VMware Workspace ONE Achieves FedRAMP High Authorization

Overview

VMware Workspace ONE has now achieved FedRAMP High, as a Joint Authorization Board (JAB) Authorization service

VMware is excited to announce it has achieved FedRAMP High for the Workspace ONE cloud-based service with a JAB Provisional Authorization. Workspace ONE is a secure, cloud-based modern management and security solution suite for End-User Computing (EUC) requirements by providing a digital workspace platform that combines endpoint device deployment and management with secure Zero Trust Access (ZTA) capabilities for agencies & branches.

Consistently ranked as a leader by industry analysts, Workspace ONE delivers end-user-simple, single sign-on (SSO) access to cloud, web, mobile-native, and Windows-based apps in one unified catalog within Workspace ONE Hub Services that engages employees. Agencies can enable employees with a broad range of devices including iOS, Android, Mac, and Windows-based, as well as ruggedized devices to meet the needs or preferences of an agent or their mission while enforcing fine-grained, conditional access policies that also take into account device compliance information delivered by VMware’s Unified Endpoint Management (UEM) technology, and further delivering advanced desktop management capabilities for Windows 10 and 11, macOS, Chrome OS and Linux beyond what is available through MDM APIs.

Workspace ONE is also currently in-process for DoD Impact Level 5 from Defense Information Systems Agency (DISA) approval to support additional security controls for the DoD Cloud Computing Security Requirements Guide (CC SRG).  

For State, Local, and Educational (SLED) customers, VMware Workspace ONE with UEM, Access, Intelligent Hub, and Intelligence are StateRAMP Moderate authorized and In Process to be High and VMware Workspace ONE MTD is StateRAMP Moderate authorized through the Lookout, Inc. Joint Authorization Board (JAB) P-ATO.

FedRAMP Paths & JAB Provisional Authorization

There are two approaches to obtaining a FedRAMP Authorization, a provisional authorization through the Joint Authorization Board (JAB) or an authorization through an agency. The JAB is the primary governing body for FedRAMP and includes the Department of Defense (DoD), Department of Homeland Security (DHS), and General Services Administration (GSA). The JAB selects approximately ~ (12) cloud products a year to work with for a JAB Provisional Authority to Operate (P-ATO). Additionally, the JAB is responsible for performing the continuous monitoring for all JAB Authorized cloud products.

Solution at a Glance

VMware Workspace ONE® is a digital workspace platform that simply and securely delivers and manages any app on smartphones, tablets, laptops, and other devices by integrating access control, application management, and multi-platform endpoint management. Workspace ONE integrates FedRAMP High Authorized UEM (formerly VMware AirWatch®) with conditional access control technology to deliver secure, anywhere access to applications and data. With Workspace ONE, organizations can evolve siloed cloud and mobile investments, enabling all employees, devices, and things across the organization to accelerate their digital transformation journey with a platform-based approach.  Key platform components of Workspace ONE are represented in Table 1.

Table 1: Workspace ONE FedRAMP environment core services

VMware Workspace ONE is a digital workspace platform that provides users with secure access to their applications, data, and devices from any location. This platform is made up of several different products, each with its own unique features and capabilities, as shown in the following logical service diagram:

Figure 1: Workspace ONE platform’s key components, features & capabilities

Solution Summary

The VMware Workspace ONE solution resides within VMware Government Services (VGS) authorization boundary that is designed to allow US government agencies and customers supporting the US government to migrate, manage, and operate more sensitive workloads in the cloud. The VGS authorization boundary provides Software-as-a-Service (SaaS) and Infrastructure-as-a-Service (IaaS) capabilities to deliver modern applications at the speed the US government demands and operate across the data center, the edge, and the cloud.

