30 septembre 2020 | International, C4ISR, Sécurité

The DoD needs data-centric security, and here’s why

Drew Schnabel

The U.S. Department of Defense is set to adopt an initial zero-trust architecture by the end of the calendar year, transitioning from a network-centric to a data-centric modern security model.

Zero trust means an organization does not inherently trust any user. Trust must be continually assessed and granted in a granular fashion. This allows defense agencies to create policies that provide secure access for users connecting from any device, in any location.

“This paradigm shift from a network-centric to a data-centric security model will affect every arena of our cyber domain, focusing first on how to protect our data and critical resources and then secondarily on our networks,” Vice Adm. Nancy Norton, director of the Defense Information Systems Agency and commander of the Joint Force Headquarters-Department of Defense Information Network, said at a virtual conference in July.

How does the Pentagon's AI center plan to give the military a battlefield advantage?

The Pentagon's artificial intelligence hub is working on tools to help in joint, all-domain operations as department leaders seek to use data to gain an advantage on the battlefield.

Andrew Eversden

To understand how the DoD will benefit from this new zero-trust security model, it's important to understand the department's current Joint Information Environment, or JIE, architecture; the initial intent of this model; and why the JIE can't fully protect modern networks, mobile users and advanced threats.

Evolving DoD information security

The JIE framework was developed to address inefficiencies of siloed architectures. The goal of developing a single security architecture, or SSA, with JIE was to collapse network security boundaries, reduce the department's external attack surface and standardize management operations. This framework helped ensure that defense agencies and mission partners could share information securely while reducing required maintenance and continued infrastructure expenditures.

Previously, there were more than 190 agency security stacks located at the base/post/camp/station around the globe. Now, with the JIE architecture, there are just 22 security stacks centrally managed by the Defense Information Systems Agency to provide consistent security for users, regardless of location.

“This paradigm shift from a network-centric to a data-centric security model will affect every arena of our cyber domain, focusing first on how to protect our data and critical resources and then secondarily on our networks,” Vice Adm. Nancy Norton, director of the Defense Information Systems Agency and commander of the Joint Force Headquarters-Department of Defense Information Network, said at a virtual conference in July.

To understand how the DoD will benefit from this new zero-trust security model, it's important to understand the department's current Joint Information Environment, or JIE, architecture; the initial intent of this model; and why the JIE can't fully protect modern networks, mobile users and advanced threats.

Evolving DoD information security

The JIE framework was developed to address inefficiencies of siloed architectures. The goal of developing a single security architecture, or SSA, with JIE was to collapse network security boundaries, reduce the department's external attack surface and standardize management operations. This framework helped ensure that defense agencies and mission partners could share information securely while reducing required maintenance and continued infrastructure expenditures.

Previously, there were more than 190 agency security stacks located at the base/post/camp/station around the globe. Now, with the JIE architecture, there are just 22 security stacks centrally managed by the Defense Information Systems Agency to provide consistent security for users, regardless of location.

Initially, the JIE was an innovative concept that took the DoD from a highly fragmented architecture, in which each agency managed its own cybersecurity strategy, to an architecture in which there is a unified SSA.

However, one of the early challenges identified for the JIE was managing cloud cybersecurity as part of the SSA. The components in the JIE — the Joint Regional Security Stacks family's internet access points and cloud access points — have traditionally focused on securing the network, rather than the data or user.

As more DoD employees and contractors work remotely and data volumes increase, hardware cannot scale to support them. This has created ongoing concerns with performance, reliability, latency and cost.

A cloud-first approach

In response, the DoD leverages authorized solutions from the Federal Risk and Authorization Management Program, and it references the Secure Cloud Computing Architecture guidance for a standard approach for boundary and application-level security for impact Level 4 and 5 data hosted in commercial cloud environments.

The purpose of the SCCA is to provide a barrier of protection between the DoD Information Services Network and the commercial cloud services that the DoD uses while optimizing the cost-performance trade in cybersecurity.

Defense agencies are now exploring enterprise-IT-as-a-service options to move to cloud, and reduce the need for constant updates and management of hardware. Through enterprise-IT-as-a-service models, defense agencies will be able to scale easily, reduce management costs and achieve a more competitive edge over their adversaries.

Before the pandemic hit, defense agencies were already moving to support a more mobile workforce, where employees can access data from anywhere on any device. However, a cyber-centric military requires security to be more deeply ingrained into employee culture rather than physical protection of the perimeter.

