Mobile Device Management - fedinsider.com · vendors: AT&T, ViaSat, and SRI – Vendors formed...
Transcript of Mobile Device Management - fedinsider.com · vendors: AT&T, ViaSat, and SRI – Vendors formed...
Mobile Device Management: New Strategies for Secure, Accessible Government
Mobile and Accessibility Marine Corps Mobility
Initiatives Mobile Security in an
Enterprise Environment
First Speaker Second Speaker Moderator & Third Speaker
Check for new and updated events anytime on www.FedInsider.com/events
How Mobile Has
Changed My Life, II
•
•
How Mobile Has
Changed My Life, III
•
•
•
•
•
•
Section 508 and Mobile
•
•
•
•
–
–
–
–
–
–
–
–
–
–
–
12
Ray A. Letteer, CISSP, C|CISO
Chief, Cybersecurity Division
Headquarters, US Marine Corps, C4CY
Marine Corps DAA/Senior IA Official
Marine Corps Mobility Initiatives
A Marine Corps fighting force armed with assured, secure, accurate, and timely information, to enhance the ability to take the fight to any enemy, anywhere, and win.
Marine Corps Commercial Mobile Device Strategy
13
1. Establish a secure mobile framework (SMF)
2. Transition the unclassified mobile device
infrastructure to a cost effective and
platform agnostic environment
3. Facilitate a classified mobile device
capability
4. Incorporate personally owned mobile
devices within the MCEN
Signed: April 2013
The roadmap for current Marine Corps Commercial Mobility initiatives.
1. Establish a Secure Mobile Framework
14
The Secure Mobility Framework has been established to define how Marines will securely utilize mobile capabilities. Development of this framework is critical as it lays the foundation for USMC to seamlessly adopt secure CMDs and mobile applications.
Policy, Planning, Guidance
Procurement & Acquisition
Hardware/OS Accreditation
Application Development/Certification/Distribution
Operations Optimization
Secure Mobility
Network Infrastructure
Cyber
Security
Current Efforts:
• Develop Mobile Policies
– ECSD 004: Remote Access Policy 2.0 Revision
• New RAS solutions, including Lightweight Portable Solution (LPS), Windows 8-to-Go
• Standardize Testing – Cyber IA Range
– Developing Wireless Environment
– Blackberry Enterprise Service 10 Testing
– Rapid STIG development
DISA Security
Requirement
Guides
Mission
Requirements
DAA
Decision
SRG
IA Range
Test and
Evaluate
Vendor
Solutions IAW
SRGs & STIGs
DON EMIPT
Focal Point
for Mobility
Initiatives
Streamlining Secure Configurations
2. Unclassified Mobile Device Infrastructure
Blackberry Enterprise Service (BES) 10 Installation is currently under evaluation for install within the MCEN. BES 10 has three components which can help USMC reach this goal with minimal cost within a GFE model, while working towards BYOD:
16
1.) Management of Legacy Server – Will allow USMC to retain and manage
existing Blackberry Devices 2.) Blackberry Device Service (BDS)
– Will enable USMC to deploy BBOS10 devices (Z10, Q10, Playbook)
3.) Universal Device Service (UDS) – Will enable deployment and management of
enterprise connected iOS/Android devices – Fee for use: $80/Device/Year
Current USMC BB Models will reach EOL within the next year
Blackberry corporate situation may complicate project
Developing an iOS feasibility study for iPad/iPhone use by GO/SES
3. Classified Mobile Device Capability
• Current Classified Mobility:
– SME-PED (Secure Mobile Environment Portable Electronic Device):
– Piloting DMCC (DISA Mobile Classified Capability):
• In-Development:
– USMC Systems Command Trusted Handheld (TH2) Solution
• Potential CLASSIFIED Operational Use Cases:
17
Domain 1 Domain 2
Enterprise (NIPR) Enterprise (SIPR)
Operational (SBU) Operational (Secret)
Operational (SIPR) Operational (SIPR/REL)
Closed Test Network - Notional NIPR Closed Test Network - Notional SIPR
Classified Single User Domain Not installed or disabled
18
Trusted Handheld (TH2)
Important features:
– Isolation Technology
– Software Integrity based on Hardware Root of Trust
– Multiple Active User Domains
– Suite B Encryption
– Data at Rest Encryption
Contracts awarded to three vendors: AT&T, ViaSat, and SRI
– Vendors formed teams consisting of industry players like Samsung, LG, ARM
– Competitive prototyping occurred over three iterations, culminating at the end of July 13 with a production representative device.
19
4. Marine Corps BYOD
More than $17M spent on Marine Corps mobility currently; about 40%
consists of management costs which would be almost completely eliminated
with BYOD.
DISA Mobility has a significant level of additional hands-on management;
rough numbers place the per device/per month cost at around $250. No
official “cost” has been provided.
Marine Corps BYOD will leverage a device and unlimited data plan that the
user already has contracted.
– The user will subscribe to enterprise data services at a cost of ~$15 a month.
– Certain command-directed users would receive a reimbursement.
– The carriers would manage the devices according to our policies, and we will audit.
19
Bottom line for BYOD
20
USMC BYOD
• Reduces overhead costs significantly
• Personal selection of device and plan
• Stays current with industry trends and technologies
• Maintains overall IA posture
• Leverages one device with dynamic restrictions
GFE
• Contracts required
• TEM required
• Device, server, and CAL costs
• Data/voice costs
• Management overhead
• Requires multiple devices
• Limited functionality promotes unauthorized behavior
21
Challenges / Timelines
BYOD Beta has slipped ~3 months based on initial estimates. Current Challenges include:
Legal Assurance of User agreement / Contracting for Testing Devices
Enabling Mobile PKI Authentication with Active Sync (Exchange Email)
Adjusting Policy to allow software certificate authentication methods
Way Ahead:
Develop Implementation Plan and schedule
Aid development of sustainable process for Government to certify Commercial Mobile Devices as they hit the market
Beta Phase
Current efforts designed to limit actions to just those directly impacting launch of the Beta Phase.
