might be required. The SOC must be issued through the sponsoring MSAB member or the MSAB Chair. The SOC will provide the formal acknowledgement that an agreed upon formal accreditation process has been followed.
If a specific Initiative utilizing the CFBLNet requires further confirmation of national accreditation status, it will be the responsibility of the Initiative management to solicit the required confirmation from the MSAB, through their MSAB representation.
Role of the Secretariat
The secretariat maintains copies of the official MSAB records (NAECs) of all accredited components (Sites, Enclaves and Initiatives) of the CFBLNet.
The CFBLNet secretariat can access an up-to-date copy of the CFBLNet related MSAB records (NAECs) to advise, as appropriate, the CLR(s)/GLR(s) and ensure that there is no lapse in the accreditation of Mission Partner CFBLNet Sites. Any question(s) regarding S and/or I-NEAC(s) should be addressed through the National / Organizational MSAB Rep. The MSAB is the sole authority on National and Organizational Site and Initiative security accreditation matters.
Accreditation Procedures
Overview
The accreditation process can be seen as a process parallel but independent of the Initiative approval process in chapter 4. All requirements relating to accreditation, including Mission Partners are addressed in the MSAB accreditation policy and work processes which are defined in the MSAB Terms of Reference (TOR).
In summary, Site or Initiative accreditations are first issued by Mission Partner Accreditation Authority, who submits the request and accreditation information to his MSAB representative. When all Mission Partner security requirements have been met, the MSAB member generates a Site National Accreditation Endorsement Certificate (S-NAEC) and/or an Initiative National Accreditation Endorsement Certificate (I-NAEC), which is submitted to the MSAB Chair, other MSAB members and for the CFBLNet record, the Security Coordinator of the secretariat.
In some cases the Mission Partner Accreditation Authorities for Unclassified Initiative is different than for Classified Initiative. This might have an effect on the Mission Partner accreditation timelines.
Site Accreditation
In order for an Initiative to be conducted, at least two approved involved sites must have their Site and Initiative Accreditations with MSAB certificates issued. Other sites will be able to join later on as their Site and Initiative NAECS are endorsed by the MSAB.
The Site Accreditation process starts with the Mission Partner Site Security Authority checking the implementation of the security requirements applicable to the connection of the Site infrastructure to the CFBLNet.
When the Site/Local Accreditation Authority has determined that the site has met the specified security requirements, the Site Accreditation package is sent to the Mission Partner Accreditation Authority for approval.
When the Mission Partner Accreditation Authority has determined that the Site has been correctly accredited to Mission Partner and CFBLNet standards the accreditation package is submitted to the Mission Partner MSAB Representative for Endorsement. The MSAB Rep then determines whether the Site has been accredited in a manner which satisfies CFBLNet requirements.
When the Mission Partner MSAB Rep has endorsed the site accreditation, the S-NAEC (see NAEC template at Appendix 1 to Annex S1) is competed and notification is made to the MSAB Chair, the other MSAB members and the secretariat that the site has approval to operate.
Lapse in the Renewal of S-NAECs
If an S-NAEC expires during the conduct of an Initiative, then the Site has to immediately stop its support to this Initiative. However, this does not stop the other involved sites from supporting the same Initiative.
It is the responsibility of the mission partner lead representative to prevent this situation from happening by ensuring that there is no lapse in the renewal of the accreditation of his National/Organizational CFBLNet Site(s).
The CFBLNet Secretariat will send the CLR/GLR a reminder two months before the expiration of an S-NAEC.
A warning will be sent by the CFBLNet Secretariat to the CLR/GLR four weeks before the expiration of an S-NAEC to confirm the active/inactive status of the site.
Initiative Accreditation
The Initiative Accreditation process starts with the Mission Partner Security Authority checking the implementation of the security requirements applicable to the connection of the systems supporting a given Initiative to one or more approved CFBLNet Sites.
When the Mission Partner Accreditation Authority has determined that the Initiative correctly implements the Mission Partner and CFBLNet security standards, the accreditation package is submitted to the Mission Partner MSAB Representative for Endorsement. The MSAB Representative then determines whether the Initiative has been accredited in a manner which satisfies CFBLNet requirements.
