The U.S. Department of Defense (DoD) is facing pressure from the current administration to modernize its legacy IT infrastructure while also adhering to its mandate to reduce costs across the federal government.
Simultaneously, mobile device usage has expanded significantly across the DoD to support mission agility, remote operations, and secure communications. Unfortunately, this expansion has resulted in a fragmented ecosystem of inefficient, ineffective, and redundant enterprise mobility management platforms across the DoD.
Deploying duplicative enterprise mobility management solutions not only results in unnecessary costs and siloed, disparate capabilities across the department, but also increases the risk of configuration drift, inconsistent data management, and gaps in policy enforcement. This may impede device tracking, hinder auditability, and elevate operational risk, especially in forward-deployed or classified environments.
The lack of standardization also delays coordinated threat response and inhibits seamless integration with DoD-wide systems, thereby adversely impacting the department’s mission readiness and cyber protections.
For the DoD, mobility modernization presents a critical opportunity to align modernization and cost reduction priorities agency-wide, which will reduce redundant spending and increase adherence to the current administration’s mandates on fiscal waste.
By consolidating its disparate enterprise mobility management platforms, the DoD could significantly reduce operational inefficiencies, eliminate duplicative licensing, lower support costs, and minimize security vulnerabilities arising from fragmented systems. By standardizing on a single, comprehensive mobile device management (MDM) solution, the DoD could benefit from consistent policy enforcement, streamlined device tracking, and centralized management, all of which are essential for maintaining cyber hygiene and mission readiness.
Here are six considerations that the DoD should keep in mind as they evaluate MDM solutions for use across the department:
Support for multi-tenancy:
The DoD should explore enterprise MDM solutions that support multiple Microsoft tenants and lightweight directory access protocol (LDAP) domains, enabling the agency to centralize mobility management across various DoD mission partners, regardless of their domain. This allows the DoD to remove IT system silos, save on administrative overhead and costs, and eliminate the need for individual security audits across multiple deployed enterprise mobility management solutions.
Mobile-first Zero Trust methodology:
The DoD should ensure that its enterprise MDM solution aligns with its Zero Trust architecture by enabling modern device policy enforcement, continuous device and application authorization checks, and in-line policy decision points to authorize access to critical cloud and on-prem mobile applications.
Ecosystem integration:
Any MDM solution provider that the DoD partners with should have strong integrations with mobile device manufacturers and application developers. Having strong relationships with companies like Apple and Google ensures day-zero operating system (OS) update support and alignment with their mobility modernization roadmaps.
Implementing an MDM solution from a provider with limited integration can result in delayed feature support, inconsistent policy enforcement issues, and device stability concerns. This makes extensive integration with third-party best-of-breed solutions, such as security information and event management (SIEM), mobile threat defense (MTD), IT service management (ITSM), and IT asset management (ITAM), essential to avoid vendor lock-in.
Classified and tactical network management:
Considering the sensitivity and importance of DoD data, it’s essential that the department has a centralized platform that can secure and manage devices on air-gapped, highly restricted, and closed networks, streamlining operations and enhancing its security posture.
Policy enforcement and lost device protection:
It’s essential that any MDM solution used by the DoD provide remote configuration and lockdown – enabling security teams to remotely update, patch, and even disable devices — in accordance with DoD security technical implementation guides (STIG), National Institute of Standards and Technology (NIST), and Center for Internet Security (CIS) Benchmarks. The solution the DoD chooses should also enable the organization to wipe data remotely from lost or stolen devices.
Multifactor authentication enforcement:
Any MDM solution selected by the DoD must enable two-factor authentication using common access cards (CAC) and personal identity verification (PIV) across all devices performing government work.