Pentagon network chiefs are putting automation to work
Lt. Gen. Maria Barrett takes command of U.S. Army Cyber Command (ARCYBER) in a ceremony at Fort Gordon, Ga., May 3, 2022. U.S. Army / Joseph McClammy
Tireless cyber tools can patrol parts of DOD’s networks, tools, and applications where hackers like to hide.
BALTIMORE—If pilots can use automation to take off and land, then the Defense Department can use it to run its networks, said Lt. Gen. Maria Barrett, commander of Army Cyber Command.
“We fly planes on autopilot. We land them on autopilot. This is not scary to run a network in an automated way,” Barrett said Tuesday during the AFCEA TechNet Cyber conference.
The Pentagon and military services are all working to convert their networks and processes to zero trust architectures, which rely on automation to continuously verify that no one’s accessing data they shouldn’t. The goal is a fully zero trust Pentagon by 2027.
“Zero trust is all about looking at the data. And so it's not just about the human being who logs in as an identity, because at the end of the day, that is a data element. But it's also some of those machine-to-machine interactions, which—so far in some of our tools and applications, those interactions where the adversary can hide—those have been largely hidden to us,” Barrett said during a panel discussion with the service cyber component commands. “Let's start getting down to understanding how that software interacts, to seeing it, and then we can start to really defend our networks much better.”
Looking at data based on how it flows — from outside of a network to inside or bouncing around from servers internally — is outdated. But automating cybersecurity in a way that continuously monitors who and what is accessing the network will have its own challenges.
Barrett mentioned the Defense Department’s Joint Regional Security Stacks, or JRSS, program, which is the toolkit DOD used to protect its IT infrastructure, that has suffered from latency and security weaknesses.
“It was a good idea,” Barrett said, “but I think that we have run its course and we do really need to get to this piece where we're now starting to think about looking for the anomalous data that occurs in several different aspects of our network in order to identify where the adversary is much sooner and…in an automated way.”
The Defense Information Systems Agency is phasing out JRSS as it brings its zero trust prototype system, dubbed Thunderdome, online. Moreover, DISA wants to improve that boundary defense with commercial technologies that can make it “simpler and less complex,” Lt. Gen. Robert Skinner, the agency’s director, said during his keynote.
JRSS, and the IT it protects, “is so complex that we cannot harmonize user experience and cybersecurity. It just can't be done,” said Skinner, who challenged the agency’s Digital Capabilities and Security Center to push Thunderdome into production by the summer.
Zero trust won’t suddenly mean everyone has access to everything, said Lt. Gen. Kevin Kennedy, commander of the 16th Air Force and Air Forces Cyber.
But zero trust won’t make the Defense Department’s networks more open. Kennedy said the Air Force has a three-pronged approach: modernizing encryption, updated boundary security, and improving identity and access management.
“There are still boundary defenses,” Kennedy said during the panel. “We want to protect the data, we want to discover what's happening in the environment, we need to look at sensors to really understand the baseline and kind of get a sense of what's happening in the data and what's transiting our environment. But we also have to make sure the environment’s available.”
Skinner said the agency is also using automation to determine what normal network activity looks like, which will help cyber operators spot problems.
"The other thing that we're working on is secure validation. Leveraging adversary TTPs, how are our defenses operating? Is it nominally? Are they operating the way they're supposed to be? In a lot of instances, we don't know today. We think it is but there's no automated way of validating that," Skinner said.