Back to news

July 5, 2018 | International, C4ISR

THE DOD’S APP STORE DOES THIS ONE CRUCIAL THING TO STAY SECURE

Lily Hay Newman

EVERY DAY, COMPANIES like Google and Apple wage a constant battle to keep malicious apps out of their marketplaces and off people's phones. And while they do catch a lot of malware before it does any damage, there are always a few nasty infiltrators that manage to sneak by and end up getting downloaded by thousands of consumers. No one wants these mistakes to happen, but when you're a crucial app store for the Department of Defense, these mistakes can't happen.

That was the problem facing the National Geospatial-Intelligence Agency as it set about creating a flexible yet ultrasecure app store in 2012. NGA is a combat support organization that primarily assesses and distributes geospatial intelligence. The agency wanted to provide sensitive and mission-critical apps to groups across the DOD through a platform that had the security and resilience of a government defense product, while also offering a streamlined, up-to-date user experience similar to ubiquitous commercial app stores.

"We recognized that we did not know everything when it came to apps, and we wanted to be using the innovation that was happening in the commercial sector," says Joedy Saffel, division chief and source director of NGA who has worked on the GEOINT App Store from the beginning. "But how do we do that in a safe, secure manner? How do we do that from a contractual perspective? And how do we do that in a way that nontraditional vendors will trust doing business with the government? It was a great challenge."

The key, Saffel says, is getting developers to agree to hand over the source code of their apps for in-depth analysis and review. Whether an app is a simple time/speed/distance calculator for a pilot or a hyper-specialized classified tool, sharing source code is a big risk for developers, because it means trusting third parties with the core intellectual property they have built their businesses on. But NGA soon realized that full access was the only way its project could work.

So NGA's GEOINT App Store runs its security protections and screening processes in a way a commercial platform never could.

Need To Know

You can browse through the GEOINT App Store yourself today and see many of the mapping, aeronautical, weather-forecasting, location-sharing, and travel-alert services that it hosts for Android, iOS, desktop, and web. But that's just the public unclassified section—one crucial aspect of designing the platform was building segmentation controls so DOD employees with different levels of clearance, or simply different needs, could have gated access to different apps.

"We built the App Store to be a completely unclassified environment that's open to the public," says Ben Foster, a technical director at NGA who is the product manager for the app store. "But it also has identity management that uses a federated approach to authentication. It's even flexible enough to integrate with other identity-management platforms across DOD. If a user is a helicopter pilot, they might see and get different apps then someone who is a tactical operator in the Army."

This system also works with the platform's pricing variations: Some apps are free to everyone, some downloads come with a fee that needs to be taken out of a particular department's budget, and some apps are licensed by NGA or another agency.

The most radical part of the GEOINT App Store from a government perspective is the speed with which NGA can process apps and get them live in the store. In general, government acquisition processes take many months or years, a clear problem when it comes to constantly evolving software. So NGA worked with its chief information officer, IT Directorate, legal team, international affairs division, and contracting office to establish a streamlined app-vetting process that would be acceptable under federal acquisition regulations. The agency also contracted with a private firm called Engility to directly manage the outreach, acquisition, and development environment for customizing prospective apps to NGA's requirements. The process, known as the Innovative GEOINT Application Provider Program, or IGAPP, minimizes bureaucratic hurdles and guides developers who want to submit an app through a pipeline that vets, modifies, and generally grooms apps for NGA's store.

"What we focused on early on was providing tools so developers can bring their app and do a lot of the pre-testing and development with Engility," NGA's Saffel says. "We're able to be flexible with that because it's being done outside of the government footprint in a brokered environment. And then NGA has a governance board that meets every week, and the whole process has matured enough that by the time an app comes to NGA, we can review it and get that application into the app store and exposed within two weeks' time."

Though the process might be even faster if NGA only did the minimum vetting required, Saffel says that the GEOINT team worked to find a balance where the apps go live quickly, but there's still time for the automated code analyses and human audits that commercial app stores can't do.

Check It Out

After a developer submits their app, Engility does extensive source code analysis and vulnerability scanning and produces an initial findings report. John Holcomb, the IGAPP program manager from Engility, notes that an initial vulnerability report can have as many as 1,000 items on it that a developer needs to address. "It's a little intimidating at first," Holcomb says. "But we walk them through it, and they go back and modify their code—it's their code, we don't modify it for them. We might go through four runs of that on a brand-new app, but by the time we're done, they will have remediated their code down to the level that the government needs. There are still going to be bureaucratic hurdles, but it's our job to break through those."

