The Engine maintains an automatically updated inventory of all assets across all Enclaves, including historical records.
Unauthorized devices cannot register with an Enclave as they lack the proper certificates, are not included in IP routing tables, and the SD-WAN orchestration database.
| | ✔ | **Least Privilege** | Designing the security architecture such that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function. |Enclave components build with least-privileged profiles. Access is granted to users explicitly based on security groups. Users must be invited into an Enclave, and belong to the same security group as an asset in order to access it.
Dispel Enclaves are single-tenant and do not share resources across Enclaves.
| | ✔ | **Secure Administration** | Performing administrative tasks in a secure manner, using secure protocols | Central administration is conducted under TLS 1.2. | | ✔ | **Strong Authentication** | Verifying the identity of users, devices or other entities through rigorous means (e.g. multi-factor authentication) before granting access. | Dispel mandates complex passwords, and supports the following multi-factor authentication systems: temporary one-time passwords (e.g., Google Authenticator), FIDO2 hardware tokens, RSA SecurID, and Apple biometrics (Face ID and Touch ID). | | ✔ | **Time Synchronization** | Coordinating clocks on all systems (e.g. servers, workstations, network devices) to enable accurate comparison of timestamps between systems. | Dispel leverages cloud provider time synchronization to ensure all Enclave systems coordinate clock times. | | | **Vulnerability Assessment** | Proactively working to discover vulnerabilities, including the use of both active and passive means of discovery, and taking action to mitigate discovered vulnerabilities. | Dispel has its own internal vulnerability discovery methods, but we do not consider these applicable to the TIC in this context. | | | **Patch Management** | Patch management is the identification, acquisition, installation, and verification of patches for products and systems. | Dispel provides patch management servers on which vetted updates may be staged for an installer to use to apply to their internal environments. | | ✔ | **Auditing and Accounting** | Capturing business records, including logs and other telemetry, and making them available for auditing and accounting as required. | The Dispel Engine maintains logs of all system provisioning and deletion events. Additional syslogging and session recording of virtual desktops is also available. | | ✔ | **Resilience** | Ensuring that systems, services, and protections maintain acceptable performance under adverse conditions. | Dispel integrates with seven public cloud providers, spanning over 150 data centers globally. In the event of a cloud- or regional-outage, services can be transferred to other areas. | | | **Enterprise Threat Intelligence** | Obtaining threat intelligence from private and government sources, and implementing mitigations for the identified risks. | | | | **Situational Awareness** | Maintaining effective awareness, both current and historical, across all components. | | | | **Dynamic Threat Discovery** | Using dynamic approaches (e.g. heuristics, baselining, etc.) to discover new malicious activity. | | | ✔ | **Policy Enforcement Parity** | Consistently applying security protections and other policies, independent of the conveyance mechanism used. | All policies are centrally enforced by the Engine for users, and at build time by SaltStack scripts during virtual machine image provisioning. | | ✔ | **Effective Use of Shared Services** | Employing shared services, where applicable, that can be individually tailored, measured to independently validate service conformance, and offer effective protections for tenants against malicious actors, both external as well as internal to the service provider. | All Dispel Enclaves are single-tenant, and therefore not exposed to pivoting between environments. Administrators may choose the number of Enclaves, which correspond to the amount of segmentation desired. | | ✔ | **Integrated Desktop, Mobile, and Remote Policies** | Defining polices such that they apply to a given agency entity no matter its location. | All remote access is granted via Enclaves uniformly. Policy rules are applied universally for both desktop/mobile devices, and for virtual desktops. | ## Policy Enforcement Point Capabilities ### Overview Policy Enforcement Point (PEP) Capabilities are network-level capabilities that inform technical implementation for relevant use cases. PEP Capabilities are divided into eight groups and fulfilled by applications, devices, or services identified in TIC Use Cases and TIC Overlays. The eight PEP capability groups correspond to the following security functions. Dispel assists in the **bold** ones: * [**Files**](/regulatory-framework-mappings/dhs-tic/vol.