Monday, January 30, 2023
  • About us
    • Write for us
    • Disclaimer
    • Terms of use
    • Privacy Policy
  • RSS Feeds
  • Advertise with us
  • Contact us
DefenceTalk
  • Home
  • Defense News
    • Defense & Geopolitics News
    • War Conflicts News
    • Army News
    • Air Force News
    • Navy News
    • Missiles Systems News
    • Nuclear Weapons
    • Defense Technology
    • Cybersecurity News
  • Military Photos
  • Defense Forum
  • Military Videos
  • Military Weapon Systems
    • Weapon Systems
    • Reports
No Result
View All Result
  • Home
  • Defense News
    • Defense & Geopolitics News
    • War Conflicts News
    • Army News
    • Air Force News
    • Navy News
    • Missiles Systems News
    • Nuclear Weapons
    • Defense Technology
    • Cybersecurity News
  • Military Photos
  • Defense Forum
  • Military Videos
  • Military Weapon Systems
    • Weapon Systems
    • Reports
No Result
View All Result
DefenceTalk
No Result
View All Result

US DoD Releases Path to Cyber Security Though Zero Trust Architecture

by US Department of Defense
November 28, 2022
in Cybersecurity
4 min read
0
US DoD Releases Path to Cyber Security Though Zero Trust Architecture

Marines with Marine Corps Forces Cyberspace Command pose for photos in the cyber operations center at Lasswell Hall aboard Fort Meade, Maryland, Feb. 5, 2020. MARFORCYBER Marines conduct offensive and defensive cyber operations in support of United States Cyber Command and operate, secure and defend the Marine Corps Enterprise Network. This image is a photo illustration.

14
VIEWS

The Defense Department on Tuesday released its Zero Trust Strategy and Roadmap, which spells out how it plans to move beyond traditional network security methods to achieve reduced network attack surfaces, enable risk management and effective data-sharing in partnership environments, and contain and remediate adversary activities over the next five years.

“Zero trust is a framework for moving beyond relying on perimeter-based cybersecurity defense tools alone and basically assuming that breach has occurred within our boundary and responding accordingly,” David McKeown, the department’s acting chief information officer, said.

McKeown said the department has spent a year now developing the plans to get the department to a zero trust architecture by fiscal year 2027. Included in that effort was development of a Zero Trust Portfolio Management Office, which stood up earlier this year.

“With the publication of this strategy we have articulated the ‘how’ that can address clear outcomes of how to get to zero trust — and not only accelerated technology adoption, as discussed, but also a culture of zero trust at DOD and an integrated approach at the department and the component levels.”

Getting the Defense Department to reach the goals laid out in the Zero Trust Strategy and Roadmap will be an “ambitious undertaking,” McKeown said.

Ensuring that work will largely be the responsibility of Randy Resnick, who serves as the director of the Zero Trust Portfolio Management Office.

“With zero trust, we are assuming that a network is already compromised,” Resnick said. “And through recurring user authentication and authorization, we will thwart and frustrate an adversary from moving through a network and also quickly identify them and mitigate damage and the vulnerability they may have exploited.”

Resnick explained the difference between a zero trust architecture and security on the network today, which assumes a level of trust for anybody already inside the network.
“If we compare this to our home security, we could say that we traditionally lock our windows and doors and that only those with the key can gain access,” he said. “With zero trust, we have identified the items of value within the house and we place guards and locks within each one of those items inside the house. This is the level of security that we need to counter sophisticated cyber adversaries.”

The Zero Trust Strategy and Roadmap outlines four high-level and integrated strategic goals that define what the department will do to achieve that level of security. These include:

  • Zero Trust Cultural Adoption — All DOD personnel understand and are aware, trained, and committed to a zero trust mindset and culture to support integration of zero trust.
  • DOD information Systems Secured and Defended — Cybersecurity practices incorporate and operationalize zero trust in new and legacy systems.
  • Technology Acceleration — Technologies deploy at a pace equal to or exceeding industry advancements.
  • Zero Trust Enablement — Department- and component-level processes, policies, and funding are synchronized with zero trust principles and approaches.

Resnick said development of the Zero Trust Strategy and Roadmap was done in collaboration with the National Security Agency, the Defense Information Systems Agency, the Defense Manpower Data Center, U.S. Cyber Command and the military services.

The department and its partners worked together to develop a total of 45 capabilities and more than 100 activities derived from those capabilities, many of which the department and components will be expected to be involved in as part of successfully achieving baseline, or “target level” compliance with zero trust architecture within the five-year timeline, Resnick said.

