Is Android secure enough for mission-critical government and military use? (Exclusive video)

By | October 31, 2011, 9:56pm PDT

Summary: ZDNet Government’s David Gewirtz takes a deep dive into military and government Android security with Dell’s top Android security expert.

A few weeks ago, I published an article entitled Making Android secure enough for secure government work.

In it, I recounted some scary stories about government smartphone usage, and then explored some (very smart) work being done to make Android-based smartphones secure enough for government work.

The nice folks at Dell, who are working on this project, reached out to me and I had the opportunity to sit down with Neal Foster, Dell’s Executive Director of Mobility Solutions Development for a deep dive into Android security, government smartphone usage, and some insider secrets about how to harden Android for military use.

Here’s that discussion. It’s absolutely fascinating. Before you watch it, I’d like to send a shout-out of thanks to both Neal and his associate Scott Radcliffe, who were both incredibly helpful, patient, and tolerant as we got the bugs worked out of our second-ever Skype Studio interview.

And now, here’s Neal and Android security.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

David Gewirtz, Distinguished Lecturer at CBS Interactive, is an author, U.S. policy advisor, and computer scientist. He is featured in The History Channel special The President's Book of Secrets.

Disclosure

David Gewirtz

At various times during his adult life, David has voted for both Democrats and Republicans, and has been disappointed by both. He is deeply disturbed by how partisanship has come before patriotism in America, which gives him the freedom to pick on both sides.

David is a frequent guest on TV and radio stations across America and can usually be heard or seen on-the-air at least once a week. He writes weekly commentary and analysis for CNN’s Anderson Cooper 360 and has been interviewed by Fox News, CNN, various ABC and NBC affiliates, and Canada’s Global TV. He has been a featured guest on National Public Radio and has also been featured on Voice of America, Radio Free Europe, and Radio Liberty where his commentaries on technology, industry, and emerging nations have been broadcast into 46 countries (all in their own unique translations).

David is the executive director of U.S. Strategic Perspective Institute, a nonprofit research and policy organization. He is the Cyberterrorism Advisor for the International Association for Counterterrorism & Security Professionals, a columnist for The Journal of Counterterrorism and Homeland Security and a special contributor to Frontline Security Magazine. He is a member of the FBI’s InfraGard program, the security partnership between the FBI and industry. David is also a member of the U.S. Naval Institute and the National Defense Industrial Association, the leading defense industry association promoting national security.

David is an advisory board member for the Technical Communications and Management Certificate program at the University of California, Berkeley extension. He is also a member of the instructional faculty at the University of California, Berkeley extension.

David’s “day job” is as publisher and editor-in-chief of ZATZ publishing, an online publisher of technical magazines. Other than than his ownership stake in Component Enterprises, Inc. (the parent company of ZATZ), David has no additional industry investments.

ZATZ has many advertisers who do, in part, provide for David’s lush income and extravagant lifestyle. Most of them are IBM and Lotus aftermarket suppliers, some of them make goodies for Microsoft Outlook, and a few make all sorts of strange mobile devices and add-on products. David has been a regular judge of the IBM Awards, but has no formal financial interest in or with IBM.

Because the ZATZ online magazines often review products, David and ZATZ are sent an overwhelming stream of unsolicited, silly, and often useless products to review. Because they’re such a pain to track and ship back, these products often wind up in a dumpster or fill up the corner of a large closet. Although David has no plans to review products in connection to his ZDNet blog, if he does do a product review, he will disclose any relationship completely in that posting.

Both through ZATZ and independently, David derives a small income through various advertising and sales relationships with Amazon.com and Google. These are minor relationships and they will not impede his willingness or ability to chastise either company should they deserve it.

David has many other business relationships, but none of them relate to anything he covers in his ZDNet blog. David does have a bit of the sales-guy bug and if he’s not doing a sales deal with someone at least once a month, he goes through withdrawal. He has a number of consulting clients, but none of them relate to anything he covers for ZDNet (and if they ever do, he will either disclose that fact, or decline to write about them).

Back in the 1980s, David held the unusual title of “Godfather” at Apple. He has written and published 40 incredibly simplistic applications for Apple’s iPhone.

Although David is forbidden to disclose the terms of his iPhone developer agreement, he isn’t drinking the Apple Kool Aid, will never be confused with a metrosexual, and feels free to mock Apple, and Apple users, any time the occasion permits, on alternate Tuesdays, or if he’s bored.

