...
Shared Security Responsibility Model
CloudAdminsSupport Team | Project System Administrators |
Application Layer |
•Monitor application authentication - Monitor tenant applications for security compliance and provide recommendations for remediation
|
•Install- Install/configure applications in a secure fashion
|
•Create - Create and update passwords to meet NASA guidelines
|
Container Layer |
•Implement - Implement Container Registry for storage of approved Containers
|
•Store - Update Infrastructure Containers to resolve identified vulnerabilities
| - Store approved Containers in approved Container registries
|
•Update - Update Containers to resolve identified vulnerabilities
|
O/S Layer |
•Monitor instances •Read - Monitor resources for security compliance and provide notifications for required patches
|
•Use recommended AMIs/AVMs
- Read and understand vulnerabilities from weekly vulnerability reports
|
•Configure - Configure secure instances and implement patches as required
|
Cloud Layer |
•Recommend secure configurations and AMIs/AVMs- Ensure SSM usage, monitor ports, and
|
Monitor - ensure Password / API key age compliance
|
•Coordinate ISSO - Operations to ensure completion of User Agreement
|
is attested to prior to the creation of AWS/Azure users- and Security Training as part of onboarding process
|
Physical Layer |
•AWS - AWS and Azure provide secure facilities, hardware, and other capabilities
|
Allowable Types of Data
- Data in Science Cloud must be categorized as Federal Information Security Management Act (FISMA) Low or Moderate
- Science Cloud is approved for both FISMA Low and Medium, and is appropriate for the storage and processing of public data that is openly available
- Uploading of classified, EAR, or ITAR data to the Science Cloud is strictly prohibited
- Storage of CUI is allowed provided it is protected via encryption in transit and at rest
...
