Countdown to 2027: Where to Start Implementing the Zero Trust Strategy for the Department of Defense
Defense Department organizations have four years to deploy seven pillars, including 45 core capabilities of zero trust.
"I hear more about IT revolution than evolution these days, but I think IT is more evolution," DIA CIO Doug Cossa said.
"The ultimate goal is understanding exactly what is happening on the network, who is connecting, what is connected, and what are those devices and users doing on the network so you can make sure that, where connection is necessary for a mission, it's available but also that it's secure," Forescout's Dean Hullings said.
"If there's one thing DoD and industry have done, it's try a whole bunch of different tools over the last 10 to 12 years. What we have to do now is string them all together to show which ones work best for the capabilities the Army needs today and divest the ones that they don't need," Peraton VP Jennifer Napper said.
"I will offer you there will be no sanctuary in the next fight. We have to have a resilient network," Lt. Gen. John Morrison said.
"I have a mantra of 'I want to kill to the [Common Access Card] as the primary authentication mechanism for the department'," Lt. Gen. Robert Skinner said. "Industry has better authentication, and it's not just two-factor, it's truly multi-factor authentication."
The new office is slated for October, Pentagon CIO John Sherman said, while also giving updates on the Spectrum Strategy implementation plan and the cyber workforce strategy.
The space rush will result in tens of thousands of new assets launched within the decade, which will create a "truly enormous" cyber attack surface, said Sam Visner, a technical fellow at the MITRE Corporation.
The Security Measures publication focuses on running software, while the Recommended Minimum Standards focuses on developing it.
"This is a good reminder that the GRU remains a looming threat, which is especially important given the upcoming Olympics, an event they may well attempt to disrupt," observed John Hultquist, VP of Analysis at Mandiant Threat Intelligence.
Rep. Langevin criticized the 2022 budget overview for its brevity, opacity, and appearance as "nearly a carbon copy" of the 2021 document. "If DoD were a high school student, I would have called [the 2022 budget overview] plagiarism."
OSCAL's goal is to enable compliance and security assessments to keep pace in complex, fast-moving, ever-changing DevSecOps environments.
The budget requests funding for four new teams for the Cyber Mission Force. Those teams will support CYBERCOM operations and provide cyber support for space operations.
Zero-trust security "is not one single product that one can purchase off the shelf," a NIST scientist observes. But underlying zero trust's many component parts are a few critical elements, including identity and automation.