CLASSIFICATION:  UNCLASSIFIED

DoD Ports and Protocols Program

The complete Ports and Protocol website can be found on the SIPRNET at http://pnp.cert.smil.mil.  This website represents an unclassified version of that site. 

Program Overview
Program Plan
Program Execution
Configuration Control Board (CCB) Information *(PKI Required)
Technical Assistance Group (TAG) Information *(forthcoming)
References, Documentation, and User Forms
FAQ
Glossary
Components Contact Information
Ports and Protocols Program Contact Information

Program Overview

The ASD-C3I, in coordination with the Defense-wide Information Assurance Program (DIAP), the Joint Staff, USSTRATCOM, and the Defense Information Systems Agency (DISA) announced the DoD Ports and Protocol Program (PNP) with the release of the 28 January 2003 memorandum entitled DoD Ports, Protocols, and Services – Increasing Security at the Internet/DISN Boundary. This program represents a fundamental change in the DoD Computer Network Defense (CND) philosophy, replacing the current CND philosophy of “Deny by exception” with “Permit by exception.”

Program Plan

All Combatant Commands, Services, Agencies, and Field Activities (hereafter referred to as Components) will provide a point of contact (POC) to the Joint Task Force – Computer Network Operations (JTF-CNO).  These POCs are responsible for consolidating a list of automated information systems (AIS) required by their organization, including the protocols and/or ports utilyzed, as well as operational and technical necessity.  This information will be uploaded into the DISA maintained, DoD PNP Registration System.  DISA will then format this information and provide it to the DISN Security and Accreditation Working Group (DSAWG).  The DSAWG will either approve or disapprove a system and its associated protocols and/or ports.  If a request was not submitted, or the DSAWG disapproves the request, the JTF-CNO will direct DISA to deny any inbound packets over that port and/or protocol at the Internet Access Points (IAS).

Program Execution

The timeline for the initiative began with the USSTRATCOM memorandum entitled Increasing Security at the Internet-Niprnet Boundary (DoD Ports and Protocol Program) released 13 February 2003. Based on the ASD-C3I memo, Components are to provide the JTF-CNO with a primary and alternate PNP NLT 12 February 2003.  The JTF-CNO will provide the approved list of Component PNP POCs to DISA for issuing of PNP database logon/passwords, and instructions for accessing the DoD PNP Registration System.  Component POCs may submit and edit requests within this system.  Additionally, they will have the ability to check the status of submitted requests.

The JTF-CNO is sponsoring a PNP Workshop on March 28,2003.  This workshop will provide the POCs with detailed information on the program.  The location and time of the workshop has been published to the POCs.

DISA will:

·         Manage PnP Registration access and content.

·         Provide logon/passwords as directed by the JTF-CNO.

·         Provide reports for the DSAWG as directed

·         Provide report to the JTF-CNO as directed

·         Assist Component POCs who do not have access to the SIPRNET

The DSAWG will evaluate requests prior to the implementation of any port/protocol blocks.  The JTF-CNO will query the PnP Registration System for any requests that were submitted relevant to upcoming port ranges or protocol blocks. A port/protocol will be blocked if:

·         No requests for a port/protocol was submitted to the DoD PNP Registration System.

·         A request was submitted but was denied by the DSAWG.

Should the DSAWG approve a request then the associated ports/protocol will remain open for 12 months and will be reevaluated after that time. Component must ensure that the PNP registration system is maintained, to ensure that, should another combatant command, service, agency, or field activities request be disapproved at a later date, their mission critical ports/protocols are not closed.

Timeline

28 January 2003           ASD-C3I release memorandum

12 February 2003        ASD-C3I suspense to Components to provide JTF-CNO with PNP POCs

13 February 2003        USSTRATCOM releases memorandum

13 March 2003            Suspense for Component submitting PNP Waiver Requests to DoD PNP database

28 March 2003            JTF-CNO sponsors DoD PNP POC Workshop:  Contact your component POC for information.

16 April 2003               JTF-CNO directs blocking initial ports (1024 – 1000)

bimonthly                      JTF-CNO directs additional port blocks based on success of initial blocks.  Schedule TBA.

References and Documentation

JTF-CNO 14 March 2003 PNP Update Message
ASD/C3I Memorandum - DoD Ports, Protocols and Services
DoD Ports, Protocols and Services Security Technical Guidance
Firewall Guidance
Listing of well known port numbers and associated services
Listing of well known Transport Layer protocols
DOD Instruction 5200.40 DoD Information Technology Security Certification and Accreditation Process (DITSCAP)
DoD Directive 8500.1  Information Assurance
DoD Instruction 8500.2 Information Assurance Implementation

User Forms
System Authorization Access Request (DISA Form 41) - Print the form and fill in the appropriate blocks. Completed forms should be faxed to 703-882-2885, DSN: 381, ATTN: Amy Rak.  Failure to do so will result in a denial of access to the system.  Contact the PnP Help Desk with any questions.

Change Management Form - As part of the Ports and Protocols Registration Application management process, a change management form should be filled out whenever a change is made to the production system. 
 

FAQ

Click here for PNP Frequently Asked Questions.

Glossary

Click here for PNP Glossary

Components Contact Information

Ports and Protocols Program Contact Information

CLASSIFICATION:  UNCLASSIFIED