05
Feb
The Centers for Medicare & Medicaid Services (CMS) is a pivotal agency within the Department of Health and Human Services (HHS). Tasked with extending coverage for eligible individuals under Medicare, Medicaid, the Children’s Health Insurance Program (CHIP), and the Health Insurance Marketplace, CMS is responsible for paying over $900 billion annually for medical services rendered to nearly 100 million beneficiaries and recipients.
CMS’s broad spectrum of sensitive data necessitates stringent confidentiality, integrity, and availability (CIA) safeguards. CMS has established an enterprise-wide Information Security and Privacy program under the Information Security and Privacy Group (ISPG) to meet this challenge.
batCAVE aims to alleviate frustration among CMS and Federal Government agencies by enabling more rapid development of secure and usable systems using a platform-as-a-service (PaaS) delivery and operations model.
batCAVE empowers HHS/CMS partners to adopt Development, Security, and Operations (DevSecOps) best practices. Leveraging previous research on the Risk Management Framework (RMF) and platform capabilities, batCAVE builds an open-source PaaS model that facilitates continuous cybersecurity and supports key cybersecurity objectives outlined in Executive Order 10428, including zero trust architecture and a secure software supply chain.
A significant part of this initiative is to adopt Agile software development and Development, Security, and Operations (DevSecOps) practices to expedite acquisitions, scoping, discovery, lean experimentations and iterations, and deployment of applications, ultimately reducing operational inefficiencies and decrease the time to achieve an Authority to Operate (ATO).
Automation: By automating steps required for the ATO process, batCAVE allows developers to focus more on developing modern applications.
Lower-risk releases: Continuous automated testing built into the batCAVE pipelines enables developers to release new features with high confidence and low risk.
Inherited controls: With batCAVE, ADOs will inherit controls from six packages within CFACTS (batCAVE, AWS/CMS Cloud, IDM, EUA, CCIC, and OCISO), dramatically reducing the time to achieve ATO.
Transparency: batCAVE serves as a service that provides guidance and clarity for developers in the process of getting their applications deployed to the cloud.
theta. as a subcontractor, has a multifaceted role on batCAVE, contributing to various critical aspects of the project. Primarily, we provide scalable and secure digital integration services, enabling the seamless development and deployment of a comprehensive DevSecOps pipeline.
The tech stack employed for this project is designed for agility, automation, and security. It comprises several industry-standard tools, programming languages, and services:
Languages & Scripts: The project utilizes YAML for configuration management, Python for various backend functionalities and scripting tasks, and Shell for automating operating system-level tasks.
Version Control: GitHub and GitLab facilitate collaborative and iterative development.
Observability & Monitoring: Grafana, Loki, and Prometheus offer a powerful combination for real-time monitoring, log aggregation, and metrics visualization, facilitating rapid anomaly detection and resolution.
Cloud Services: We extensively use AWS for cloud services, leveraging its extensive suite of scalable and secure infrastructure services.
Containerization and Orchestration: Docker and Kubernetes are employed for the containerization of applications and orchestration of these containers in the cloud, enabling efficiency, portability, and microservice-based architecture. The Amazon EKS service further provides a secure and scalable Kubernetes control plane.
Security: Istio and Falco enforce security policies, provide insights into network traffic, and detect abnormal application behavior.
Continuous Integration/Continuous Deployment (CI/CD): GitLab Runners and Argo CD-managed deployments power the CI/CD pipeline, enabling automatic testing and deployment, increasing development velocity, and reducing the risk of deployment errors.
Infrastructure as Code (IaC): Helm Charts and IaC practices are used for defining and managing the cloud infrastructure in an automated, consistent manner, promoting DevOps practices and reducing deployment errors.
API Development: APIs are crucial to our project, facilitating communication and interaction between different software components.
Operating Systems: Linux and Windows Server are employed for their respective scalability, security, and performance strengths based on individual application needs.
Through this technological arsenal, the batCAVE team is actively researching and developing the deployment of HHS/CMS applications through the DevSecOps pipeline and obtaining a continuous Authority to Operate (ATO).
Our work with CMS and HHS through the batCAVE project exemplifies our commitment to employing cutting-edge technologies and methodologies to drive the development of secure, effective, and user-centric software solutions. Focusing on secure DevSecOps, we support HHS/CMS to maintain their data’s CIA and, more importantly, provide enhanced, efficient, and reliable services to millions of Americans.
