NSA Presentation on Csfc
Total Page:16
File Type:pdf, Size:1020Kb
An Architecture for Agile Systems Engineering of Secure Commercial-off-the-Shelf Mobile Communications by Jamieson W. Gump BS in Electrical Engineering, May 1984, University of Vermont MS in Engineering Management, October 1990, Western New England University A Dissertation submitted to The Faculty of The School of Engineering and Applied Science of The George Washington University in partial satisfaction of the requirements for the degree of Doctor of Philosophy May 21, 2017 Dissertation directed by Shahram Sarkani Professor of Engineering Management & Systems Engineering Thomas A. Mazzuchi Professor of Engineering Management & Systems Engineering The School of Engineering and Applied Science of The George Washington University certifies that Jamieson Wesley Gump has passed the Final Examination for the degree of Doctor of Philosophy as of March 17, 2017. This is the final and approved form of the dissertation. An Architecture for Agile Systems Engineering of Secure Commercial-off-the-Shelf Mobile Communications Jamieson Wesley Gump Dissertation Research Committee: Shahram Sarkani, Professor of Engineering Management & Systems Engineering, Dissertation Co-Director Thomas Mazzuchi, Professor of Engineering Management & Systems Engineering, Dissertation Co-Director E. Lile Murphree, Professor Emeritus of Engineering Management and Systems Engineering, Committee Member Bill A. Olson, Professorial Lecturer in Engineering Management and System Engineering, Committee Member Paul L. Blessner, Professorial Lecturer in Engineering Management and Systems Engineering, Committee Member ii © Copyright 2017 by Jamieson Wesley Gump All rights reserved iii Dedication This dissertation is dedicated to my patient and outrageously loving and supportive wife, Cheryl (Colburn) Gump. iv Acknowledgements I would like to thank all the folks who helped me through this process. I would like to thank my advisors for providing expert advice and for their encouragement and humor. Dr. Shahram Sarkani and Dr. Thomas Mazzuchi were expert advisors and helped dozens of students through the process with compassion and wisdom. For my colleagues at the Johns Hopkins University Applied Physics Laboratory (JHU/APL) who work in this field with me and assisted with case study write-ups to assist in the refining of my architecture. They are in the trenches with me working on secure mobile for our critical U.S. Government users and have helped realize the vision that the National Security Agency provided within the CSfC program. I want to thank NSA: their vision and direction provided a foundation for this architecture framework. I want to thank the folks that completed the case study questionnaires. These systems engineers are all senior folks working on challenges projects for national defense. I would like to thank the attendees at NDIA Systems Engineering Conference and the anonymous reviewers at the INCOSE Systems Engineering Journal for recommendations on my journal article. Finally, I would like to thank the members of my George Washington University Engineering Management and Systems Engineering (GWU EMSE) cohort for sharing lessons learned, strategies, and camaraderie through the process. In particular, my cohort included colleagues at JHU APL, Matt Montoya, and Alan Ravitz. They went above and beyond to share their thoughts during the process. v Abstract An Architecture for Agile Systems Engineering of Secure Commercial-off-the-Shelf Mobile Communications The United States (U.S.) Federal Government has long had a need for highly secure communications. The National Security Agency (NSA) is responsible for the wide range of technologies to secure these communications. They realized, recently, that the development times for U.S. Government encryption technology was not keeping pace with the rapid evolution of commercial mobile technologies coupled with a realization that commercial technologies exist to meet the requirements for the U. S. federal Government. Specifically, NSA has published specifications on their website to operationalize these capabilities. Commercial Solutions for Classified (CSfC), the NSA term for Commercial Off-the-Shelf (COTS) secure communications, coupled with published capability packages allows a developer to rapidly field a secure communications solution built entirely on COTS technology. The end user is presented with the latest in mobile communications technologies with the software security applied after market. The first users of this technology are within the Department of Defense (DoD); other agencies are anticipated to field capabilities as well. No architecture exists to aid in the development of these capabilities, and research is required to develop an overarching architecture to support these emerging capabilities. This architecture will address the rapidly evolving commercial mobile security market and address fully leveraging commercial technologies to field the latest technologies in the shortest amount of time and at the lowest cost. With the encryption built on software (vice hardware), Agile Engineering techniques can be readily applied. Although developed in the U.S) for viii the U.S. Federal Government, this approach has been adopted by other governments and is anticipated to be adopted by commercial users for enhanced security. With the NSA move to commercial technologies and the commercial market moving to enhanced security for “standard commercial users,” there is an emerging convergence of these two approaches. An architectural construct to support this growing user base is the focus of this research. The method to be employed is to survey the wide range of implementations currently being fielded using a case study methodology, developing an effective overarching architectural contract, and returning to the Subject Matter Experts (SMEs) across this community to validate the architecture. The utility of the architecture will be rooted in the ability to aid the full range of customers; from mobile phone solutions, to secure laptops, and fixed communications at remote sites. The initial work has revealed effective architectural constructs to support the wide range of emerging applications of this promising approach from NSA – commercial solutions for classified. Note: A shorter version of this work was accepted for publication as a journal article in Systems Engineering. (Gump, Mazzuchi, & Sarkani, 2017) and as a journal article in Journal of Enterprise Architecture (Gump, Mazzuchi, & Sarkani, 2017). ix Table of Contents Dedication ......................................................................................................................... iv Acknowledgements ............................................................................................................v Abstract ........................................................................................................................... viii List of Figures ................................................................................................................. xiii List of Tables ....................................................................................................................xv Chapter 1 - Introduction ...................................................................................................1 1.1 Research Problem .................................................................................................................. 1 1.2 Research Overview ................................................................................................................ 2 1.3 Overview of Dissertation ....................................................................................................... 3 Chapter 2 - Literature Review ..........................................................................................5 2.1 Mobility Introduction ............................................................................................................ 6 2.2 Introduction to Threats to Mobile Technology ..................................................................... 8 2.3 Mobile Enabling Technologies ............................................................................................... 9 2.3.1 Wireless .......................................................................................................................... 9 2.3.2 Commercial LTE and Vulnerabilities ............................................................................. 11 2.3.3 Public Key Infrastructure (PKI) ...................................................................................... 12 2.3.4 VOIP Secure Calls .......................................................................................................... 12 2.3.5 Networking ................................................................................................................... 13 2.3.6 Mobile and Cloud Services ........................................................................................... 13 2.3.7 Smart Grid..................................................................................................................... 15 2.3.8 Near Field Capabilities (NFC) ........................................................................................ 15 2.3.9 Virtual Private Networking (VPN) ................................................................................. 16 2.3.10 Mobile Applications .................................................................................................... 16 2.3.11 U.S. Government