Mission Mobility - Changing How and Where Real Mission Work is Done

P U B L I C S E C T O R
S U M M I T
Washingt on, DC

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Mission Mobility - Changing How and
Where Real Mission Work is Done
2 9 5 4 6 5

Mission Mobility®
SUCCESS IN 60
© Copyright Monkton, Inc. All Rights Reserved.

4
Securely Extending Cloud to the Tactical Edge
AWS Cloud
AWS Lambda
Office based user community
Amazon S3
SSH Key bucket
AWS KMS key
Amazon S3
output bucket
Managers
Administrators
Finance/Budget
Analysts
Policy Makers
Technical Support
Developers
AWS Snowball Edge
AWS Device Farm
Amazon Comprehend
Amazon EC2
Amazon Managed
Blockchain
Amazon Kinesis
Field based user community
Tactical Operations
First Responders
Law Enforcement
Inspections
Audits
Assessments
HR/Recruiters
Maintenance
Logistics
Construction
Inventory
Asset Tracking
EMT/Telehealth
Physical Rehab
Training
Distance Learning
P U B L I C S E C TO R
S U M M I T

5
Case Study: BRICE USAF A4 Maintenance
MISSION:
CHALLENGES:
Flight Readiness
Manpower shortage for maintainers
Aircraft maintenance requires meticulous
records keeping in maintenance system
Aircraft maintenance work performed on flight
line
Access to maintenance system at PC terminal
hundreds of yards away from aircraft
Create a mobile app to access legacy
maintenance system on the flight line where
work is being performed
SOLUTION:
S U M M I T

66
 1st iOS DoD enterprise native mobile app assessed and compliant with DoD required NSA NIAP
 1st iOS DoD enterprise native mobile app integrated with DISA Purebred for mission use case
 1st USAF CCE DevOps/Cloud native project
 1st Successful implementation of mobile middleware in DoD Cloud SRG IL-4 environment
 1st DoD native mobile app permitted to connect to a DISA DECC mainframe system of record
 1st USAF enterprise mobile app validated by DISA DMUC and NSA CCTL against 2 NIAP PP
 1st DoD mobile project to go from RDTE OTA concept through formal SA&A to Production ATO
BRICE is a True Pathfinder Project
S U M M I T

7
BRICE Video
Insert Video Day of Presentation
S U M M I T

8
Prototype to Production
From
To
Idea Agile Prototype User Assessment Security Assessment
Mission Owner Developer Mission User CISO/AO ATO Mission Community
Idea
Agile Prototype
on Secure Platform User Assessment
Mission Owner Developer Mission User CISO/AO ATO Mission Community
S U M M I T

9
Identity and Authentication Mobile App Data in Transit Cloud Services
Policy and/or topic
area
NIST SP 800-63-3 Mobile app security
Bi-directional data transfer
to/from app
FedRAMP and
DoD CC SRG
Public Domain IAL 1 and AAL 1 OWASP and CWE TLS 1.2 DoD CC SRG IL-2
CUI IAL 2 and AAL 2
NIAP Application Software PP
Compliance
TLS 1.2 DoD CC SRG IL-4
NSS
IAL 2 and AAL 2 (min)
IAL 3 and AAL 3 (pref)
NIAP Application Software PP &
Extended Package for Software File
Encryption Validation
TLS 1.2 w/ CSfC approved
ciphers
DoD CC SRG IL-5
Classified IAL 3 and AAL 3
NIAP Application Software PP &
Extended Package for Software File
Encryption Validation
TLS 1.2 w/ CSfC approved
ciphers
DoD CC SRG IL-6
Pathway to Production for DoD Mobile Apps
S U M M I T

10
Vetting from Platform App Store, running on
NIAP Validated Device with Separation
Capabilities
DoD Components conduct vetting in
accordance with NIAP Reqs for for vetting
mobile apps from NIAP App Protection
Profile
NIAP Common Criteria Evaluation Lab
Validation in accordance with CNSSP-11
Unmanaged Apps:
Personal Use Only
(i.e. Weather, ESPN, Marriott)
Managed Apps:
Work, mission, accessing CUI content
online or offline. Both commercial and
GOTS
Managed Cybersecurity:
Primary purpose to provide security
functionality: VPN/Containers/VDI
DoD Mandated Compliance for Managed Apps
S U M M I T

11
Mobile Front End
(App + Device)
Wireless Connectivity
(Cellular)
Mobile Back End
(Middleware)
Legacy Mission Support System
(at Gov Data Center)
 Component: Apple iPads + iOS
native app
 Capability: FIPS 140-2, NIAP,
STIG, HERO, RMF, Modern UI,
Supported by APIs, Derived PKI,
Disconnected Ops
 Partners: Monkton, Apple, DoD
PKI Office (Purebred)
 Component: Verizon LTE
 Capability: ITCC, Segregated data,
authorized connections, physical
R2R connection with AWS
GovCloud facility
 Partners: Verizon, Monkton
 Component: AWS GovCloud +
Monkton Rebar
 Capability: FedRAMP, Cloud hosted
mobile middleware, app MDF /
micro services, connectivity to
device and back end system,
Derived PKI, Data Sync
 Partners: Monkton, Amazon
 Component: Legacy Database
 Capability: Information System, Data
connectivity services
 Partners: DISA CAP/TIC provider, AWS.
Akamai
First AF NIAP compliant native app
First use of commercial network to
commercial cloud architecture
First mobile middleware deployed
directly in GovCloud
First mobile app and architecture connecting /
transacting with legacy information system
Mobile Solution Architecture
S U M M I T

