Primero “Tier 4” Local Server Deployment
Resources Allocation and Work Plan

Introduction

For those of you who are interested in self hosting Primero v2, in addition to the guidance we have shared on Self-hosting background and set up and Installation Guidance, there are programmatic considerations that must be taken into account. The self hosting model for Primero is an implementation model we call “Tier 4”. This model has 2 sites, one “demo” and one “production”. We use the demo CPIMS+ to manage configurations (forms, roles, reports), to receive updates and security patches, and to test and train. Demo has no real data on it. In the Tier 4 model, the demo site lives on UNICEF’s Microsoft Azure servers. For the production site, we use the server that in the partner selected data center managed by a capable technical team who can support the infrastructure set up and maintenance. All the real data is stored on this server. This implies a higher level of accountability and management for the in-country team. A work plan template for a Tier 4 implementation can be found here: https://docs.google.com/spreadsheets/d/1TBBl4qj5mC_N-2KmkaN_uITw-O7bRxTde5YUpFxG9e8/edit?usp=sharing 

Roles and Responsibilities

In this model, it should be clear that the Primero Team cannot be responsible for managing or supporting any of the following and partners are responsible for:

  1. All infrastructure including setting up servers, hosting, setting up monitoring and security measures, security certificates, data durability/data storage, backups, DNS, and configuration of the demo and production instance
  2. Owning, protecting and securing the data
  3. Disaster recovery protocols and data breach protocols
  4. Clear process in place for configuration promotion from “demo” to “production” to receive the most up-to-date releases (which include updates and security patches)
  5. Primero v2 is a progressive web application (PWA) and we have an identity provider that helps us securely authenticate and manage users. If a mobile device management solution is requested for mobile devices, this must be procured and maintained.

The set-up of local infrastructure demands ongoing technical support and budgets. Therefore, you must select a technical partner which has demonstrated a very good capacity, strong technical infrastructure skills and understanding of the work for the project sustainability.

Primero will be handling highly sensitive, personal data, it is crucial that a Terms of Use is signed by the Deputy Representative (if UNICEF is involved) or Minister or Head of Country Operations for this implementation. An Information Sharing Protocol and Data Breach Protocol is required for an implementation which is a case management tool, and is part of the Information Management standards for case management. This ensures you have a clear risk mitigation strategies in place, as well as governance and accountability for decisions that impact child safeguarding, data protection and cyber security. There must be considerations made for the on-going sustainability of the system which includes accounting for on-going costs and resourcing.

To be ensure we are all on the same page, the local production server, which we call Primero Tier 4 package, includes:

It is up to the local ICT team (in the government or the leading agency) to implement mechanisms for security that ensure application availability, data confidentiality, and system integrity. Please read the eloquent warning in the Primero Self Hosting Guide. It fully applies to Tier 4 infrastructure. If you would like to proceed with Tier 4, could you confidently confirm that the in-country team can take on this responsibility for implementing and installing the software?

Of course we understand that Tier 4 service assumes a shared responsibility between the UNICEF Primero Team and the Local Team for the application and infrastructure. To be very clear the key roles and responsibilities are:

UNICEF Primero Team Responsibilities: UNICEF will continue to be responsible for maintaining and releasing the Primero application. It will provide Level 3 support to ensure application integrity and stability. A Global Team focal point will be available for consultation and support requests from the Local Team. The main responsibilities are:

It is up to the local ICT team (government or the leading agency) to implement mechanisms for security that ensure application availability, data confidentiality, and system integrity. Please read the eloquent warning in the Primero Self Hosting Guide. It fully applies to Tier 4 infrastructure. Could you confirm if the in-country team can take on this responsibility for implementing and installing the software?

Of course we understand that Tier 4 service assumes a shared responsibility between the UNICEF Primero Team and the Local Team for the application and infrastructure. To be very clear the key roles and responsibilities are:

UNICEF Primero Team Responsibilities: UNICEF will continue to be responsible for maintaining and releasing the Primero application. It will provide Level 3 support to ensure application integrity and stability. A Global Team focal point will be available for consultation and support requests from the Local Team. The main responsibilities are:

Local Team Responsibilities: the Local Team will be broadly responsible for operating the infrastructure, managing the data,  and ensuring the availability of Primero to the local programme team. That means the Local Team needs to have access to the right resources and staff with the relevant skill set such that the infrastructure can be responsibly operated. If the team cannot support this work, then the decision to use Primero Tier 4 should be reconsidered or appropriate roles should be staffed for or outsourced to technology and infrastructure vendors. The team's main responsibilities are:

  1. Infrastructure security: ensuring only authorized access to the system and the data.
  2. Keeping up with software updates for core systems that operate on the local infrastructure. This includes Ubuntu LTS updates and PostgreSQL updates.
  3. Setting up an approach to monitor for and react to unusual system resource usage: excessive use of disk space, memory, CPU.
  4. Rescaling the system in response to increase in system load and usage.
  5. Procuring and setting up a non-production sample infrastructure that will be used by UNICEF to test the Tier 4 delivery approach.