When the Mission Partner MSAB Rep has endorsed the Initiative accreditation the I-NAEC (see NAEC template at Appendix 1 of Annex S1) is completed and notification is made to the MSAB Chair, the other MSAB members and the secretariat that the Initiative on that site has approval to operate. In order to allow timely distribution of documentation, I-NAEC must be issued at least three working days before the start of the Initiative. Failure to meet this requirement could negatively impact participation in the rest of the Initiative.
The decision on whether an Initiative already accredited requires a new accreditation depends upon the software and hardware configuration / changes that will have occurred since the last accreditation. The decision rests with the Site/Local Accreditation Authority in co-ordination with the Initiative Lead and Lead Mission Partner Accreditation Authority. Where no re-accreditation is required, the Site/Local Accreditation Authority will notify the Initiative Lead, who will inform the National/Organizational Leads and CFBLNet secretariat Coordinator. Initiative Accreditation procedures are the same for classified and unclassified enclaves.
The objective of this section is to establish the basic principles for mission partner to follow in order to achieve a coordinated approach to CIS security.
In the context of this document, CIS security is defined as ‘The application of security
measures for the protection of communication, information and other electronic systems, and the
information that is stored, processed or transmitted in these systems with respect to confidentiality,
integrity, availability, authentication and non-repudiation’.
Each mission partner will have its own security policy/strategy and will maintain flexibility in how to respond to different types of security incidents.
In the rest of this section, CFBLNet assets are defined as hardware or software assets
supporting the CFBLNet mission and services (at the infrastructure or Initiative level).
Principles
It is advised that each mission partner implements a CIS Security strategy addressing at least the following principles:
integrity of CFBLNet assets and ensure that no loss of confidentiality resulted.
situational awareness between mission partner as well as early warning of security
incidents (see section below on CFBLNet Incident Reporting).
It is advised that, whenever possible and relevant, each mission partner takes advantage of
initiatives run on CFBLNet to exercise the workflow of security incident reporting described in
the next section.
SECURITY INCIDENT REPORTING
A Security Incident is defined as any event compromising or that has the potential to compromise, the confidentiality, integrity or availability of a communication and information system.
The objective of the reporting process is to provide a framework under which mission partner are able to quickly inform each other of a CFBLNet security incident (including in the context of an initiative). The intent is to:
Incident impact category
Description
Action officer (by order of priority)
Category 1
(possible examples: prolonged network/service outage, extremely widespread malware infection)
The incident may cause severe impact on any users (including users from a different mission partner) of the initiative. The incident may also be related to the possible compromise of classified information
CLR
Initiative Lead
Security WG rep
Category 2
(possible examples: short term network/service outage – cause and remediation are known, local malware infection)
The incident may cause moderate impact on any users (including users from a different mission partner) of the initiative
Category 3
(possible examples: detected network latency, unexpected IP range)
The incident impact may cause minor impact on any users (including users from a different mission partner) of the initiative
Table 1 - Incident Categories
The purpose of the Blackbone is to provide a permanent, common, closed, unclassified transport (bearer) layer. Its primary function is to transport encrypted traffic throughout the network.
Each Enclave has a number of core services available. Other services, named Core PLUS services and additional services, are available.
Each enclave is supported by a distributed DNS service with each CMP/GMP being responsible for managing its own DNS domains in accordance with the DNS naming conventions.
Each enclave DNS is a federation of DNS servers, with the CCEB, NATO and USA providing the root DNS server. The master DNS root server is provided by the initiative lead group (CCEB, NATO or USA), allowing each CMP/GMP having a national DNS top level domain server.
Each enclave supports a distributed e-mail service between CMP/GMPs.
Simple Message Transfer Protocol (SMTP) is the agreed e-mail protocol between CMP/GMPs. CMP/GMPs may implement their own national e-mail protocols, ensuring they provide an SMTP interface at their national/organizational POP boundary.
The enclave supports the Web service (HTTP and HTTPS) protocols to provide Web services across the enclave for management and engineering coordination as well as the delivery of Web-based information sources and products for initiatives.
CMP/GMPs are actively encouraged to populate these Web services in support of information dissemination for the purposes of CFBLNet management/coordination and to support Initiatives. CMP/GMPs should advise the NWG when a permanent or temporary Website is established in the enclave.
Should classified CFBL information need to be made available, a website will be stood up in the enclave.
Each enclave supports the Network Time Protocol (NTP) in order to provide a stable time source, synchronized across the wide area.
