Changes

{| class="wikitable" style="align:center; border-top: #000000 2px solid; border-bottom: #000000 2px solid; border-left: #000000 2px solid; border-right: #000000 2px solid" width="1200px"

{| class="wikitable" style="align:center; border-top: #000000 2px solid; border-bottom: #000000 2px solid; border-left: #000000 2px solid; border-right: #000000 2px solid" width="1200px"

|-

|-

! style="background: #dddddd; color: black" width="250px" scope="col" |[https://www.canada.ca/en/treasury-board-secretariat/services/information-technology/policy-implementation-notices/implementing-https-secure-web-connections-itpin.html ITPIN 2018-01]

! style="background: #dddddd; color: black" width="250px" scope="col" |[https://www.canada.ca/en/government/system/digital-government/modern-emerging-technologies/policy-implementation-notices/implementing-https-secure-web-connections-itpin.html ITPIN 2018-01]

! style="background: #dddddd; color: black" width="250px" scope="col" |[[../Strategy | Implementation Strategy]]

! style="background: #dddddd; color: black" width="250px" scope="col" |[[../Strategy | Implementation Strategy]]

! style="background: #dddddd; color: black" width="250px" scope="col" |[[../Implementation Guidance | Implementation Guidance]]

! style="background: #dddddd; color: black" width="250px" scope="col" |[[../Implementation Guidance | Implementation Guidance]]

== Audience ==

== Audience ==

This guide is primarily for business owners, web developers, IT and IT security practitioners who are involved in implementing externally-facing GC online services.

This guide is primarily for business owners, web developers, IT and IT security practitioners who are involved in implementing externally-facing GC online services.

== Strategy Framework ==

== Strategy Framework ==

The following table provides an overview of the framework for this strategy.

The following table provides an overview of the framework for this strategy.

<br><br>

<br><br>

1. Identify key resources required to act as central point(s) of contact with TBS and the HTTPS Community of Practice.  Establish connections via the GCTools channels at:

1. Identify key resources required to act as central point(s) of contact with TBS and the HTTPS Community of Practice.  Establish connections via the GCTools channels at:

* GCconnex: [https://gcconnex.gc.ca/groups/profile/35218846/gc-https-everywhere-2018-https-partout-dans-le-gc-2018 GC HTTPS Everywhere 2018]

* GCcollab: [https://gccollab.ca/groups/profile/1358152/engc-https-everywhere-2018frgc-https-partout-2018 GC HTTPS Everywhere 2018]

* GCmessage: [https://message.gccollab.ca/channel/httpseverywhere-httpspartout #HTTPSEverywhere-HTTPSpartout]

* GCmessage: [https://message.gccollab.ca/channel/httpseverywhere-httpspartout #HTTPSEverywhere-HTTPSpartout]

<br>

<br>

2. Perform an inventory of all departmental domains and subdomains. Sources of information include:

2. Perform an inventory of all departmental domains and subdomains. Sources of information include:

* Internally available HTTPS Dashboard (insert link when available)

* [https://https-everywhere.canada.ca/ HTTPS Dashboard]

* TBS Application Portfolio Management (APM)

* TBS Application Portfolio Management (APM)

* Departmental business units  

* Departmental business units  

<br>

<br>

3. Provide an up-to-date list of all domain and sub-domains of the publicly-accessible websites and web services to the following website: [https://canada-ca.github.io/pages/submit-institutional-domains.html Submit your institution's domains].  

3. Provide an up-to-date list of all domain and sub-domains of the publicly-accessible websites and web services to TBS Cybersecurity.

<br><br>

4. Perform an assessment of the domains and sub-domains to determine the status of the configuration. Tools available to support this activity includes GC HTTPS Dashboard, SSL Labs, Hardenize, etc.

* Use the following website for domain additions: [https://canada-ca.github.io/pages/submit-institutional-domains.html Submit your institution's domains].

<br>

4. Perform an assessment of the domains and sub-domains to determine the status of the configuration. Tools available to support this activity include the GC HTTPS Dashboard, [https://www.ssllabs.com/ SSL Labs], [https://www.hardenize.com/ Hardenize], [https://www.sslshopper.com/ssl-checker.html SSLShopper], etc.

