DSS, CMS, and data hub systems shall encapsulate all access to internal components through their specific gateways and interfaces either in public (externally facing communications) or shared (internal communications). No other access shall be granted. AWS IAM groups, users, and roles shall be configured in accordance with principle of least privilege. Access to Graylog, database, and message broker administration shall be granted only to system administrators for each specific service. NOTE: CMS security is dependent upon specific implementation of each CMS system and configuration of security within the CMS system. While automated security and process monitoring is not likely to be configured fully upon the initial launch, it is intended that this will be implemented during production operations in close cooperation with Caltrans IT. This shall include the use of CloudTrail and CloudWatch to accomplish the following: Kill all failed or non-responding processes Verify configuration of all launched processes Monitor system and process access and access violations Quarantine or kill and relaunch any suspected compromised systems or operations Conduct regular automated AWS inspections of the system configuration To ensure consistent system launch, delivery of system services, and secure system configurations, all system launch processes will be automated using CloudFormation or, in the case of some modeling components, use of the EC2 APIs and programmatic launch of components from controlled system images. This will include the automation of system upgrades and patches. This will minimize the possibility of the introduction of inconsistent and incorrect security and system configurations, and provide the ability to more easily monitor for and correct system deficiencies. To prevent denial of system services or security issues, as well as ensure proper operation of the system, all data received by the data hub shall be validated to ensure that is well-formed and within reasonable tolerances for system processing (volume, content, timing, etc.)
DSS, CMS, and data hub systems shall encapsulate all access to internal components through their specific gateways and interfaces either in public (externally facing communications) or shared (internal communications). No other access shall be granted. AWS IAM groups, users, and roles shall be configured in accordance with principle of least privilege. Access to Graylog, database, and message broker administration shall be granted only to system administrators for each specific service. NOTE: CMS security is dependent upon specific implementation of each CMS system and configuration of security within the CMS system. While automated security and process monitoring is not likely to be configured fully upon the initial launch, it is intended that this will be implemented during production operations in close cooperation with Caltrans IT. This shall include the use of CloudTrail and CloudWatch to accomplish the following: Kill all failed or non-responding processes Verify configuration of all launched processes Monitor system and process access and access violations Quarantine or kill and relaunch any suspected compromised systems or operations Conduct regular automated AWS inspections of the system configuration To ensure consistent system launch, delivery of system services, and secure system configurations, all system launch processes will be automated using CloudFormation or, in the case of some modeling components, use of the EC2 APIs and programmatic launch of components from controlled system images. This will include the automation of system upgrades and patches. This will minimize the possibility of the introduction of inconsistent and incorrect security and system configurations, and provide the ability to more easily monitor for and correct system deficiencies. To prevent denial of system services or security issues, as well as ensure proper operation of the system, all data received by the data hub shall be validated to ensure that is well-formed and within reasonable tolerances for system processing (volume, content, timing, etc.)
i-210_pilot_high-level_design_v1_march_15_2018.docx