Each enclave supports IP Telephony (VoIP) for in-band secure communications between the CMP/GMPs. It is also the primary means of secure communications for the CFBLNet management and engineering communities.
Each enclave site should have at least one VoIP (hardware or software phone) capability onsite as a minimum that is compatible with the enclave standard system. This phone is primarily for engineering management and coordination. Each site must coordinate with a “Call Manager-enabled” site to have its VoIP phone managed.
This document provides a high-level definition of terms for use by members of the CFBLNet or others who are interested in CFBLNet interoperability Initiatives.
Term
Meaning
AES
Advanced Encryption Standard
ABCA
A five nation army group consisting s of Australia, Canada, New Zealand, the United Kingdom, and the United States. It is subordinate to the CCEB.
APAN
All Partners Access Network. CFBLNet maintains its community on APAN.
ASIC
A five nation air force group consisting s of Australia, Canada, New Zealand, the United Kingdom, and the United States. It is subordinate to the CCEB.
AUSCANNZUKUS
A five nation maritime group consisting s of Australia, Canada, New Zealand, the United Kingdom, and the United States. It is subordinate to the CCEB
Black backbone (BLACKBONE)
The common CFBLNet, closed, unclassified routed IPv4/IPv6 network layer implemented using a mixture of bearer networks. Its primary purpose is to transport encrypted traffic throughout the network.
BPS
Boundary Protection Service. Generic concept that provides security services needed whenever an enclave interfaces with another.
C4ISR
Command Control Communications Computers Intelligence Surveillance and Reconnaissance
CAEC
Coalition Accreditation Endorsement Certificate
CCEB
Combined Communications-Electronics Board
C-EG
CFBLNet Executive Group - the oversight group of the CFBLNet, answerable to the C-SSG.
CFBLNet
Combined Federated Battle Laboratories Network - a multinational, research, development, trials, assessment, exercises, testing and training infrastructure based on an IP backbone network. The term also covers the supporting staff, working groups and management structure. It consist of all connected distributed and integrated network architecture of Combined, Joint, and Service infrastructure components at the confines of the connected battle Laboratories and sites of the participants.
CFBLNet Guide and Manual
CFBLNet Publications details the Organization and Responsibilities of CFBLNet and its users.
Charter
See Technical Arrangement.
CIIP
CFBLNet Initiative Information Package.
CIS
Communications and Information Systems.
CJM3IEM
5 eyes Memorandum Of Understanding
Core CFBLNet Mission Partner Lead Representative. Each CMP has a CLR who acts as the central POC for the coordination of CFBLNet activities of the CMP.
CMM
CFBLNet Management Meeting. The CMM is facilitated by the Secretariat, and hosted by a CFBLNet Mission Partner. It is attended by the C-EG, Secretariat, CLRs / GLRs, WG representatives, the Initiative Sponsor of proposed Initiatives, and other persons as invited by the C-EG or CLRs / GLRs.
CMP
Core CFBLNet Mission Partner (formerly Charter Nation / Organisation) are member nations and belong to one of the three Principal Participants. Each CMP has one lead known as the CMP Lead Representative (CLR).
Robust, reliable and stable services which have been developed and deployed on the CFBLNet permanent components to support Initiatives.
CPT
CFBLNet Productivity Tool. Web based tool in support of CFBLNet Initiative processing.
C-SSG
CFBLNet Senior Steering Group - a flag-level steering group that provides overall direction on CFBLNet matters. There is one representative from each principal participant (USA-CCEB-NATO).
EAL
Evaluation Assurance Level
Enclave
An information processing domain at a site which operates at a specific security level. Initiatives execute in enclaves.
GMP
Guest CFBLNet Mission Partner. Entities which are not Core CFBLNet Mission Partners may become Guest CFBLNet Mission Partners, subject to the approval of the Principal participants.
GLR
Guest CFBLNet Mission Partner Lead Representative.
IATO
Interim Approval To Operate
IMWG
Information Management Working Group. A WG that deals with all publication aspects of CFBLNet, consisting of nominated CMP’s or their representatives.
Initiative
An activity utilizing the CFBLNet. This may be a series of exercises, test, training, trials and/or experiments designed to resolve combined interoperability shortfalls and improve readiness.
The person responsible for coordinating among the participating members for the planning, execution and reporting on an Initiative. The Initiative Lead is identified on the Initiative Proposal. The Initiative Lead coordinates with the CLR or GLR of the Initiative Sponsor, and is also, responsible for briefing the Initiative Proposal at CMMs, and providing status updates.
