3 Takeaways From The DoD Zero-Trust Strategy and Roadmap

By
Director, Cyber Technologies

In November 2022, the Department of Defense (DoD) released its . This strategy 鈥� anticipated for months following the zero-trust memo issued by the Executive Branch in January 2022 鈥� represents a new, Department-wide cybersecurity framework that lays out dozens of capabilities the DoD must realize in order to achieve by fiscal year (FY) 2027. The DoD has indicated its goals for shifting to zero-trust are to 鈥渞educe the attack surface, enable risk management and effective data-sharing in partnership environments, and quickly contain and remediate adversary activities.鈥�

As the DoD commitments to a long term zero-trust mindset, here are three key takeaways for the rest of the industry:

123/3

After years of siloed and patchwork solutions, the DoD is pursuing standardized and unified approaches to cybersecurity.

Following a series of executive orders aimed at bolstering the country鈥檚 cybersecurity posture over the last few years, the DoD is now aligning with much of the federal government in pursuing a more unified, standardized approach to cybersecurity.

While the DoD will continue to encourage its various components to stand up their own zero-trust offices (e.g., the Army confirmed in October 2022 that the service will establish its ), the goal of targeted zero-trust by FY27 ensures that all branches will adhere to a universal minimum standard of network security and best practices. The DoD can be expected to drive this initiative with a cultural focus on zero-trust training and adoption as well as strategic use of the Planning, Programming, Budgeting, and Execution (PPBE) process for resource allocation.

The roadmap describes how the Department is under 鈥渨ide-scale and persistent attack from known and unknown malicious actors鈥� who 鈥渙ften鈥� breach the Pentagon鈥檚鈥渄efensive perimeter.鈥� The timeline for components to phase in zero-trust implementation 鈥� with the first deadline, logging all network traffic, arriving in Q4 of FY23 鈥� illustrates the real urgency behind this initiative.

The roadmap even provides accelerated timelines for components to more quickly reach 鈥渁dvanced zero-trust.鈥� While not yet a requirement, advanced zero-trust goes beyond targeted zero-trust and includes a greater focus on the 鈥淩espond鈥� and 鈥淩ecover鈥� functions of the , with the goal of more effectively countering advanced persistent threats (APTs) and nation-state adversaries.

While the roadmap does name what capabilities the DoD must implement to achieve targeted zero-trust, it does not point to specific technologies or solutions. That鈥檚 where collaboration and partnership with commercial providers will play a critical role in helping the Department meet its goals.

The roadmap defines three courses of action for the Department to reach targeted zero-trust: establish a zero-trust 鈥渂aseline,鈥� partner with commercial providers to develop zero-trust compliant cloud environments, and utilize government-owned private cloud. There is a clear role for providers in each of these areas. Finally, integration across solutions and the different pillars of zero-trust, which creates greater visibility and the ability to organize a more effective response to threat actions, will be a critical area for industry partners to address as the Department is seeking help in this regard.

The 木瓜AV Difference

Ambitious deadlines for targeted zero-trust means the clock is ticking across DoD components. The DoD relies on partners who understand its broad and diverse missions across a global enterprise, as well as its challenging operating environments. These partners must be able to deliver advanced and trusted services, solutions, and support that enable the DoD to operate effectively in the face of evolving threats and attacks.

That鈥檚 where 木瓜AV comes in. As a leading provider of managed security solutions for the federal government and the defense industry, we know how to assess your organization鈥檚 alignment with soon-to-be-mandatory zero-trust requirements and identify gaps. We deliver trusted mission systems, enterprise solutions, and cloud and security managed services that align with the DoD鈥檚 zero-trust strategy 鈥� all while proactively detecting, defending against, and enabling rapid recovery from threats.

Don鈥檛 leave your organization vulnerable or risk non-compliance. Reach out to our experts and start securing your organization with zero-trust today.

木瓜AV