Biography

David Gewirtz

In addition to hosting the ZDNet Government and ZDNet DIY-IT blogs, CBS Interactive's Distinguished Lecturer David Gewirtz is an author, U.S. policy advisor, and computer scientist. He is featured in The History Channel special The President's Book of Secrets, is one of America's foremost cyber-security experts, and is a top expert on saving and creating jobs. He is also director of the U.S. Strategic Perspective Institute as well as the founder of ZATZ Publishing.

David is a member of FBI InfraGard, the Cyberwarfare Advisor for the International Association for Counterterrorism & Security Professionals, a columnist for The Journal of Counterterrorism and Homeland Security, and has been a regular CNN contributor, and a guest commentator for the Nieman Watchdog of the Nieman Foundation for Journalism at Harvard University. He is the author of Where Have All the Emails Gone?, the definitive study of email in the White House, as well as How To Save Jobs and The Flexible Enterprise, the classic book that served as a foundation for today's agile business movement.

27
Comments

Join the conversation!

Just In

RE: Is Android secure enough for mission-critical government and military use? (Exclusive video)
dbaps 13th Nov
This is really what you want to look at:

Fips 140-2

http://csrc.nist.gov/groups/STM/cmvp/validation.html

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2011.htm

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm

This is why we still use Blackberries. The first Iphone didn't even have encryption. Android had no security. Everyone is moving forward and will eventually meet Fips 140-2. IMHO Microsoft will get there first because they know how to build a security layer due to all the experience they have with the old Microsoft Phone, which I believe did meet this standard. IOS is close. Android trails by a lot. I can't find the spreadsheet that shows all of the categories for each of the Operating Systems. Sorry. I've seen it in hard copy. In any case this is why the government is waiting.
0 Votes
+ -
No!
Tim Acheson 1st Nov
For starters, it's open source. Hackers already have the source code.
@Tim Acheson And now you're going to tell us that Windows and OSX are more secure because we don't have the source? That's a very bass ackwards viewpoint... with the source being open and under constant scrutiny, that makes it far more secure than the opposite. If I want lockdown, give me Linux first.
Although less than osx. It's the same order for mobile. WP is top, android a far distant second, ios a joke.
0 Votes
+ -
Johnny Vegas - Citation Needed
daboochmeister 2nd Nov
.
0 Votes
+ -
Open source = insecure?
tkeller@... 1st Nov
@Tim Acheson Truecrypt is open source, so hackers have the source code, so it's insecure?

Just because you have the source code, does not make it insecure.
@tkeller@... It doesn't make it secure, either. Thus in one sense it's irrelevant.
@Tim Acheson If you think OSS is insecure from it's openness, then you're COMPLETELY MISSING THE POINT!

Open source software allows for editing of software, so if you spot something insecure...you can FIX IT YOURSELF! And if you're feeling nice you can share said fixes with the world.
@Tim Acheson ROFL!!! Not too bright are you?
@blueskip ,,, Or you aren't; what are you basing your comment on? It's easy to make statements; harder to back them up.
Andriod itself is not the issue. The extreme variations are real. It's how network access is configured, managed, and profiled between the host and client. Any device is vulnerable, not just Android. Any network is vulnerable. Software implementation and operation is the awkward and insecure space.

Good Interview David.

Doug
0 Votes
+ -
No one matches the military equipment and training of the US. Android would be the best way to allow any enemy to bring it down. Android is not even secure enough for personal use. It should be completely off limits to the military.
@Johnny Vegas OMG I hope you don't have a job that matters anywhere! You couldn't possibly be more wrong.
0 Votes
+ -
Is open source secure?? Really
jscott418 1st Nov
Just the fact that open source is freely open should lend to most concerned about security that it does seem to have that ability to not be secure. Its like having a combination lock and publishing the code? Where is the security in that?
@jscott418
Open Source is more secure because people can investigate the source, find bugs and holes and fix them, not just a small group of developers like might be employed by Microsoft or Apple, it can be tested by the best across the world, this has been proven by time to be a better and stronger way to secure software. Look at Windows XP, now 9 years old and still security holes being fixed every week. Look at Open source software like Qmail, still 15 yrs later has a $500 bounty if you can hack the pure Qmail software program
@GaryOtto

"people can investigate the source, find bugs and holes and fix them"

Or people can find the bugs and holes, not fixing them but exploiting them.
@GaryOtto
exploit them.