Overall, VGS provides the following FedRAMP authorized services at the High baseline: VMware Cloud on AWS GovCloud (US) (VMC), Hybrid Cloud Extension (HCX), Carbon Black Cloud (CBC), Software Defined WAN (SD-WAN), Horizon Cloud Service (HCS), Aria Suite Cloud for US Public Sector, and as mentioned, Workspace ONE. More information on the VGS public sector roadmap can be found on the VMware Trust Center; below are key aspects of the VGS and subsequent SaaS offerings:

• Sold, operated and supported by VMware
• On-demand capacity and flexible consumption
• Full operational consistency with on-premises SDDC
• Fast and simple bi-directional workload migration
• FIPS 140.2 compliant cryptographic modules for encryption for Data-at-Rest & Data-in-Transit
• Hosted, operated and managed by VMware employees who are U.S. citizens, located on U.S. soil
• Direct access and integration with native AWS services
• IPv6 support for the Workspace ONE service

Architecture

This service is optimized to run on dedicated, elastic, bare-metal AWS infrastructure to protect highly sensitive government workloads with hardened security. AWS GovCloud provides the foundational FedRAMP IaaS components, which enables government’s infrastructure and operations teams to be able to count on those elements to add value to enable government agencies to ensure scale for capacity up or down quickly and confidently and provide access to native AWS services for the VMware Workspace ONE platform features and service.

As an IT admin, you can rely on the use of this FedRAMP Software-as-a-Service (SaaS) Workspace ONE offering to handle device enrollment, a customized app catalog, policy enforcement, compliance, and integration with email, social media, and more, securely and meeting the compliance needs of the U.S. Federal Gov't and Military.

In the following diagram, end-users’ devices are accessing a Workspace ONE UEM tenant in the FedRAMP cloud, which is powered by the AirWatch Cloud Connectors and Active Directory domain controller.

Figure 2: Workspace ONE platform’s logical architecture

VMware Workspace ONE UEM (powered by AirWatch) is responsible for device enrollment, a mobile application catalog, policy enforcement regarding device compliance, and integration with key enterprise services, such as email, content, and social media.

Workspace ONE Unified Endpoint Management (UEM) features include:

• Device management platform – Allows full life-cycle management of a wide variety of devices, including phones, tablets, Windows 10, and rugged and special-purpose devices.
• Application deployment capabilities – Provides automatic deployment or self-service application access for employees.
• User and device profile services – Ensures that configuration settings for users and devices:
  • Comply with enterprise security requirements
  • Simplify end-user access to applications
• Productivity tools – Includes an email client with secure email functionality, a content management tool for securely storing and managing content, and a web browser to ensure secure access to corporate information and tools.

Workspace ONE UEM can be implemented using an on-premises or a cloud-based (SaaS) model. Both models offer the same functionality.

Modern Management & Security for Federal Government 

Government agencies at every level have had to reimagine how best to achieve mission outcomes, protect information, and improve employee engagement in the new distributed workplace. In response to this challenge, there has been a dramatic acceleration in the adoption of modern applications—such as software-as-a-service (SaaS) and native-mobile apps—coupled with the proliferation of mobile devices and platform options, many of which are connecting through unsecured networks.

IT departments are challenged more than ever to ensure these devices meet compliance requirements, applications are available to users and updated in a timely manner, and that applications and the data contained on them, or they access are secure from unauthorized eyes. With many traditional tools unable to scale or adequately fulfill their requirements in this distributed, disconnected model, organizations must modernize how they deliver, manage, and secure access to government resources.

VMware Workspace ONE utilizes a FedRAMP High Authorized instance for key Workspace ONE technologies: VMware Workspace ONE Unified Endpoint Management and VMware Workspace ONE Access™. Workspace ONE is consistently ranked as a leader by industry analysts. It delivers best-in-class multiplatform endpoint management, application management, access control, and application and desktop virtualization that enable government agencies to be productive and secure for devices both Government-Furnished Equipment (GFE) or BYOD-Approved Device(s) (BYODAD).

It begins with user-simple, single sign-on (SSO) access to cloud, web, mobile-native, and Windows-based apps in one unified application catalog. Agencies can enable employees with a broad range of devices, including iOS, Android, Mac, Windows, and rugged devices, to meet the needs or preferences of a user or their mission. Powerful conditional access policies can combine device compliance information with user and location information from UEM to deliver the appropriate authentication challenges to keep information secure.