The next evolution to secure DISA and DoD networks is to embrace a secure access edge model with zero-trust capabilities. The SASE model moves essential security functions — such as web gateway firewalls, zero-trust capabilities, data loss prevention and secure network connectivity — all to the cloud. Then, federal employees have direct access to the cloud, while security is pushed as close to the user/data/device as possible.

SP 800-27, zero-trust guidance from the National Institute of Standards and Technology, provides a road map to migrate and deploy zero trust across the enterprise environment. This guidance outlines the necessary tenants of zero trust, including securing all communication regardless of network location, and granting access on a per-session basis. This creates a least-privilege-access model to ensure the right person, device and service have access to the data they need while protecting high-value assets.

As the DoD transforms the JIE architecture to an as-a-service model with zero-trust capabilities, defense agencies will experience cost savings, greater scalability, better performance for the end user and war fighter, improved visibility, and control across DoD networks — and ultimately a stronger and more holistic cybersecurity capability moving forward.

https://www.c4isrnet.com/opinion/2020/09/29/the-dod-needs-data-centric-security-and-heres-why/

Sur le même sujet

  • New fighter jets to look for in 2021

    5 janvier 2021 | International, Aérospatial

    New fighter jets to look for in 2021

    While commercial aviation stalled in 2020, many military programs did not so. As a result, 2021 is going to be an eventful year for aviation enthusiasts. Let's see, what new fighter jets are going to see the skies or finish their development cycle in the new year. Shenyang FC-31 A decade ago, China surprised the world with Chengdu J-20, becoming the second nation in the world with domestically-produced fifth-generation fighter jets in operational capability. But J-20s are large and expensive, and just as the United States several years before, China became interested in smaller, cheaper alternatives. One alternative was offered by Shenyang Aircraft Corporation. While not much is known about the secretive aircraft, it is likely it was export-oriented at first, and repurposed as a light, possibly carrier-based companion to the J-20 later. The prototype of FC-31 first flew in 2012, but disappeared from the public eye shortly after. The aircraft returned in 2020, much improved, and with the rumors that the mass-production is about to start. We will probably see the resolution of its story in 2021: the aircraft may be officially adopted, deployed, or at least showcased in its primary role on one of China's aircraft carriers. KAI KF-X The first Korean fifth-generation fighter jet entered the development back in 2001. The project evolved, partnering with Indonesian Aerospace and United States' Lockheed-Martin, and gaining more and more government's interest as the geopolitical situation in the region heated up. KAI began building several prototypes in 2019, at least part of them scheduled for completion in mid-2021. According to the developers, the work is going as planned, so, the rollout of the first prototype will likely happen in the coming summer, followed by a round of ground tests. The maiden flight is scheduled for 2022 though, so, we will have to wait another year to see the new jet taking to the skies. Boeing F-15EX https://www.aerotime.aero/26839-New-fighter-jets-to-look-for-in-2021

  • Lockheed wins $4.1 bln battle command system contract from US govt
  • Contract Awards by US Department of Defense - July 06, 2020

