Secure Handling, Inspection, and Evaluation for Device Access

To address the ArmyÆs need to determine the level of risk when a person uses a personal device to access Army resources (i.e., bring your own device (BYOD)) in accordance with zero trust principles, Intellisense Systems, Inc. (Intellisense) proposes to develop a new Secure Handling, Inspection, and Evaluation for Device Access (SHIELD) solution based on a unique combination of the design guidelines set forth in National Institute of Standards and Technology Special Publication 800-207 and advanced machine learning. Specifically, the innovation in zero trust architecture with supporting machine learning components will determine the level of trustworthiness (i.e., level of risk) when a person uses a personal device to access Army resources. SHIELD will accomplish this by implementing a set of guiding principles for workflow, system design, and operations to improve the security posture of Army resources. A policy engine and policy administrator will combine to form the policy decision point for user access. SHIELD will significantly lessen uncertainties by focusing on authentication, authorization, and restricting implicit trust zones. This will be accomplished without installing software on the personal device. The SHIELD solution will quantify the technical challenges, the risks and how they will be mitigated, and any resultant dependencies. The approach will be designed with a focus on open architecture and industry standards and protocols, which directly addresses the ArmyÆs requirements. In Phase I, Intellisense will determine the feasibility of SHIELD and describe in detail the approach to be used for determining its trustworthiness. Also in Phase I, Intellisense will describe the technical challenges, the risks and how they will be mitigated, and any dependencies that are required for the solution to work. In Phase II, Intellisense plans to develop the solution outlined in Phase I. A demonstration of SHIELD determining the trustworthiness of a personal device will be performed (specific device information will be provided by the Army after award). The demonstration will include the ability for observers to determine how the level of trustworthiness for a given device was measured (e.g., what specific device factors were used to determine the level of trustworthiness of the device, any configuration data used in the decision, and how that data was mapped to a level of trustworthiness).