How the DoD Zero Trust Strategy Better Protects Sensitive Digital Assets

Advanced persistent threat actors continue to invent schemes to penetrate the cybersecurity defenses of the Pentagon and America’s military industrial base. At stake are national security interests, technological innovations and the personal identity records of people who serve as soldiers or in a related civilian capacity.

Like other parties to the global chess match between sophisticated and well-funded hackers and ethical security professionals, the U.S. Department of Defense (DoD) and military supply chain organizations sometimes find themselves on the losing end of digital firefights. For instance, in February, the DoD was compelled to notify more than 25,000 individuals that their personally identifiable information had been compromised. The data breach affected people who work for the DoD, operate in a support capacity or who had simply applied for a job.

Along with rolling out the Cybersecurity Maturity Model Certification (CMMC) program, a DoD zero trust strategy is expected to be in place by 2027. High-ranking Pentagon officials are touting the anticipated DoD zero trust strategy as a watershed moment.

“Zero trust integration offers the most robust and reliable approach to cybersecurity, ensuring that our systems are resilient against evolving threats, while safeguarding our nation’s interests,” DoD deputy chief information officer David McKeown reportedly said. “It is not just a program, or a new application, zero trust is an evolution of our entire security landscape. By embracing it, we not only protect our data, but we strengthen our defenses and preserve our way of life.”

What Does DoD Zero Trust Cybersecurity Involve?

The DoD released its zero trust strategy and roadmap in 2022 to notify companies that benefit from lucrative government contracts to begin implementation. Much like David McKeown’s speech at a recent symposium on zero trust, the directive envisions bringing all DoD networks and supporting databases under the advanced cybersecurity approach. The Pentagon outlined the following ways this determined cybersecurity tactic could be broadly adopted, effectively limiting threat actors’ ability to steal valuable and sensitive digital assets.

• Zero Trust Culture: By training and creating heightened awareness, DoD personnel would adopt a more consistent defensive posture.
• Information Security: This cybersecurity practice would be integrated into newly minted and legacy systems. The overall actions will minimize the potential impact of a data breach.
• Acceleration: The technologies would be integrated at a faster or equal pace of innovations. Staying ahead of foreign threats is mission critical.

The Pentagon appears keenly aware that hackers working for America’s enemies will continue to receive the funding and material support needed to craft workarounds and new schemes. That’s largely why the DoD noted the process would continue to evolve in a pragmatic fashion. It’s also a way DoD-linked companies, as well as other private sector ventures, can use American innovation to their advantage.

How Does Zero Trust Work?

A zero trust approach leverages strict login credential verification methods to enhance IT security and protect critical data. All users and devices are vetted before access can be granted. Once a legitimate network user logs into the system, pre-set limits have been established to ensure that the individual cannot directly view, download, copy, damage or pilfer off certain digital assets. It essentially takes a holistic approach to protecting information from hackers that employees and key stakeholders do not necessarily need to handle.

Zero Trust Network Access (ZTNA) ranks among the primary resources employed to build out this type of cybersecurity strategy. However, managed IT firms with cybersecurity expertise typically take advantage of a variety of technologies and approaches when implementing zero-trust defenses.

One way to visualize how the DoD zero trust strategy works in the military and private sector involves a comparison with traditional cybersecurity philosophies. Before zero trust and other seemingly outside-the-box approaches to cybersecurity emerged, companies often relied on what is known as the perimeter or “castle-and-moat” approach. Digital assets were thought of as being secured behind the castle walls. The moat was an added layer of security put in place to prevent enemies from reaching and scaling the castle walls.

Business networks use anti-virus software and firewalls to emulate the heavy stone and mortar barriers. More advanced security measures — or moats — were used to deter threat actors from getting within striking distance.

The zero-trust strategy advocated by the DoD and others operates under the assumption that siege apparatus can be used to successfully overcome moats and castle walls. Zero trust effectively creates a defensive mechanism that frustrates invaders even after they breach the perimeter.

While the castle-and-moat concept illustrates the basic idea of zero trust, companies have far exceeded those walls in recent years. The adoption of cloud-based and remote workforces has spread data out over vast digital landscapes. Not only do organizations have to prevent castle wall breaches, but they also have to protect the entire feudal countryside.

Primary Principles of Zero Trust Strategies

At first blush, the DoD makes some assumptions that may seem counterintuitive in the cybersecurity space. Pentagon security experts are looking beyond mere defensive positions, such as securing a network’s attack surface. The military’s zero trust assumptions include never trusting, always verifying and assuming the barbarians are already inside the gates. These are principles zero trust strategies follow to coral intruders into areas where they can do little to no harm.

Multifactor Authentication

Zero trust policies typically require legitimate network users to enter their username and password and then wait to receive a code on a secondary device. This step thwarts garden variety hackers because they cannot access the code or device. It’s a hurdle few cybercriminals know how to overcome.

Endpoint Verification

The Pentagon has virtually no intention of trusting wide-reaching endpoint device login attempts. In a robust zero trust strategy, each and every endpoint would effectively get pinged to ensure it corresponds to an approved device. Once a back-and-forth process has been successfully completed, an endpoint device will be deemed trustworthy or get blocked.

