Navy tests telework tool for reserves

A CAC-enabled mobile access device could provide secure remote connections from any computer to resources inside the Navy network for Reserve personnel not on active duty.

Telework typically isn’t an issue for military personnel, who work on bases where access to resources such as the Navy Marine Corps Intranet is available.

“The Navy uses the NMCI, network and resources to meet its mission,” said Lt. Cmdr. Michael Leachman, force information assurance manager in Norfolk, Va. “Full-time personnel have everyday access.”

But Reserve forces not on active duty don’t have access to Defense Department networks most of the time. “We are part of the Navy,” said Capt. Matthew Ragan, chief technology officer of the Navy Reserve Forces Command in Norfolk. “We have the same training requirements” but often without the same level of access.

Reservists have access to the NMCI network during their monthly drill weekends, but during the rest of the time, they need to rely on more limited remote access.


Related stories:

Big telework savings trumps butts in the seats

Satellites come to the rescue when ground systems fail

For continuity, build telework into operations


To enable NMCI access, the Navy provides Common Access Card readers for desktop PCs, and some personnel receive BlackBerrys or laptops with CAC readers and virtual private network clients. But those mobile devices do not provide the flexibility and security that personnel would like, and the Navy is beginning a pilot program to provide portable NMCI access through a CAC-enabled USB authentication device.

The MobiKey Fusion user device from Route1, of Toronto, will let reservists authenticate through the Defense Identity Management Network (Defimnet), a service delivery platform that Route1 developed. It resides inside the DOD perimeter to establish a secure connection and access a virtual desktop to conduct business. If successful, the program would help eliminate the concern of an endpoint's trustworthiness without issuing secure hardware to users.

“Access is cheaper than assets,” Ragan said. “We’re trying to move to an access model.”

DOD announced the Defimnet pilot program in March with Route1 and Hewlett-Packard Enterprise Services, which was awarded a contract in August to oversee the transition of NMCI to its next generation.

The MobiKey Fusion USB device can be used with government-standard smart identification cards, including DOD’s CAC and its civilian government counterpart, the Personal Identify Verification card. The Navy Fleet and Industrial Supply Center procured 400 of the MobiKey devices in May, along with TruOffice subscriptions to provide remote desktop access for the program.

The Navy's policy is to provide a CAC reader for home computers to all reservists who want one, Ragan said.

“They can get all the business done that they need to get done” with it, including using e-mail, sharing data and uploading information, he said. Although the reader can provide strong authentication using digital certificates loaded onto the CAC, it does not secure the connection, which could expose NMCI to malware or other threats on an untrusted device. In addition, the reader cannot ensure the security of data on the remote computer and is not portable.

Defimnet is not the first effort to enable secure, portable remote access to DOD resources. The Air Force Research Laboratory’s Software Protection Initiative has produced Lightweight Portable Security, a tool created in-house that essentially creates trusted endpoints for remote access. It is a bootable CD developed with open-source software that works with most Windows, Mac or Linux computers to create a nonpersistent trusted node for secure Web browsing, cloud computing or network access. It boots a Linux operating system from a LiveCD and installs nothing on the client computer, running only in RAM to bypass local malware and leave no record of the session.

The LPS-Public edition is small, with a 124M image that can fit on a mini-CD. It is available to government and public users as a free download and is intended to be used for casual telework and on untrusted systems needed for sensitive tasks. It also can be used to access CAC-enabled websites. The government-specific LPS-Remote Access creates a virtual government-furnished equipment node on a private computer and is available for all federal agencies and contractors. It was developed in 2009 to provide a telework tool for continuity of operations in anticipation of a possible flu pandemic.

Approved by DOD's CIO in December 2009 for continuity of operations, LPS-Remote Access has since been adopted by more than 30 DOD organizations with more than 58,000 employees. More than 35,500 copies of LPS-Public have been downloaded from the Software Protection Initiative website since 2008.

There were no adequate commercial solutions for secure, portable remote access when the Air Force began working on LPS, but tools such as MobiKey have since appeared on the market. Although the Navy pilot program is one of the first uses of MobiKey Fusion, which is specifically enabled for CAC and PIV cards, one of the reasons it was chosen for the test is that MobiKey has a proven track record, Ragan said.

“The reason we are confident is because other agencies are using it,” he said.

The MobiKey Fusion is preconfigured with users' CAC data and personal identification numbers. After authentication, users have a list of options based on their access profile. “Once they are authenticated, the user experience is identical to sitting in front of a computer on the network,” said Brian Brunetti, Route1’s chief operating officer.

The connection is secured with a FIPS 140-2 certified cryptographic module that uses the 256-bit Advanced Encryption Standard. Because users access a virtual desktop, they don't download data.

“Any data on the NMCI network never leaves that network,” Brunetti said. “What the user is seeing on the screen is encrypted screen shots.” The only data going from the remote computer is encrypted keystrokes and mouse clicks, and the only data coming back is encrypted screen shots.

That protects data, leaves no record on a remote computer and protects NMCI from malware on the remote computer.

“It’s very government-oriented,” Brunetti said of the system. “Most of our traction is coming from government.”

The Defimnet test began in September with a proof of concept involving 20 MobiKey users, mostly technical experts in the Washington and Norfolk areas, to make sure that the devices work as advertised. A broader, 400-person test that is expected to last about 60 days will follow, Ragan said.

Before the program started, about 1,600 people signed up on a website to take part. Ragan said the pilot program will be as diverse as possible across the Reserve force.

“We are going to slice the applicants by region and then slice the regional distributions by pay grade,” he said.

If the program works as hoped, MobiKey access could be added as a new service to NMCI, although plans do not call for the device to replace CAC readers, which will remain available.

The Navy’s goal is to enable access anytime, anywhere, from any device, Ragan said. But that is unlikely to be achieved soon.

“Although MobiKey is a step toward that, it is not the final step,” he said.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.