Significant Software Changes and Authorization Requirements in Game Warden

The Department of War (DOW) utilizes Game Warden, a Platform as a Service (PaaS) solution, to streamline cloud-hosted application development, deployment, and operations. Understanding how software changes within the Game Warden environment impact security and authorization is crucial. Game Warden defines significant software changes for applications and outlines when a new Deployment Passport is necessary based on deltas in a given cyber risk posture.

Defining significant changes

A significant software change in a Game Warden-hosted application refers to any modification that:

• Alters the security posture: Introduce new vulnerabilities, change data flows, add new user populations, or expose new attack surfaces within the Game Warden environment.

• Increases cyber risk: Expand the potential for unauthorized access, data breaches, or service disruptions specific to the 2F Platform.

Game Warden considerations

• Shared Responsibility Model: Game Warden manages the security of the underlying Game Warden infrastructure and platform.

• Built-in security features: Game Warden incorporates various security features, such as continuous monitoring, automated security testing, and vulnerability scanning. Significant changes may require re-evaluation to ensure continued compliance with the terms of the authorization to operate.

• Compliance requirements: Game Warden facilitates compliance with DOW security standards. Significant changes may require re-evaluation to ensure continued compliance with the terms of the authorization to operate.

Examples of significant changes

• Modifying core application logic: Changes to the primary functionality or workflow of the application hosted on Game Warden.
• Altering data handling: Change how the application stores, accesses, or processes sensitive data within the Game Warden environment.
• Integrating new services or APIs: Adding new third-party integrations within Game Warden that may expose data or introduce new vulnerabilities.
• Customizing security configurations: Modifying firewall rules, access controls, or encryption settings within the 2F Platform.
• Leveraging new Game Warden features: Utilizing newly released Game Warden features that alter the application's behavior or capabilities.
• Major system changes: Adding application containers or services.

Routine updates vs. Significant changes in Game Warden

Significant changes require a formal Security Relevant Change (SRC) review and government approval. Depending on the impact of the change, the Defense Innovation Unit (DIU) Information Systems Security Manager (ISSM), the Government Security Controls Assessor (SCA), or the Authorizing Official (AO) reviews and approves the change before deployment.

Before deploying a significant change, the Game Warden team evaluates the change—including updates to pipelines, infrastructure as code (IaC), security as code (SaC), and the processes that generate Deployment Passports—to determine whether the change requires an SRC and government approval.

AWS Bedrock integration and updates

Before integrating Amazon Bedrock on Game Warden, review the Define your use case to determine how your application will use the service.

Integrating AWS Bedrock into an application qualifies as a significant change.

• Adding AWS Bedrock with a configuration that matches the Game Warden Baseline requires a new Deployment Passport.
• Adding AWS Bedrock with a configuration that deviates from the Game Warden Baseline requires a new Deployment Passport and an SRC.
• Changing the AWS model for an application with an approved AWS Bedrock Deployment Passport does not require a new Deployment Passport or SRC.