Cybersecurity Solutions
Total Page:16
File Type:pdf, Size:1020Kb
National Security Agency/ Central Security Service CYBERSECURITY SOLUTIONS DATA AT REST CAPABILITY PACKAGE Version 4.8 October 2019 Data-at-Rest Capability Package CHANGE HISTORY Title Version Date Change Summary Commercial Solutions 0.8 July 2014 Initial draft of CSfC Data-at-Rest (DAR) for Classified (CSfC) requirements Data-at-Rest (DAR) Capability Package Commercial Solutions 1.0 September 2014 Official release of CSfC DAR requirements for Classified (CSfC) Introduced SWFDE/FE (SF) Solution Data-at-Rest (DAR) Design Capability Package Aligned with SW FDE Protection Profile (PP) 1.0 & FE Extended Package (EP) 1.0 Commercial Solutions 1.8 October 2014 Initial draft of CSfC DAR Version 2 for Classified (CSfC) requirements Data-at-Rest (DAR) Capability Package Commercial Solutions 2.0 December 2014 Official release of CSfC DAR Version 2 for Classified (CSfC) requirements Data-at-Rest (DAR) Added PE/FE (PF) Solution Design Capability Package Aligned with MDF PP 3.0 Commercial Solutions 2.8 May 2015 Initial draft of CSfC DAR Version 3 for Classified (CSfC) requirements Data-at-Rest (DAR) Capability Package Commercial Solutions 3.0 March 2016 Official release of CSfC DAR Version 3 for Classified (CSfC) requirements. Data-at-Rest (DAR) Added HWFDE/FE and HWFDE/SW FDE Capability Package (HF and HS) Solution Design Updated requirements to reflect new FDE Collaborative Protection Profile (cPP) 2.0 Discussed the associated Independent Software Vendor (ISV) technology which aligns with the FDE cPP 2.0 Added Lost and Found (LF) use case Commercial Solutions 3.8 January 2017 Initial draft of CSfC DAR Version 4 for Classified (CSfC) requirements Data-at-Rest (DAR) Capability Package Commercial Solutions 4.0 January 2018 Official release of CSfC DAR Version 4 for Classified (CSfC) requirements Data-at-Rest (DAR) Added Removable Media (RM) Solution 1 CYBERSECURITY SOLUTIONS October 2019 Data-at-Rest Capability Package Title Version Date Change Summary Capability Package Component and Solution Design Added continuous physical control (previously positive control) guidance Added random password generation Added secure file deletion guidance Added optional two-factor authentication Relocated Threat Section to a separate document available on the CSfC webpage Removed the Testing Section to a separate DAR Testing Annex document Changed DAR-PE-5 from minimum of 4 characters to minimum of 6 characters Commercial Solutions 4.8 October 2019 Initial Draft of CSfC DAR Version 5 for Classified (CSfC) Requirements. Data-at-Rest (DAR) Added Enterprise Management Capability Package (EM) Use Case Added Unattended Operations (UO) Use Case Added Hardware FDE/Hardware FDE (H/H) Solution Design Added “optional” DAR Location Services capability Added guidance for Implementing CSfC in a High Assurance GOTS Environment Updated glossary and acronym list Removed Table 17: Lost and Found requirements table; alternatively, dispersed the requirements into existing tables, now identifiable as “LF” in the “Use Case” column. 2 CYBERSECURITY SOLUTIONS October 2019 Data-at-Rest Capability Package TABLE OF CONTENTS 1 Introduction .......................................................................................................................................... 7 2 Purpose and Use ................................................................................................................................... 8 2.1 Implementing CSfC in a High Assurance GOTS Environment ....................................................... 8 3 Legal Disclaimer .................................................................................................................................... 8 4 Data-at-Rest Protection Overview ........................................................................................................ 9 4.1 Rationale for Layered Encryption ................................................................................................. 9 4.2 Solution States ............................................................................................................................ 10 4.2.1 EUD Solution States ............................................................................................................ 10 4.2.2 Enterprise Management (EM) Server & Mission Control Element (MCE) Solution States . 10 4.3 DAR CNSA Suite ........................................................................................................................... 11 4.4 Authentication ............................................................................................................................ 12 4.5 Continuous Physical Control ....................................................................................................... 13 4.6 Red, Gray, and Black Data ........................................................................................................... 14 4.7 Cryptographic Erase (CE) ............................................................................................................. 14 4.8 Provisioning ................................................................................................................................. 14 4.9 Secure File Deletion .................................................................................................................... 15 4.10 DAR Location Based Services ...................................................................................................... 16 5 Solution Components.......................................................................................................................... 17 5.1 Software Full Disk Encryption (SWFDE) ...................................................................................... 17 5.2 File Encryption (FE) ..................................................................................................................... 18 5.3 Platform Encryption (PE) ............................................................................................................. 20 5.4 Hardware Full Disk Encryption (HWFDE) .................................................................................... 21 5.5 End User Device (EUD) ................................................................................................................ 22 5.6 DAR Enterprise Server (ES) and Mission Control Elements ........................................................ 22 6 Solution Designs .................................................................................................................................. 22 6.1 SWFDE/FE (SF) Solution Design................................................................................................... 23 6.2 PE/FE (PF) Solution Design .......................................................................................................... 24 6.3 HWFDE/FE (HF) Solution Design ................................................................................................. 24 3 CYBERSECURITY SOLUTIONS October 2019 Data-at-Rest Capability Package 6.4 HWFDE/SWFDE (HS) Solution Design ......................................................................................... 24 6.5 HWFDE/HWFDE (HH) Solution Design ........................................................................................ 25 7 DAR Use Cases..................................................................................................................................... 25 7.1 Lost and Found (LF) Use Case ..................................................................................................... 26 7.2 Removable Media (RM) Use Case ............................................................................................... 27 7.3 Enterprise Management (EM) Use Case ..................................................................................... 28 7.3.1 Enterprise Management via MA CP, MSC CP, or Campus WLAN CP .................................. 30 7.3.2 Enterprise Management via High Assurance GOTS Solution .............................................. 31 7.3.3 Enterprise Management Key Recovery ............................................................................... 31 7.4 Unattended Operations (UO) Use Case ...................................................................................... 32 8 Configuration Requirements ............................................................................................................... 33 9 Requirements for Selecting Components ........................................................................................... 35 10 Configuration ...................................................................................................................................... 37 10.1 Overall Solution Requirements ................................................................................................... 37 10.2 Configuration Requirements for All DAR Components ............................................................... 38 10.3 Requirements for SWFDE Components ...................................................................................... 40 10.4 Requirements for FE Components .............................................................................................. 41 10.5 Requirements for PE Components .............................................................................................. 42 10.6 Requirements for HWFDE Components ....................................................................................