Loading contract…
BETAThis is a new independent transparency project, not an official government website. The data is sourced from public registers and may contain errors, so always verify against the official source. If you find a problem, please report it here.
Delivering Apps to Smartphones is a key element of transforming the digital workplace and providing colleagues with modern solutions which enable them to be more efficient and effective. To date the delivery of Apps to the DWP store has been slow and/or resulted in apps being declined due to primarily to security concerns and lack of the right tools and internal capability to be able to assess and understand app behaviour.
In a global landscape where we have new vulnerabilities continuously emerging, we have the opportunity to secure an 'App Threat Assessment' from a third party.
Options Considered
The desired outcome is:
New apps added to the DWP App store in volume and at pace. User experience enhanced and colleagues have a wider range of apps to improve productivity
Security risks reduced
Two options have been considered and tested:
Internal Service: A test rig was developed which identified which IP addresses each app accessed. Whilst this provided some helpful information, it did not provide an assessment of
If/what data is being transferred/leaked out of DWP;
Which phone services are being used by the app e.g. blue tooth, location services etc.
any underlying and/or unexpected behaviours being performed by the app
This resulted in a considerable amount of residual product and security team effort which in a number of cases failed to determine the associated risk due to a lack of visibility of app behaviour.
External, expert service: In 2017, as a proof of concept 3 apps were sent for review by 4 suppliers, specialising in threat assessments. Each supplier provided a comprehensive threat assessment which will enable DWP to make an informed assessment of each app within 24 hours of request. The security community as well as the product team were impressed with the granularity of detail provided.
Doing nothing would expose the department to security risks or lost data. Therefore external procurement is recommended.
| Supplier | Identifier | Award Value | Cross-References |
|---|---|---|---|
| KRYPTOWIRE LLC | - | £160,000 | - |