In addition to digging deep into source code, IGAPP also tests how apps function in practice, to make sure that there aren't benign-looking aspects of the code that actually underlie a shady function. "We take the compiled application and we watch what it does," Holcomb says. "Who does it phone home to? Is it sending private information unencrypted?"

After an app gets approved for inclusion in the GEOINT App Store, developers continue to work with IGAPP on developing and vetting software updates so that patches and improvements can be pushed out quickly.

The brokered vetting process means that the government never holds developers' source code directly. The inspection is always mediated by Engility, which signs nondisclosure agreements with developers and isn't a software maker itself. Holcomb says that the company carefully guards app data while storing it, and once a project is done, Engility doesn't just do a soft data deletion; it hard-purges the information from its cloud servers within 30 days. NGA's Saffel and Holcomb both note that developers were apprehensive about the unusual workflow at first, but over the years the app store has gained credibility.

Developers say they benefit from the IGAPP process both by securing lucrative government contracts and by integrating the improvements from the IGAPP development into their commercial products. The code audits and security vetting IGAPP offers are expensive, so developers generally don't do such extensive assessment on their own.

"Everyone's dream is to sell to the government, but it normally takes years of effort to get to a position where you can. In our case, I was able to sell to the government in less than a month," says Bill DeWeese, CEO of the firm Aviation Mobile Apps, which has had six apps accepted into the GEOINT App Store. "You do feel a little anxiety about sharing source code, you worry about your IP leaking and someone getting ahold of it. But I haven't had any issues, and the benefit is the increased quality of your products at no cost—you get the analysis for free and you can put it in your commercial offerings."

NGA's Saffel says the governance board that evaluates the apps at the end of the process is careful to stay vigilant so nothing goes into the store by accident. The board will still push back on apps or turn them away when warranted, but Saffel says the process has matured such that most of what the board sees these days is ready or very near ready to go live. And IGAPP prioritizes its patching process and infrastructure, to make it easy for developers to push bug fixes and improvements throughout the life of an app. All of this means a consumer-grade turnaround time for critical Department of Defense tools without the consumer-grade security concerns.

"NGA is kind of a unique combat-support agency," Saffel says. "With the GEOINT App Store we chose to go into a very risky new frontier for DOD and the government in general, but I think we've demonstrated that we can do things differently and still be secure and still control access. We're supporting a lot of different mission sets, and I expect that the app store will keep growing."

https://www.wired.com/story/dod-app-store-does-this-one-crucial-thing-to-stay-secure/

On the same subject

  • CACI Awarded $1.5 Billion Contract to Provide Transport and Cybersecurity Services to National Geospatial-Intelligence Agency

    June 5, 2020 | International, Aerospace, C4ISR

    CACI Awarded $1.5 Billion Contract to Provide Transport and Cybersecurity Services to National Geospatial-Intelligence Agency

    June 4, 2020 - CACI International Inc (NYSE: CACI) announced today that it has been awarded its largest contract in company history, a single-award Indefinite Delivery Indefinite Quantity (IDIQ) contract to provide transport and cybersecurity services to the National Geospatial-Intelligence Agency (NGA). The single award IDIQ has a base period of five years plus five 1-year award term periods with a ceiling of $1.5 billion. Under the contract, CACI will provide enterprise Information Technology (IT) services to NGA and its mission partners. Specifically, CACI network and cybersecurity experts, located at NGA's headquarters and facilities in Springfield, VA, St. Louis, MO, and around the globe, will help design, engineer, procure, implement, operate, sustain, and enhance NGA networks and cybersecurity posture. The contract encompasses a significant expansion of CACI's continuing business with the NGA. CACI will also help NGA create efficiencies by making available an expansive service and material catalog to the agency that streamlines the acquisition of IT services from weeks to days for streamlined customer support. John Mengucci, CACI President and Chief Executive Officer, said, “This record award demonstrates CACI is delivering on its strategy to win larger, more enduring contracts. It also represents our steadfast commitment to protecting and defending our nation's networks so the NGA can deliver mission-critical geospatial intelligence to the warfighter around the globe.” CACI Executive Chairman and Chairman of the Board Dr. J.P. (Jack) London, said, “CACI is proud to support the NGA's mission of collecting, analyzing, and distributing geospatial intelligence in support of national security. Our work will always reflect CACI's culture of character, ethics, and integrity.” CACI's 23,000 talented employees are vigilant in providing the unique expertise and distinctive technology that address our customers' greatest enterprise and mission challenges. Our culture of good character, innovation, and excellence drives our success and earns us recognition as a Fortune World's Most Admired Company. As a member of the Fortune 1000 Largest Companies, the Russell 1000 Index, and the S&P MidCap 400 Index, we consistently deliver strong shareholder value. Visit us at www.caci.com. There are statements made herein which do not address historical facts, and therefore could be interpreted to be forward-looking statements as that term is defined in the Private Securities Litigation Reform Act of 1995. Such statements are subject to factors that could cause actual results to differ materially from anticipated results. The factors that could cause actual results to differ materially from those anticipated include, but are not limited to, the risk factors set forth in CACI's Annual Report on Form 10-K for the fiscal year ended June 30, 2019, and other such filings that CACI makes with the Securities and Exchange Commission from time to time. Any forward-looking statements should not be unduly relied upon and only speak as of the date hereof. CACI-Contract Award View source version on businesswire.com: https://www.businesswire.com/news/home/20200604005132/en/

