Changes

Jump to navigation Jump to search
no edit summary
Line 3: Line 3:  
{| class="wikitable" style="align:center; border-top: #000000 2px solid; border-bottom: #000000 2px solid; border-left: #000000 2px solid; border-right: #000000 2px solid" width="1200px"
 
{| class="wikitable" style="align:center; border-top: #000000 2px solid; border-bottom: #000000 2px solid; border-left: #000000 2px solid; border-right: #000000 2px solid" width="1200px"
 
|-
 
|-
! style="background: #dddddd; color: black" width="250px" scope="col" |[https://www.canada.ca/en/treasury-board-secretariat/services/information-technology/policy-implementation-notices/implementing-https-secure-web-connections-itpin.html ITPIN 2018-01]
+
! style="background: #dddddd; color: black" width="250px" scope="col" |[https://www.canada.ca/en/government/system/digital-government/modern-emerging-technologies/policy-implementation-notices/implementing-https-secure-web-connections-itpin.html ITPIN 2018-01]
 
! style="background: #dddddd; color: black" width="250px" scope="col" |[[../Strategy | Implementation Strategy]]
 
! style="background: #dddddd; color: black" width="250px" scope="col" |[[../Strategy | Implementation Strategy]]
 
! style="background: #dddddd; color: black" width="250px" scope="col" |[[../Implementation Guidance | Implementation Guidance]]
 
! style="background: #dddddd; color: black" width="250px" scope="col" |[[../Implementation Guidance | Implementation Guidance]]
Line 21: Line 21:  
== Audience ==
 
== Audience ==
 
This guide is primarily for business owners, web developers, IT and IT security practitioners who are involved in implementing externally-facing GC online services.
 
This guide is primarily for business owners, web developers, IT and IT security practitioners who are involved in implementing externally-facing GC online services.
 +
 +
'''Note: ITPIN 2018-01 [https://www.canada.ca/en/treasury-board-secretariat/services/information-technology/policy-implementation-notices/implementing-https-secure-web-connections-itpin.html Implementing HTTPS for Secure Web Connections] applies to departments as defined in [https://laws-lois.justice.gc.ca/eng/acts/f-11/page-1.html#h-227972 section 2 of the FAA]:'''
 +
<br><br>
 +
(a) any of the departments named in [https://laws-lois.justice.gc.ca/eng/acts/f-11/page-30.html#h-230472 Schedule I];<br>
 +
(a.1) any of the divisions or branches of the federal public administration set out in column I of [https://laws-lois.justice.gc.ca/eng/acts/f-11/page-31.html#h-230498 Schedule I.1];<br>
 +
(b) a commission under the [https://laws-lois.justice.gc.ca/eng/acts/I-11 Inquiries Act] that is designated by order of the Governor in Council as a department for the purposes of this Act;<br>
 +
(c) the staffs of the Senate, House of Commons, Library of Parliament, office of the Senate Ethics Officer, office of the Conflict of Interest and Ethics Commissioner, Parliamentary Protective Service and office of the Parliamentary Budget Officer; and<br>
 +
(d) any departmental corporation (a corporation named in [https://laws-lois.justice.gc.ca/eng/acts/f-11/page-32.html#h-230507 Schedule II]).
 +
 
== Strategy Framework ==
 
== Strategy Framework ==
 
The following table provides an overview of the framework for this strategy.
 
The following table provides an overview of the framework for this strategy.
Line 71: Line 80:  
<br>
 
<br>
 
2. Perform an inventory of all departmental domains and subdomains. Sources of information include:
 
2. Perform an inventory of all departmental domains and subdomains. Sources of information include:
* Internally available HTTPS Dashboard (insert link when available)
+
* [https://https-everywhere.canada.ca/ HTTPS Dashboard]
 
* TBS Application Portfolio Management (APM)
 
* TBS Application Portfolio Management (APM)
 
* Departmental business units  
 
* Departmental business units  
 
<br>
 
<br>
3. Provide an up-to-date list of all domain and sub-domains of the publicly-accessible websites and web services to the following website: [https://canada-ca.github.io/pages/submit-institutional-domains.html Submit your institution's domains]. Alternatively, submit the CSV output from the [https://https-everywhere.canada.ca/ HTTPS Dashboard] to ZZTBSCYBERS@tbs-sct.gc.ca, noting additions in <span style="color:green;">green</span>, deletions in <span style="color:red;">red</span>, and modifications (e.g.: ownership) in <span style="color:yellow;background:#AAAAAA;">yellow</span>.
+
3. Provide an up-to-date list of all domain and sub-domains of the publicly-accessible websites and web services to TBS Cybersecurity.
<br><br>
+
* Update and send the filtered “compliance.csv” file available from the [https://https-everywhere.canada.ca/ HTTPS Dashboard] for mass updates; or
4. Perform an assessment of the domains and sub-domains to determine the status of the configuration. Tools available to support this activity includes GC HTTPS Dashboard, SSL Labs, Hardenize, etc.
+
* Use the following website for domain additions: [https://canada-ca.github.io/pages/submit-institutional-domains.html Submit your institution's domains].
 +
<br>
 +
4. Perform an assessment of the domains and sub-domains to determine the status of the configuration. Tools available to support this activity include the GC HTTPS Dashboard, [https://www.ssllabs.com/ SSL Labs], [https://www.hardenize.com/ Hardenize], [https://www.sslshopper.com/ssl-checker.html SSLShopper], etc.
 