And Linux servers have been hacked a few times in the last 6 months, even with all that scrutiny
1) Many issues in MS OSes are found by others. good guys notify MS and bad guys misuse it.

2) For open source, there are very few poeple who read the source code. The % of such readers is less than the number of developers in MS.
@rice2999 "Or people can find the bugs and holes, not fixing them but exploiting them."

And how exactly is that different from what's being done with Windows and other variants DAILY????

@William Farrell "And Linux servers have been hacked a few times in the last 6 months, even with all that scrutiny" Ok let's now count the number of times OTHER servers have been hacked? Nevermind, I can't count that high.
@GaryOtto ,,, Yes, look at them. More solid, secure and reliable than any other OS out there right now. 98 & XP Pro are still my workhorses.
0 Votes
+ -
So wrong......
linux for me 2nd Nov
@jscott418

The Pawn to Own contests stop trying to hack the linux systems because they couldn't do it, and failed to win the prizes for breaking linux. Notice that they only do Windows and Macs now, and they succeed every time.

SO yes...Really...linux is much more secure than any of those closed source system.
@linux for me

They didn't stop trying to hack Linux systems because they couldn't do it but more so the fact that there is less then 1% of people who use it. Based on such a small scale why try to hack it? They want to push vendors who own the market such as Apple and Microsoft for better security as the majority of people use their products. Don't get me wrong I believe Linux is a very safe OS after a bit of configuration but it also depends on the distro and what clowns got their hands on it such as Google ruining Linux with the Android distro. Aside the fact I dislike all the ads everywhere and that you have zero privacy... They some how managed to find a way to make it laggy and glitchy. Even then the main point is that Android is the leader in malware for the mobile market. Does this mean Linux isn't safe? Not entirely, but Android is another story. I understand the premise behind jscott418's idea but it would have been better put like, It's like having a combination lock and giving you the design sheets of how it is assembled, this gives you a better idea what is happening inside and how it works giving you visibility you would otherwise not have. I do agree with the model it can be safer but at the same time they may apply a patch creating a backdoor many wouldn't be aware of. On the other hand you have many out there that do a pretty good job at keeping Linux relatively secure, but never forget there is nothing that is perfect especially any operating system.
@jscott418 ,,, no, rather than publishing the code, it's more like publxhing how the tumblers work and when and if and so on. P Poor analogy.
0 Votes
+ -
Maybe with Samsung...
BigTipper 2nd Nov
Plain vanilla Android may not be secure enough, but that doesn't mean you can't make it secure. Look at what Samsung is doing with it's Android phones. 39 Active Sync Exchange policies supported and MDM (mobile device management) support, so you can control your users. AES 256-bit encryption (on it's latest devices) and you can encrypt memory cards to their devices, as well.

I think Samsung's latest efforts compete against anything out there.
0 Votes
+ -
Android apps are highly insecure
The Star King 2nd Nov
I'm not sure Android is secure enough for consumers let alone the military!

Android apps have the power to make phone calls, access private data and even install other software automatically. The developer only has to tick the appropriate box to access these priviliges. That's right, on Android, if you want your app to act as a trojan, you don't need to pwn Android, just tick a box!

The user is told about these permissions when installing from the Market place but it's a "take it or leave it" deal. Permissions cannot be denied later. In practice the majority of games and other apps seem to "require" a large and unjustified swathe of permissions (why does a platform game "need" to know who I am phoning?) so that the user either accepts or gives up on apps entirely.
@The Star King ,,, sort of agree, but ... who says the gvt won't be using seriously hardened OSware?
This is really what you want to look at:

Fips 140-2

http://csrc.nist.gov/groups/STM/cmvp/validation.html

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2011.htm

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm

This is why we still use Blackberries. The first Iphone didn't even have encryption. Android had no security. Everyone is moving forward and will eventually meet Fips 140-2. IMHO Microsoft will get there first because they know how to build a security layer due to all the experience they have with the old Microsoft Phone, which I believe did meet this standard. IOS is close. Android trails by a lot. I can't find the spreadsheet that shows all of the categories for each of the Operating Systems. Sorry. I've seen it in hard copy. In any case this is why the government is waiting.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix