Trusted Internet Connections (TIC) Reference Architecture Document Version 2.2 Federal Interagency Technical Reference Architectures June 19, 2017 Federal Network Resilience Revision History Date Version Description Approved By 4/20/09 1.0 Agency feedback M.A. Brown, RADM, USN incorporated and released DAS Cybersecurity & Communications, DHS 3/24/2011 2.0 Capabilities and M. Coose architecture updated by the Director, Federal Network TIC 2.0 Working Group. Security, DHS Final version prepared by DHS. 9/1/2011 2.0 Final approval by OMB M. Coose and reference to M-11-11. Director, Federal Network Security, DHS 9/16/2013 2.0 Added Appendix H – John Streufert Cloud Considerations. Director, Federal Network Resilience, DHS 6/9/2017 2.2 Modified Secure Mark Kneidinger communications from Director, Federal Network Critical to Recommended Resilience, DHS TIC Reference Architecture V2.2 i Table of Contents ACKNOWLEDGEMENTS ........................................................................................................................................ 1 ORIGINAL TIC TECHNICAL ARCHITECTURE STRATEGY TEAM MEMBERS ................................................................. 1 KEY STAKEHOLDERS ................................................................................................................................................. 1 ADVISORS .................................................................................................................................................................. 2 TIC 2.0 UPDATE PARTICIPANTS................................................................................................................................. 2 TIC TECHNICAL ARCHITECTURE DOCUMENT TEAM MEMBERS ................................................................................ 2 INTRODUCTION ....................................................................................................................................................... 3 UPDATES AND CHANGES IN THE TIC 2.0 ARCHITECTURE .......................................................................................... 3 SCOPE OF THE DOCUMENT ......................................................................................................................................... 3 TIC POLICY REFERENCES .......................................................................................................................................... 4 TIC CLARIFICATION .............................................................................................................................................. 5 TIC TRUST RELATIONSHIPS ................................................................................................................................ 5 CONCEPTUAL TIC ARCHITECTURE .................................................................................................................. 7 SECURITY PATTERN FOR EACH CONNECTION CLASS ............................................................................... 8 SECURITY PATTERN #1: EXTERNAL CONNECTIONS ................................................................................................... 9 SECURITY PATTERN #2: INTER-AGENCY (INTERNAL PARTNERS) CONNECTIONS..................................................... 10 SECURITY PATTERN #3: INTRA-AGENCY (INTERNAL PARTNERS) CONNECTIONS .................................................... 12 SECURITY PATTERN #4: TIC SYSTEMS .................................................................................................................... 13 SECURITY FUNCTIONS, DESCRIPTIONS AND CHARACTERISTICS ....................................................... 16 SECURITY FUNCTION: PACKET FILTERING ............................................................................................................... 17 SECURITY FUNCTION: CONTENT FILTERING ............................................................................................................ 19 SECURITY FUNCTION: PROXY .................................................................................................................................. 20 SECURITY FUNCTION: IDPS .................................................................................................................................... 20 SECURITY FUNCTION: AUTHENTICATION ................................................................................................................ 22 SECURITY FUNCTION: REMOTE ACCESS .................................................................................................................. 24 SECURITY FUNCTION: MANAGEMENT ..................................................................................................................... 25 SECURITY FUNCTION: LOGGING .............................................................................................................................. 26 SECURITY FUNCTION: DATA STORAGE .................................................................................................................... 28 SECURITY FUNCTION: MONITORING ........................................................................................................................ 30 SECURITY FUNCTION: AUDIT ................................................................................................................................... 31 SECURITY FUNCTION: REPORTING ........................................................................................................................... 32 SECURITY FUNCTION: SECURE COMMUNICATIONS .................................................................................................. 33 SECURITY FUNCTION: RESPONSE ............................................................................................................................. 34 APPENDICES ............................................................................................................................................................ 36 APPENDIX A – DEFINITION OF EXTERNAL CONNECTION ......................................................................................... 36 APPENDIX B – TIC CAPABILITIES LIST .................................................................................................................... 41 APPENDIX C – GLOSSARY: COMMON TERMS AND DEFINITIONS .............................................................................. 50 APPENDIX D – ACRONYMS: COMMON ABBREVIATIONS .......................................................................................... 53 APPENDIX E – GUIDANCE FOR OCONUS TELEWORK/REMOTE ACCESS CONNECTIONS ......................................... 55 APPENDIX F – RECOMMENDATIONS FOR NETWORK TIME PROTOCOLS (NTP) ......................................................... 57 APPENDIX G – AGENCY DOMAIN NAME SYSTEM (DNS) DEPLOYMENT .................................................................. 58 APPENDIX H – CLOUD CONSIDERATIONS ................................................................................................................ 61 APPENDIX I – REFERENCES ...................................................................................................................................... 68 TIC Reference Architecture V2.2 ii Table of Figures FIGURE 1: CONCEPTUAL MODEL FOR TIC TRUST RELATIONSHIPS ................................................................................ 5 FIGURE 2: CONCEPTUAL TIC ARCHITECTURE ............................................................................................................... 7 FIGURE 3: TAXONOMY OF A SECURITY PATTERN .......................................................................................................... 8 FIGURE 4: EXTERNAL CONNECTION SECURITY PATTERN ............................................................................................ 10 FIGURE 5: INTER-AGENCY CONNECTION SECURITY PATTERN ..................................................................................... 11 FIGURE 6: INTRA-AGENCY CONNECTION SECURITY PATTERN .................................................................................... 13 FIGURE 7: TIC ACCESS POINT FUNCTIONAL BLOCK DIAGRAM ................................................................................... 14 FIGURE 8: TIC SYSTEMS SECURITY PATTERN ............................................................................................................. 15 FIGURE 9: RELATIONSHIP BETWEEN SECURITY FUNCTIONS AND CONNECTIONS CLASSES .......................................... 16 FIGURE 10: CURRENT TIC OCONUS SOLUTION ......................................................................................................... 56 FIGURE 11: PROPOSED REMOTE ACCESS FOR OCONUS CONNECTIONS SOLUTION .................................................... 56 FIGURE 12: GUIDANCE FOR IMPLEMENTING PRIMARY TIME SERVERS ......................................................................... 57 FIGURE 13: DNS ARCHITECTURE ................................................................................................................................. 58 FIGURE 14: D/A UNRESTRICTED-ACCESS DATA .......................................................................................................... 63 FIGURE 15: D/A RESTRICTED-ACCESS DATA ............................................................................................................... 64 FIGURE 16: D/A-TO-CSP CONNECTIVITY REQUIREMENTS ........................................................................................... 65 FIGURE