    7 juillet 2020 | International, Aérospatial, Naval, Terrestre, C4ISR, Sécurité

    Contract Awards by US Department of Defense - July 06, 2020

    DEFENSE LOGISTICS AGENCY Raytheon Co., Andover, Massachusetts, has been awarded a $6,000,000,000 modification (P00102) to six-year base contract SPRBL1-15-D-0017 with one four-year option period, to add an additional year of performance and increase funding for depot-level repairables and consumable spare parts, as well as repair and engineering services for multiple weapon systems. This modification increases the contract ceiling from $2,000,000,000 to $8,000,000,000. This was a sole-source acquisition using justification 10 U.S. Code 2304 (c)(1), as stated in Federal Acquisition Regulation 6.302-1. This is an indefinite-delivery/indefinite-quantity contract with both fixed-price and cost elements. Location of performance is Massachusetts, with a Sept. 27, 2021, ordering period end date. Using customer is the Department of Defense. Type of appropriation is fiscal 2020 through 2021 Army working capital funds and other procurement funds as necessary. The contracting activity is the Defense Logistics Agency Land and Maritime, Aberdeen Proving Ground, Maryland. Federal Prison Industries,** doing business as UNICOR, Washington, D.C., has been awarded a maximum $14,220,050 modification (P00006) exercising the second one-year option period of one-year base contract SPE1C1-18-D-1069 with two one-year option periods for physical fitness uniform trunks. This is a firm-fixed-price, indefinite-delivery/indefinite-quantity contract. Locations of performance are Washington, D.C.; Minnesota; Colorado; Louisiana; Kentucky; and New Jersey, with a July 11, 2021, ordering period end date. Using military service is Army. Type of appropriation is fiscal 2020 through 2021 defense working capital funds. The contracting activity is the Defense Logistics Agency Troop Support, Philadelphia, Pennsylvania. Melton Sales & Service,* Columbus, New Jersey, has been awarded a maximum $10,093,553 firm-fixed-price, indefinite-delivery/indefinite-quantity contract for transfer transmissions. This was a sole-source acquisition using justification 10 U.S. Code 2304 (c)(1), as stated in Federal Acquisition Regulation 6.302-1. This is a three-year contract with no option periods. Location of performance is New Jersey, with a July 6, 2023, ordering period end date. Using military service is Army. Type of appropriation is fiscal 2020 through 2023 Army working capital funds. The contracting activity is the Defense Logistics Agency Land and Maritime, Warren, Michigan (SPRDL1-20-D-0117). Bridgestone Americas Tire Operations LLC, doing business as GCR Tire Service, Phoenix, Arizona, has been awarded a maximum $8,709,450 firm-fixed-price requirements contract for M870 series low bed semitrailer wheel pneumatic tires. This was a competitive acquisition with one response received. This is a three-year contract with no option periods. Location of performance is Arizona, with a July 5, 2023, performance completion date. Using military service is Army. Type of appropriation is fiscal 2020 through 2023 Army working capital funds. The contracting activity is the Defense Logistics Agency Land and Maritime, Warren, Michigan (SPRDL1-20-D-0096). NAVY Vigor Marine LLC, Portland, Oregon, is awarded a $133,406,869 firm-fixed-price contract to prepare for and accomplish repair and alteration requirements for USS McCampbell (DDG 85) chief of naval operations scheduled depot maintenance availability. This contract includes options which, if exercised, will bring the cumulative value of this contract to $155,621,173. Work will be performed in Portland, Oregon. USS McCampbell will receive comprehensive modernization for DDG 51 class ships to ensure a mission relevant service life. These improvements will include hull, mechanical and electrical technology insertion; as well as provide critical warfighting improvements, such as upgraded machinery control system, integrated bridge and navigation system (to include physical throttles); advanced galley upgrade; wireless communications and digital video surveillance system upgrade; upgrade to a fiber optic local area network backbone; AEGIS baseline 9 upgrade (that includes updated guns weapons system); enhanced Vertical Launching System; multi-mission signal processor; and Ballistic Missile Defense 5.0 upgrade. Work is expected to be completed by November 2021. Fiscal 2020 operation and maintenance (Navy); and fiscal 2020 other procurement (Navy) funding in the amount of $154,319,412 will be obligated at time of award. Funds in the amount of $21,166,210 will expire at the end of the current fiscal year. In accordance with 10 U.S. Code 2304(c)(3), this contract was not competitively procured. The Puget Sound Naval Shipyard and Intermediate Maintenance Facility, Bremerton, Washington, is the contracting activity (N4523A-20-D-0550). Cubic Defense Applications Inc., Orlando, Florida, is awarded a $99,100,000 firm-fixed-price, cost-plus-fixed-fee, indefinite-delivery/indefinite-quantity contract. This contract supports the Surface Training Immersive Gaming and Simulations effort and provides for the development, delivery and total life cycle support of a new virtual environment training system. Work will be performed in Orlando, Florida. Life cycle support of the new training systems includes updates, maintenance, upgrades and modifications to surface ship trainers and associated courseware to maintain fleet operational readiness. This system will be one of the pillars