Deep Dive 184-5 Flashcards
Military Base Environment 1
Military Base has a daunting perimeter.
Like a small town, typical buildings include:
Headquarters buildings
Admin buildings
Classrooms
Unaccompanied Base Housing (BOQ/BEQ/UEPH)
Military Base Environment 2
Military Base has a daunting perimeter. Like a small town, typical buildings include: High Tech or Data Center Buildings Base Hospital Base Fire Department Airfield, Hangars, Squadron Buildings Retail outlet, Base Exchange (BX/PX) Public Works (DPW/CES)
Military Base Requirements or Needs 1
Building Automation Systems
Fire Alarm Systems
Security Systems
Card Access, CCTV, FOIDS, X-Ray Machines, Pop-Up Barriers and Barricades, License Plate readers, etc.
Military Base Requirements or Needs 2
Energy Reduction Programs, UESC, PC, Renewable Energy
Mass Notification Systems
Lighting Projects
Support Services for the products shown above
Electrical Switch Gear, breaker panels, and generators
Key Base Personnel 1
The Contracting Officer
The Contract Specialist
The Contracting Officer’s Technical Representative
The Small Business Advocate (OSDBU)
Key Base Personnel 2
Commanding Officer (CO)
Top Military Officer in Base Command Structure as well as base and energy security.
The Base Infrastructure falls under the CO with exception of the Base Hospital or other tenant commands
Personal goals include energy reduction
Rank is usually O-6, full Colonel or Navy Captain.
Tenure is usually 2-3 years at Base.
Key Base Personnel 3
Public Works Officer (PWO)
Responsible for Base infrastructure, has a team of workers Office may initiate RFP’s or work solicitations, which go to the Contracting Office for release by the KO
Contracting Officer’s Technical Representative (COTR) work with the Contracting Office to prepare solicitations.
Key driver of technology decisions and purchases
Civilian positions allows stability at the base.
May request Justification & Approval for Sole Source or a “J&A”, if reasonable and defendable
Key Base Personnel 4
Energy Manager
Works in Base Engineering, usually a civilian
Responsible for reducing base energy usage
Goals are to meet EPACT05, EISA 2007, EO 13423.
Works to help the CO meet his energy goals
Base Fire Chief
Directs the purchase of Fire Alarm Systems, Mass Notification Systems (MNS) and support services
Manages the base Fire Station – www.dodfire.com
Base Security Personnel
Provost Marshall (Army) Security Officer (Navy/Marines/ Coast Guard) Security Forces (Air Force)
Responsible for base security:
Drives the requirements and purchasing of base security systems and equipment.
Security office may be located near the “Main Gate”.
Engineering Office Personnel
Responsible for projects:
Engineering personnel work on projects involving Building Automation Systems, HVAC projects, Renewable Energy projects, Energy improvements, Lighting, and other base infrastructure projects.
Army, Department of Public Works (DPW): Civil Engineers (CE), usually led by a Major or Lieutenant Colonel (O-4 or O-5)
Air Force, Civil Engineer Squadron, Major, LCOL, civilians
Navy, PWD: Public Works Officer (PWO), Resident Officer in Charge of Construction (ROICC) or (FEAD), Civil Engineer Corps (CEC), led by LCDR or Commander (O-4 or O-5)
Coast Guard: Civil Engineering Unit, civilians
Engineering-related Activities
Base Operations and Support Contractor (BOS) or
Base Operations and Support Services (BOSS)
A civilian contractor who provides operations and maintenance
Military outsourcing routine maintenance and service tasks
Special category small business, 8a, Alaskan Native Corp
Siemens; as subcontractor to the BOS contractor
Resource Efficiency Manager (REM)
Civilian contract employee hired through a small business.
Hired to reduce energy or water consumption
Minimum goal is to save 2X annual REM cost.
U.S. Army Corps of Engineers (USACE)
South Pacific Division
Naval Facilities Engineering Command (NAVFAC) Areas of Responsibility
NAVFAC SOUTHWEST SAN DIEGO, CA
10 REGIONS EUROPE ASIA HAWAII
Cybersecurity Activities
What worries keep the Government up at Night??
A Cyber “Pearl Harbor” type attack
An attack on the nation’s Industrial Control Systems (ICS)
ICS/PLCs Run our Nations Infrastructure-
Electrical Grid
Water & Sewer
Telecommunications
Military Command and Control Centers
Data Centers
Medical Centers
Transportation; Rail, Air Transport, Ocean Transport, Ports
There are only Three (3) Major Electrical Grids in the USA;One, The Eastern Interconnect Power Grid, serves 20 States
Cybersecurity Activities 2
By its nature, Cyber Warfare is asymmetric, a little bit of cyber attack effort can create disproportionate damage. This gives minor powers a huge advantage.
Cyber Warfare may or may not inflict immediate physical damage, however the longer term effects can lead to profound physical damage.
What would happen to a Data Center without HVAC?
An International Airport without Power?
Air Traffic Control Center without radar and communications?
The Pentagon without Data and Information?
Cyber Attacks can be planned to be delayed like a time bomb waiting to be commanded to go-off when directed. Rival foes are already embedded!!
Cyber Attacks can come from any location in the world and it is difficult to know where the attack was initiated or by whom.
A Shift from DIACAP To Risk Management Framework (RMF)
Differences??
Defense Information Assurance Certification and Accreditation Process (DIACAP)
DIACAP, think “Pass or Fail” security checks
If DIACAP is in place, replace with RMF process within 3 Yrs
RMF, No absolute security, think levels of acceptable risk
Low, Medium, or High Risk, a NIST standard, ISO based.
Government acknowledges there are NO security guarantees, only protective levels
RMF requires on-going risk assessment and monitoring, a service opportunity
DoD RMF Process Adopts NISTs RMF
Step 1: Categorize
Categorize the information system and the information processed, stored, and transmitted by that system based on an impact analysis (1).
Step 2: Select
Select an initial set of baseline security controls for the information system based on the security categorization; tailoring and supplementing the security control baseline as needed based on organization assessment of risk and local conditions (2).
Step 3: Implement
Implement the security controls and document how the controls are deployed within the information system and environment of operation.
See appropriate NIST publication in the publications section.
DoD RMF Process Adopts NISTs RMF
Step 4: Assess
Assess the security controls using appropriate procedures to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system (3).
Step 5: Authorize
Authorize information system operation based upon a determination of the risk to organizational operations and assets, individuals, other organizations and the Nation resulting from the operation of the information system and the decision that this risk is acceptable (4).
Step 6: Monitor
Monitor and assess selected security controls in the information system on an ongoing basis including assessing security control effectiveness, documenting changes to the system or environment of operation, conducting security impact analyses of the associated changes, and reporting the security state of the system to appropriate organizational officials (5).
GSA
The General Services Administration (GSA) is the Federal Government’s
premier acquisition agency and landlord. It has two organizations:
FSA Negotiates the GSA Schedule with vendors and provides oversight on applicable laws.
PBS Serves as the Federal Government’s landlord. Tasked with providing superior workplaces for Federal customer agencies..
