DISA storefront for apps makes security the no. 1 priority

To help centrally manage and secure emerging smart-phone applications, which is a key component of the Defense Department’s mobile enterprise strategy, the Defense Information Systems Agency is building a departmentwide application storefront for the delivery of applications, updates and device configurations.

DISA envisions this DOD application storefront as serving a similar purpose as public storefronts such as Apple’s App Store or Google's Marketplace. When launched later in 2012, it will serve as a place where DOD users can go and get the latest applications for their smart phones and other mobile devices.

Related coverage:

DOD mobile strategy behind the eight-ball compared to industry

“Once we’ve got our mobile applications storefront up [this year], then we’re going to see massive growth,” said Bruce Bennett, DISA’s program executive officer for communications. “It will be a departmentwide storefront just like Android Marketplace, but instead of pointing to a commercial server it will point to one located in DOD secured spaces.”

DOD’s increasing use of smart phones is driving the need for such a mobile application storefront. Bennett said, however, that these applications need to be tightly controlled as to who has access to them and what DOD users put on their smart phones. The storefront will allow DISA to check out the apps and make sure they are safe before posting them.

From a security standpoint, DISA wants to ensure that DOD users stay compliant with rules and regulations. DOD mandates specific configuration settings for smart phones through the use of Security Technical Implementation Guides (STIGs), which are developed by DISA and updated periodically in an effort to keep pace with documented emerging threats and changes to technology.

Given the widespread popularity of Apple’s iOS and Google’s Android mobile operating systems, it was just a matter of time before DISA addressed these smart phone operating systems in formal STIGs.

“The issue we have is that commercial vendors have already designed their phones and security was not an initial concern,” said Bennett. “We’re trying to go back and work with them and figure out what we can do for the phones that are already out.”

In October, DISA approved an Interim Security Configuration Guide for Apple iOS devices, restricting iOS for limited deployment, pilots, and demonstrations. In November, DISA approved the STIG for Android version 2.2, the first secure Android operating system-based platform that meets DOD Directive 8100.2 security requirements. The secure Android operating system was approved for use on Dell Streak 5 devices with device management software from Good Technology.

According to Chris Roberts, vice president of worldwide public sector at Good Technology, Dell and Good Technology collaborated on writing a set of Application Programming Interfaces (APIs) to shut off components of the device that could potentially leak data.

When it comes to security, Bennett said that the BlackBerry is more mature and considered the incumbent compared to the other smart-phone operating systems used in DOD. But, that could change very soon, he said.

“RIM [Research in Motion, the maker of BlackBerry devices] has been willing to make adaptations up and down the line historically to ensure that they meet DOD standards,” added Roberts. “The biggest challenge for RIM is that it’s tough to fight a multipronged war when there are other operating systems out there and other hardware options that people are choosing to use.”

DISA as mobile operator

According to DISA’s 2011-2012 Campaign Plan, the agency intends to provide mobile-device services as a virtual network provider. In May 2011, DISA issued a request for information (RFI) seeking industry advice on how the agency might become a Mobile Virtual Network Operator (MVNO) to manage more than a million smart phones and other devices.

“We’re actively working the whole mobility issue, trying to develop what we can leverage from the commercial market and how best that translates into DOD needs,” said Bennett. “We’re gathering anything that has been learned and we’re trying to put it into one central repository so we can make the best decision.”

DISA’s ultimate goal in this initiative is “acquisition sensitive” said Bennett, who would not comment on the agency’s specific plans. However, according to the May 2011 RFI, DISA is looking to establish MVNO services throughout the DOD to extend enterprise unified communications to mobile devices “locked to an MVNO providing third and eventually fourth-generation network service.”

The MVNO services would include “data services only with encrypted voice-over-IP services” and in addition to real-time media services “the government acting as an MVNO seeks to actively manage and monitor the security” of smart phones and other devices, the RFI states. The government “sees this as a niche telecom business ultimately servicing federal, state, local, and tribal agencies,” the RFI also states.

“In these budget times, the federal government and DOD are looking to leverage technologies that are commercially available and not reinvent the wheel,” said Roberts. “They want to take advantage of mobility in its fullest while having the security that they require. That’s really the golden goose for them.”