under the overall Surface Training Advanced Virtual Environment Program. Work is expected to be completed by July 2025. No funds will be obligated at the time of award, but will be obligated on individual orders as they are issued. This contract was competitively procured via an electronic request for proposal and six offers were received. The Naval Air Warfare Center Training Systems Division, Orlando, Florida, is the contracting activity (N61340-20-D-0018). Jacobs/B&M JV, Pasadena, California, is awarded a $99,000,000 maximum amount, indefinite-delivery/indefinite-quantity, architect-engineer contract for architect-engineer services. This includes the design, engineering, specification writing, cost estimating and related services at various locations under the cognizance of then Naval Facilities Engineering Command (NAVFAC) Pacific. No task orders are being issued at this time. Work will be performed at various Navy, Marine Corps, Air Force and other government facilities within the NAVFAC Pacific area of operations, including but not limited to, Guam and the Commonwealth of the Northern Marianas Islands (75%); Australia (15%); Hawaii (5%); and Diego Garcia (5%). The work to be performed provides for the preparation of region/Facilities Engineering Command team; DD Form 1391 project documentation; engineering studies; specifications utilizing the Department of Defense SpecsIntact program; cost estimates utilizing the micro-computer aided cost estimating system (second generation); design and engineering services for functional analysis and concept development; request for proposal (RFP) documentation for design-build projects; and RFP documentation, plans and specifications for design-bid-build projects. The term of the contract is not to exceed 60 months and is expected to be completed by July 2025. Fiscal 2018 military construction (planning and design) contract funds in the amount of $10,000 are obligated on this award and will not expire at the end of the current fiscal year. Future task orders will be primarily funded by military construction (planning and design). This contract was competitively procured via the Navy Electronic Commerce Online website and two proposals were received. The NAVFAC Pacific, Joint Base Pearl Harbor-Hickam, Hawaii, is the contracting activity (N62742-20-D-0002). HDR Environmental, Operations and Construction Inc., Englewood, Colorado, is awarded a $75,000,000 maximum amount, indefinite-delivery/indefinite-quantity contract to conduct marine species monitoring services and implement components of the Navy's Integrated Comprehensive Monitoring Program. No task orders are being issued at this time. The primary geographic area covered by this contract encompasses the Naval Facilities Engineering Command (NAVFAC) Atlantic and Pacific areas of operations. Additionally, tasks associated with this contract may be assigned anywhere in the world. The work to be performed will obtain services for performance of marine resources monitoring and program management in support of Navy environmental compliance and reporting requirements. Services may include, but are not limited to, literature review and data searches; aerial, shipboard, and/or underwater visual surveys; passive acoustic monitoring; assessments to determine potential impacts from military activities; behavioral studies and controlled exposure experiments; biopsy sampling; tagging and tracking; analysis of data and technical assistance to ensure legal compliance; preparation of necessary reports, consultation packages and permit applications; and management and coordination of complex projects with other Federal agencies, institutions and organizations spanning a wide range of geographic locations. The term of the contract is not to exceed 60 months with an expected completion date of July 2025. Fiscal 2020 operations and maintenance (Navy) (O&M, N) contract funds in the amount of $5,000 are obligated on this award and will expire at the end of the current fiscal year. Future task orders will be primarily funded by O&M, N. This contract was competitively procured via the beta.SAM.gov website, and two proposals were received. The NAVFAC Atlantic, Norfolk, Virginia, is the contracting activity (N62470-20-D-0016). Raytheon Missiles and Defense, Tucson, Arizona, is awarded a $34,749,670 modification (P00011) to previously-awarded fixed-price-incentive-firm contract N00019-18-C-1068. This modification provides for the production and delivery of 58 additional Lot 20 AIM-9X Block II all up round tactical missiles (29 for the Navy and 29 for the Air Force); an additional 61 Block II Captive Air Training Missiles (one for the Navy and 60 for the Air Force); an additional 35 all up round containers (12 for the Navy and 23 for the Air Force); and one lot of spares assets for the governments of Finland, Israel, the Netherlands, Norway, Singapore, Turkey and Poland. Work will be performed in Tucson, Arizona (31%); Andover, Massachusetts (10%); Keyser, West Virginia (9%); Santa Clarita, California (8%); Hillsboro, Oregon (5%); Ottawa, Ontario, Canada (5%); Goleta, California (4%); Cheshire, Connecticut (4%); Heilbronn, Germany (3%); Simsbury, Connecticut (2%); San Jose, California (2%); Valencia, California (2%); Anaheim, California (2%); Cajon, California (2%); Cincinnati, Ohio (1%); Anniston, Alabama (1%); San Diego, California (1%); Chatsworth, California (1%); Amesbury, Massachusetts (1%); Claremont, California (1%); Sumner, Washington (1%); and various locations within the continental U.S. (4%), and is expected to be completed