Sigcat Software Showcase 1992/SIGCat Software Showcase 1992 - CD-ROM Strategies.ISO/research/docs/c19.doc

Text File | 1992-03-02 | 17.1 KB | 530 lines

GENERAL SERVICES ADMINISTRATION
     Washington, DC  20405


                     FIRMR BULLETIN C-19

TO:  Heads of Federal agencies

SUBJECT:  Information system security (INFOSEC)

1.  Purpose.  This bulletin provides information about system
engineering, installation, maintenance, repair, training,
accounting, key services, and other support services pertaining to
INFOSEC and electronic equipment, including the design, engineering
and other arrangements in meeting network transmission and TEMPEST
requirements.  It also provides information about Federal Secure
Telephone Service (FSTS).

2.  Expiration date.  This bulletin contains information of a
continuing nature and will remain in effect until canceled.

3.  Contents.

    Topic                                              Paragraph

Related material..........................................4
Information and assistance................................5
Definitions...............................................6
Acronyms..................................................7
Program description.......................................8
  FSTS....................................................8a
  INFOSEC service.........................................8b
  STU-III terminal........................................8c
  TEMPEST.................................................8d
  Maintenance and repair..................................8e
  Other services..........................................8f
  Acquisition of equipment and service....................8g
INFOSEC training service..................................9
  General.................................................9a
  Service and rates.......................................9b
  Request for training....................................9c
  National Security Agency (NSA) certification............9d
Interagency agreements....................................10
Cancellation..............................................11
Information and Assistance Contacts..................Attachment A
INFOSEC Courses Available............................Attachment B
Special Support Services Available...................Attachment C


TC 90-1                                          Attachments

     FEDERAL INFORMATION RESOURCES MANAGEMENT REGULATION
                         APPENDIX B
FIRMR Bulletin C-19


4.  Related material.  FIRMR Part 201-24.

5.  Information and assistance.  See Attachment A.

6.  Definitions.

    a.  "Central Office of Record (COR)" means a central office
within an agency or organization that maintains and safeguards
records of accountable COMSEC materials received or created by
Government organizations subject to COR oversight.

    b.  "COMSEC" means communications security systems, services,
and concepts that constitute protective measures taken to deny
unauthorized persons information derived from telecommunications of
the United States Government related to national security and to
ensure the authenticity of any such communications.

    c.  "Federal Secure Telephone Service (FSTS)" means a worldwide
secure voice service designed to protect sensitive and classified
voice transmissions.

    d.  "Information Systems Security (INFOSEC)" means a composite
of factors necessary to protect FIP systems and the information
they process to prevent exploitation through interception,
unauthorized electronic access, or related technical intelligence
threats, and to ensure authenticity.  This protection results from
the application of security measures; including cryptosecurity,
transmission security, emission security, and computer security; to
systems that generate, store, process, transfer, or communicate
information of use to an adversary, and also includes the physical
protection of sensitive material and sensitive technical security.

    e.  "TEMPEST" is the investigation, study, and control of
compromising emanations from electrical and electronic equipment.

7.  Acronyms.

COR      Central Office of Record
FIP      Federal Information Processing
FSTS     Federal Secure Telephone Service
STU      Secure Telephone Unit

8.  Program description.  Following is a description of INFOSEC
programs and services, and COMSEC equipment and consultation
services worldwide:



                              2
                                              FIRMR Bulletin C-19


    a.  FSTS.  FSTS is a full-service secure voice
telecommunications service using the STU-III voice and data
terminal.  FSTS facilities may be installed in the private
residences of persons that must work with sensitive or classified
information.

    b.  INFOSEC service.  GSA provides INFOSEC system and equipment
protection services to Government agencies within the 50 States,
Puerto Rico, Bermuda, the Virgin Islands, Canada, Mexico, Europe,
and the Far East.  Service Centers are strategically located to
ensure that appropriate levels of service are maintained.

    c.  STU-III terminal.  The STU-III Low Cost Secure Voice/Data
Terminal is the latest generation of full service secure
telecommunications equipment.  GSA is available to assist Federal
agencies with implementation of STU-III equipment.  Services
available include COR support, COMSEC accounting, keying services,
and GSA maintenance contracts.

    d.  TEMPEST  GSA manages a TEMPEST service to support the needs
of Federal agencies on a worldwide basis.  TEMPEST services are
performed in accordance with applicable Department of Defense
documents.  GSA TEMPEST services include vulnerability analysis of
facilities and FIP resources that process classified and sensitive
information applications; user awareness and familiarization
briefings; and continuous evaluation of equipment applicability
standards.

