Organization for Security Organization for Security and Cooperation in Europeand Cooperation in Europe
OECD ICT Management OECD ICT Management Workshop Workshop
Paris, October 2004Paris, October 2004
OSCE OSCE -- backgroundbackground
55 member states, annually rotating Chair, 55 member states, annually rotating Chair, consensus based decision making.consensus based decision making.Permanent Council in Vienna establishes Permanent Council in Vienna establishes mandatemandateSecretariat (administrative centre) in ViennaSecretariat (administrative centre) in Vienna25 countries of operations (Missions)25 countries of operations (Missions)Management Reform introduced in 2000Management Reform introduced in 2000Central ERP system implemented in 2004Central ERP system implemented in 2004Central document management system being Central document management system being implemented 2004implemented 2004--20052005
missionNW
IS
IR
UK
SDFI
ES
F
EP
LV
NL
B
DK
D
CH
I
RUS
BL
UKR
PL
CZ
SK
HA
RO
MO
L
CRBH
SaMBUL
ALBSkp
GRE
TUR
GEO
AR
AZ
KAZ
SL
UZB
TKM
KGZ
TAD
LI
Croatia
BiH
Kosovo
Georgia
Moldova
Ukraine
Tajikistan
Skopje Albania
Vienna
Belarus
Tashkent
AlmatyBishkek
Ashgabad
Yerevan
OSCE Global Presence Map
SaM
PR CiO
Baku
HCNM
ODIHR
Prague
OSCE Field Operations
OSCE Institutions
OSCE Information Security OSCE Information Security Organizational EnvironmentOrganizational Environment
Governance IssuesGovernance IssuesSG/SG/HoMHoM/CIO responsibility/CIO responsibilityStaff and information classificationStaff and information classificationOSCE deOSCE de--centralized organizational environmentcentralized organizational environmentNeed mandate (and budget) from Member StatesNeed mandate (and budget) from Member States
OSCE InfoSec management priorities:OSCE InfoSec management priorities:OSCE InfoSec Strategy OSCE InfoSec Strategy -- what do we need to protect, from whom, at what do we need to protect, from whom, at what level ? what level ? How do we protect OSCE information and systems in the short and How do we protect OSCE information and systems in the short and long long term?term?Move from decentralized fragmented patchwork of ICT security Move from decentralized fragmented patchwork of ICT security practices to corporate frameworkpractices to corporate framework
OSCE Information Security OSCE Information Security Action PlanAction Plan
InfoSecInfoSec strategy (Information Security strategy (Information Security Management Plan)Management Plan)Established interim policiesEstablished interim policiesDesigned solutions where neededDesigned solutions where neededCreated Virtual OSCE Created Virtual OSCE InfoSecInfoSec teamteam
Governance/approval Governance/approval -- standardizationstandardization
InfoSec Virtual Team InfoSec Virtual Team
Created OSCECreated OSCE--wide virtual wide virtual InfoSecInfoSecteam in May 2004team in May 2004Established a prioritized action plan for Established a prioritized action plan for corporate solutioncorporate solutionFirst set of corporate solutions First set of corporate solutions implemented in September 2004implemented in September 2004Action Plan revised and work ongoingAction Plan revised and work ongoing
OSCE InfoSec Short Term OSCE InfoSec Short Term StrategyStrategy
Consolidation of the existing infrastructureConsolidation of the existing infrastructure
Finalize implementation of the standard security solutions in Finalize implementation of the standard security solutions in all OSCE Missionsall OSCE MissionsImplement reliable solution for firewall backup and software Implement reliable solution for firewall backup and software managementmanagementImplement a VPN failover and traffic shaping solution Implement a VPN failover and traffic shaping solution Implement standard secure mobile computing solutionsImplement standard secure mobile computing solutionsImplement a secure wireless solution for OSCE environmentImplement a secure wireless solution for OSCE environmentEE--mail spam filtering, content filtering and intruder detection mail spam filtering, content filtering and intruder detection solutions for OSCE environmentsolutions for OSCE environment
OSCE InfoSec Long Term OSCE InfoSec Long Term StrategyStrategy
Design and implement an OSCE Design and implement an OSCE Information Technology Security Information Technology Security FrameworkFramework
Business Continuity PlanBusiness Continuity Plan
Compliance with International Compliance with International Standards Standards
Governance/approval Governance/approval -- enforcementenforcement
OSCE OSCE InfoSecInfoSec reality todayreality today
Major goals of Information Security : Major goals of Information Security : Confidentiality, Integrity, AvailabilityConfidentiality, Integrity, Availability
What are we protecting?What are we protecting?InformationInformationOSCE Corporate applicationsOSCE Corporate applications::