12
Monkton Rebar
• SDK for mobile iOS and Android mobile apps
• Server component provides authentication and authorization services
• Mobile developers focus on UI and business logic
• Inherit NSA NIAP security controls with consistency
NIAP Application Software Protection Profile
NIAP Extended Package for Software File Encryption
• Integrate PKI derived credentials easily
• Micro services connect to AWS GovCloud
• Extend Legacy systems to the tactical edge
Data at Rest Rebar Middleware
AWS Content
And Services
Data in Transit
Authentication
Authorization
User Interface
Business Logic
AWS Cloud Services
Legacy System
Data in TransitData at Rest
AuthorizationAuthentication
Microservices
S U M M I T

13
Mobile
Middleware
CCE Environment
Legacy System
Integration
BRICE
Rebar Hub
The intent of the BRICE-Rebar Hub
program was to demonstrate an Initial
Operating Capability of:
 One mobile app
 One mobile middleware
 One legacy system
The hard work has been done.
Mobile App
Cloud to the Edge
S U M M I T

14
Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep
BRICE
iOS App
EMAS
Mobile
Middleware
ATO
UAT 1
Design
Security Authorization & Accreditation
UAT 2 & 3
Development
CCE Production Readiness
IMDS Interface NetworkingDEV Config. ManagementTEST PROD
The Path to Production
S U M M I T

15
Apps Designed By Users For Users
User Design Lab
Three day app design workshop focused on functional end users (4-8 people)
● Day 1: Interview attendees to understand actual day-in-the-life of the end user
● Day 2: Iterative process to design app screens that enable the business process
● Day 3: Review high fidelity app design, optimize UI/UX, and modify final build
Functional workers’ input is key to successful BPR and optimized solution design
Agile design philosophies are utilized and favored over traditional waterfall approach
Key takeaways: Adoption and productivity derived from the app dramatically increases when
the actual end users are involved in the upfront design process.
S U M M I T

17
 Organizations involved in assessment and approval process
 USAF HAF A4P
 USAF ARFC A4
 USAF A6
 USAF AFRC A6
 AFLCMC/HIAM (BES PEO)
 DISA DMUC and DoD OCIO
 BRICE app assessed and validated by NSA Common Criteria Test Lab
 BRICE app assessed and validated by DISA DMUC
 Authority to Operate (ATO) for BRICE in September 2018
 Deployed to production users at DM AFB December 2018
BRICE ATO – UAT to ATO in <6 Months
S U M M I T

1818
• Greater “Time on Task”
• Maintainers reported 1+ hour of time savings per shift
• Greater accuracy of data entered directly into the
maintenance system vs transcribed paper notes.
• USAF contract $1.6M
• USAF reports $8500/per maintainer annual savings
USAF A4 Mission Value
S U M M I T

1919
Mission Mobility
A community of vendors
working together to deliver
a predictable, repeatable
process for enabling the
business of Government to
be conducted securely at
the tactical edge.
S U M M I T

20
It’s Not Just Where You Work, But How
With Mission Mobility, Agencies can now extend highly sensitive mission enabling content from the AWS Cloud to
the tactical edge and change HOW the organization better performs its day-to-day functions with modern processes
that permit users to:
ACCESS Sensitive Content
STORE Sensitive Content
CAPTURE Sensitive Content
PROCESS Sensitive Content
BI-DIRECTIONALLY TRANSMIT Sensitive Content
DIGITALLY SIGN WITH NON-REPUDIATION
S U M M I T

2121
Mobility Enables Better Processes
Change where and how job-tasks can be completed when sensitive Government
content is…
1
ACCESSED
yy2
CAPTURED
3
STORED
4
SENT
Accessed and
viewed at the
location where
users are
performing
their duties
Captured with a
mobile app
leveraging native
mobile OS
features (GPS,
camera,
biometrics,
sensors)
Stored safely
for low-
bandwidth,
disconnected
or offline
scenarios
Sent bi-
directionally to
enable real-time
query and
updating
of mission and
legacy systems
5
SIGNED
Use PKI (CAC/PIV)
derived
credentials to
digitally sign with
non-repudiation
S U M M I T

22
Mobile Device & OS
NIAP
MFA
NIST 800-63B
AAL2
Cloud Services
FedRAMP
DoD CC SRG IL-4
SA&A
NIAP Vetting
Vulnerability Scans
Carrier
4G/5G
Prioritization
Mobile App Dev
NIAP
User
Design Lab
MDM
FedRAMP
Mission Mobility Factory
S U M M I T

23
Common Mobility First Examples
Inventory Supply
Chain Asset
Management
HR, Recruiting,
and Training
Maintenance,
Logistics,
Operations
Inspections, Audits,
Assessment
Reporting
Medial, EMT,
Rehab, Tele-
health
Operations, First
Responder, Physical
Security, and Law
Enforcement
S U M M I T

2424
Run EC2 AMIs and deploy AWS Lambda code on Snowball Edge to run local processing
or analysis with machine learning or other applications. Applications can run directly on
the device as a consistent AWS environment without network connectivity.
Snowball Edge Architecture
S U M M I T

S U M M I T
S U M M I T

S U M M I T
Thank you!
S U M M I T

Mission Mobility - Changing How and Where Real Mission Work is Done

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Mission Mobility - Changing How and Where Real Mission Work is Done

Similar to Mission Mobility - Changing How and Where Real Mission Work is Done (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Mission Mobility - Changing How and Where Real Mission Work is Done