802
edits
Changes
Jump to navigation
Jump to search
Line 29:
Line 29: − + − == Introduction == − The pattern diagrams are provided by the ESA to represent target architectures for the GC Enterprise, as defined in the [[ESA Architecture Definition Document (ESADD)|GC Enterprise Security Architecture Definition Documents (ESADD)]] for various Enterprise Security Focus Areas. These target architectures act as a reference point which can be used to assess proposed solutions when performing security assessment activities. The pattern diagrams represent a collection of common security use cases and include references to relevant [[ESA Use Cases and Patterns#security controls|security controls]] described in CSE's [http://www.cse-cst.gc.ca/its-sti/publications/itsg-csti/index-eng.html ITSG-33 - IT Security Risk Management: A Lifecycle Approach]. − − This page and its sub-pages are intended to be a repository for the ESA Pattern Diagrams and Use Cases. − − == ESA Patterns and Use Cases Repository == − − − |- − ! style="background: #000000; color: white" width="20%" scope="col" " width="100px" | '''Pattern ID''' − ! style="background: #000000; color: white" width="20%" scope="col" " width="100px" | '''Use Case ID''' − ! style="background: #000000; color: white" width="20%" scope="col" " width="350px" | '''Use Case Title''' − ! style="background: #000000; color: white" width="20%" scope="col" " width="700px" | '''Description''' − |- − ! style="background: #fffb9a; color: #ffffff " colspan="4" | '''[[Security Operations]]''' − |- − | style="background:#01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-OPS-001|PN-OPS-001]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-001''' − | style="background: #c2d1e4; color: #000000 " | Discover Unauthorized Client Endpoint − | style="background: #eaeff6; color: #000000 " | Security Operator performs hardware asset scan and reports an unknown device is attached to the network. The asset is confirmed as a rogue device and the device is blocked. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="2" | '''[[Pattern PN-OPS-002|PN-OPS-002]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-002''' − | style="background: #c2d1e4; color: #000000 " | Detect Unauthorized Client Endpoint Configuration Change − | style="background: #eaeff6; color: #000000 " | End User performs an out-of-policy configuration change. The condition is detected by OPS and the approved configuration is restored. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-003''' − | style="background: #c2d1e4; color: #000000 " | Validate Client Endpoint Configuration − | style="background: #eaeff6; color: #000000 " | A CDM scan for software configuration is performed and the software configuration does not match the baseline. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="2" | '''[[Pattern PN-OPS-003|PN-OPS-003]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-004''' − | style="background: #c2d1e4; color: #000000 " | Backup Server Endpoint – Enterprise Initiated − | style="background: #eaeff6; color: #000000 " | The System Administrator commands a requested backup for a client endpoint device. The backup is performed and a confirmation report is sent to System Administrator confirming backup completion success or failure. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-005''' − | style="background: #c2d1e4; color: #000000 " | Restore Server Endpoint – Enterprise Initiated − | style="background: #eaeff6; color: #000000 " | The System Administrator requests the restore of a server device. The restore is performed and a confirmation report is sent to the System Administrator confirming restore completion success or failure. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="4" | '''[[Pattern PN-OPS-004|PN-OPS-004]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-006''' − | style="background: #c2d1e4; color: #000000 " | Detect Anomaly − | style="background: #eaeff6; color: #000000 " | The system receives an event that it treats as an anomaly. The anomaly is assessed against digital policy rules to determine whether or not the anomaly is a routine, day-to-day event or whether it should be treated as a cyber security event. The course of action is then invoked based on that assessment. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-007''' − | style="background: #c2d1e4; color: #000000 " | Mitigate Routine Anomaly − | style="background: #eaeff6; color: #000000 " | Routine anomalies are day-to-day events that can be mitigated through orchestration of digital policy rule responses. Most anomalies require no actual response but are recorded for auditing purposes. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-008''' − | style="background: #c2d1e4; color: #000000 " | Detect Behavioural Anomaly − | style="background: #eaeff6; color: #000000 " | The system builds a baseline of “normal” network traffic volume by time-of-day. It then detects an unexpected increase in network traffic that exceeds a configured threshold. This is one of many anomalies for which digital policy rules exist that are detected and responded to within the Enterprise. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-009''' − | style="background: #c2d1e4; color: #000000 " | Detect Pattern of Anomalies − | style="background: #eaeff6; color: #000000 " | The system detects a pattern of anomalies within an anomaly history that indicates a GC-wide distributed attack. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="3" | '''[[Pattern PN-OPS-005|PN-OPS-005]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-010''' − | style="background: #c2d1e4; color: #000000 " | Remediate External Known Vulnerability − | style="background: #eaeff6; color: #000000 " | Information about a known vulnerability is received from an external source and is remediated. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-011''' − | style="background: #c2d1e4; color: #000000 " | Internally Identify Vulnerability from Security Analytics − | style="background: #eaeff6; color: #000000 " | A vulnerability is discovered internally through “big data” analysis of raw data. Vulnerabilities of this nature are always considered cyber security events and managed accordingly. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-012''' − | style="background: #c2d1e4; color: #000000 " | Remediate Internally Identified Vulnerability − | style="background: #eaeff6; color: #000000 " | The internally identified vulnerability is analyzed for possible remediation solutions. This use case functions in parallel with UC-OPS-013. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-OPS-006|PN-OPS-006]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-013''' − | style="background: #c2d1e4; color: #000000 " | Cyber Security Event − | style="background: #eaeff6; color: #000000 " | The system detects an anomaly that is escalated as a cyber security event (incident) for further action. A cyber security event is disclosure of a new vulnerability, intelligence that a threat actor may be planning an attack against a GC information system (e.g. Distributed Denial of Service (DDOS) attack), detection of current attack (suggested by a pattern of multiple individual events), etc. − |- − ! style="background: #fffb9a; color: #ffffff " colspan="4" | '''[[End User Device Security|Endpoint Security]]''' − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="2" | '''[[Pattern PN-EUD-001|PN-END-001]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-001''' − | style="background: #c2d1e4; color: #000000 " | Authenticate Device to Network − | style="background: #eaeff6; color: #000000 " | Endpoint authenticates to the GC network − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-013''' − | style="background: #c2d1e4; color: #000000 " | Re-Key Endpoint − | style="background: #eaeff6; color: #000000 " | Update user's certificate on endpoint using enterprise ICAM services. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-EUD-002|PN-END-002]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-002''' − | style="background: #c2d1e4; color: #000000 " | Install Security Patch − | style="background: #eaeff6; color: #000000 " | Security patch pushed to Endpoint − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="4" | '''[[Pattern PN-EUD-003|PN-END-003]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-003''' − | style="background: #c2d1e4; color: #000000 " | Wipe Endpoint – Local − | style="background: #eaeff6; color: #000000 " | Endpoint Wipe performed locally on endpoint − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-004''' − | style="background: #c2d1e4; color: #000000 " | Lock Endpoint – Local − | style="background: #eaeff6; color: #000000 " | Endpoint Lock Out performed locally on endpoint − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-005''' − | style="background: #c2d1e4; color: #000000 " | Wipe Endpoint – Remote − | style="background: #eaeff6; color: #000000 " | Endpoint Wipe controlled remotely from enterprise − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-006''' − | style="background: #c2d1e4; color: #000000 " | Lock Endpoint – Remote − | style="background: #eaeff6; color: #000000 " | Lock Endpoint – Remote − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-EUD-007|PN-END-007]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-007''' − | style="background: #c2d1e4; color: #000000 " | Download Application Software − | style="background: #eaeff6; color: #000000 " | Endpoint pulls application software from an enterprise server − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-EUD-008|PN-END-008]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-008''' − | style="background: #c2d1e4; color: #000000 " | Perform Vulnerability Scan – Local − | style="background: #eaeff6; color: #000000 " | Endpoint Security performs a local scan and sends the results to the GC enterprise − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-EUD-009|PN-END-009]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-009''' − | style="background: #c2d1e4; color: #000000 " | Detect Network Intrusion