EE--mail systemmail system
IRMA: Integrated Resources Management systemIRMA: Integrated Resources Management system
DOC.IN: (Knowledge and Document management system)DOC.IN: (Knowledge and Document management system)
OSCE Portal: Common ICT platform for data and information sharinOSCE Portal: Common ICT platform for data and information sharingg
WAN infrastructure WAN infrastructure -- hope to consolidate communications contracts (100+)hope to consolidate communications contracts (100+)
The BIG pictureThe BIG picture
CroatiaZagreb
TurkmenistanAshkabad
KazakhstanAlmaty
PRCiOTbilisi
UkraineKiev
Hofburg
ODIHRWarsaw
HCMNThe Hague
Bosnia andHerzegovina
Sarajevo
Prague
Bishkek/Kyrgistan
AlbaniaTirane
MoldovaKishinau
Serbia andMontenegro
Belgrade
BelarusMinsk
UzbekistanTashkent
Armenia/Yerevan
HLPGVienna
Tajikistan
OMIKPrishtine
GeorgiaTbilisi
FoMVienna
Azerbadjan/Baku
FYROMSkopje
InternetInternet Internet
Internet x 2
Internet
Internet Internet
Internet
Internet x 2 &leased Line
Internet x2
Leased Line
InternetInternet
Internet x 2
In-house
Internet x3& VSAT
Internet &Leased line
In-house
Internet
Internet x 2
Internet
Internet
Internet
Internet
OSCE Secretariat
Peje
Prizren
Police School
Mitrovice 1
Mitrovice 2
Gjilan
MW link
MW Link
Strepce
Lipjan
Rahovec
Logistcs &Procurem.BBC 1
MW Link
MW Link
MW Link
MW Link
MW Link
MW Link
MW link
MW Link
FO Caplina
FO Tebinje
FO Siroki Brijeg
RC Srajevo
FO Srajevo
FO Pale
FO Visegrad
FO Foca/Srbinje
FO Bugojno
FO Travnik
RC Tuzla
FO Bijelina
BiHPACK
PRI
FO Drvar
FO Bihac
RC Mostar
BiHPACK
RC BanjaLuka
FO SanskiMost
FO Zvornik
FOSrebenica
FO Zenica
FO Doboj
BiH PACK
Hodjan
Hulab
Kurgantepa
Shartuz
Garm
Internet
Internet
Internet
No AccessVlore
Gjirokaster
Korce
Kukes
Shkoder
Elbasan
Internet Internet
Internet
InternetInternet
TetovoPolice
Academy
KumanovoWarehouse
Leased Line
Leased Line
Leased Line
Leased Line
Tchinkvali
Suchumi
BMO 1
BMO 2
BMO 3
BMO n-1
BMO n
TeamStepanakert
Team Erevan
Team ErevanOsh
Podgorica
P. TrainingCentre Zemun
P. TrainingCentre South
FC Knin
FO Zadar
FC Sisjak
FC Vukovar
IRMA Portal G/Wise
DataStorage
Peshkopi
Dial up
FO Prijedor
FO Orasje
Oracle
Oracle
Oracle
OracleOracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle Oracle
Oracle
Working Document - OSCE WAN Layout(23/10/2003)
FOKarlovac
FOPetrinja
FO Split
FO Korenica
FOB.Monastir
FO Pakrac
WHRajlovac
Leased Line
Annex 5
OracleOracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle*12 / 03
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle
Oracle
OracleOracle
Oracle
Legend
Temporary Solution (to beinstalled within 2003)
OracleExisting Long term solution
How we protect OSCE informationHow we protect OSCE informationInternational Organizations /
Partner Sites
IPSec-compliant Gateway
VPN-1 SecuRemote /RSA SecureID token
authentication
CheckPoint VPN-1SecureClient
Remote Users
OSCE Missions and Institutions
CheckPoint Express VPN-1/FireWall-1
Management Console• Visual Policy Editor• SecureUpdate• Real-time Monitor• Reporting Module• Account Management Module• Open Security Extension
Web Server (planned)
Extranet Application Servers
LDAP Directory
Data Center – Hosting Facility
Corporate Network/Services
Router
CheckPoint VPN-1/FireWall-1 Gateway• VPN-1 Accelerator Card• FloodGate-1• Extranet Management Interface
Authentication / Reverse Proxy
Server
“BIG” Internet
OSCE Standard Security SolutionsOSCE Standard Security Solutions
CheckPoint VPNCheckPoint VPN--1 Gateway:1 Gateway:Protects resources with Protects resources with FireWallFireWall--1, Stateful Inspection 1, Stateful Inspection Allows centralized management Allows centralized management and distributed deployment of both and distributed deployment of both security policy and softwaresecurity policy and softwareProtects data in transit with VPN Protects data in transit with VPN industry standards industry standards
3DES and AES encryption3DES and AES encryptionIPSec / IKE IPSec / IKE All leading user authentication All leading user authentication schemes (including RADIUS schemes (including RADIUS and RSA SecureID token)and RSA SecureID token)
Provides reliable performance with Provides reliable performance with integrated QoS and hardware integrated QoS and hardware accelerationacceleration
VPNVPN--1 SecureClient:1 SecureClient:Basic VPN Client for Windows Basic VPN Client for Windows 98/ME, NT, 2000 and XP 98/ME, NT, 2000 and XP Centrally managed “personal Centrally managed “personal firewall” policiesfirewall” policiesSecurity Configuration Security Configuration Verification (SCV)Verification (SCV)Software packaging and Software packaging and distribution featuresdistribution features
OSCE Standard Security SolutionsOSCE Standard Security Solutions
NOKIA IP Series AppliancesNOKIA IP Series Appliances
Platform Layer
Application Layer
Management Layer
Support LayerSupport Layer
Top Related