DoD_Industry_Day_Devices_Slides_Final.pdf

UNCLASSIFIED

Mobility Devices Mobility Industry Day

DoD Mobility PMO Aug 2014

Agenda

• Purpose

• Mobility Overview

• Current Device Deployment Status

– DMUC (DoD Mobility Unclassified Capability)

– DMCC (DoD Mobility Classified Capability)

• Challenges

• Capability Goals

Purpose

• Prepare for and plan the government’s future capabilities in mobile technology based on cooperation with the commercial community

– Develop an understanding of current market trends

– Inform industry of government challenges

– Discuss government strategy and approaches to mobile capability

– Build a path forward that reduces risk for government operations and vendor contracting

Operates over commercial wireless networks

3G/4G technology for improved customer experience

Commercial mobile devices built on open standards

Mobility End-to-End Concept

Email

Chat

Calendar

Mobile Apps

Device & Network Mgt & Security

Enterprise Integration

Customer Service & Technical Support

Secure Services &

Applications

Mobile Web/App Clients

DoD Mobility Enterprise (secure) Platform

VOIP*

Security Services (SIM**, Device, Network)

*Voice Over Internet Protocol **Security Information Manager

Presenter Presentation Notes How we are solving the problem & what capabilities are to be delivered.

-- Based on system solution that balances security with user experience -- Moves security into enterprise and network infrastructure vice GOTS hardening of end device

Pace of Mobility

MDM/MAS

(Mobile Device Manager /

Mobility Applications Store) Carriers CAC Readers

(Combined Access Card) Applications

Mobility Infrastructure

BAI Mobile

Precise Biometrics

Thursby

• Rapidly evolving technology

• Reacting to release of new hardware/software

• Integration across vendor technology

• Developing DoD Mobile Policies & Business Processes

• Meeting wide range of DoD Mission & Security Requirements

• Government driving integration

• Dependent on early vendor cooperation

• Driving policy (new Security Technical

Information Guide (STIG), Security Requirements Guide (SRG), etc.)

• Reducing time to Warfighter

OEM

(Original Equipment

Manufacturer)

DMUC

DMUC – Release v2.0

DoD Enterprise Capabilities

M

DM

DoD Enterprise Mobile Application Storefront Shared pre-approved Apps within an initial Enterprise Store

Mobility Gateway Mobile Virtual Private

Network (VPN) Capability NFG/IAP Connectivity

Mobility Networking

Enterprise MAS + Evaluation of CC/S/A* Specific MAS (*Combatant Commanders/Services/Agencies)

DECCs Samsung Knox 1.0 deployment Samsung Knox 2.0 deployment

DoD NetOps Automated

Feed

Commercial Mobile Devices Support for Apple and Samsung Devices

Integrity Checking and Secure/Multipurpose Internet Mail Extension (S/MIME) for iOS Support via Fixmo and baiMobile CAC Readers

Wireless Carriers Carrier Agnostic

Tiered Support Construct Tier 2/3 via DISA Tier 1 at CC/S/A

Admin Portal via Tiered Permissions Order Entry via DISA Portal

Defense Working Capital Fund (DWCF )Service

DMUC iOS/Android Baselines Apple iOS

Devices

• iPhone 4, 4S, 5 & 5S

• iPad 2, 3, 4 w/ Retina, Mini, Mini w/

Retina, & iPad Air

Baseline Operating System

• iOS 7.1.X

Enabled Features

• Siri (limited use; only available when device is unlocked)

• Apple App Store (approved apps only)

Disabled Features

• AirDrop

• Voice dialing

S/MIME

• DEE baiMobile 3000MP SCR

• Thursby Pkard Reader secure browser with Thursby SCR

• Multiple SCRs for DEE and Pkard

Reader

Full Outlook Functionality iOS & Android Android

• Secure Wi-Fi

• Camera enabled

• GPS

• Bluetooth

• Native browser

• YouTube

• Contacts

Disabled Features

• Screen capture

• Browser auto fill

• Browser pop ups

• Personal email accounts

• Cloud Backups

Security Policy

• Password required

• 30 day inactivity limit

• 15 minute LockScreen Timeout

• Device Wipe at 10 failed attempts

• Blocks jail broken/rooted devices

• No System Files tampering

• Integrity Checking

Devices

• Samsung Galaxy S4 with Knox

• Tablet expected summer 2014

Baseline Operating System

• 4.4.X

• Device Encryption

Disabled Features

• Google Play

• SD Card

• Tethering (USB & Wi-Fi)

• USB

• Near Field Communication (NFC)

