Creating mobile security standards
Connecting state and local government leaders
Agencies are moving forward with security standards for cell phones and mobile apps under a pair of recent policy directives.
The Department of Defense began to plan its strategy support of mobile devices five years ago, but policies have only solidified in the past two months with a memo from former Acting DOD CIO John Zangardi and a directive from the interagency Committee on National Security Systems (CNSS).
Therese Firmin, principal director of DOD CIO’s cybersecurity division and deputy chief information security officer, outlined the three parts of the mobile strategy at the Nov. 29 AFCEA Mobile Tech Summit. “The infrastructure to support mobile capabilities, the devices themselves and the applications that run on the devices are the three key components of our strategy,” she said.
Firmin emphasized the need for “agile and scalable” solutions that will fit the massive customer base at DOD that deals with complex missions around the world. Plus, “people expect now to be able to keep up with technology, so we can no longer be in a situation where our equipment ages out,” she added.
Zangardi's Oct. 6 memo to DOD agencies created a baseline standard for securing mobile apps on employee devices, instructing agencies to adopt standards used by the National Information Assurance Partnership (NIAP) for mobile app vetting.
The memo calls for “a risk-managed approach” for assessing applications found in commercial app stores, according to Firmin. It uses the National Institute of Standards and Technology’s Risk Management Framework "Assess Only" process to analyze applications, and the evaluations are submitted to a portal maintained by the Defense Information Systems Agency so they can be accessed by all DOD users.
CNSS Directive 510, issued Nov. 20, provides a minimum set of requirements for the introduction and use of government-managed mobile devices in secure spaces. It sets out criteria for documenting risk-based decisions on where devices are being used and mission needs.
There is a need to speed the app approval process, which NIAP Director Janine Pedersen said will benefit from industry input on testing requirements.
“[Apps] need to meet national security requirements, and we want to do authentication to get these apps out as quickly as possible,” Pedersen said. “We are looking to automate our testing, and we are relying on industry and our test labs to make that happen.”
The DHS Science & Technology Directorate is also working to help agencies with automated app testing. S&T submitted a study to Congress with NIST on the security on mobile device security for all government agencies in April. The report argued that given the massive size of the consumer-based mobile ecosystem, government may not be able to close security gaps without regulation. It also offered recommendations on programmatic improvements, departmental authorities, standards and best practices and areas for additional research.
On the technology side, S&T recently funded a project to secure the entire app development lifecycle. Partners Red Hat and Kryptowire will develop a framework for automating security and privacy compliance by ensuring app code and third-party libraries comply with security standards through the development, deployment and maintenance processes.
Karygiannis, vice president of product at Kryptowire, said it is easy for app developers to fix vulnerabilities once they are made aware of issues. “We see large companies who don’t know what the acceptance criteria for apps in government are, so having an open, transparent standard is good.”
Cooperation among agencies on standards can also streamline the process.
If authentication becomes evidence based and agencies "can agree to the process and checkpoints … at the component level, then it doesn’t need to be checked again at headquarters and creates the idea of reciprocity,” Sritapan said.
Nevertheless, human guidance is still an important as part of the application authentication process, Sritapan said. “You still need to make our own risk-based decisions at the end of the day,” he said.