Attempt (Firewall) (Endpoint Security) − | style="background: #eaeff6; color: #000000 " | Endpoint Firewall detects an intrusion attempt and notifies the GC enterprise − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="3" | '''[[Pattern PN-EUD-010|PN-END-010]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-010''' − | style="background: #c2d1e4; color: #000000 " | Authenticate User to Device − | style="background: #eaeff6; color: #000000 " | User authenticates locally to the endpoint − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-039''' − | style="background: #c2d1e4; color: #000000 " | Power on Endpoint − | style="background: #eaeff6; color: #000000 " | Power on sequence for an endpoint − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-040''' − | style="background: #c2d1e4; color: #000000 " | Change Local Password − | style="background: #eaeff6; color: #000000 " | End user changes the local password or PIN on the endpoint − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="3" | '''[[Pattern PN-EUD-011|PN-END-011]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-011''' − | style="background: #c2d1e4; color: #000000 " | Authenticate User to Enterprise − | style="background: #eaeff6; color: #000000 " | User authenticates to the GC enterprise prior to accessing GC resources − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-012''' − | style="background: #c2d1e4; color: #000000 " | Reset User Enterprise Password − | style="background: #eaeff6; color: #000000 " | The user's enterprise password has expired (triggered by time) or been reset by OPS and must be reset the next time the user accesses the enterprise network − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-014''' − | style="background: #c2d1e4; color: #000000 " | Control Enterprise Access − | style="background: #eaeff6; color: #000000 " | User access to GC enterprise resources is based on attributes of the Environment, Platform, User, and Requested Resource − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-EUD-015|PN-END-015]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-015''' − | style="background: #c2d1e4; color: #000000 " | Provision Endpoint for Initial Use − | style="background: #eaeff6; color: #000000 " | Provisioning Part 3: Prepare endpoint for delivery to the user by creating a local account and issuing temporary tokens. Register endpoint and user with asset management and validate the configuration. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-EUD-018A|PN-END-018A]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-018A''' − | style="background: #c2d1e4; color: #000000 " | Establish VPN – Endpoint User Initiated − | style="background: #eaeff6; color: #000000 " | End user initiates a secure communications channel over a VPN with the GC enterprise − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-EUD-018B|PN-END-018B]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-018B''' − | style="background: #c2d1e4; color: #000000 " | Establish VPN – Endpoint Application Initiated − | style="background: #eaeff6; color: #000000 " | End user requests an application service that establishes a secure communications channel over a VPN with the GC enterprise − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="17" | '''TBD''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-021''' − | style="background: #c2d1e4; color: #000000 " | Audit Configuration Policy − | style="background: #eaeff6; color: #000000 " | Endpoint application, system and security generated events − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-022''' − | style="background: #c2d1e4; color: #000000 " | Sign and Encrypt File − | style="background: #eaeff6; color: #000000 " | Endpoint signs and encrypts a file − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-023''' − | style="background: #c2d1e4; color: #000000 " | Violate Endpoint Security Policy – Download − | style="background: #eaeff6; color: #000000 " | End user attempts a download in violation of security policy. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-024''' − | style="background: #c2d1e4; color: #000000 " | Violate Endpoint Security Policy – Web Access − | style="background: #eaeff6; color: #000000 " | End user attempts to access a web site in violation of security policy − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-025''' − | style="background: #c2d1e4; color: #000000 " | Initiate Multi-Domain Environment − | style="background: #eaeff6; color: #000000 " | Augments the power on sequence to launch an environment capable of supporting multiple security domains on a single device (e.g., BYOD) − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-026''' − | style="background: #c2d1e4; color: #000000 " | Download File − | style="background: #eaeff6; color: #000000 " | End user initiates a file download to the endpoint − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-027''' − | style="background: #c2d1e4; color: #000000 " | Switch Domains – Multi-Domain Endpoint − | style="background: #eaeff6; color: #000000 " | End user navigates between security domains on a multi-domain device − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-028''' − | style="background: #c2d1e4; color: #000000 " | Move Data Between Domains - Multi-Domain Endpoint − | style="background: #eaeff6; color: #000000 " | End user moves data between security domains on a multi-domain device − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-029''' − | style="background: #c2d1e4; color: #000000 " | Scan for Malware - Endpoint Initiated − | style="background: #eaeff6; color: #000000 " | Endpoint performs a local malware scan and sends the results to the GC enterprise − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-030''' − | style="background: #c2d1e4; color: #000000 " | Check for Config/Software Updates - Endpoint Initiated − | style="background: #eaeff6; color: #000000 " | Endpoint initiates a check for current configuration and software − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-031''' − | style="background: #c2d1e4; color: #000000 " | Sanitize and Re-Provision Endpoint − | style="background: #eaeff6; color: #000000 " | Endpoint is sanitized and provisioned to a different end user − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-032''' − | style="background: #c2d1e4; color: #000000 " | Repair Endpoint − | style="background: #eaeff6; color: #000000 " | Endpoint repair process including recovering data on the device prior to repair and restoring device configuration after repair − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-033''' − | style="background: #c2d1e4; color: #000000 " | Sanitize and Retire Endpoint − | style="background: #eaeff6; color: #000000 " | Sanitize and retire an endpoint - non-destructive − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-034''' − | style="background: #c2d1e4; color: #000000 " | Destroy Endpoint − | style="background: #eaeff6; color: #000000 " | Retire and dispose of an endpoint - Physical Destruction − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-035''' − | style="background: #c2d1e4; color: #000000 " | Perform Self-Check − | style="background: #eaeff6; color: #000000 " | Endpoint performs a health check − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-036''' − | style="background: #c2d1e4; color: #000000 " | Change Endpoint Configuration within Policy − | style="background: #eaeff6; color: #000000 " | End user performs an endpoint configuration change within security policy − |- − | style="background: #3567a8; color: #ffffff " | '''UC-END-037''' − | style="background: #c2d1e4; color: #000000 " | Update Endpoint Antivirus Software - Enterprise Initiated − | style="background: #eaeff6; color: #000000 " | GC enterprise pushes an update to antivirus software to an endpoint. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''[[Pattern PN-EUD-038|PN-END-038]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-038''' − | style="background: #c2d1e4; color: #000000 " | First Use of Endpoint − | style="background: #eaeff6; color: #000000 " | Provisioning Part 4: Initial use of the endpoint by the end user that results in replacement of one-time passwords, installation of user keys and certificates, and other personalization of the device. − |- − ! style="background: #fffb9a; color: #ffffff " colspan="4" | '''[[Network and Communications Security]]''' − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="7" | '''[[Pattern PN-NCS-001|PN-NCS-001]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-001''' − | style="background: #c2d1e4; color: #000000 " | Interoperation of Network-Centric Client Endpoint with Network-Centric Private Cloud Service − | style="background: #eaeff6; color: #000000 " | A network-centric client endpoint accesses a service in network-centric cloud network. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-002''' − | style="background: #c2d1e4; color: #000000 " | Interoperation of Information-Centric Client Endpoint with Network-Centric Private Cloud Service − | style="background: #eaeff6; color: #000000 " | An information-centric client endpoint accesses a service in a network-centric cloud network. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-003''' − | style="background: #c2d1e4; color: #000000 " | Interoperation of Network-Centric Client Endpoint with Information-Centric Private Cloud Service − | style="background: #eaeff6; color: #000000 " | A network-centric client endpoint accesses a service in an information-centric cloud network. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-004''' − | style="background: #c2d1e4; color: #000000 " | Interoperation of Information-centric Client Endpoint with Information-Centric Cloud Private Service − | style="background: #eaeff6; color: #000000 " | An information-centric client endpoint accesses a service in an information-centric cloud service. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-005''' − | style="background: #c2d1e4; color: #000000 " | Interoperation of Network-Centric Client Endpoint with Public Cloud Service − | style="background: #eaeff6; color: #000000 " | A network-centric client endpoint accesses a service in a public cloud. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-006''' − | style="background: #c2d1e4; color: #000000 " | Interoperation of Information-Centric Client Endpoint with Public Cloud Service − | style="background: #eaeff6; color: #000000 " | An information-centric client endpoint accesses a service in a public cloud. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-007''' − | style="background: #c2d1e4; color: #000000 " | Interoperation of Public User with GC Service − | style="background: #eaeff6; color: #000000 " | Citizen access to public services. − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="2" | '''[[Pattern PN-NCS-002|PN-NCS-002]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-008''' − | style="background: #c2d1e4; color: #000000 " | Endpoint Authentication and Assessment − | style="background: #eaeff6; color: #000000 " | Connection of a GC endpoint to a switch or access point. Device performs IEEE 802.1X authentication and assesses the compliance status of the client endpoint. The infrastructure side of UC-END-001. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-009''' − | style="background: #c2d1e4; color: #000000 " | Client Endpoint Remediation − | style="background: #eaeff6; color: #000000 " | The NAC redirects a non-compliant GC endpoint to an isolated remediation network where it may be brought into compliance using OPS services. − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="1" | '''[[Pattern PN-NCS-003|PN-NCS-003]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-010''' − | style="background: #c2d1e4; color: #000000 " | Cross-Domain Transfer (Network-Centric) − | style="background: #eaeff6; color: #000000 " | Transfer of information between different domains via a Cross-Domain Solution (CDS). − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="3" | '''PN-NCS-004''' − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-XXX''' − | style="background: #c2d1e4; color: #000000 " | ''End-to-End Call Setup'' − | style="background: #eaeff6; color: #000000 " | ''Setup of an end-to-end voice or video call. Correspondents belong to different SIP domains. Call to a UC conference server can be an alternate flow.'' − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-XXX''' − | style="background: #c2d1e4; color: #000000 " | ''Presence / IM'' − | style="background: #eaeff6; color: #000000 " | ''Presence and Instant Messaging. Availability to participate in other types of UC can be an alternate flow.'' − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-XXX''' − | style="background: #c2d1e4; color: #000000 " | ''External Call Setup'' − | style="background: #eaeff6; color: #000000 " | ''Setup of a voice call to a non-GC recipient via an external SIP trunking provider.'' − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="2" | '''PN-NCS-005''' − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-XXX''' − | style="background: #c2d1e4; color: #000000 " | ''Software Defined Network (SDN) Configuration'' − | style="background: #eaeff6; color: #000000 " | ''Use of SDN and OpenFlow in conjunction with virtualized (NFV) and non-virtualized network devices.'' − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-XXX''' − | style="background: #c2d1e4; color: #000000 " | ''Consolidated Network Management'' − | style="background: #eaeff6; color: #000000 " | ''Unified cross-domain network management in a CSfC architecture.'' − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="2" | '''PN-NCS-006''' − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-XXX''' − | style="background: #c2d1e4; color: #000000 " | ''Device Mobility'' − | style="background: #eaeff6; color: #000000 " | ''Mobile IP / MOBIKE'' − |- − | style="background: #3567a8; color: #ffffff " | '''UC-NCS-XXX''' − | style="background: #c2d1e4; color: #000000 " | ''Network Mobility'' − | style="background: #eaeff6; color: #000000 " | ''NEMO'' − |- − ! style="background: #fffb9a; color: #ffffff " colspan="4" | '''[[Application Security|Applications Security]]''' − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="2" | '''[[Pattern PN-APP-001|PN-APP-001]]''' − | style="background: #3567a8; color: #ffffff " | '''UC-APP-001''' − | style="background: #c2d1e4; color: #000000 " | Information Access Application Login − | style="background: #eaeff6; color: #000000 " | A user logged into a desktop computer seamlessly logs in to an enterprise information access application. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-APP-002''' − | style="background: #c2d1e4; color: #000000 " | Application Authorization Decision − | style="background: #eaeff6; color: #000000 " | An enterprise application consults a centralized authorization service to determine whether a requested action is permitted. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''PN-APP-002''' − | style="background: #3567a8; color: #ffffff " | '''UC-APP-003''' − | style="background: #c2d1e4; color: #000000 " | Discovery of a service with specified characteristics − | style="background: #eaeff6; color: #000000 " | A service discovers another service with specified characteristics prior to making a synchronous request to that service. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="2" | '''PN-APP-003''' − | style="background: #3567a8; color: #ffffff " | '''UC-APP-004''' − | style="background: #c2d1e4; color: #000000 " | Orchestrated business process − | style="background: #eaeff6; color: #000000 " | A centralized orchestrator coordinates synchronous requests to services to implement automated business processes. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-APP-005''' − | style="background: #c2d1e4; color: #000000 " | Choreographed business process − | style="background: #eaeff6; color: #000000 " | Services use an asynchronous event-driven model to implement automated business processes without the need for a centralized orchestrator. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="2" | '''PN-APP-004''' − | style="background: #3567a8; color: #ffffff " | '''UC-APP-006''' − | style="background: #c2d1e4; color: #000000 " | Call setup with out-of-band strong authentication − | style="background: #eaeff6; color: #000000 " | A voice and/or video call is established between two entities authenticated using an out-of-band technique. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-APP-007''' − | style="background: #c2d1e4; color: #000000 " | Call setup with in-band strong authentication − | style="background: #eaeff6; color: #000000 " | A voice and/or video call is established between two entities authenticated using an in-band technique. − |- − ! style="background: #fffb9a; color: #ffffff " colspan="4" | '''[[Data Security]]''' − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="3" | '''PN-DAT-003''' − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-003''' − | style="background: #c2d1e4; color: #000000 " | Create Protected Data Object − | style="background: #eaeff6; color: #000000 " | Shows the creation of a protected data object. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-004''' − | style="background: #c2d1e4; color: #000000 " | Access Protected Data Object − | style="background: #eaeff6; color: #000000 " | Shows the interaction between the END and DAT::IRM to allow access to a protected data object and the provenance update after access. − |- − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-005''' − | style="background: #c2d1e4; color: #000000 " | Modify Protected Data Object − | style="background: #eaeff6; color: #000000 " | Shows the interaction between the END and DAT::IRM to allow access and modification of a protected data object. − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="1" | '''PN-DAT-YYY''' − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-XXX''' − | style="background: #c2d1e4; color: #000000 " | Access and use protected 3rd party digital content − | style="background: #eaeff6; color: #000000 " | Two options: 1) User launches a software package with via shared license server; or 2) User streams protected content via video − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="1" | '''PN-DAT-YYY''' − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-XXX''' − | style="background: #c2d1e4; color: #000000 " | Create semantic rule set − | style="background: #eaeff6; color: #000000 " | Shows the steps required to create and test a semantic rule set prior to deployment. The semantics are used by devices in the enterprise to interpret the security policy bound to each data object. − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="1" | '''PN-DAT-YYY''' − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-XXX''' − | style="background: #c2d1e4; color: #000000 " | Create data usage policy − | style="background: #eaeff6; color: #000000 " | Shows creation if a data usage policy. − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="1" | '''PN-DAT-YYY''' − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-XXX''' − | style="background: #c2d1e4; color: #000000 " | Update usage policy − | style="background: #eaeff6; color: #000000 " | After a data object has been in use and may have left the GC Enterprise, the usage policy is updated. Examples include revoked access, changes in content classification, and changes in the allowed operations. − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="3" | '''PN-DAT-001''' − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-001''' − | style="background: #c2d1e4; color: #000000 " | Monitor file activity − | style="background: #eaeff6; color: #000000 " | Shows the interactions with ICA, and OPS to support file activity monitoring (FAM). − |- − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-XXX''' − | style="background: #c2d1e4; color: #000000 " | Monitor database activity − | style="background: #eaeff6; color: #000000 " | Shows the interactions with ICA and OPS to support database activity monitoring (DAM). − |- − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-XXX''' − | style="background: #c2d1e4; color: #000000 " | Monitor cloud activity − | style="background: #eaeff6; color: #000000 " | Shows the interactions with ICA and OPS to support cloud activity monitoring (CAM). − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="1" | '''PN-DAT-YYY''' − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-XXX''' − | style="background: #c2d1e4; color: #000000 " | Prevent Data Loss - Database DLP − | style="background: #eaeff6; color: #000000 " | Shows the interactions with CSS required to discover and protect sensitive content − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="1" | '''PN-DAT-YYY''' − | style="background: #3567a8; color: #ffffff " | '''UC-DAT-XXX''' − | style="background: #c2d1e4; color: #000000 " | Prevent Data Loss - Storage DLP − | style="background: #eaeff6; color: #000000 " | Shows the interactions with CSS required to discover and protect sensitive content − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''PN-END-YYY''' − | style="background: #3567a8; color: #ffffff " | '''UC-END-XXX''' − | style="background: #c2d1e4; color: #000000 " | Prevent Data Loss - Endpoint DLP − | style="background: #eaeff6; color: #000000 " | Highlight operation of DLP functions on client and server endpoints. − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''PN-OPS-YYY''' − | style="background: #3567a8; color: #ffffff " | '''UC-OPS-XXX''' − | style="background: #c2d1e4; color: #000000 " | Manage DLP − | style="background: #eaeff6; color: #000000 " | Describe the collection of data for an enterprise DLP solution − |- − | style="background: #01044d; color: #ffffff " text-align: center;" rowspan="1" | '''PN-ICA-YYY''' − | style="background: #3567a8; color: #ffffff " | '''UC-ICA-XXX''' − | style="background: #c2d1e4; color: #000000 " | Manage IRM Keys − | style="background: #eaeff6; color: #000000 " | Shows the interactions between ICA, Encryption Services, and IRM to manage keys for encrypting data objects − |- − ! style="background: #fffb9a; color: #ffffff " colspan="4" | '''[[Compute and Storage Services Security|Computer and Storage Services Security]]''' − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''PN-CSS-001''' − | style="background: #3567a8; color: #ffffff " |'''PN-CSS''' − | style="background: #c2d1e4; color: #000000 " | − | style="background: #eaeff6; color: #000000 " | − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''PN-CSS-002''' − | style="background: #3567a8; color: #ffffff " | − | style="background: #c2d1e4; color: #000000 " | − | style="background: #eaeff6; color: #000000 " | − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''PN-CSS-003''' − | style="background: #3567a8; color: #ffffff " | − | style="background: #c2d1e4; color: #000000 " | − | style="background: #eaeff6; color: #000000 " | − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''PN-CSS-004''' − | style="background: #3567a8; color: #ffffff " | − | style="background: #c2d1e4; color: #000000 " | − |style="background: #eaeff6; color: #000000 " | − |- − | style="background: #01044d; color: #ffffff " text-align: center; rowspan="1" | '''PN-CSS-005''' − | style="background: #3567a8; color: #ffffff " | − | style="background: #c2d1e4; color: #000000 " | − | style="background: #eaeff6; color: #000000 " | − |- − ! style="background: #fffb9a; color: #ffffff " colspan="4" | '''[[Identity, Credential, and Access Management]]''' − |} − − == References == − [http://www.cse-cst.gc.ca/its-sti/publications/itsg-csti/index-eng.html ITSG-33 - IT Security Risk Management: A Lifecycle Approach] − − [[Media:GC ESA Description Document (ESADD) - Main Body.pdf|GC ESA Description Document Main Body]] − − [[Media:GC ESA Description Document (ESADD) - ANNEX A END.pdf|GC ESA Description Document Annex A - End User Device Security]] − − [[Media:GC ESA Description Document (ESADD) - ANNEX B DAT.pdf|GC ESA Description Document Annex B - Data Security]] − − [[Media:GC ESA Description Document (ESADD) - ANNEX C NCS.pdf|GC ESA Description Document Annex C - Network and Communications Security]] − − [[Media:GC ESA Description Document (ESADD) - ANNEX D OPS.pdf|GC ESA Description Document Annex D - Security Operations (OPS)]] − − [[Media:GC ESA Description Document (ESADD) - ANNEX E APP.pdf|GC ESA Description Document Annex E - Application Security (APP)]] − − [[Media:GC ESA Description Document (ESADD) - ANNEX F CSS.pdf|GC ESA Description Document Annex F - Compute and Storage Services Security (CSS)]] − − [[Category:Government of Canada Enterprise Security Architecture (ESA) Program]] − [[Category:Enterprise Security Architecture]] − [[Category:GC Enterprise Architecture]]
ESA Pattern Diagram Repository (view source)
Revision as of 12:30, 20 April 2021
, 12:30, 20 April 2021Replaced content with "<div class="center"><div style="float: right; z-index: 10; position: absolute; right: 0; top: 1;">File:JoinusonGCconnex.png|link=http://gcconnex.gc.ca/groups/profile/278..."
</div></div>
</div></div>
{{TOCright}}
{{TOCright}}
{{Delete|reason=Expired Content}}
{| class='wikitable' border='1'
