Military Information Security Concepts

The background

A defence project in the maritime sector was handed over to the client with serious gaps in the information security documentation. There were no fully valid network infrastructure plans. The actual current status and the composition of the installed IT systems were based largely on unsubstantiated assumptions.

The challenges

• Systematic inventory: Comprehensive recording of all IT system components installed in the current environment.
• Definition of complexity and scope: Precise differentiation between which components fall within the project’s scope and which interfaces exist with upstream or parallel defence projects.
• Non-destructive reconstruction: Derivation and creation of complete network topologies and diagrams without having to physically dismantle the maritime system or jeopardise its operational capability.

Our solution

• Non-destructive network analysis & site survey: Use of on-site surveys and passive network analyses to precisely map interfaces, data flows and system boundaries without physical dismantling or disruption to the ship’s operations.
• Classification & Re-engineering: Comprehensive inventory and clear delineation of all IT systems with regard to their project affiliation and scopes of application.
• Documentation & Accreditation Support: Preparation of complete, standards-compliant information security documentation in accordance with the requirements for military systems, as well as support throughout the certification process with the relevant authority.
• The result: Successful granting of a provisional operating licence (IATO – Interim Approval To Operate) by the relevant military accreditation authority (DEUmilSA).

The background

This involves providing comprehensive information security support and developing the concept for a large-scale series of training facilities. The facilities are used for training across almost all military units, with a focus on the Army and support units. The mandate covers the entire product life cycle: from the initial planning of the facilities, through the evaluation of hardware and software components, to final accreditation.

The challenges

• Variant and scaling management: Clearly defined and delineated scopes of application across different plant variants, without redundant duplication of work.
• Heterogeneous stakeholder landscape: Management of shifting responsibilities between manufacturers, subcontractors and system suppliers right up to the official handover to the client.
• Process continuity: Ensuring a consistently high safety standard, despite dynamic development and construction phases.
   

Our solution

• Efficient reference model approach (‘full-scale top-down’): Comprehensive preparation of information security documentation for the most complex, full-scale variant. The remaining variants were derived using a targeted delta analysis (reduction/subset analysis), which proved to be extremely efficient.
• Interface coordination: Active management and harmonisation of information security requirements took place across all stakeholders, suppliers and development phases.
• Accreditation support: Preparation for and ongoing support during the final accreditation process were provided in order to obtain the regular operating licence for a secure and legally compliant training facility within the armed forces.