  • Turkish, Indonesian firms team up on medium-weight tank

    May 7, 2019 | International, Land

    Turkish, Indonesian firms team up on medium-weight tank

    By: Burak Ege Bekdil ANKARA, Turkey — Turkish armored-vehicles manufacturer FNSS and its Indonesian partner PT Pindad have signed a contract to co-produce scores of medium-weight, new-generation battle tanks for the Indonesian army. The deal was signed during this year's IDEF defense and aerospace show in Istanbul Apr. 30-May 3. The companies will initially produce a batch of 18 Kaplan MT tanks within two years. The second stage of the contract involves mass production of the Kaplan MT. FNSS and PT Pindad have designed, developed and built two prototypes of the Kaplan MT under a 2015 deal. The prototypes have passed field tests in Turkey and Indonesia and were certified by the Indonesian military. The deal is part of a defense industry cooperation agreement between Turkey and Indonesia. The first prototype of the Kaplan MT tank was exhibited during IDEF'17. The tank was showcased in Indonesia during a military parade on National Armed Forces Day in October. The Kaplan MT is equipped with a battlefield management system, a wireless crew intercom system, a navigation system and an automatic fire extinguishing system. The tank is fitted with a CMI Cockerill 3105 turret mounting a Cockerill 105 mm high-pressure gun. The lightweight gun features an advanced autoloader to deliver rapid fire. The 105 mm gun can fire NATO-standard ammunition and can engage targets at a maximum distance of 10 km. The secondary weapon system includes a 7.62 mm coaxial machine gun mounted to the left side of the main gun. The Kaplan MT is powered by a new-generation diesel engine coupled to a fully automatic electronic-controlled transmission. The fuel is supplied from two separate fuel tanks. The tank has a maximum road speed of 70 km/h and a minimum operating range of 450 km. It can negotiate a gradient and side slopes of 60 percent and 30 percent, respectively. It can climb a vertical obstacle of 90 cm and can cross a trench of two meters. https://www.defensenews.com/global/2019/05/06/turkish-indonesian-firms-team-up-on-medium-weight-tank

  • Raytheon awarded additional $386M for foreign Paveway bomb buys

    November 22, 2019 | International, Aerospace

    Raytheon awarded additional $386M for foreign Paveway bomb buys

    ByChristen McCurdy Nov. 21 (UPI) -- Raytheon has been awarded a new contract to produce the Paveway Family of Weapons, kits that turn "dumb" bombs in the precision guided bombs, for allied militaries. The $386 million contract, announced Wednesday by the Department of Defense, covers "Paveway-specific activities," including studies, production, certification, integration and sustainment, referred to as a total package approach. Paveway bombs, really kits that convert "dumb" bombs into precision weapons, can use either GPS or laser guidance, increasing both accuracy and flexibility of existing munitions. According to Raytheon, Paveways have made up a significant number of air-to-ground precision-guided weapons used in recent years in Middle East missions, including Operation Iraqi Freedom, Operation Enduring Freedom and Unified Protector. The new contract is a modification to a previous one, increasing the ceiling of the previous contract, awarded in August 2018, from $110 million to $496 million. This modification involves 100 percent military sales to countries that have either contracted to acquire or expressed interest in acquiring Paveway weapons, and is funded entirely by foreign military sales funds, the Pentagon said. Work will be performed at Raytheon's Tucson site and at Air Force test ranges. https://www.upi.com/Defense-News/2019/11/21/Raytheon-awarded-additional-386M-for-foreign-Paveway-bomb-buys/2241574294851/

All news