Mission Centric Mobile Application Development Best Practices

Transcription

1 Mission Centric Mobile Application Development Best Practices Advanced Mobility Working Group Date Released: November 2013 SYNOPSIS The following white paper provides an overview of the best practices and lessons learned from federal agencies embarking on mission centric mobility. The ACT-IAC Advanced Mobility Working Group (AMWG) Mobile Applications Committee held a government panel discussion on Tuesday, August 13, 2013, represented by key agencies leading the charge in transforming their critical processes through employing mobile systems. The paper below provides a synopsis of the discussion. American Council for Technology-Industry Advisory Council (ACT-IAC) Advancing Government through Collaboration, Education and Action

2 American Council for Technology-Industry Advisory Council (ACT-IAC) The American Council for Technology (ACT) is a non-profit educational organization established in 1979 to improve government through the efficient and innovative application of information technology. In 1989 ACT established the Industry Advisory Council (IAC) to bring industry and government executives together to collaborate on IT issues of interest to the Government. ACT-IAC is a unique, public-private partnership dedicated to helping Government use technology to serve the public. The purposes of the organization are to communicate, educate, inform, and collaborate. ACT-IAC also works to promote the profession of public IT management. ACT-IAC offers a wide range of programs to accomplish these purposes. ACT-IAC welcomes the participation of all public and private organizations committed to improving the delivery of public services through the effective and efficient use of IT. For membership and other information, visit the ACT-IAC website at Advanced Mobility Working Group (AMWG) ACT-IAC s AMWG sponsored the creation of this white paper. ACT-IAC created the AMWG to address mobility issues. The AMWG's mission is to foster collaboration between Government and industry in the area of mobile computing. The AMWG focuses on a variety of advanced mobility topics, including several components of the new Digital Government Strategy: - Make Existing High-Value Data and Content Available through Web APIs (Section 2) - Release Government-Wide Bring-Your-Own-Device (BYOD) Guidance Based on Lessons Learned From Successful Pilots at Federal Agencies (Section 3.3) - Set up a Government-Wide Mobile Device Management (MDM) Platform (Section 5.5) - Improve Priority Customer-Facing Services for Mobile Use (Section 7) - Promote the Safe and Secure Adoption of New Technologies (Section 9) - Develop Government-Wide Best Practices, Guidance and Standards (Section 9.1) - Evaluate and Streamline Security and Privacy Processes (Section 10) Disclaimer This document has been prepared to provide information regarding a specific issue. This document does not nor is it intended to take a position on any specific course of action or proposal. This document does not nor is it intended to endorse or recommend any specific technology, product or vendor. The views expressed in this document do not necessarily represent the official views of the individuals and organizations that participated in its development. Every effort has been made to present accurate and reliable information in this report. However, ACT-IAC assumes no responsibility for consequences resulting from the use of the information herein. Copyright American Council for Technology, This document may not be quoted, reproduced and/or distributed unless credit is given to the American Council for Technology-Industry Advisory Council. Further Information For further information, contact the American Council for Technology-Industry Advisory Council at (703) or Advancing Government Through Collaboration, Education and Action Page 2

3 Introduction The introduction of smartphones dramatically transformed the way people interact with mobile devices. Consumers now have a bevy of power at their fingertips to do everything from navigating their way to any destination to transferring money from their bank account to exploring the constellations using intuitive and intelligent applications. This paradigm shift has led the revolution of what is possible in the palm of your hand. Today, federal agencies are exploring how to extend and enhance their mission by leveraging the latest in mobile technologies. This means many are starting down the road of mission centric mobile systems development and how it will change and improve the way mission activities are executed. The road forward for these agencies was not without its challenges. This paper provides insight to what the Department of Veterans Affairs, the Census Bureau, Amtrak, and the Defense Advanced Research Projects Agency (DARPA) all learned along their journey to creating an advanced mobile enterprise. Panel Insights and Lessons Learned All panelists are directly involved in their organization s move to apply smart mobile technology to their mission. They each provided their unique and in depth perspectives on a number of topics. Panelists included: Kathy Frisbee, Co-Director, Connected Health, Office of Informatics and Analytics, Veterans Health Administration Tony Flynn, Senior Director, Business Mobile Systems, Amtrak Barbara LoPresti, Chief, Technical Management Office, United States Census Bureau Bill Dunlap, Assistant Chief Software Services, Support Services Office, Information Technology Services, DARPA The dialogue was broken into a series of questions and responses first led by the moderator, Jeremy Wood, Director of Application Development at the Government Printing Office (GPO), and then from the audience. Each topic brought forward rich dialogue and detailed insight as to the triumphs and obstacles encountered during the mobile application development process. Most Valuable Lessons Learned; What Can Others Learn? Smart mobile devices were primarily built for the commercial world. As Mr. Dunlap noted, most consumer devices today do not support the security standards of the federal enterprise, which means agencies must investigate alternative ways to protect their sensitive data. Beyond choosing the right platform, agencies must also consider, test, and validate third party solutions such as FIPS certified wrappers or sandboxes to meet their security requirements as well as ensure they function properly on their selected devices and operating system. Integrating devices and third party security tools can have a notable impact on application performance and usability without the right combination of solutions. It is also important to note that this technology will continue to evolve rapidly so it is critical that organizations continue to research and test available solutions as they progress. Once security requirements have been met, agencies can then move to the development of mobile systems and applications. Both simple and complex processes can benefit from mobilization depending on the existing workflow. When mobilizing a system or workflow, agencies must focus on mobile use cases that will achieve greater accuracy, better access to data, improved productivity, and tangible return on investment. When building mobile applications, government organizations should consider: Overall workflow benefits (outside just mobilization), Designing change management processes to prepare end users for the integration of mobile applications to their environment, Advancing Government Through Collaboration, Education and Action Page 3