by July 2023. Fiscal 2020 missile procurement (Air Force) funds in the amount of $23,081,565; fiscal 2020 weapons procurement (Navy) funds in the amount of $11,021,806; fiscal 2019 missile procurement (Air Force) funds in the amount of $135,020; fiscal 2019 weapons procurement (Navy) funds in the amount of $40,506; fiscal 2018 missile procurement (Air Force) funds in the amount of $40,506; fiscal 2018 weapons procurement (Navy) funds in the amount of $13,502; and Foreign Military Sales funds in the amount of $416,765 will be obligated at the time of award, $54,008 of which will expire at the end of the current fiscal year. The Naval Air Systems Command, Patuxent River, Maryland, is the contracting activity. Avian-Precise Co.,* Lexington Park, Maryland, is awarded a $19,700,000 modification (P00006) to previously-awarded cost-plus-fixed-fee, cost reimbursable, indefinite-delivery/indefinite-quantity contract N00421-18-D-0016. This modification provides sustainment engineering, training and tools in support of the Naval Air Systems Command engineering group. Work will be performed in Patuxent River, Maryland (91%); and Jacksonville, Florida (9%), and is expected to be completed by April 2023. No funds are being obligated at time of award, funds will be obligated on individual orders as they are issued. The Naval Air Warfare Center Aircraft Division, Patuxent River, Maryland, is the contracting activity. Signal Systems Corp.,* Millersville, Maryland, is awarded a $13,467,258 cost-plus-fixed-fee order (N68335-20-F-0324) against previously-issued basic ordering agreement N68335-20-G-1062. This order provides for advanced Small Business Innovation Research (SBIR) products for airborne anti-submarine warfare (ASW) and undersea warfare continued research and development efforts under SBIR Topic N04-007, "Continuous Active Sonar Signal Processing;" Topic N093-168, "Target Localization Using Multi-Static Sonar with Drifting Sonobuoys;" and Topic N101-005, "Spread Spectrum Techniques for Sonar Ping Technology." Work will be performed in Millersville, Maryland (83%); and Lexington Park, Maryland (17%). The applications to be further developed include acoustic ASW sensors and systems; telemetry and recording systems; signal and data processing; algorithm development; mathematical modeling; system and application prototyping; active and passive display enhancements; information assurance, anti-tampering and cybersecurity concepts; and techniques and analysis to predict the performance of the associated ASW systems. Work is expected to be completed by July 2025. Fiscal 2020 research, development, test and evaluation (Navy) funds in the amount of $683,000 will be obligated at time of award, none of which will expire at the end of the current fiscal year. The Naval Air Warfare Center Aircraft Division, Lakehurst, New Jersey, is the contracting activity. Lockheed Martin Rotary and Mission Systems, Baltimore, Maryland, is awarded a $12,805,321 not to exceed, indefinite-delivery/indefinite-quantity, cost-plus-fixed-fee contract for materials and engineering services required to develop and integrate technological improvements for the DDG-51 hull; mechanical and electrical machinery control systems (MCS); Littoral Combat Ship (LCS) Freedom class MCS; and Landing Helicopter Dock/A (LHD/A) MCS installed onboard current Navy ships in support of Naval Surface Warfare Center, Philadelphia Division. Work will be performed in Orlando, Florida (65%); the remaining (35%) will be performed in Baltimore, Maryland; Philadelphia, Pennsylvania; San Diego, California; Norfolk, Virginia; and Mayport, Florida, as determined by the individual task orders. The services under this contract will support the development, implementation, execution and life cycle sustainment of shipboard MCS for LCS class, LHD/A class and DDG class surface ship machinery control equipment and systems, as well as serve the Logistics Management Branch of the Naval Surface Warfare Center, Philadelphia Division. This statement of work requests highly specialized services that only Lockheed Martin can support. As such, Lockheed Martin has developed proprietary test scripts and test equipment to provide for delivery and support of MCS systems and components. Work is expected to be completed by July 2026. Fiscal 2017 shipbuilding and conversion (Navy) funding in the amount of $500 ($500 minimum guarantee for contract) will be obligated at time of award via an individual task order and will not expire at the end of the current fiscal year. This contract was not competitively procured via the Federal Business Opportunities. In accordance with 10 U.S. Code 2304(c)(1), this contract was not competitively procured; there was one responsible source and no other supplies or services will satisfy agency requirements. The Naval Surface Warfare Center Philadelphia Division, Philadelphia, Pennsylvania, is the contracting activity (N64498-20-D-0009). ARMY General Dynamics Land Systems, Sterling Heights, Michigan, was awarded a $10,260,921 modification (P00110) to contract W56HZV-17-C-0067 for Abrams systems technical support. Work will be performed in Sterling Heights, Michigan, with an estimated completion date of March 31, 2022. Fiscal 2020 Foreign Military Sales (Taiwan) funds in the amount of $10,260,921 were obligated at the time of the award. U.S. Army Contracting Command, Detroit Arsenal, Michigan, is the contracting activity. *Small Business **Mandatory Sour https://www.defense.gov/Newsroom/Contracts/Contract/Article/2261436/source/GovDelivery/

Toutes les nouvelles