    e.  Maintenance and repair.  GSA offers continuous long-term
system and equipment services and repair; see Attachment A for
information and assistance contacts.  Services include:

        (1)  Emergency repairs available 24 hours a day, 7 days a
week, providing a 4-hour national average response time; and

        (2)  System failure analysis, trouble isolation,
assistance, coordination, and restoration.

    f.  Other services.  GSA engineers and technicians will advise
and assist Government agencies on all INFOSEC matters.  Attachment
C lists some of the special services available.

    g.  Acquisition of equipment and service.  Acquisition of
equipment or service for resale has demanded changes in methodology
for cost recovery.  These services are attainable on the basis of
a percentage charge for each contract.  Information about the
rate-setting process can be obtained by contacting the
organizations listed in Attachment A, paragraph a.

                              3
FIRMR Bulletin C-19


9.  INFOSEC training service.

    a.  General.  GSA operates an INFOSEC Training Center in Kansas
City, Missouri.  Some of the courses are conducted at extension
training facilities in Washington, DC and San Francisco,
California.  The center can also provide on-site training at agency
locations.  Attachment B provides a listing  of courses.

    b.  Services and rates.  The course schedule and tuition rates
are based on resident courses conducted at a resident training
center.  Rates for courses at locations other than the Kansas City
Training Center will include course cost plus travel, per diem, and
materials for instructors.

    c.  Request for training.  Agencies should address requests for
training to the Registrar of the INFOSEC Training Center.  If an
agency has established a point of contact, the request should be
routed through the agency's representative.  The request should
state the training and schedule desired and should arrive at the
Registrar at least 45 days before the requested training date.  See
Attachment A for addresses.  Course catalogs provide detailed
information on the course requirements.

    d.  NSA certification.  Students requiring NSA certification
for performance of maintenance will receive a COMSEC Maintenance
Training and Experience Record (DD Form 1435) upon successful
completion of COMSEC equipment courses.

10.  Interagency agreements  Interagency agreements are available
to agencies requiring comprehensive services for systems and
networks that use multiple equipment and services.  GSA will
negotiate a rate for these special agreements.

11.  Cancellation.  FIRMR Bulletin 37, revision 1 is canceled.






Thomas J. Buckholtz
Commissioner
Information Resources
Management Service




                              4
                                              FIRMR Bulletin C-19
                                              Attachment A

             INFORMATION AND ASSISTANCE CONTACTS


a.  Rates and Billing Information:

      General Services Administration
      Information Security Management Division
      Service Coordination (KVIPC)
      7th & D Streets, SW, Room 5915
      Washington, DC  20407

      Telephone:  FTS 458-7310 or [phone]
                  AUTOVON 335-1708

      Message Address:  GSA INFO SEC MGMT DIV WASH DC//KVIPC//

b.  Policy, Engineering, Planning, Agreements and New Services:

      General Services Administration
      Information Security Management Division
      Program Management and Evaluation (KVI-M)
      7th & D Streets, SW, Room 5060
      Washington, DC  20407

      Telephone:  FTS 458-7200 or [phone]
                  AUTOVON 335-1708

      Message Address:  GSA INFO SEC MGMT DIV WASH DC//KVI-M//

c.  INFOSEC Training Information:

      General Services Administration
      Information Security Management Division
      Information Security Training Center
      ATTN:  Registrar  (KVIS-6)
      1500 East Bannister Road
      Kansas City, MO  64131

      Telephone:  FTS 926-7682/6921 or [phone]/6921
                  AUTOVON 465-7682/6921

       Message Address:  GSA SPEC OPS BR KANSAS CITY MO//KVIS-6//







                              1
FIRMR Bulletin C-19
Attachment A


d.  Operation, Equipment Services, and Application Engineering:

       General Services Administration
       Information Security Management Division
       Service Coordination (KVTPC)
       7th & D Streets, SW, Room 5060
       Washington, DC  20407

       Telephone:  FTS 458-7310 or [phone]
                   AUTOVON 335-1708

       Message Address:  GSA INFO SEC MGMT DIV WASH DC//KVIPC//

e.  Day-to-Day Operations, Recurring/Continuing Equipment Services.
Contact your local operations area as shown below:

  (1)  Eastern Operations:

  (a)  Washington, DC Area Operations

       General Services Administration
       Information Security Management Division
       Metro Operations (KVIE)
       7th & D Streets, SW, Room 5060
       Washington, DC  20407

       Telephone:  FTS 458-7530 or [phone]

       Message Address:  GSA INFO SEC MGMT DIV WASH DC//KVIE//

  (b)  Field Services (Central & Eastern Time Zones)