Could you confirm if the in-country team can take on these responsibilities?

The structure of the local team will vary based on needs and available resources. Typically it will involve some combination of:

For production support, responsibility between the UNICEF Primero Team and the Local Team will be divided up for system support:

 It is up to the Local Team to determine the infrastructure approach for Primero Tier 4. The Primero v2 Self-Hosting Checklist is a good starting point. The team should consider the following:

  1. Ubuntu/Canonical package repositories, Dockerhub, Azure Devops repos, optionally Let's Encrypt

Sample Infrastructure

The infrastructure in this diagram represents a Primero Tier 4 setup that uses Microsoft Azure with a local data center providing a redundant backup for compliance. Could you confirm if the in-country team can take on this responsibility for infrastructure set up?

The Local Team is responsible for ensuring basic security standards for the local infrastructure. This includes:

 

Could you confirm if the in-country team can take on this responsibility for security standards?

Key Considerations for Security

  1. Data Encryption: Ensure that all data, both in transit and at rest, is encrypted using strong encryption algorithms. This prevents unauthorized access to sensitive information even if there is a security breach.
  2. Access Controls and Authentication: Implement robust access controls to restrict access to the system and sensitive data based on roles and permissions. Multi-factor authentication (MFA) should be employed to add an extra layer of security for user logins.
  3. Audit Trails and Logging: Establish comprehensive logging and audit trails to monitor system access and activity. This helps detect and investigate any unauthorized access or suspicious activities.
  4. Secure Development Practices: Ensure that secure coding practices are followed during the development of the case management system to minimize vulnerabilities that could be exploited by attackers.
  5. Regular Security Updates and Patch Management: Keep the system and all associated software up to date with the latest security patches to address known vulnerabilities and reduce the risk of exploitation.
  6. Data Backup and Disaster Recovery: Regularly back up all data and establish a robust disaster recovery plan to ensure that critical information can be recovered in case of any data loss or system failure.
  7. Data Retention Policies: Define clear data retention policies to avoid storing unnecessary data and to comply with relevant data protection regulations.
  8. Physical Security: If the system is locally hosted, ensure physical security measures are in place to protect the servers and infrastructure from unauthorized access.
  9. Vendor Security: If using a cloud-based service, carefully vet the cloud service provider's security practices, compliance certifications, and data protection measures.
  10. Employee Training and Awareness: Train all employees and users on security best practices, such as identifying and reporting potential security threats or phishing attempts.
  11. Incident Response Plan: Develop a comprehensive incident response plan to handle security breaches or data breaches effectively and minimize their impact.
  12. Regular Security Assessments: Conduct regular security assessments, penetration testing, and vulnerability scanning to identify and address potential weaknesses in the system.
  13. Monitoring and Intrusion Detection: Implement monitoring and intrusion detection systems to identify and respond to security incidents promptly.
  14. Legal Considerations: Ensure that the deployment and use of the case management system comply with all applicable laws and regulations, especially those related to child protection and data privacy.

Guidance

Architecture for Interoperability

Sharing Details with Primero Technical Teams for Set up

The domain, security certificate and email for notifications must be set up and shared with the Primero Technical Team to help you with Tier 4 deployment. This includes:

Domain (this is what the users will put in the browser to use Primero)

******************************************************************************

primero_host: 'somedomain.gov.ae'

Security Certificate (this email will receive information about the security certificate)

**********************************************************************************************

certbot_email: 'primero@example.org.ae'

 

Email (for notifications etc)

******************************

SMTP_ADDRESS: 'mail.server.org.ae'

SMTP_PORT: '587'

SMTP_DOMAIN: 'server.org.ae'

SMTP_AUTH: 'plain'

SMTP_STARTTLS_AUTO: 'true'

MAILER_NOTIFICATION_HOST: 'domain.gov.ae'

MAILER_DEFAULT_FROM: 'noreply@domain.org.ae'

MAILER_DELIVERY_METHOD: 'smtp'”

Openfunction Hosting Interoperability Requirements

OpenFN will provided 2 project webhooks