<br><br>
 
<br><br>
 
5. Develop a prioritized implementation schedule for each of the affected websites and web services, following the recommended prioritization approach in the ITPIN:
 
5. Develop a prioritized implementation schedule for each of the affected websites and web services, following the recommended prioritization approach in the ITPIN:
 
* ''6.2.1 Newly developed websites and web services must adhere to this ITPIN upon launch.''
 
* ''6.2.1 Newly developed websites and web services must adhere to this ITPIN upon launch.''
 
* ''6.2.2 Websites and web services that involve an exchange of personal information or other sensitive information must receive priority following a risk-based approach, and migrate as soon as possible.''
 
* ''6.2.2 Websites and web services that involve an exchange of personal information or other sensitive information must receive priority following a risk-based approach, and migrate as soon as possible.''
* ''6.2.3 All remaining websites and web services must be accessible through a secure connection, as outlined in Section 6.1, by September 30, 2019.''
+
* ''6.2.3 All remaining websites and web services must be accessible through a secure connection, as outlined in Section 6.1, by December 31, 2019.''
 
<br>
 
<br>
6. Engage the departmental IT group for implementation as appropriate.  
+
6. Engage departmental IT planning groups for implementation as appropriate.
 
* Where necessary adjust IT Plans and budget estimates for the FY where work is expected.
 
* Where necessary adjust IT Plans and budget estimates for the FY where work is expected.
* It is recommended that SSC partners contact their SSC Service Delivery Manager to discuss the departmental action plan and required steps to submit a request for change.  
+
* It is recommended that SSC partners contact their SSC Service Delivery Manager to discuss the departmental action plan and required steps to submit a request for change.
 +
* '''An expedited process for HTTPS BRDs has been established - ensure the title of your BRD is "<u>GC HTTPS Initiative - TLS 1.2 Upgrade</u>", ou également: "<u>Initiative du GC relative à HTTPS – Mise à niveau TLS 1.2</u>"
 
<br>
 
<br>
7. Based on the assessment, and using the [http://www.gcpedia.gc.ca/wiki/HTTPS_Initiative guidance available on GCpedia], the following activities may be required:
+
7. Based on the assessment, and using the [https://wiki.gccollab.ca/GC_HTTPS_Everywhere guidance available on GCcollab], the following activities may be required:
* Obtain certificates from a GC-approved certificate source as outlined in the ''Recommendations for TLS Server Certificates for GC Public Facing Web Services''
+
* Obtain certificates from a GC-approved certificate source as outlined in the [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Recommendations for TLS Server Certificates] [https://wiki.gccollab.ca/images/8/8b/Recommendations_for_TLS_Server_Certificates_-_14_May_2021-FR-REV-NG.pdf Recommandations liées aux certificats de serveur TLS] for GC Public Facing Web Services
* Obtain the configuration guidance for the appropriate endpoints (e.g. web server, network/security appliances, etc.) and implement recommended configurations to support HTTPS.
+
* Obtain the [https://wiki.gccollab.ca/GC_HTTPS_Everywhere/Implementation_Guidance configuration guidance] for the appropriate endpoints (e.g. web server, network/security appliances, etc.) and implement recommended configurations to support HTTPS.
 
<br>
 
<br>
8. Perform another assessment of the applicable domains and sub-domains to confirm that the configuration has been updated and that HTTPS is enforced in accordance with [https://www.canada.ca/en/treasury-board-secretariat/services/information-technology/policy-implementation-notices/implementing-https-secure-web-connections-itpin.html ITPIN 2018-01].
+
8. Perform another assessment of the applicable domains and sub-domains to confirm that the configuration has been updated and that all elements are enforced in accordance with [https://www.canada.ca/en/treasury-board-secretariat/services/information-technology/policy-implementation-notices/implementing-https-secure-web-connections-itpin.html ITPIN 2018-01]. Results will appear in the [https://https-everywhere.canada.ca/ HTTPS Dashboard] within 24 hours.
    
<br>
 
<br>
Line 125: Line 137:     
The use of continuous, distributed security analytics and infrastructure monitoring will support advanced awareness and automation, thus improving security of both the network and its users.   
 
The use of continuous, distributed security analytics and infrastructure monitoring will support advanced awareness and automation, thus improving security of both the network and its users.   
 +
 +
== Exemption Requests ==
 +
 +
Departments who cannot implement all the requirements of the ITPIN must apply to GC Enterprise Architecture Review Board (GC EARB) for an exemption with a rationale to justify the request.
 +
Links to the required GC EARB deck template, which includes direction for all departments who will be unable to meet the requirements of the ITPIN by the end of the calendar year, along with an excel template to provide details are below:
 +
 +
(1.EN) [https://wiki.gccollab.ca/images/6/63/GC_EARB_HTTPS_Exemption.pptx GC EARB HTTPS Exemption Template - EN]<br>
 +
(1.FR) [https://wiki.gccollab.ca/images/c/ca/GC_EARB_HTTPS_Exemption_FR.PPTX GC EARB HTTPS Exemption Template - FR]<br>
 +
(2.EN) [https://wiki.gccollab.ca/images/0/0a/GC_EARB_HTTPS_Exemption_Details.xlsx GC EARB HTTPS Exemption Details - EN]<br>
 +
(2.FR) [https://wiki.gccollab.ca/images/6/6a/GC_EARB_HTTPS_Exemption_Details_FR.xlsx GC EARB HTTPS Exemption Details - FR]<br>
 +
 +
Departments should contact the CIOB-DPPI IT-Division-TI <ZZCIOBDP@tbs-sct.gc.ca> mailbox for further requirements for submitting an exemption request.
    
== Enquiries ==
 
== Enquiries ==

Navigation menu

GCwiki