MES_U_Unclassified-_Briefing-Final.pdf

UNCLASSIFIED 1

UNCLASSIFIED

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Mobility Enterprise Services –Unclassified (MES-U) Pre-Solicitation Conference

Constance (Coni) E. Jackson Defense Information Technology

Contracting Organization (DITCO) 02 April 2019

UNCLASSIFIED 2

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Pre-Solicitation Conference Guidelines

• All questions before, during and after the Pre-Solicitation Conference must be submitted in writing to the Contracting Officer and/or Contract Specialist.

• All questions and corresponding answers will be posted on FedBizOpps after conclusion of the Pre-Solicitation Conference.

• Any correspondence regarding the MES-U requirement shall be directed only to the Contracting Officer and/or Contract Specialist.

UNCLASSIFIED 3

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Contracting Points of Contact

• Contracting Officer: Constance (Coni) E. Jackson DITCO Contracting Officer/Agreements Office Chief, Emerging Technologies, Special Interest Contracts & Pricing Division, PL84 618-418-6696 constance.e.jackson4.civ@mail.mil

• Contract Specialist: Melissa Weh Contract Specialist

DISA/DITCO/PL8414

618-418-6518 melissa.a.weh.civ@mail.mil mailto:constance.e.jackson4.civ@mail.mil mailto:melissa.a.weh.civ@mail.mil

UNCLASSIFIED 4

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Mobility Enterprise Services- Unclassified

(MES-U)

Pre-Solicitation Conference

Jake Marcellus Portfolio Manager

DoD Mobility Portfolio Management Office 02 April 2019

Presenter Presentation Notes

FRANK

UNCLASSIFIED//FOR OFFICIAL USE ONLY 5

UNCLASSIFIED//FOR OFFICIAL USE ONLY

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Presentation Disclaimer

"The information provided in this briefing is for general information purposes only. It does not constitute a commitment on behalf of the United States Government to provide any of the capabilities, systems or equipment presented and in no way obligates the United States Government to enter into any future agreements with regard to the same. The information presented may not be disseminated without the express consent of the United States Government. This brief may also contain references to United States Government future plans and projected system capabilities. Mention of these plans or capabilities in no way guarantees that the U.S. Government will follow these plans or that any of the associated system capabilities will be available or releasable to foreign governments."

Presenter

FRANK

UNCLASSIFIED 6

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Agenda

• DoD Mobility Overview

– Service Offerings and Capabilities

– Initiatives

• MES-U Acquisition

– Certifications and Skills

– Guiding Principles

• DMUC Deep Dive with DoD Mobility PMO Chief Engineer

• Question and Answer Session

02 APR 19 -- 1000

Presenter

Jake

UNCLASSIFIED 7

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DoD Mobility PMO Overview

The DoD Mobility Portfolio Management Office provides UNCLASSIFIED and CLASSIFIED managed mobility service offerings composed of commercially available Mobile Devices and Enterprise Mobility Management solutions.

Mobility Enterprise Services - Unclassified (MES-U)

DMUC |

DMCC-S |

DMCC-TS |

DoD Enterprise service offering enabling government owned Mobile Devices access to Unclassified Department of Defense Information Network (DoDIN) and Commercial information services.

DoD Enterprise service offering enabling government owned Mobile Devices access to Classified Secret Department of Defense Information Network (DoDIN) telephony and information services.

DoD Enterprise service offering enabling Mobile Devices access to Classified Top Secret Department of Defense Information Network (DoDIN) telephony services.

Mobility Enterprise Services Classified (MES-C)

Presenter

Jake

UNCLASSIFIED 8

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DoD Mobility Service Offerings and Capabilities

DMUC DMCC-S DMCC-TS (Phase 1)

Users: 140K+ Customer brings

Device & Cell Plan $4.31/month Customers: DoD Commercial Mobile Devices approved by National Information Assurance Partnership (NIAP) ‒ iOS, Android, and Samsung

Knox capable Mobile Device Management DEE/Non-DEE NIPR Access PKI Authentication & Identity (Purebred) Mobile Application Store w/1000+ Apps Apps Vetting Service

Users: 68 Costs

-Infra: Under Dev -Device: $~400 -Cell Plan: $30-$60

Customers: DoD, DISA, NLCC, IC Secure voice calls up to TS-collateral classification level Commercial Mobile Devices and

Tablets configured to NSA Commercial Solutions for Classified Program Office’s standards

DoD CIO is drafting policy on authorizations

Users: 2,950 Costs

-Inf. $59.05 /month -Device $~400 -Cell Plan $30-$60

Customers: DoD, Non-DoD Federal, NATO, Select Foreign National

Commercial Mobile Devices and Tablets configured to NSA Commercial Solutions for Classified Program Office’s standards

