Navy tests telework tool for reserves

Telework typically isn’t an issue for military personnel, who work on bases where access to resources such as the Navy Marine Corps Intranet is available.

“The Navy uses the NMCI, network and resources to meet its mission,” said Lt. Cmdr. Michael Leachman, force information assurance manager in Norfolk, Va. “Full-time personnel have everyday access.”

But Reserve forces not on active duty don’t have access to Defense Department networks most of the time. “We are part of the Navy,” said Capt. Matthew Ragan, chief technology officer of the Navy Reserve Forces Command in Norfolk. “We have the same training requirements” but often without the same level of access.

Reservists have access to the NMCI network during their monthly drill weekends, but during the rest of the time, they need to rely on more limited remote access.

Related stories:

Big telework savings trumps butts in the seats

Satellites come to the rescue when ground systems fail

For continuity, build telework into operations

To enable NMCI access, the Navy provides Common Access Card readers for desktop PCs, and some personnel receive BlackBerrys or laptops with CAC readers and virtual private network clients. But those mobile devices do not provide the flexibility and security that personnel would like, and the Navy is beginning a pilot program to provide portable NMCI access through a CAC-enabled USB authentication device.

The MobiKey Fusion user device from Route1, of Toronto, will let reservists authenticate through the Defense Identity Management Network (Defimnet), a service delivery platform that Route1 developed. It resides inside the DOD perimeter to establish a secure connection and access a virtual desktop to conduct business. If successful, the program would help eliminate the concern of an endpoint's trustworthiness without issuing secure hardware to users.

“Access is cheaper than assets,” Ragan said. “We’re trying to move to an access model.”

DOD announced the Defimnet pilot program in March with Route1 and Hewlett-Packard Enterprise Services, which was awarded a contract in August to oversee the transition of NMCI to its next generation.

The MobiKey Fusion USB device can be used with government-standard smart identification cards, including DOD’s CAC and its civilian government counterpart, the Personal Identify Verification card. The Navy Fleet and Industrial Supply Center procured 400 of the MobiKey devices in May, along with TruOffice subscriptions to provide remote desktop access for the program.

The Navy's policy is to provide a CAC reader for home computers to all reservists who want one, Ragan said.

“They can get all the business done that they need to get done” with it, including using e-mail, sharing data and uploading information, he said. Although the reader can provide strong authentication using digital certificates loaded onto the CAC, it does not secure the connection, which could expose NMCI to malware or other threats on an untrusted device. In addition, the reader cannot ensure the security of data on the remote computer and is not portable.

Defimnet is not the first effort to enable secure, portable remote access to DOD resources. The Air Force Research Laboratory’s Software Protection Initiative has produced Lightweight Portable Security, a tool created in-house that essentially creates trusted endpoints for remote access. It is a bootable CD developed with open-source software that works with most Windows, Mac or Linux computers to create a nonpersistent trusted node for secure Web browsing, cloud computing or network access. It boots a Linux operating system from a LiveCD and installs nothing on the client computer, running only in RAM to bypass local malware and leave no record of the session.

The LPS-Public edition is small, with a 124M image that can fit on a mini-CD. It is available to government and public users as a free download and is intended to be used for casual telework and on untrusted systems needed for sensitive tasks. It also can be used to access CAC-enabled websites. The government-specific LPS-Remote Access creates a virtual government-furnished equipment node on a private computer and is available for all federal agencies and contractors. It was developed in 2009 to provide a telework tool for continuity of operations in anticipation of a possible flu pandemic.

Approved by DOD's CIO in December 2009 for continuity of operations, LPS-Remote Access has since been adopted by more than 30 DOD organizations with more than 58,000 employees. More than 35,500 copies of LPS-Public have been downloaded from the Software Protection Initiative website since 2008.

There were no adequate commercial solutions for secure, portable remote access when the Air Force began working on LPS, but tools such as MobiKey have since appeared on the market. Although the Navy pilot program is one of the first uses of MobiKey Fusion, which is specifically enabled for CAC and PIV cards, one of the reasons it was chosen for the test is that MobiKey has a proven track record, Ragan said.

“The reason we are confident is because other agencies are using it,” he said.

The MobiKey Fusion is preconfigured with users' CAC data and personal identification numbers. After authentication, users have a list of options based on their access profile. “Once they are authenticated, the user experience is identical to sitting in front of a computer on the network,” said Brian Brunetti, Route1’s chief operating officer.

The connection is secured with a FIPS 140-2 certified cryptographic module that uses the 256-bit Advanced Encryption Standard. Because users access a virtual desktop, they don't download data.

“Any data on the NMCI network never leaves that network,” Brunetti said. “What the user is seeing on the screen is encrypted screen shots.” The only data going from the remote computer is encrypted keystrokes and mouse clicks, and the only data coming back is encrypted screen shots.

That protects data, leaves no record on a remote computer and protects NMCI from malware on the remote computer.

“It’s very government-oriented,” Brunetti said of the system. “Most of our traction is coming from government.”

The Defimnet test began in September with a proof of concept involving 20 MobiKey users, mostly technical experts in the Washington and Norfolk areas, to make sure that the devices work as advertised. A broader, 400-person test that is expected to last about 60 days will follow, Ragan said.

Before the program started, about 1,600 people signed up on a website to take part. Ragan said the pilot program will be as diverse as possible across the Reserve force.

“We are going to slice the applicants by region and then slice the regional distributions by pay grade,” he said.

If the program works as hoped, MobiKey access could be added as a new service to NMCI, although plans do not call for the device to replace CAC readers, which will remain available.

The Navy’s goal is to enable access anytime, anywhere, from any device, Ragan said. But that is unlikely to be achieved soon.

“Although MobiKey is a step toward that, it is not the final step,” he said.