Delivering VMware Anywhere Workspace with DoD365 Integration

Overview

image 80

Introduction

In today’s remote worker environment, the Department of Defense (DoD) is migrating away from the COVID-19 emergency response deployment, under the Commercial Virtual Remote (CVR) program. The solution was invoked at the time to ensure a rapid enablement of the remote worker within the DoD branches/services access to Microsoft’s commercial O365. Now, a transition to a higher security, long-term office productivity environment that end-users will leverage both in the office and at home has begun. This transition involves connecting to a DoD-enhanced version ‘DoD365’, as well as other derivatives that are custom to military branches (e.g., Army365).

However, numerous complexities with the deployment will make a single, scalable solution challenging to leverage as a sole-source set of enablement solutions, especially when coupled with a growing list of the DoD’s plans for device and end-user enablement options, such as the decision to allow personnel to access its new collaboration platform DoD365 with personal devices (BYOD), beyond the government-provided (i.e. Government-Furnished Equipment (GFE)) mobile devices would be allowed to connect to the service and remote enablement.

When taking in the sheer scale of these enhancements, it’s important to consider how the VMware Workspace ONE® suite and its integration with Microsoft 365 (M365) implementations in the Federal Government, and specifically the DoD, provide a true multi-cloud approach and support an evolution beyond CVR and provide a digital transformation of remote work enablement via VMware Anywhere Workspace.

Audience

This document is intended for IT administrators and product evaluators who are familiar with VMware's Anywhere Workspace powered by EUC and VMware Workspace ONE. Familiarity with the End-User Computing environment and modern management that include device, app and identity management is assumed. Knowledge of other technologies, such as VMware Horizon, Security, Secure Access Service Edge (SASE), and Zero Trust Architecture (ZTA) is also helpful.

Enablement

Anywhere Workspace, powered by the Workspace ONE End-User Computing (EUC) suite, provides the necessary enablement of DoD365 integration and enhancements for enterprise-grade UEM, cloud-enablement, and cybersecurity elements for Zero-Trust Security, including:

  • Enterprise IT-as-a-Service (EITaaS) - Enterprise service enablement & acceleration through centralized IT features & staff support, powered by VMware Workspace ONE.
  • App Modernization & Management - Access to data and info in centralized data lakes
  • Multi Cloud Integration - FedRAMP-hosted / On-Prem / milCloud / Hybrid Cloud (HCX) and cloud independent, e.g., VMware / AWS / Azure / Private and so on.
  • Virtual Cloud Networking (VCN) - Integration with VMware VCN or 3rd party versions.
  • Virtual Desktop Interface (VDI) - Enable remote desktop access and security.
  • Zero-Trust Security (ZTS) - Aligned to endpoint security, as well as the network and communications via Secure Access Service Edge (SASE).
  • Command & Control (C2) - Easy integration and management controls & automation.

 

Solution

The Workspace ONE suite and its components help with this large-scale, enterprise transformation and the integration with DoD365; its components provide the flexibility and scalability needed to make the transition, including:

  • Workspace ONE Unified Endpoint Management (UEM) for Mobile Device Management (MDM) and policy enforcement and access controls for modern management of a blended end-user deployment spanning Win 10/macOS/iOS/Android and Linux based devices.
  • Workspace ONE Access for Identity and Configuration and Access Management (IdM/ICAM) providing for mobile authentication and digital signing with Derived Credentials and certificate-based authentication (CBA).
  • Workspace ONE Intelligent Hub services for Content, Application and Training Management and Enablement and User Experience (UX), including App Catalog and Self-Service.
  • Workspace ONE Boxer secure, National Information Assurance Partnership (NIAP) compliant, email client with data loss prevention (DLP).
  • Workspace ONE Tunnel for a per-app virtual private network (VPN), providing secure in-transit communications.
  • Workspace ONE Intelligence to correlate data from multiple sources for visibility and automated workflows.
  • Workspace ONE Horizon providing for secure delivery of virtual desktop interfaces (VDI) and apps across hybrid cloud, from a single control plane with rapid provisioning, automation, and simplified management to extend the best digital workspace experience to end-users.

Each of these elements provide a DoD entity the ability to take on the tasks of modern CVR transition engagements that will be required of a true enterprise-grade ‘Remote Access’ for DoD-based personnel to M365/DoD365 collaboration utilities such as MS Teams, integration to .mil E-Mail and data and file-sharing tools, including SharePoint.