Workspace ONE automates traditional onboarding, laptop and mobile device configuration, and delivers real-time application lifecycle management that bridges legacy enterprise client-server apps to the mobile cloud era. Government agencies can easily deploy, configure, secure, manage, and support smartphones, tablets, laptops, and other devices across multiple mobile applications and operating systems. Workspace ONE includes industry-leading mobile device, email, application, content, and browser management solutions.

Whether enabling government-furnished equipment (GFE), such as government-owned, personally enabled devices, or even for a bring-your-own-device (BYOD) program, agencies and branches can implement these solutions standalone, in a dual-persona, containerized solution; or as a comprehensive solution based on device type, use case and user role in the organization. This integrated solution helps agencies reduce costs and increase efficiency while mitigating security risks and managing data loss prevention (DLP).

Workspace ONE includes Workspace ONE Access, which is FedRAMP High Authorized. Workspace ONE Access combines with Workspace ONE Intelligent Hub to provide a single unified application catalog, multifactor authentication, conditional access, and SSO to SaaS and web apps. Workspace ONE Intelligent Hub can also be utilized to provide actionable notifications to users, a people search directory, and access to support or intranet pages.

Workspace ONE Feature Matrix for FedRAMP

VMware Workspace ONE® is an intelligence-driven digital workspace platform that provides multi-platform endpoint management to deliver and manage any app on any device simply and securely. Workspace ONE Standard, Advanced, and Enterprise are available as both a cloud service or on-premises and the FedRAMP solution provides the following features:

Table 2: Workspace ONE FedRAMP environment additional service capabilities

Additional Enablement & Security

Workspace ONE provides a consumption-like experience for applications and information delivered by government-secure clouds, public clouds, and private clouds. Once authenticated through the Workspace ONE Intelligent Hub app, employees can instantly access their personalized enterprise app catalog and subscribe to authorized mobile, SaaS, and web apps. Additionally, Workspace ONE can be used with other VMware on-premises solutions where FedRAMP instances are not available.

Table 3: Workspace ONE additional capabilities

Flexibility to use any device: BYOD or GFE

The architecture you deploy today must work with devices not yet invented. From wearables to 3D graphics workstations, keeping employees productive means their apps must be available when and where they are. The architecture must also provide the flexibility to react to unforeseen events, including sudden shifts in work styles and locations. Some devices may be agency-owned and require IT to configure and manage them through their lifecycle.

Many devices may be owned by the employees themselves, purchased as part of a defined BYOD-Approved Device(s) program, or as the result of an unforeseen event. Workspace ONE provides the flexibility to deliver any ownership model, enabling management of on- or off-network devices, supporting BYODAD programs with adaptive management, or providing secure access from new devices with strong authentication.

Table 4: Workspace ONE device deployment & management capabilities

Real-time app delivery and automation

Workspace ONE takes full advantage of new Windows capabilities and leverages industry-leading UEM technology to enable desktop administrators to automate application distribution and updates on the fly. Combined with award-winning VMware Horizon® virtualization technology¹, automating the application delivery process enables better security and compliance.

Workspace ONE eases the transition to Windows modern management with co-management capabilities for Microsoft System Center Configuration Manager (SCCM).

Table 5: Workspace ONE app delivery capabilities

Zero Trust security and endpoint compliance with conditional access

To protect the most sensitive information, Workspace ONE combines identity and device management to enforce access decisions based on a range of conditions from strength of authentication to network, location, and device compliance.

Table 6: Workspace ONE Zero Trust & conditional access capabilities

Secure productivity apps

Workspace ONE secure productivity apps include catalog, email, calendar, contacts, content, authentication access, and more. Designed for mobile users, Workspace ONE apps have a wealth of time-saving features employees want to use, and industry-leading, enterprise-grade security to protect sensitive agency data. Enable users with frictionless, secure access to the apps, tools, and content they require to get work done from anywhere.

