A Unified DOD Zero-Trust Approach Begins with Existing Technologies

Barriers to a Unified Security Approach

Part of the problem is that some of the missions of different military branches and units are very specific and require zero-trust solutions tailored to, for example, airplanes or tanks, Stoyanov adds.

While intelligence sharing between branches will lead to synergies over time, that’s not how things have played out to date.

“I'm seeing the federal civilian side setting up groups for knowledge sharing,” Stoyanov says. “I'm not seeing that in DOD.”

EXPLORE: Why the Navy is expanding its AI capabilities.

The Pentagon also lacks an agency such as CISA driving network visibility efforts departmentwide as part of an initiative like the Continuous Diagnostics and Mitigation program.

Civilian agencies’ cloud platforms, data centers and computers can connect to networks, but the DOD has more hard assets, such as airplanes, that can’t do so for security reasons. That’s one of the reasons the Pentagon has more than 10,000 networks, the infrastructure for which needs consolidating, Stoyanov says.

Between his Common Access Card and usernames and passwords for various systems, Stoyanov says, he had to keep track of five user accounts while he was a federal employee. DOD applications must operate across those different infrastructures.

Click the banner below to learn how federal agencies are implementing zero trust architecture.

Inventorying DOD’s Assets Is the Next Step

Tailoring zero trust to the military’s specialized missions will be driven by industry, Stoyanov says. For instance, the Navy will need contractors to help tackle the problem of carrying out hardware refreshes and software updates on ships every six to 12 months when they make land, he says.

The DOD’s first step is to inventory existing technologies and determine how many users it has, as well as where its data and apps reside. Only then can the Pentagon set about consolidating identity, credential and access management solutions, Stoyanov says.

LEARN MORE: How the DOD’s cyber workforce implementation plan will target talent gap.

The recent leak of highly classified DOD documents detailing U.S. eavesdropping on allies, intercepted communications and Ukrainian military weaknesses raises concerns around the department’s timeline for inventorying its IT assets.

“We still have lots of assets that are unclassified but might have sensitive data on them,” Stoyanov says. “There are data loss technology tools that could be deployed to not only scan individual workstations but scan infrastructures, scan cloud environments and figure out how we solidly get ahold of some of these spills before they happen and prevent them and guide users.”