Initiative Lead C/GLR
The CLR or GLR of the Initiative Lead’s CMP/GMP. For role and responsibilities see CFBLNet Guide.
Initiative Matrix
Spreadsheet maintained by the IWG with support from the Secretariat to track the status of CFBLNet Initiatives.
Initiative participant
Nation, Service, Agency or specific organization conducting an Initiative on CFBLNet. The Initiative Participant may be a part of a CMP or GMP.
Initiative proposal
The initial paperwork proposing a new project produced by the Initiative Lead. The Initiative Proposal format is detailed in CFBLNet Guide
Initiative sponsor
The CMP or GMP which has an overall responsibility for an Initiative.
I-NAEC
Initiative National Accreditation Endorsement Certificate
IP
Internet Protocol
ISA
Information Sharing Agreement
IWG
Initiatives Working Group. The WG that manages and controls the CFBLNet Initiative process.
Mission Partners
CFBLNet CMP and GMPs.
MNIS PMO
Multinational Information Sharing Project Management Office. Acts as the Secretariat and network manager for the CFBLNet.
MoA
Memorandum of Agreement
MoU
Memorandum of Understanding
MSAB
Multi-national Security Accreditation Board
NAA
National Accreditation Authority
NAEC
National Accreditation Endorsement Certificate. Completed by the Mission Partner Accreditation Authority (for either the CMP or GMP) and sent to the MSAB Board. (See S-NAEC and I-NAEC)
NATO
North Atlantic Treaty Organisation
NCC
Network Control Center
Network Test
Testing designed to ensure connectivity and interoperability across the CFBLNet.
NOC
See NCC.
NTP
Network Time Protocol
NWG
Network Working Group – A WG that deals with all Network aspects of the CFBLNet, consisting of nominated Mission Partners representatives.
Persistent Enclave
An enclave created for an infinite period to support the execution of multiple Initiatives and operating over the BLACKBONE. It will operate as a System High logical network at an unclassified protected or Classified level, releasable to the CAVEAT approved by the C-EG.
PMP
A Potential CFBLNet Mission Partner; Any entity engaged in, or supported by, research, development, trials, and assessment (RDT&A), exercise, testing and training for Command, Control, Communication, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR) capability development across the spectrum of operations is a Potential CFBLNet Mission Partner
POC
Point of Contact - The primary person with whom contact should be made.
PoP/POP
Point of Presence
Principal Participant
The three Principal Participants are: the United States, the CCEB and NATO. Each has one C-SSG representative and one C-EG representative.
Request for Change (RFC)
Record of proposed changes for the main body and each Annex of the CFBLNet Guide and Manual.
Secretariat
Acts as the central point for the coordination of day-to-day management of activities of the CFBLNet on behalf of the C-SSG and C-EG. An essential body for the welfare of the CFBLNet.
SME
Subject Matter Expert. Person or persons having expert knowledge in a particular content area.
S-NAEC
Site National Accreditation Endorsement Certificate
SOC
Statement of Conformity
Strategic Plan
A document maintained by the C-EG on behalf of the C-SSG which provides the strategic plan for CFBLNet together with rationale and action plan.
SWG
Security Working Group - A WG that deals with all Security aspects of the CFBLNet, consisting of nominated Mission Partner representatives.
Technical Arrangement
The founding document of CFBLNet which was signed by the USA, CCEB, and NATO to establish CFBLNet.
Temporary Enclave
Created for a finite period to support the execution of specific Initiatives and operating over the BLACKBONE. The level of classification and release caveats used within these enclaves will be determined by the Initiative requirements.
ToR
Terms of Reference
UNRI
Unclassified Not Releasable to Internet
UGMP
Unclassified Guest CFBLNet Mission Partner. Entities which are not Core CFBLNet Mission Partners may become Unclassified Guest CFBLNet Mission Partners, subject to the approval of the Principal Participants. Referred to in the publication as a GMP
VPN
Virtual Private Network
WAN
Wide Area Network
WG
Working Group
Z
An abbreviation used for a network encryption device.
[1] A classified CFBLNet enclave may be connected to a dummy domain by an unevaluated BPS, controlled by that member Mission Partner. The dummy domain needs to be maintained at the appropriate security protection level for the classification of the information being exchanged.