Secure Enterprise Voice Defense Enterprise Email

DMUC Futures

Mobile Endpoint Protection Mobile Content Mgmt More DoD Apps Forensics Support

DMCC-TS Future

Access to more Voice Networks NSA Next Gen Solutions Gateways

Converged

OCONUS

DMCC-S Futures

Larger Form Factors (Tablets) More SIPR capability access NSA Next Gen Solutions Gateways

Converged

OCONUS

DoD Mobility is…

Secure Assured Managed

Army

COCOM

Navy

USAF

DHA

DCMA DOD

Highly Portable Tested About choices

DMUC is a DoD Information System DAR solutions are the future of DMCC-S DMCC-TS is a special program

Presenter

Al

UNCLASSIFIED 9

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Mobility PMO Organization Chart

Presenter

FRANK AND AL

UNCLASSIFIED 10

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DMUC Holistic Picture

Requirements

DOD CIO

DISA MPEO

NIAP

Mobility PMO

Design

COOP

Robust Load Balancing Geo Routing

Services Email Web Enterprise Apps Service Desk

Licensing Purebred Office Apps

OS

iOS Android

Security

STIG

HBSS/ePO

ACAS

NIAP

FIPS 140-2

CSSP

IAM

Enclave CAs

OCSP

CRL

CDR

Root CAs Intermediate CAs Cert Gen/Process Radius

TACAS

Components

NAS

VPN

FW

LSC

SBC

Switch Router

EMM/MDM

MAS

MAM

ACS

DNS

NTP

Database KGs Load Balancers Servers Gateways

Protocols

FTP

HTTPS

NTP

ICMP

IPSec

IKE

ICMP

SIP

TLS

SRTP

VLAN

Video

Monitoring

IDS

CONMON

SMNP

SYSLOG

Auditing

DISA OSS

ESM/ID64

OPENNMS

Networks Cellular WiFi Internet NIPRNet

Devices Apple Samsung

Presenter

Greg

UNCLASSIFIED 11

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DMUC Infrastructure Defense Enterprise Computing Center Locations

Oklahoma City, OK

MobileIron Cores

DEE Sentries Non-DEE Sentries

Mechanicsburg, PA

Columbus, OH x3 x4 x1 x2

NGA

x4

DEE Sentris

Camp Walker South Korea x2

DEE Sentris

Stuttgart, Germany x2

MobileIron Cores

DEE Sentries Non-DEE Sentries x3 x4 x1 x2

NGA

x4

Gateway #1 Gateway #2

San Antonio, TX

Presenter

Al

UNCLASSIFIED 12

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DMUC Infrastructure - Overview

• DMUC Mobile Device

• Supports iOS & Samsung Android Devices

• MobileIron Cores

• Remotely Manages Device Policies

• MobileIron Sentries

• Provides Secure Email Access w/o VPN

• Internet-Based Services

• Supporting Commercial Services (e.g., APNS, GCM, App Stores, etc.)

• Enterprise Active Directory Services Forest (EASF) Domain

• DoD Enterprise Active Directory Domain

• Mobility Gateway

• Provide Mobile VPN Access to NIPRNet

• Purebred Derived Credentials

• DoD PKI Credentials for S/MIME & Web EASF Domain

ADLDS

AD

DEE

DMUC Mobile Device

MobileIron Cores

MobileIron Sentries

Purebred Application

Purebred Agent and User with CAC

Internet-Based Services

Mobility Gateway

Presenter

UNCLASSIFIED 13

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Mobility Gateways

NetScout integration to simplify management of voice performance (pending)

Operations Support Systems tools

Splunk integration for gateway health and diagnostics

Load balancing

Mutual authentication (PKI certificate pinning) defends against Man-in-the-middle attack

Presenter

UNCLASSIFIED 14

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Cybersecurity

ATO maintenance Fully manage and track all accreditation activities in accordance with

DISA Risk Management Executive (RME) and AO requirements

• Enterprise Mission Assurance Support Service (eMASS)

• Assessment and Authorization (A&A) Request Tracking System (RTS)

• DoD Information Technology (IT) Portfolio Repository (DITPR)

• Ports, Protocols, and Service Management (PPSM)

Strict adherence to weekly Assured Compliance Assessment Solution (ACAS) scanning and patching requirements

Active monitoring and response to NSA and Columbus Network Assurance (COLS-NA) advisories on potential security issues

Rigorous change management process that has successfully implemented over 700 changes to multiple production systems

• Process approximately 15 request for changes (RFCs) per month

DMUC includes managed cybersecurity support to let customers focus on their unique mission requirements

Accreditation and Policy Reference

FIPS 140-2 Cryptographic Module Validation

National Information Assurance Partnership (NIAP)

• Mobile Device Fundamentals

• Mobile Device Management

• Application Software

Security Target Implementation Guide (STIG)