Figure 1: EUC Portfolio Logical View for Anywhere Workspace

Advantages and Drivers

There are several reasons that VMware customers have moved away from legacy device administration & deployment utilities as quickly as possible. The key motivation for this can be summarized by the following points and key Workspace ONE deployment drivers not only in commercial but specifically in the FedGov and DoD space:

  • Modern Management for Policies – VMware UEM can navigate around the pitfalls of pre-defined settings and a lack of dynamic, custom settings, including providing for a full User Interface (UI), as well as traditional Group Policy Object (GPO) support, that can be used Over-the-Air (OTA), without VPN connectivity, and configure Cloud-based GPOs leveraging a service provider, baseline templates or a policy builder that helps create custom policies, as well as supporting the use of a 3rd party Administrative Template XML-Based(ADMX) file for policy settings in GPO for Windows; additional VMware UEM services, such as VMware Workspace ONE Airlift can help further in analyzing, planning, and migrating to cloud-based GPOs.
  • Multi-tenancy – ability to manage multiple domains and deployment environments within one ‘pane-of-glass’ through Workspace ONE UEM.
  • Automation, On-boarding & Provisioning – ability to leverage Apple DEP / ABM or Google auto-provisioning, as well as other vendor programs and the inclusion of self-provisioning services and to the enroll / de-enroll process be automated after HR-based actions and perform granular enterprise task and features, such as print server configs.
  • Role-Based Access Controls (RBAC) - for numerous, divergent support groups and admin levels, including the ability to obfuscate Personally Identifiable Information (PII) at an individual admin level, that go far beyond ‘scope-tags’ and provides for true ‘delegated administration’ amongst disparate teams/groups and ‘granular’ protected views and segmented admin views.
  • Conditional Access – true vendor-independent, app access & management; not specific to only Microsoft-based apps but can be leveraged across the platform spectrum for providing device posture and behavioral risk paramount to providing Zero-Trust Security device and other enhanced security options for a more complete contextual compliance assurance for access to those apps & data with explicit ability to perform tasks, such as quarantining a device that has a known vulnerability for a specific group of users, for a specific non-Microsoft app e.g., Box version X.Y and for XYZ category of users or an X group.
  • API / Device Integration – larger pool for greater device portfolio and easier integration with Workspace ONE; includes ruggedized Android-based (e.g., Zebra-based for Healthcare) or other OS's such as Chrome OS for a greater security framework and compliance posture for Endpoint Detection / Response, including automation.
  • Device Log Views - ability to view them on a ‘per-device’ level, in order to perform Incident Response at a device level for better granular troubleshooting and Endpoint Detection & Response/Incident Response (EDR/IR).
  • Compliance Reporting - more accurate, robust & up-to-date device and app-level details for compliance validation for organizations.
  • Data encryption & Data Loss Prevention (DLP) – on the device (e.g. passcode based) and in-Transit (e.g. Per-app), as well as through a ‘VMware Tunnel’ if needed for high security of all traffic through a VPN gateway on all apps; not just Microsoft-based, ensuring full-scope DLP, including solution specific VPN client tunnels, built-in secure content locker application and ability to enforce E-Mail compliance and enable pdf signing capabilities.
  • Identity Provider (IdP) – integration is provided via a large ecosystem of 3rd party solution providers of Identity Management (IdM), and as Cloud Service Providers or IdM-as-a-Service (IDaaS), including Okta, Ping or native IaaS solutions of Azure / AWS / Google.
  • Public Key Infrastructure (PKI) Lifecycle Management - ability to properly transition between cert renewals without having to republish profiles/apps as well as, perform more than just add/revoke for Certificate-based Authentication (CBA). Also, can be used to authenticate within apps, which can have privacy data (e.g., Teams) contained within them; includes Multi-factor Authentication (MFA), risk-based, and Derived Credentials integration options (e.g., Purebred) for both iOS & Android devices.

image-20220113201442-1

Figure 2: Workspace ONE PIV-D Manager interacts with Purebred derived credential (DC) or other providers & the Workspace ONE UEM components

  • Policy Processing – ability to provide expeditious and rapid, enterprise-grade policy processing, at speeds that don’t take hours to target policies that are grouped together, keeping backlogs at a minimum for things such as, auto-lock / log-off screen / remote lock controls, which can be enabled in conjunction with FISMA / STIG controls.
  • Audit Logs & Tracking – directly available from within the console and available integration with Trust Partner Network providers for Security Information & Event Management (SIEM) and ability to enable specific communication/alerts for notification of incidents to relevant parties (e.g., SecOps).
  • Training Curriculum Management – delivery and portal experience of soldier and agent training run from within Intelligent Hub to help track compliance.

Key Differentiators

As part of the solution, including the VMware Application & Desktop Virtualization Horizon (VDI) solution which integrates with Azure AD (AAD), Workspace ONE serves as the foundation to deliver Enterprise IT-as-a-Service (EITaaS), while enabling Zero Trust initiatives throughout the DoD, including integrated Trust Partners for additional-layered cybersecurity of endpoints (e.g., Mobile Threat Defense (MTD)).

Other key things that distinguish VMware Workspace ONE:

  • FedRAMP Authorized SaaS – unique GSA FedRAMP authorization for the Workspace ONE: UEM, Access, Intel Hub, Intelligence & Software-as-a-Service (SaaS), outside of an Infrastructure-as-a-Service (IaaS) set of internal / embedded services.
  • National Information Assurance Partnership (NIAP) certified email client (e.g. VMware Boxer) and MDM (VMware Workspace ONE UEM), that provide the only UEM feature suite that can be used and deployed in all three environments e.g. Private or Public Cloud <and> On-Premise, as well as in a VMware-Hosted FedRAMP Authorized SaaS version.
  • Commercial Solutions for Classified (CSfC) from the National Security Agency (NSA) provides for a mobility capability package that is supported by NIAP and the VMware solution suite meets the requirements necessary to provide services in each of those categories for classified mobile communications listed previously.
  • Security Technical Implementation Guide (STIG) compliance with security controls set forth specifically within the MDM & Mobility Deployment Services for OnPrem EUC functions, as well as a robust set of server and virtualization product areas as well.
  • DoDIN APL for DoD branches/agencies; only vendor for use in the Multifunction Mobile Device Backend Support System (MBSS) a.k.a. UEM-based suite of services.
  • NIST SP 800-207 Zero Trust Architecture (ZTA) guidance for emerging compliance areas of Cybersecurity, including being FirstNet Listed for 1st responders by the FirstNet Authority for Mobile Device Management solution for both iOS & Android.

image-20220113201701-4

Figure 3: Zero Trust Journey and inclusion of EUC/Anywhere Workspace User Access Model for ZTA

  • Cybersecurity Maturity Model Certification (CMMC) Lifecycle management and security compliance is provided by the VMware Workspace ONE EUC suite to enable contractors, Service Providers (SPs) under the DoD’s own ability to help customers meet those requirements and to enable a secure deployment for those controls.
  • AppConfig Community is an industry-based consortium that VMware is a proud member of, which provides guidance from the industry vendors themselves, for the development, deployment, and use models for UEM/MDM integration with secure mobile apps.
  • Third-Party Trust Network provides a robust ecosystem of solution integration with Carbon Black for Endpoint Protection, as well as Mobile Threat Defense solutions (e.g., Lookout) <and> in order to integrate the data collection of these utilities into VMware’s FedRAMP Authorized Workspace ONE Intelligence service for enhanced 'Incident Response' capabilities on all device types e.g. macOS / Win10 / mobile / Rugged, as well as Security Information & Event Management (SIEM) integration (e.g., Splunk) and other Technical Alliance Partner(s).

 

image-20220113201603-2

Figure 4: Logical Connections & Service Integration to DoD365 with VMware EUC Components and ZT baseline

Architecture and Deployment Considerations

To properly provide the DoD with the capabilities required of the NexGen version of CVR, it’s important to ensure that all the use cases for this integration environment are addressed and the flexibility of that integration is available regarding solution environment and end-user support between Government-Furnished Equipment or Bring Your Own Device – Approved Devices (BYODAD)-based devices and their users in multiple scenarios including:

  • Service hosting environments > On-Premises; Private/ Public/ FedRAMP & Hybrid (HCX) Clouds
  • End-user options > GFE / BYODAD-Managed/ BYODAD-Unmanaged (a.k.a. Registered Mode)

Only VMware Workspace ONE can enable the differing hosting environments and end-user/device use cases!

Note: See the Additional Resources section for detailed information about the solution deployment options and the technologies behind them. Regarding future deployment guides & tutorials, new assets will be coming this summer related to Anywhere Workspace and Workspace ONE and DoD365 Integration; refer to VMware Tech Zone.

image-20220113201622-3

Figure 5: VMware UEM logical view of authentication flows with DoD365

Compliance

Also, these tools help branches and agencies to meet compliance and implement security control requirements for not only previous frameworks, such as NIST 800-53 FISMA but also leverage accredited solutions under National Information Assurance Partnership (NIAP) while providing compliance with security controls set forth specifically within the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG), as well as emerging compliance areas of Cybersecurity within the NIST SP 800-207 Zero Trust Architecture (ZTA) guidance, as well as Lifecycle management and security compliance under the DoD’s own Cybersecurity Maturity Model Certification (CMMC) and VMware’s ability to help customers meet those requirements and to enable a secure deployment for those controls.

The Workspace ONE solution suite will support an ‘Anywhere Workforce’, including GFE / BYO Approved Devices (BYOAD) while providing an enhanced ‘service scalability’ not found in other platforms in the UEM space. Also, integrated VMware tools within EUC, such as VMware Workspace ONE® Assist™ to remotely access and troubleshoot devices in real-time.

Summary and Additional Resources

Introduction

As the DoD’s remote worker footprint continues to grow, including on the heels of recent DoD announcements for allowing DoD365 to be reached through personal cellphones/devices (e.g. BYOD), it will be even more important to ensure that enterprise-grade Unified Endpoint Management (UEM) and Cybersecurity management and protection solutions are embedded with the DoD365 integration service. These are solely met within the VMware Anywhere Workspace for DoD365 Integrated solution and removes the need to compromise to only receive the bare-minimum options for those necessary tools IT and the organization requires for an enterprise-grade set of utilities that support those use-cases for the DoD.

Workspace ONE is more than just a set of management tools for IT and Mobility admins. Rather, it’s a NexGen solution geared to enable the transformative move to a true ‘Anywhere Workspace’ and digital enablement for remote and local workers within an agency that doesn’t rely on additional contract features/layers to enable the services needed to do the job or hide the true deployment and operational costs. Workspace ONE is a digital platform that delivers any app, on any device to any worker with intrinsic security and compliance embedded within it and reduction in complexity and management.

Outcomes

VMware Workspace ONE Integration with DoD365 provides a better solution and experience for both end-users, IT administration staff, as well as management, including:

Table 1: Outcome Matrix for VMware EUC suite and UEM integration with DoD365

IT Transformation

IT modernization – remove technical and process debt

Remove hidden Ops & Support costs and the complexity of third-party tools

Faster time to value realization – deliver technical outcomes quickly
Faster Device Compliance

Profile and application delivery is near-instantaneous with Workspace ONE, reducing risk present vs. Intune that can take up to 8 hours to process and reconcile
Less administrative overhead

Automated support and management tasks, ensuring key apps are installed in order to maintain device compliance policy options
Faster support

Remote Assist speeds up time-to-issue resolution
Operational efficiencies

Reduced run costs and increased organizational efficiency

Additional Resources

For Microsoft O365 reference material, see the following:

For Workspace ONE & Anywhere Workspace Technical Solution Documentation, see the following:

For supporting documentation on Cybersecurity, see the following:

For solution analysis, comparison and costing, see the following:

Additional Certifications and Compliance

VMware is committed to supporting government IT programs and the extended ecosystem/supply chain worldwide and we continue to expand our compliance programs to meet the requirements of the most demanding missions.

For more information on VMware Federal Certifications & compliance, see the following unique listings for other global and governmental focused compliance, see the following:

Changelog

The following updates were made to this guide:

Date

Description of Changes

2021/06/29
  • Guide was published.

About the Author

Andrew Osborn is serving in a role at VMware as a dedicated ‘Staff Technical Marketing Architect’ for all things End-User Computing (EUC) compliance / regulatory. He has over 20 years’ experience in the IT Industry, including the last 8 years within Public Sector, with roles spanning Cybersecurity, Networking, Enterprise Ops, Mobility & Telco solutions, encompassing numerous technologies and architectures. Andrew received an MIS degree from University of Oklahoma with certs from ISC2 CISSP & GIAC GSLC and is based out of San Antonio, TX. He'll be contributing to VMware’s Tech Zone to provide more tailored messaging for Federal, State, Local & Education (SLED) solutions from VMware EUC.

Feedback

Your feedback is valuable.

To comment on this paper, contact VMware End-User-Computing Technical Marketing at euc_tech_content_feedback@vmware.com.

 

Filter Tags

Workspace ONE Workspace ONE UEM Document WhitePaper Overview Modern Management Office365 Zero Trust Public Sector