DISA has an app for smart-phone security

This article was updated at 8:35 a.m. Dec. 28 to correct a reference to the National Information Assurance Partnership.

The Defense Information Systems Agency has developed an application to give smart phone users a secure way to access DOD networks.

At a mobile security conference at the Willard Hotel today, Air Force Lt. Col. Anmy Torres of the Defense Information Systems Agency outlined DOD's mobile security initiative, and the app, called Go Mobile.

Torres, director of Defense Knowledge Online working with DISA and the Army Program Executive Office for Enterprise Information Systems, said Go Mobile app works by securing information in a smart phone in a container -- often called a “sandbox -- separate from the rest of the features on the device.

It uses a plug-in, called a dongle, to connect via Bluetooth to a Common Access Card (CAC) and uses a personal identification number to ensure the physical security of the phone. When Go Mobile is active, it disables other features in the phone to secure data storage and provide safe transfer. The app enables DOD security policy management, enforcement and compliance while providing a secure web browser and a secure apps container.

Torres compared Go Mobile to a fortress in the Wild West that is the state of mobile security. It functions as a secure container that can access enterprise e-mail, calendars, contacts, Global Address List and soon secure websites.

Related stories:

Why can't I check email from my iPhone?

The weaknesses in WiMax and what you can do about them

Other security features of the Go Mobile app are remote wipe capabilities in case the device is lost or stolen. If the device is jail broken, a process of routing the operating system of the phone, Go Mobile will render any encrypted data within the application useless.

“The challenge with Go Mobile is not security or lack of it but meeting Department of Defense security standards,” Torres said.

Getting a mobile device cleared by DOD is no easy task. The certification process can take upwards of seven months, from scheduling to testing and evaluation before being added to the Unified Capabilities Approved Products List. It needs to go through CAC integration, and have various certifications including Federal Information Processing Standards 140-2 and National Information Assurance Partnership's Common Criteria. It also has to go through DISA’s Security Technical Implementation Guide.

According to Torres, Windows Mobile platform 6.1 has gone through the certification process and 11 Windows Mobile version 6.5 phones are wrapping up certification by January. According to tracking firm The Nielsen Company the Windows Mobile operating system has 14 percent of the U.S. smart phone market as of October and has been losing ground to both Google’s Android and Apple’s iOS operating systems monthly. Hence, Torres acknowledged the need of DISA and DOD to certify phones that their employees want and enable them to use Go Mobile.

Along those lines, certification for iOS should be done by the end of January, according to Torres. Where the process runs into a problem is with Android operating system because of the fractured nature of the environment. Many different carriers make Android devices and not all of them are running the same iteration of Android, with some still running versions as old as 1.6 (Donut) and new phones such as the forthcoming Samsung Nexus S that runs version 2.3 (Gingerbread). Torres said that they have been working directly with manufacturers to ensure that the phones are up to DOD standards. Torres also said that operating systems’ Applications Programming Interface (API) needs to meet the specified requirements.

“If your device meets specificity requirements, it goes on the list,” Torres said.

The first round of certification for Android 2.x phones should be done by late April or May, Torres said.

The problem that DISA and DOD face, along with many government agencies, are that smart phones are targeted almost entirely at the consumer market. That creates a security problem because manufacturers are not “baking in” security protocols as standard features.

“It is unconscionable why Google or Apple won’t open up their API for a condition of national security,” Jon Olstik, senior principal analyst at Enterprise Strategy Group, said.

Yet, as smart phones evolve they are becoming increasingly susceptible to threats such as malware, spyware, key-logging, phishing and other forms of malicious activity that IT departments have become very familiar with over the last decade when dealing with personal computers.

“Mobile devices are mobile computers. Are they treated the same way?” Daniel Hoffman, Chief Mobile Security Evangelist at Juniper Networks, said. “Limiting functionality does not work anymore.”

The point Hoffman was making as was echoed by several others at the mobile security event is that federal employees want the newest technology and want it to work to its full potential. At the same time, cognizance of mobile threats is not as ubiquitous as it could be and there is a fear that a major data breach such as the Veterans Affairs Department stolen laptop incident from 2006 will have to happen before people wake up to the need for stout mobile security.

Go Mobile, which was designed by Good Technologies, is an attempt by DOD to allow end-user employees to use desired smart phones in a secure way, but the initiative is still in its infancy. App developers still do not have a thorough guideline for app certification processes which makes app development a slower process. There have been initiatives such as the Apps For Army development challenge along with the Connecting Soldiers to Digital Applications and Mobile Device Application Development Services programs that are working on secure apps but it is still an “immature market,” according to Torres.