Mobile Security in an
Enterprise Environment
Tom Voshell
Senior Customer Solution Director
SAP Regulated Industries
© 2013 SAP AG. All rights reserved. 24 Public
Learning Points
■ Challenges and best practices in both the public and private sector for
adopting mobile technology
■ Steps agencies need to take to remain vigilant when implementing mobile
solutions
■ Best practices from the US Marine Corps and other agencies that are
deploying secure apps
■ The six touch points every agency needs to consider in building a mobile
strategy
■ How baseline security guidelines from the Department of Defense,
Department of Homeland Security, and National Institute of Standards and
Technology are setting the stage for digital government
© 2013 SAP AG. All rights reserved. 25 Public
NIST Special Publication 800-124 Revision 1
■ Architecture. Designing the architecture includes the selection of mobile device management server and client software,
the placement of the mobile device management server and other centralized elements, and the architecture of any virtual
private network (VPN) solutions.
■ Authentication. Authentication involves selecting device and/or user authentication methods, including determining
procedures for issuing and resetting authenticators and for provisioning users and/or client devices with authenticators (see
“Device provisioning” below). Authentication includes access to or integration with existing enterprise authentication
systems.
■ Cryptography. Decisions related to cryptography include selecting the algorithms for encryption and integrity protection of
mobile device communications, and setting the key strength for algorithms that support multiple key lengths.9 Federal
agencies must use FIPS-approved algorithms contained in validated cryptographic modules when using cryptography to
protect information.10
■ Configuration requirements. This involves setting minimum security standards for mobile devices, such as mandatory
host hardening measures and patch levels, and specifying additional security controls that must be employed on the mobile
device, such as a VPN client.
■ Device provisioning. It is important to determine how both new and existing devices will be provisioned with client
software, authenticators, configuration settings, etc.
■ Application vetting and certification requirements. This sets security, performance, and other requirements that
applications must meet and determines how proof of compliance with requirements must be demonstrated.
NIST technical security considerations for designing mobile
device management solutions.
© 2013 SAP AG. All rights reserved. 26 Public
800-124 refers to Managing the device lifecycle
Device Enrollment
Configure devices
Assign to groups
Deploy apps by role
Configure and Enroll in E-mail
Configure Wifi and VPN access
Remote lock
Remote wipe
Access violation lock
Disable device, network, application and e-mail access
Disposal of obsolete devices
Enforce security policies
Monitor/track security violations
Access Control
Compliance activity logging
Maintain/modify configuration
Monitor hardware, software and packages
App notifications and updates
Track assets
Telco expense management
Location tracking
Monitor compliance
Monitor hardware, software and packages
Manage roaming and carrier
Location tracking
Drill-down by data element
© 2013 SAP AG. All rights reserved. 27 Public
Enterprise Security Requires Securing the entry points
Applications Devices
Password
enforcement
Certificate
management
OTA software
distribution
Asset management
Auditing/compliance
monitoring
WiFi settings, VPN
settings
Remote wipe
Content
File access (e.g.
SharePoint), file
sharing, file sync, time-
sensitive file
distribution
Password, lock,
remote wipe,
encryption, DLP,
certifications
LDAP and Active
Directory integration,
group management,
policy enforcement
Communications
Granular app-level
security
Per-app VPN, FIPS 140-
2 compliance
Encryption of data at rest
and data in motion
Application discovery
and private app store
Software updates for
applications
Individually encrypted
apps with secure keys
Manage WiFi
connectivity
FIPS compliant VPN
Systems management
e.g. Cisco ISE
Network access
management
Manage the cost of
the billing, invoicing
© 2013 SAP AG. All rights reserved. 28 Public
PRIVATE APP
STORE
BUSINESS
USER
MOBILE
MIDDLEWARE
OPEN DEVELOPMENT
FRAMEWORK
CONTROL VISIBILITY MANAGEMENT
ENTERPRISE
SYSTEMS
APPLICATION
SECURITY
DEVICE
MANAGEMENT
EMPLOYEE
PRODUCTIVITY
APPLICATION
DEVELOPMENT
Security in an Enterprise Mobile Solution Architecture
1
2
3
4
5
6
© 2013 SAP AG. All rights reserved. 29 Public
Application
Governance
Consistent
application of
defined system
access and
security policies
Security within the Application Lifecycle
Develop / Update
Test
Fingerprint
Secure
Deploy
Consume
Thank you
Tom Voshell
SAP Regulated Industries – Fed / Civ
Senior Customer Solution Director
Washington, DC
Live Events
• Government Mobility: Catalyst for Change – Thursday, November 7, 2013 – 8:00 – 11:00 Breakfast Briefing (public sector only) – 3 CPE’s awarded by George Washington University – http://www.eventbrite.com/event/8633542157/webinar
• Agency Innovation: Making Mobile Government a Reality – Tuesday, October 1, 2013 – 8:00 – 10:30 Breakfast Briefing (private sector welcome) – http://www.eventbrite.com/event/8738453951/webinar
Webinars
• Profile of a Cyber Criminal: Mitigating Threats Inside and Outside of your Agency – Tuesday, November 12, 2013 – 2:00 – 3:00 PM (EST) – https://goto.webcasts.com/starthere.jsp?ei=1022944
Upcoming Events and Webinars
Check for new and updated events anytime on www.FedInsider.com/events