       General Services Administration
       Information Security Management Division
       Field Operations (KVTEF)
       7th & D Streets, SW, Room 5670
       Washington, DC  20407

       Telephone:  FTS 458-7510 or [phone]

       Message Address:  GSA INFO SEC MGMT DIV WASH DC//KVIEF//







                              2
                                             FIRMR Bulletin C-19
                                             Attachment A


  (c)  European Operations

       Facility Engineering and Services/GSA
       Stop 94, KVIEF
       APO New York, NY  09057

       Telephone:  [phone]
                   AUTOVON 330-6430

       Message Address:  FAC ENG & SVCS RHEIN MAIN GE//GSA//

  (2)  Western Operations:

  (a)  Field Operation (Mountain & Pacific Time Zones)

       General Services Administration
       Information Security Management Division
       Western Operations (KVIWF-9)
       450 Golden Gate Avenue
       P.O. Box 36058, Rm 1001
       San Francisco, CA  94102

       Telephone:  FTS 556-7943 or [phone]
                   AUTOVON 586-6854
       Message Address:  GSA WEST OPS BRANCH SAN FRANCISCO
                         CA//KVIWF//

  (b)  Pacific Operation (Hawaii and the Far East)

       General Services Administration
       Information Security Management Division
       Western Operations (KVIWP-9)
       450 Golden Gate Avenue
       P.O. Box 36058, Rm 1001
       San Francisco, CA  94102

       Telephone:  FTS 556-7939 or [phone]
                   AUTOVON 586-6854

       Message Address:  GSA WEST OPS BRANCH SAN FRANCISCO
                         CA//KVIWP//







                              3
                                              FIRMR Bulletic C-19
                                              Attachment B

                  INFOSEC COURSES AVAILABLE


Course Title                                 Course Number


                COMSEC POLICY AND MANAGEMENT

Telecommunications
  Security Specialist                          GT-1501

COMSEC Accounting                              GT-1201


                      COMSEC EQUIPMENT

KY-71 Limited Maint.                           EQ-2210

KY-71 Type IV Maint.                           EQ-2314

Key Generator
  Systems Analysis
  w/o Limited
  Maintenance                                  EQ-2230

KG-84 Limited Maint.
  w/Systems                                    EQ-2226

KG-81 Limited Maint.
  w/Systems                                    EQ-2235

KG-84 & KG-81 Limited
  Maint. w/Systems                             EQ-2228

KG-84 & KG-94 Limited
  Maint. w/Systems                             EQ-2232

KG-84, KG-81, & KG-94
  Limited Maint.
  w/Systems                                    EQ-2234

KG-81 & KG-94 Limited
  Maint. w/Systems                             EQ-2239

Equipment Installation
  Techniques                                   GT-1208



                              1
FIRMR Bulletin C-19
Attachment B


       SECURE DATA SYSTEMS OPERATIONS AND MAINTENANCE

Personal Computer
  Primer for Electronic
  Technicians                                  CS-3101

BLACKER KDC/ACC
  Systems Operations                           CS-3448

BLACKER KDC/ACC
  Systems Maintenance                          CS-3443

IBM ASTW
  Maintenance                                  CS-3303


                 SPECIALIZED CUSTOM COURSES

Customized courses to meet specific requirements can be arranged
with the INFOSEC Training Center (ITC).  The ITC can provide
training support on short notice and, with a highly professional
and experienced staff, can provide flexible and timely responses.
Information can be obtained by contacting the ITC organization
listed in Attachment A.
























                              2
                                              FIRMR Bulletin C-19
                                              Attachment C

             SPECIAL SUPPORT SERVICES AVAILABLE


Special support services include, but are not limited to, the
following:

               Application engineering
               Circuit acquisition
               Corrective and preventive maintenance for a wide
                 variety of equipment
               Cost estimates
               Equipment fabrication
               Equipment rehabilitation
               Facility design
               Fault diagnosis
               Logistic support
               Network integrity assurance
               On-site surveys
               Printed wiring board repair
               Contracting
               System and equipment installation
               System engineering
               TEMPEST
               Training
               Modifications (mandatory)*

*    The National Security Agency (NSA) requires that each agency
fund for its own modification kits or purchase them through GSA.
When GSA  purchases a modification kit for an established rate
customer, the cost of the kit will be passed on to the customer.
If the modification is mandatory, its application (labor etc.) by
GSA will be covered, provided it can be performed during a routine
visit or trouble call.

A non-established rate customer requesting modification services
for equipment not maintained on a monthly service agreement will be
billed for the modification kit, and application of the
modification will be at the hourly at-cost rate.

All optional modifications will be performed on an at-cost basis.









                              1