...
Shared Security Responsibility Model
Layer | Science Cloud Support Team | Project System Administrators |
Application Layer | - Monitor tenant applications for security compliance and provide recommendations for remediation
| - Install/configure applications in a secure fashion
- Create and update passwords to meet NASA guidelines
|
Container Layer | - Implement Container Registry for storage of approved Containers
- Update Infrastructure Containers to resolve identified vulnerabilities
| - Store approved Containers in approved Container registries
- Update Containers to resolve identified vulnerabilities
|
O/S Layer | - Monitor resources for security compliance and provide notifications for required patches
| - Read and understand vulnerabilities from weekly vulnerability reports
- Configure secure instances and implement patches as required
|
Cloud Layer | - Ensure SSM usage, monitor ports, and ensure Password / API key age compliance
| - Coordinate with the Operations to ensure completion of User Agreement and Security Training as part of onboarding process
|
Physical Layer | - AWS and Azure provide secure facilities, hardware, and other capabilities
|
Allowable Types of Data
- Data in Science Cloud must be categorized as Federal Information Security Management Act (FISMA) Low or Moderate
- Science Cloud is approved for both FISMA Low and Medium, and is appropriate for the storage and processing of public data that is openly available
- Uploading of classified, EAR, or ITAR data to the Science Cloud is strictly prohibited
- Storage of CUI is allowed provided it is protected via encryption in transit and at rest
...
- Open Data only (publicly accessible, non-proprietary)
- No EAR
- No ITAR
- CUI is allowed but must be encrypted in transit and at rest
- FISMA Low or Moderate onlydata
- All AWS commercial services allowed in US regions
...