Micro-segmentation

One of the more advanced ways that zero trust strategies protect data, micro-segmentation is a term that describes segregating various types of data into zones. This strategy isolates highly sensitive and valuable data, making it increasingly difficult for cybercriminals to uncover.

Least-Privilege Access

This facet speaks to the notion the castle has already been breached. It’s a type of fail-safe protocol that places restrictions on each and every user. Should a nation-state hacker slip into a DoD network or that of a military contractor, the thief cannot access information beyond those assigned to the network profile the criminal hacked.

It’s also important to utilize ZTNA to pinpoint the geolocations of devices trying to access a system. Needless to say, someone trying to log into a Pentagon database from the Kremlin would need to be deterred and expelled.

Zero Trust Use Cases Worth Considering

Employing zero trust architecture is not reserved for the U.S. military and private-sector companies that support national security. The concept has been kicking around since the 1990s and was coined in 2010. Since then, wide-reaching operations have employed different versions to harden their cybersecurity defenses. These are ways businesses can improve their defenses.

• VPN Conversion: Rather than relying on virtual private networks to hide from hackers, replacing them with zero trust architecture dramatically reduces risk.
• Remote Efficiency: Rather than using cumbersome remote security measures, zero trust strategies help consolidate an outfit’s security under a single umbrella.
• Verification: Zero trust applications can verify a login request from any device. It can also help block so-called “shadow IT,” which involves unauthorized cloud services.
• Stakeholders: The zero-trust approach extends to contractors and partners who may require access to a particular system. You can more easily and safely onboard third-party contractors with this security measure in place.

While the DoD plans to implement, arguably, the most stringent zero trust policy in conjunction with CMMC 2.0, the benefits of any operation upgrading its cybersecurity stance with zero trust delivers significant benefits.

Benefits of Implementing DoD Zero Trust Strategy

Nothing impedes private industry leaders from opting into a zero trust strategy that mirrors that of the DoD. The enhanced detection, verification and data segregation methodology is not reserved for the federal government. Companies in the military industrial base will most assuredly be integrating the DoD mandate, and others can gain the following benefits articulated by the Pentagon.

• The ability of a user to access required data from anywhere, from any authorized and authenticated user and device, fully secured.
• Secured and protected information systems facilitating the Department’s evolution into a more agile, more mobile, cloud-supported workforce.
• Reduced attack surface risk profiles through protective actions enabled by micro-segmentation of the DoD IE.
• Threats to Cloud, Artificial Intelligence (AI) and Command, Control, Communications, Computers and Intelligence (C4I) remediated through risk-based cybersecurity protocols and policies.
• Effective damage containment, mitigation and remediation when a device, network, user or credential is compromised.
• Consistent, aligned and effectively resourced ZT capabilities for advanced cybersecurity operations.
• A resilient DoD IE that recovers rapidly from attacks and minimizes damage through enablement of zero trust.

It’s also important to note that zero trust architecture does more than just identify, deter and impede the nefarious efforts of outsider threats. The DoD and military industrial base must remain ever-vigilant about insider threats. Should a disgruntled employee or corporate plant attempt to breach critical information, that individual will also be restrained by micro-segmentation and least-privilege network access, among other deterrents. Those are reasons why overcoming the challenges involved in adopting a zero-trust strategy proves worthwhile.

Challenges of Adapting Zero Trust Architecture

The zero-trust strategy exceeds the perimeter defensive model outlined in the castle-and-moat analogy. It does not operate under the assumption that attackers cannot overcome outward defenses. The willingness to accept the fact victims of data breaches doubled from 2022 to 2023 positions zero trust as a realistic approach to protecting vital national security secrets, as well as private-sector information. Decision-makers will likely need to work with an experienced managed IT services firm that possesses zero trust expertise to overcome the following obstacles.

Piecemeal Integration

Companies sometimes try to minimize technology investments by onboarding software, hardware and other items that are not ideally suited to coexist. Attempting a mishmash of zero trust solutions can leave gaps that savvy hackers can exploit. It may be prudent to go all-in on zero trust to harden cybersecurity defenses.

One-Size-Fits-All Approaches

Another seemingly cost-effective shortcut involves adopting programs that appear to handle all the zero trust facets. In terms of a reliable zero trust strategy, there is no one-size-fits-all option. Upgrading network security calls for penetration testing and a comprehensive risk assessment to determine the best zero trust solution.

Legacy Systems Pose Clear and Present Dangers

It’s not always possible to effectively retrofit a system designed to use perimeter defenses. It may be necessary to upgrade outdated equipment and technologies to accommodate zero trust architecture.

Industry leaders must also understand that zero trust strategies differ from the type you can set and forget. They require ongoing maintenance and administration. A real person — preferably a cybersecurity expert — must be tasked with assessing network use profiles and their access. Someone will also need to spearhead policies and practices that establish least privilege access, as well as eliminate the usernames and profiles of outgoing employees. That’s typically why companies working in the military industrial base partner with third-party firms with managed IT and zero trust cybersecurity expertise.

Implement Zero Trust Cybersecurity with the Help of Red River

At Red River, we work with companies in the military industrial base to craft cybersecurity solutions that detect, deter and expel threat actors. If you are interested in taking your data security to the level advocated in the DoD zero trust strategy, contact us today.