-3-security-capabilities.md#files-pep-security-capabilities) * Email * Web * [**Networking**](/regulatory-framework-mappings/dhs-tic/vol.-3-security-capabilities.md#networking-pep-security-capabilities) * [**Resiliency**](/regulatory-framework-mappings/dhs-tic/vol.-3-security-capabilities.md#resiliency-pep-security-capabilities) * Domain Name System (DNS) * Intrusion Detection * [**Enterprise**](/regulatory-framework-mappings/dhs-tic/vol.-3-security-capabilities.md#enterprise-pep-security-capabilities) * [**Unified Communications and Collaboration (UCC)**](/regulatory-framework-mappings/dhs-tic/vol.-3-security-capabilities.md#unified-communications-and-collaboration) * [**Data Protection**](/regulatory-framework-mappings/dhs-tic/vol.-3-security-capabilities.md#data-protection) The PEP capability groups listing is not exhaustive. Additional groups may be developed to reflect new use cases. The following tables provide: (1) a list of PEP capabilities, (2) a description of each capability, and (3) a mapping to relevant NIST CSF categories. Generally speaking, Dispel's services don't cover criteria in the Email, Web, DNS, or Intrusion Detection sections. We've therefore omitted them from this framework mapping. ### Files PEP Security Capabilities {% hint style="info" %} File capabilities are available in Dispel's Virtual Desktops. These features are not part of Enclaves in general. {% endhint %} | Covered | Capability | Description | Dispel | | ------- | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ✔ | Anti-malware | Anti-malware protections detect the presence of malicious code and facilitate its quarantine or removal. | Linux Virtual Desktops are equipped with anti-malware detection. Windows desktops include Windows Defender. | | | Content Disarm & Reconstruction | Content Disarm & Reconstruction technology detects the presence of unapproved active content and facilitates its removal. | | | ✔ | Detonation Chamber | Detonation Chambers facilitate the detection of malicious code through the use of protected and isolated execution environments to analyze the files. | Virtual desktops are isolated, single-tenant OS environments on hypervisors. Virtual desktops are designed to be destroyed after use to prevent malware spread and persistence. | | | Data Loss Prevention | Data loss prevention (DLP) technologies detect instances of the exfiltration, either malicious or accidental, of agency data. | | ### Networking PEP Security Capabilities | Covered | Capability | Description | Dispel | | ------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ✔ | Network Access Controls | Network Access Control protections prevent the ingest or transiting of unauthorized network traffic. | IP table traffic routing within an Dispel Enclave's VPN structure dictates network access and egress. | | ✔ | IP Blacklisting | IP Blacklisting protections prevent the ingest or transiting of traffic received from or destined to a blacklisted IP address. | All Dispel egress nodes ("Exit Points") maintain blacklists. They are automatically populated by Spamhaus blacklists, and may also be configured. | | ✔ | Host Containment | Host Containment protections enable a network to revoke a host’s access to the network. | Hosts may be removed from a Dispel Enclave by revoking their access permissions and then cycling the Entry Point the host is connecting to. | | ✔ | Network Segmentation | Network Segmentation separates a given network into subnetworks, facilitating security controls between the subnetworks, and decreasing the attack surface of the network. |Each Enclave SD-WAN is made up of two cascade cipher VPN tunnels. The underlying VPN infrastructure is single-tenant. Each Enclave is thus segmented from one another, and a compromise on one cannot spread laterally to another.
Enclaves are also Moving Target Defense systems, reducing any given attack surface to just the duration the Enclave Entry Point exists.
| | ✔ | Microsegmentation | Microsegmentation divides the network, either physically or virtually, according to the communication needs of application and data workflows, facilitating security controls to protect the data. | Within Enclaves, security groups define what users are allowed to access what resources. Dispel Wicket ESIs--which provide VPN uplinks from on-premises systems--support IP and port whitelisting and blacklists. | ### Resiliency PEP Security Capabilities | Covered | Capability | Description | Dispel | | ------- | ----------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ✔ | DDoS Protections | DDoS protections mitigate the effects of distributed denial of service attacks. |Dispel provides flexible infrastructure to prevent data consumption in a DDoS attack. Enclaves can scale in size and scope of Entry Points. Network ingress points can alter their topology, providing an evasive attack surface. Enclave Entry Points can also block all traffic from suspicious IP addresses.
In additional to Dispel's native architecture, the underlying cloud providers Dispel partners with also implement their own DDoS protections--including automation detection and response mechanisms.
| | ✔ | Elastic Expansion | Elastic expansion enables agencies to dynamically expand the resources available for services as conditions require. | Dispel provides capacity ahead of demand provisioning with scheduled build times for scaling up and down virtual resources. For example, the number of Enclaves can increase at 7 AM when the workday starts, then decrease at 6 PM as the day ends. | | ✔ | Regional Delivery | Regional Delivery technologies enable the deployment of agency services across geographically diverse locations. | Dispel's cloud partners provides access to over 150 data centers across the globe. This includes North America, South America, Europe, the Middle East, Africa, and Asia. | ### Enterprise PEP Security Capabilities | Covered | Capability | Description | Dispel | | ------- | ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Security Orchestration, Automation, and Response (SOAR) | Security Orchestration, Automation and Response tools define, prioritize and automate the response to security incidents. | | | | Shadow IT Detection | Elastic expansion enables agencies to dynamically expand the resources available for services as conditions require. | | | ✔ | VPN | Virtual Private Network solutions provide a secure communications mechanism between networks that may traverse across unprotected or public networks. | Dispel provides VPNs natively within an Enclave. The default system is two cascade ciphered OpenVPN AES-256 tunnels, with independently generate 4096-bit RSA keys for the initial key exchange. Administrators have the option of using WolfSSL as as interior VPN tunnel as well. | ### Unified Communications and Collaboration | Covered | Capability | Description | Dispel | | ------- | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | | ✔ | Identity Verification | Identity verification ensures that access to the virtual meeting is limited to appropriate individuals. Waiting room features, where the meeting host authorizes vetted individuals to join the meeting, can also be utilized. | Dispel's video conferencing tool | | ✔ | Encrypted Communication | Communication between virtual meeting participants and any data exchanged is encrypted at rest and in transit. Some UCC offerings support end-to-end encryption, where encryption is performed on the clients and can only be decrypted by the other authenticated participants and cannot be decrypted by the UCC vendor. | | | ✔ | Connection Termination | Connection termination mechanisms ensure the meeting host can positively control participation through inactivity timeouts, on-demand prompts, unique access codes for each meeting, host participant eviction, and even meeting duration limits. | | | | Data Loss Prevention | Mechanisms should be implemented to control the sharing of information between UCC participants, intentional or incidental. This may be integrated into additional agency DLP technologies and can include keyword matching, attachment file type or existence prohibitions, attachment size limitations, or even audio/visual filters. | | ### Data Protection | Covered | Capability | Description | Dispel | | ------- | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ✔ | Access Control | Access control technologies allow an agency to define policies concerning the allowable activities of users and entities to data and resources. | Dispel Access Control Lists (ACLs) define allowable access policies by users to data and resources. | | ✔ | Protections for Data at Rest | Data protection at rest aims to secure data stored on any device or storage medium. | The Dispel database that maintains administrative functions is encrypted at rest with AES-256, block-level storage encryption. | | ✔ | Protections for Data in Transit | Data protection in transit, or data in motion, aims to secure data that is actively moving from one location to another, such as across the internet or through a private enterprise network. |Dispel transmits information over the public Internet. We protect data in transit with strong encryption, reviewing and updating to employ the latest cryptographically reliable cipher suites.
For example, at this time, when you are connected to your Dispel services through our client application or a hardware device, and for internal server-to-server transmissions, we use two layers of cascade ciphered AES-256-CBC with independent 4096-bit RSA keys for the initial key exchange. Keys are typically generated by segmented compute systems designed with randomness in mind, and distinguished between clients.
When you are using one of our browser-accessible applications, we employ AES-256-GCM encryption. These may be secured using SHA-256 with 2048-or 4096-bit RSA keys, depending on the security requirements of the application. This means many communications through Dispel are protected by three layers of encryption. We encrypt data multiple times, using different ciphers, for several reasons. As one example, by using different ciphers encrypted data is less susceptible to a zero day flaw that could affect both at the same time.