RMF: DoDI 8510.01 / NIST SP 800-53 controls

ACAS: USCYBERCOM TASKORD 13-0670

Presenter

Will

UNCLASSIFIED 15

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

MES-U Acquisition

High-level Requirements:

• End-to-end managed integrator

Highly Technical Engineering support Capability integration at the speed of Mobility Tier III Engineering Support

Status: Pre-solicitation

Timeline: Anticipate RFP to be released 4QFY19

Presenter

Frank

UNCLASSIFIED 16

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

MES-U Awardee Expected Certifications and Skillset

• Project Management

• Network Engineering Expertise

DODIN

Internet (IP, TLS, TCP)

VoIP Cloud

• Systems Development

• Systems Architecture

• Systems Engineering

• Systems Integration

• Innovations and Thought Leadership

• Service Management Frameworks

Service Strategy Service Design Service Transition Service Operations

Process, Quality and Risk Management DoD Specific Security Professional competency

Presenter

Frank

UNCLASSIFIED 17

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Detailed Technical Requirements

• Detailed technical requirements are broken down into 2 main categories:

• MES-U Integrator

• RMF

• T&E

• Capability integration

• MGW

• Next Generation Enterprise Mobility Management (EMM) Task

• Architecture

• Capability

• Compliance

• Tier 1

• Monitoring

• Unique Use Cases

• Identify Management

• Affordable (hosting costs)

• Program Support

• Product Support

• Systems engineering

Presenter

UNCLASSIFIED 18

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

EMM Main Components

• Developed from Gartner 2018 Criteria for EMMs and tailored for MES-U

• Additionally, within each category, where applicable, the Government has identified categorized requirements based on need.

Required: Essential, must-have features needed to manage mobile devices, protect the information they contain and manage the apps that run on them.

Preferred: Additional features not necessary to satisfy the minimum mobile device management requirements of the Government, but required to address specific needs such as certificate use on devices and apps.

Supplemental: Requirements-driven features necessary for specific deployment scenarios to support specific Government mobility customers, but not needed in all mobility support deployments.

Presenter

UNCLASSIFIED 19

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

EMM Main Components (Continued)

• The EMM multiple capabilities are organized into the 10 categories below:

Baseline criteria: The criteria listed here are the basic baseline functionality present in the EMM suite as the common critical items to all mobility management systems.

Mobile Device Management: These functions include control of device features such as the camera, external memory and profile distribution.

Mobile Application Management (MAM): These criteria address the ability to manage policies and control data sharing for mobile applications.

Security Management: These functions include management of secure containers, limiting of certain data transfer functions outside and into the container as well as policy management. Container may be a physical application/hypervisor or the common policy management of Enterprise managed applications that controls application data and usage.

Presenter

UNCLASSIFIED 20

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

EMM Main Components (Continued)

Identity Management: These functions are related to access controls for user and/or device credentials, managed containers, app security and single sign-on (SSO) into the container.

System Integration: This section examines the ability of the EMM suite to integrate with existing government infrastructure such as enterprise email, calendar, public-key infrastructure (PKI) and directory services.

End-user Experience: These functions will determine how the EMM suite interacts with end users and impacts their workflows.

Service Desk Experience: These features are focused on the support and provisioning functions available to service desks.

Audit and Management Reporting: This section describes reporting monitoring capabilities and outlines required audit capabilities.

Vendor Licensing and Support: This section contains criteria for vendor support and licensing.

Presenter

UNCLASSIFIED 21

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Guiding Principles

• This requirement is for full mobility service management; not a ‘single domain solution’

• Our users are in the business of the Defense of our Nation

• 140K and growing customer base; service must be always on!

• User Experience is paramount

• Approved Cloud and On-Prem solutions are of interest

• Knowledge of DoD standards, and policies is key

• Knowledge of Global Internet transport is key

• Relationships with Mobility OEM providers is key

• Risks must be thoroughly mitigated; insurance is not an option

Presenter

UNCLASSIFIED 22

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

Contracting Points of Contact

• Contracting Officer: Constance (Coni) E. Jackson DITCO Contracting Officer/Agreements Office Chief, Emerging Technologies, Special Interest Contracts & Pricing Division, PL84 618-418-6696 constance.e.jackson4.civ@mail.mil

• Contract Specialist: Melissa Weh Contract Specialist

DISA/DITCO/PL8414

618-418-6518 melissa.a.weh.civ@mail.mil mailto:constance.e.jackson4.civ@mail.mil mailto:melissa.a.weh.civ@mail.mil

UNCLASSIFIED 23

TRUST IN DISA: MISSION FIRST, PEOPLE ALWAYS!

DEFENSE INFORMATION SYSTEMS AGENCY

The IT Combat Support Agency

/USDISA @USDISAwww.disa.mil