S/MIME

• KNOX 2.0 DEE S/MIME support with baiMobile 3000 MP

• Multiple SCRs for DEE and Pkard

Reader

No Outlook Notes & Tasks

UNCLASSIFIED

UNCLASSIFIED

Device Strategy

DoD Mobility supported device focus areas

– Compatible with MDM and the current mobility infrastructure

• E-mails, Public Key Encryption (PKE) and Unified Capability (UC) services

– Capable of meeting all DoD mobility Security Requirements

• Mobile SRG, MDM STIG

• iOS STIG and other Android Knox STIG

• PKE requirements

• National Information Assurance Partnership (NIAP)/Applied

Physics Laboratory (APL) Certified

– Device agnostic for DMUC devices

• Being platform independent

• Support iOS, Android, Windows 8

• Blackberry supported by DISA Defense Enterprise E-mail (DEE)

– Leverage commercially available mobile O/S offering and devices for DMUC

• DISA needs Industry’s assistance to better address:

– The very short life span of devices

• Adapting to Industry’s short update cycles

• Short notice prior to Carrier/OEM vendor updates

• Adhering to DoD requirements

– Controlling software baselines

• DoD cannot control OS/Carrier firmware updates… How do we adapt?

– Preparing for new devices without early access

• DoD gets the devices simultaneous with the public and we’re already behind

– Flexible device procurements options

• Easy phone number swap/exchange

• Device exchange on the fly

• Fast re-activations

• Enable/Disable roaming

• Data min pooling

• No pre-service plan commitments

• Ability to upgrade devices easily

DMUC Device Challenges

DMCC

UNCLASSIFIED

UNCLASSIFIED

DMCC-S Release-Driven Capabilities

Q4 FY2014

Release 1.0 Capabilities

Q1 FY2015

Release 2.0 Capabilities

Enterprise Mobile Gateway and Mobile Management

• Gateway leveraging Multi-Carrier Entry Point

(MCEP)

• Continuous monitoring (Spin 1)

• Gateway Redundancy / Failover

• International access via Mobile HotSpots

Enterprise Services Enabled:

• Secure Enclave Webmail Access

• Secure Voice Calls (includes Defense Red

Switch Network (DRSN) interoperability)

Enterprise Mobile Gateway and Mobile Management

• New Integrator Commercial Solution (ICS)

• VPN gateway leveraging MCEP

• Mobile Device Management

• Added continuous monitoring (Spin 2)

• Automated Course of Action (ACOA) “Spin 1”

• Gateway Redundancy / Failover

• International access via Mobile HotSpot

Enterprise Services Enabled:

• Secure Enclave Webmail Access

• Secure Voice Calls (includes DRSN interoperability)

UNCLASSIFIED

UNCLASSIFIED 13

DMCC-S Release 1.0 (R1.0) International Roaming and Failover

DoD Enterprise Capabilities 2 Mobility Gateways

(MCEP)

Secures comms before features utilized

NSA Approved Smartphone Support for Motorola

RAZR MAXX

NSA Approved Mobile HotSpots International roaming capability

Wireless Carrier Domestic Access over

APN

Gateway /

MCEP

OWA

Secure Phone Calls to DMCC, DRSN, ECVoIP, VoSIP, SCIP Devices

Order Entry via DISA Direct Order Entry (DDOE) DWCF Service

Failover

COOP

DR

Continuous Monitoring

Spin 1

Internet Ingress Point

1.0 Int. Access Build and

Test with Hot Spot

AT&T

Liberate MiFi 5792 [Others pending]

Nanny Exorcist KeyProtector

| 14 |

DMCC Architecture Separate infrastructures minimize spillage hazard

UNCLASSIFIED

UNCLASSIFIED

Classified Mobile Device

Release 1.0 Devices

• Razor Maxx

Phone Features

• Enhanced Security through

Customized and hardened OS

Capabilities

• VoIP Application

• Custom “Nanny” Application

• Web Browser for E-Mail

*NO ON-DEVICE STORAGE

Release 2.0 Devices

• COTs Android Device

Phone Features

• Enhanced Security through

Customized and hardened OS (4.4.x)

Capabilities

• MDM Application

• VoIP Application

• Web Browser for E-Mail

*NO ON-DEVICE STORAGE

DMCC Device Challenges

• Similar challenges to DMUC

• DISA needs Industry’s assistance to better address:

– Fielding up-to-date handsets

• Fully featured services that can securely access any data on DoD networks, regardless of classification

– Reducing threat postures

• Automate sensing and reacting to exploits from internal and external threats to reduce risks to national security without increasing manpower or training requirements

– Supporting TS/SCI level Mobility

• TS Voice & Data

– Flexible secure device procurements options

• Delivery of a secure commercial device reducing integration and testing requirements

• Ability to upgrade devices easily

• Secure device management

– Supporting applications

• Chat

• Improved e-mail experiences

• Others