Table 7: Workspace ONE productivity app capabilities

Integrated Trust Framework

VMware Workspace ONE utilizes FedRAMP High Authorized technologies— Workspace ONE UEM and Workspace ONE Access—to incorporate a framework of trust for operating in today’s perimeterless world. By taking a better approach to delivering a better experience while not compromising on security, Workspace ONE facilitates modernizing government IT to meet the challenges of the 21st century.

With the addition of VMware Workspace ONE Intelligence into the Workspace ONE FedRAMP environment, government customers will have two options for integration:

1. On-prem UEM deployment through the use of the ‘Intelligence Connector’ in order to facilitate the data transfer from the on-prem UEM to the hosted Intelligence tenant or natively via an existing/new FedRAMP cloud-hosted UEM tenant.
2. After deployment, customers can leverage a secure, cloud-hosted environment to provide a service for their Workspace ONE platform that delivers insights, analytics, and automation for the digital workspace and gain deep insights into device, user, and app posture that enable data-driven decisions across an agency or branch’s entire environment via Intelligence as reflected below in Figure 3.

Figure 3: Workspace ONE Intelligence Connector Examples

Building on the industry-leading device and user management capabilities of Workspace ONE UEM, Identity Management via Access, and User/Device app and experience management through Hub Services, Intelligence additionally can provide the following benefits.

Workspace ONE Intelligence Benefits

At its core, Workspace ONE Intelligence is designed to simplify user experience without compromising security. The intelligence service aggregates and correlates data from multiple sources to give complete visibility into the entire environment. It produces the insights and data that will allow you to make the right decisions for your Workspace ONE deployment. Intelligence has a built-in automation engine that can create rules to take automatic action on security issues as highlighted in Table 8.

Table 8: FedRAMP Phase I Feature Matrix

The complete Workspace ONE Intelligence Reference Architecture Guide (see Figure 1 for architecture flow overview) provides a framework and guidance on architecture, design considerations, and deployment of the Workspace ONE suite, as well as Horizon VDI solutions and integration and architecting Workspace ONE Intelligence into them. For those agencies/branches that want to evaluate the platform, the GSA FedRAMP marketplace provides a submission portal to request the System Security Plan for the VMware solution that is available on all FedRAMP XaaS Authorized solutions. Note: This information provides the agency’s Authorizing Officer (AO) the resources to review and provide authorization for the service’s use.

Figure 4: Data Sources for Workspace ONE Intelligence

Zero Trust Architecture & Network Access (ZTA / ZTNA)

Organizations can also further enable and implement a Zero Trust approach to security. Leverage machine learning to deliver continuous verification with risk analytics based on user behavior and device context. Agencies can enable a Zero Trust security framework with the inherent security capabilities of the intelligence-driven Workspace ONE platform and Workspace ONE Trust Network, as shown in Figure 5. This rich ecosystem of integrated partner solutions is enhanced by what Intelligence provides. This integrated solution helps agencies successfully empower the ‘anywhere organization’ and:

• Provide a Digital Employee Experience Management, as a part of Workspace ONE Intelligence, deliver a set of capabilities to help IT admins monitor digital workspace KPIs impacting a user’s experience, while proactively discovering issues and quickly remediating them with automation.
• Aggregate, correlate, and analyze data from multiple sources to deliver integrated insights, analytics, and automation for the digital workspace to help provide for risks from threats and feed actions to secure the ZTA model as represented in Figure 5.
• IT teams can proactively improve digital employee experience, strengthen security, and optimize IT operations.
• Application of single sign-on (SSO) to SaaS, Web, and virtualized desktops and applications.

Figure 5: Consolidated Threat View Example - Reported by Trust Network Solutions Over Time & CVE Metrics

Platform Privacy and Security

VMware is committed to supporting the government’s security and privacy management and policies. Intelligence provides IT managers the flexibility for data collection and storage configuration parameters, as Intelligence aggregates data from multiple sources that can be opted in or out of including deauthorizing those connections from the other Workspace ONE suite components including:

• UEM – Device ID (UDID, IMEI, IP, MAC, Serial Number), first name, last name, email, managed apps list, telecom, and network information, apps usage data, security health of devices.
• Access – User login details including successful and failed attempts, and app launch data.
• Intelligence SDK – App crash details, monthly active users (MAU), daily active users (DAU), app launch, network details, and app usage details.
• Common Vulnerabilities and Exposures (CVEs) – Doesn’t contain any PII data. Workspace ONE simply ingests CVE data from public sources such as NIST.
• Multi-factor Authentication (MFA) - Workspace ONE Access supports chained, two-factor authentication (2fA). The primary authentication methods can be username and password or mobile SSO. You can combine these authentication methods with RADIUS, RSA Adaptive Authentication, and VMware Workspace ONE Verify as secondary authentication methods to achieve additional security for access control.

Additionally, customers have control over all personally identifiable information (PII) sent to the cloud, such as phone number, username, email, and private app information. Raw data is stored for 3 months and trend data for 12 respectively.

Lastly, VMware takes pride in the assurance of its Cloud-Hosted solutions providing industry-leading security. The system has gone through penetration testing by a team of VMware InfoSec professionals. Customer data collected from the Workspace ONE production environment is encrypted using HTTPS (TLS 1.2), based on AES for uploading to Amazon Web Services (AWS) and to ensure confidentiality during transfer.

Only customers can access their data through a unique Workspace ONE login, including the Workspace ONE console interface. VMware will not access a customer’s data without their consent. Various levels of Multi-factor Authentication (MFA) access controls are used to lock down the system to only show data at the request of the customer.

VMware Compliance

VMware takes great pride in participating and complying with regulatory programs worldwide and continues to expand our compliance programs to meet the requirements of the most demanding missions. More information on VMware compliance can be found in the VMware Cloud Trust Center.

• GSA FedRAMP Marketplace - VMware
• VMware Federal Certifications

VMware Workspace ONE FedRAMP Summary

VMware is committed to providing industry-leading, public-sector solutions for endpoint management security, virtualization, cloud, and mobile. Embracing not only commercial requirements and industry standards but also government certification and accreditation programs and as a resource for Federal, State, and Local government(s) needs.

VMware’s Workspace ONE FedRAMP High Authorized solution, which includes Workspace ONE UEM, Intelligence, Intelligent Hub, and Access combine to provide a single unified device and user enablement platform for on-boarding of users and their devices including an application catalog, multifactor authentication, conditional access, and SSO to SaaS and web or native apps and can also be utilized to provide actionable notifications to users, a people search directory, and access to support or intranet pages to reduce downtime and maximize users time and efficiency.

Additional Resources

For more information on configuring or enabling Workspace ONE, Workspace ONE Intelligence and UEM, as well as Access, and Hub Services:

Workspace ONE Documentation

• VMware Tech Zone: Workspace ONE Resources

• VMware Workspace ONE UEM Release Notes
• VMware Workspace ONE Intelligence Release Notes
• VMware Workspace ONE Access Release Notes

Workspace ONE Government & Compliance Solutions

• Tech Zone: VMware Workspace ONE Security & Compliance Solutions
• Tech Zone: VMware Public Sector Solutions
• Tech Zone: VMware Horizon Cloud Service FedRAMP High / IL5
• Tech Zone: VMware Workspace ONE MTD FedRAMP Solution

Changelog

The following updates were made to this guide:

About the Author

Andrew Osborn is serving in a role at VMware as a dedicated ‘Staff Technical Marketing Architect’ for all things End-User Computing (EUC) compliance / regulatory. He has over 20 years’ experience in the IT Industry, including the last 10 years within Public Sector, with roles spanning Cybersecurity, Networking, Enterprise Ops, Mobility & Telco solutions, encompassing numerous technologies and architectures. Andrew received an MIS degree from University of Oklahoma with certs from ISC2 CISSP & GIAC GSLC and is based out of San Antonio, TX. He'll be contributing to VMware’s Tech Zone to provide more tailored messaging for Federal, State, Local & Education (SLED) solutions from VMware EUC.

Feedback

Your feedback is valuable.

To comment on this paper, contact VMware End-User-Computing Technical Marketing at euc_tech_content_feedback@vmware.com.