Military Information Security Concepts

The background

A defence project in the maritime sector (surface vessel) was handed over to the client with serious gaps in the information security documentation. There were no fully valid network infrastructure plans. The actual current status and the composition of the installed IT systems were based largely on unsubstantiated assumptions.

The challenges

• Systematic inventory: Comprehensive recording of all IT system components in use within the current environment.
• Defining complexity and scope: Precise differentiation between which components fall within the project’s own scope and which interfaces exist with upstream or parallel defence projects.
• Non-destructive reconstruction: Deriving and creating complete network topologies and diagrams without having to physically dismantle the maritime system or jeopardise its operational capability.

Our solution

• Non-destructive network analysis & site survey: Use of on-site surveys and passive network analyses to precisely map interfaces, data flows and system boundaries without physical dismantling or disruption to the ship’s operations.
• Classification & Re-engineering: Comprehensive inventory and clear delineation of all IT systems with regard to their project affiliation and scopes of application.
• Documentation & Accreditation Support: Preparation of complete, standards-compliant information security documentation in accordance with the requirements for military systems, as well as support throughout the certification process with the relevant authority.

• The result: Successful granting of a provisional operating licence (IATO – Interim Approval To Operate) by the relevant military accreditation authority (DEUmilSA).A).

   

The background

This project involves the provision of comprehensive information security support and the design of a large-scale series of over 100 training systems in six different variants for the BAAINBw. The systems are used for training in almost all units that operate within the Land Command Network (FüVbuLa), with a focus on the Army and the support sector. The mandate covers the entire product life cycle: from initial system planning, through the evaluation of hardware and software components, to final accreditation.

The challenges

• Variant and scaling management: Clearly defined and delineated scopes of application across six different plant variants, without redundant duplication of work.
• Heterogeneous stakeholder landscape: Managing shifting responsibilities between manufacturers, subcontractors, system suppliers and the lecture theatre construction teams, right through to the official handover to the BAAINBw and the troops.
• Process continuity: Ensuring a consistently high safety standard despite dynamic development and construction phases.
   

Our solution

• Efficient reference model approach (‘full-scope top-down’): Comprehensive preparation of information security documentation for the most complex, full-scope variant. The remaining five variants were derived using a targeted delta analysis (reduction/subset analysis), which proved to be extremely efficient.
• Interface coordination: Active management and harmonisation of information security requirements took place across all stakeholders, suppliers and development phases.
• Accreditation support: Preparation for and ongoing support during the final accreditation process were provided in order to obtain the standard operating licence for a secure and legally compliant training facility within the armed forces.