<br><br>

<br><br>

5. Develop a prioritized implementation schedule for each of the affected websites and web services, following the recommended prioritization approach in the ITPIN:

5. Develop a prioritized implementation schedule for each of the affected websites and web services, following the recommended prioritization approach in the ITPIN:

* ''6.2.1 Newly developed websites and web services must adhere to this ITPIN upon launch.''

* ''6.2.1 Newly developed websites and web services must adhere to this ITPIN upon launch.''

* ''6.2.2 Websites and web services that involve an exchange of personal information or other sensitive information must receive priority following a risk-based approach, and migrate as soon as possible.''

* ''6.2.2 Websites and web services that involve an exchange of personal information or other sensitive information must receive priority following a risk-based approach, and migrate as soon as possible.''

* ''6.2.3 All remaining websites and web services must be accessible through a secure connection, as outlined in Section 6.1, by September 30, 2019.''

* ''6.2.3 All remaining websites and web services must be accessible through a secure connection, as outlined in Section 6.1, by December 31, 2019.''

<br>

<br>

6. Engage the departmental IT group for implementation as appropriate.  

6. Engage departmental IT planning groups for implementation as appropriate.

* Where necessary adjust IT Plans and budget estimates for the FY where work is expected.

* Where necessary adjust IT Plans and budget estimates for the FY where work is expected.

* It is recommended that SSC partners contact their SSC Service Delivery Manager to discuss the departmental action plan and required steps to submit a request for change.  

* It is recommended that SSC partners contact their SSC Service Delivery Manager to discuss the departmental action plan and required steps to submit a request for change.

<br>

<br>

7. Based on the assessment, and using the [http://www.gcpedia.gc.ca/wiki/HTTPS_Initiative guidance available on GCpedia], the following activities may be required:

7. Based on the assessment, and using the [https://wiki.gccollab.ca/GC_HTTPS_Everywhere guidance available on GCcollab], the following activities may be required:

* Obtain certificates from a GC-approved certificate source as outlined in the ''Recommendations for TLS Server Certificates for GC Public Facing Web Services''

* Obtain certificates from a GC-approved certificate source as outlined in the [https://wiki.gccollab.ca/images/8/89/Recommendations_for_TLS_Server_Certificates.pdf Recommendations for TLS Server Certificates] for GC Public Facing Web Services

* Obtain the configuration guidance for the appropriate endpoints (e.g. web server, network/security appliances, etc.) and implement recommended configurations to support HTTPS.

* Obtain the [https://wiki.gccollab.ca/GC_HTTPS_Everywhere/Implementation_Guidance configuration guidance] for the appropriate endpoints (e.g. web server, network/security appliances, etc.) and implement recommended configurations to support HTTPS.

<br>

<br>

8. Perform another assessment of the applicable domains and sub-domains to confirm that the configuration has been updated and that HTTPS is enforced in accordance with [https://www.canada.ca/en/treasury-board-secretariat/services/information-technology/policy-implementation-notices/implementing-https-secure-web-connections-itpin.html ITPIN 2018-01].

8. Perform another assessment of the applicable domains and sub-domains to confirm that the configuration has been updated and that all elements are enforced in accordance with [https://www.canada.ca/en/treasury-board-secretariat/services/information-technology/policy-implementation-notices/implementing-https-secure-web-connections-itpin.html ITPIN 2018-01]. Results will appear in the [https://https-everywhere.canada.ca/ HTTPS Dashboard] within 24 hours.

<br>

<br>

==Implementation Considerations==

==Implementation Considerations==

<div class="toccolours mw-collapsible mw-collapsed" style="width:100%">  

<div class="toccolours mw-collapsible mw-collapsed" style="width:100%">  

The use of continuous, distributed security analytics and infrastructure monitoring will support advanced awareness and automation, thus improving security of both the network and its users.   

The use of continuous, distributed security analytics and infrastructure monitoring will support advanced awareness and automation, thus improving security of both the network and its users.   

== Enquiries ==

== Enquiries ==