4 Data response requirements and testing the performance prior to deployment, and Environmental impacts; conditions such as bright sunlight and limited to no connectivity have a significant impact on how organizations develop application(s). Within VHA, Ms. Frisbee found that even simple applications often require a robust support system in their environment. Many VHA applications are in support of veterans who are not necessarily techsavvy. To fill this gap, VHA is offering helpdesk and training as well as social media tools to their users, which ensures the users are getting the intended value from the application(s). Finally, because advanced mobility is quickly gaining traction in Government, all panelists felt that it was critical, prior to beginning any development, that a consistent, enterprise level mobile application development governance process be put in place. This ensures consistent standards across the agency and prevents duplication in effort within the organization. Security Challenges and Overcoming Them Universally, the panelists faced challenges around security and leveraging commercial platforms in a secure enterprise environment. Whether it was lack of FIPS certifications of the devices or navigating the unchartered territory of mobile device management (MDM) solutions and deployment. However, the lack of FIPS certification on the devices has led organizations to take calculated steps in evaluating their security posture as opposed to simply checking a box and moving on. As stated above, continued research and testing of available tools enable government organizations to have a true view of what mobile solutions are truly capable of within each unique IT environment. That way, once deployed, the solution set is providing the organization with the optimal, effective security posture. Panelists also identified that security challenges also occur organizationally. There is often a disparity in a mission or program office s mobile vision and how security requirements impact the realization of that vision. Steps must be taken to harmonize these components to ensure mobile systems that are deployed aren t so secure that they are not employed effectively. User satisfaction and experience are as critical to mobile success as security. Trade-offs on the following must be considered to ensure robust mobile systems: Network access Data access Authentication Device control Data encryption Sandboxing/containerization Generally, users understand the need for security provisions, but for different user groups different requirements may be appropriate. For users interacting with highly sensitive data such as PII or PHI, multi-factor authentication may be appropriate. However, for users submitting data such as maintenance requests, a complex password may be sufficient. Considering these security elements upfront will allow mobile processes to be executed much more fluidly. Native, HTML5 or Mobile Enterprise Application Platforms (MEAPS) Inevitably the biggest question asked from the audience was whether the panelist s organization had a platform preference and why. Each panelist had their own unique perspective and believed each platform has its place in federal mobility. Native application development is ideal when an organization wants to fully exploit all the device s native capabilities and achieve optimal performance. This is often best for more complex workflows. Advancing Government Through Collaboration, Education and Action Page 4

5 HTML5 applications are best when trying to reach broad audiences, such as VA s 4 million veterans, to accommodate a wide variety of device types. The downside to HTML5 apps is that they tend to lack the richness and performance of the dedicated, device-specific applications that users often prefer. Performance of HTML5 applications is also contingent upon connectivity; if there is a high degree of connectivity required to make the application function, HTML5 could present limitations. MEAPs can help transform the code of a more simple push application to work across multiple platforms, however, in the case of a more complex application with robust functionality, configuration requirements tend to eat into the perceived time and cost savings of this development route. The choice of platform, like the development of security requirements, heavily depends on the use case and purpose of the mobile system at hand. There is no one size fits all. In fact, to address this, Ms. LoPresti led an effort to develop on and test all major platforms in Census IT environment to determine which approach would best met the needs of their specific use cases and requirements. Infrastructure Support Traditionally, infrastructure support for mobility is thought of as simply the need to deploy a MDM solution. Panelists brought a deeper perspective on the infrastructure required to support mission centric mobile devices and applications. Most importantly, as noted by Mr. Flynn, there is a need to develop a sustainable concept of operations in concert with the implementation of a device management solution. This concept of operations will determine how an organization procures, provisions, configures, distributes, and destroys the devices. It will also define how applications are distributed, how role-based access control is to be implemented, and how security and governance policies will be enforced. Having these processes in place is paramount to streamlining the mobile enterprise. In addition, once an organization web-enables mission systems, it can spur an open field for development. While this enthusiasm is positive, without control, it can become the wild west. As a result, many agencies have seen the need for a development environment that helps enforce the concept of operations, creates efficiencies through code reuse, defines testing and certification procedures, and optimizes the application development process. Such an application environment can foster development while driving it in a controlled and consistent manner. Panelists agreed that this is often the last thing organizations think of on the journey to mobile application development, but could be the most fundamental in ensuring integrity. Summary While Government races to adopt the latest in mobile technologies and push applications out to its constituents and employees there many things to consider upfront such as infrastructure and security to development platforms and agency culture. Clearly, the panel demonstrated that mobile application development is multi-faceted and any one gap can cause unexpected stalls and potential security issues. What will continue to be important and keep government at the edge is the ability for federal agencies to communicate with each other about pinnacles and pitfalls they experience in the new mobile world. One thing is certain smart mobile devices transformed computing and are now having a transformational effect on the Federal Government and how they execute their mission. Authors & Affiliations Melissa Adamson, Agilex Jeremy Wood, Government Printing Office Christina Fisher, Appian Geary Brummell, Microsoft Advancing Government Through Collaboration, Education and Action Page 5