“Each capability, the 45 capabilities, resides either within what we’re calling ‘target,’ or ‘advanced’ levels of zero trust,” he said. “DOD zero trust target level is deemed to be the required minimum set of zero trust capability outcomes and activities necessary to secure and protect the department’s data, applications, assets and services, to manage risks from all cyber threats to the Department of Defense.”

Across the department, every agency will be expected to comply with the target level implementation outlined in the Zero Trust Strategy and Roadmap. Only a few might be expected to achieve the more advanced level.

“If you’re a national security system, we may require the advanced level for those systems,” McKeown said. “But advanced really isn’t necessary for literally every system out there. We have an aggressive goal getting to ‘targeted’ by 2027. And we want to encourage those who have a greater need to secure their data to adopt this advanced level.”

Resnick said achieving the target level of zero trust isn’t equivalent to a lower standard for network security.

“We defined target as that level of ability where we’re actually containing, slowing down or stopping the adversary from exploiting our networks,” he said. “Compared to today, where an adversary could do an attack and then go laterally through the network, frequently under the noise floor of detection, with zero trust that’s not going to be possible.”

By 2027, Resnick said, the department will be better poised to prevent adversaries from attacking the DOD network and minimize damage if it does occur.

“The target level of zero trust is going to be that ability to contain the adversary, prevent their freedom of movement, from not only going laterally but being able to even see the network, to enumerate the network, and to even try to exploit the network,” he said.

If later on more is needed, he said, the requirements for meeting the target level of compliance can be adjusted.

“Target will always remain that level to which we’re seeing and stopping the adversary,” he said. “And for the majority of the DOD, that’s really our goal.”

Tags: cybersecuritynetwork securityzero trustZero Trust Architecture
Previous Post

US bans gear from China’s Huawei and ZTE over security risk

Next Post

China Military Power Report Examines Changes in Beijing’s Strategy

Related Posts

US should buy control of Nokia, Ericsson to fight Huawei: attorney general

US bans gear from China’s Huawei and ZTE over security risk

November 28, 2022

US authorities announced a ban Friday on the import or sale of communications equipment deemed "an unacceptable risk to national...

Cybersecurity for 2020 Elections a Top DoD Priority, General Says

Cyber vulnerability in networks used by spacecraft, aircraft and energy generation systems

November 16, 2022

A major vulnerability in a networking technology widely used in critical infrastructures such as spacecraft, aircraft, energy generation systems and...

Next Post
China Military Power Report Examines Changes in Beijing’s Strategy

China Military Power Report Examines Changes in Beijing's Strategy

Latest Defense News

India approves purchase of 33 Russian fighter jets

Two Indian military jets crash, one pilot killed

January 30, 2023
China made third-largest air incursion this year, says Taiwan

Senior US general warns of possible looming war with China

January 28, 2023
French Air Force Mirage 2000 jet fighter

France could meet Ukraine’s demand for fighter jets

January 27, 2023
Denmark in talks with Israel to replace howitzers donated to Ukraine

Denmark in talks with Israel to replace howitzers donated to Ukraine

January 27, 2023
Israel, Gaza militants trade missiles after deadly West Bank raid

Israel, Gaza militants trade missiles after deadly West Bank raid

January 27, 2023
Leopard tanks to arrive in Ukraine around late March: Germany

Leopard tanks to arrive in Ukraine around late March: Germany

January 27, 2023

Defense Forum Discussions

  • Japan, Koreas, China and Taiwan regional issues
  • Italy defence procurement, arms counter-trade and weapons exports
  • China - Geostrategic & Geopolitical.
  • Military Aviation News and Discussion
  • Turkish navy
  • NATO
  • The Russian-Ukrainian War Thread
  • Royal Australian Air Force [RAAF] News, Discussions and Updates
  • Royal Australian Navy Discussions and Updates 2.0
  • Australian Army Discussions and Updates
DefenceTalk

© 2003-2020 DefenceTalk.com

Navigate Site

  • Defence Forum
  • Military Photos
  • RSS Feeds
  • About us
  • Advertise with us
  • Contact us

Follow Us

No Result
View All Result
  • Home
  • Defense News
    • Defense & Geopolitics News
    • War Conflicts News
    • Army News
    • Air Force News
    • Navy News
    • Missiles Systems News
    • Nuclear Weapons
    • Defense Technology
    • Cybersecurity News
  • Military Photos
  • Defense Forum
  • Military Videos
  • Military Weapon Systems
    • Weapon Systems
    • Reports

© 2003-2020 DefenceTalk.com