Air Force Lays Groundwork For Smart Bases with Zero Trust

The Air Force faces structural challenges to developing “smart bases,” per the Pentagon’s department-wide initiative. But zero trust will be a key approach to handling interconnected devices and sensors.

Building out smart bases across the entire department means connecting devices powering day-to-day administrative activities and mission-sensitive devices like “internet of things” sensors, intelligence platforms, data access platforms, repair and sustainment devices, and weather, security and safety components specific to the Air Force.

“Air Force has an interesting challenge,” Air Force CTO Jay Bonci said during a Defense News webcast this week. “Because our bases are Air Force projection platforms, … we have to think about them differently from how we operate our missions there and how we conduct things like our vital space mission and our Air Force maintenance and logistic operations. There are a great number of things for us that are really more deeply tied into the mission when we think about smart devices.”

As the service modernizes its systems, priorities include network support for all smart and cloud-connected devices, including government and commercial cloud. The service also considers how to bring in new technology securely, including ensuring devices are appropriately manufactured with documented hardware and software supply chains.

“There’s a lot of really interesting challenges going forward for the sort of ‘smart base’ concept, but really when you boil it down, it’s a proliferation of devices. It’s a proliferation of data pathways, and it’s ways of automating what our airmen and guardians do today,” Bonci said.

The service aims to keep interconnected networks and sensors safe with guidance from the DOD zero trust strategy as it needs secure, resilient devices with a thorough understanding of those devices’ manufacturing history, supply chains, how they’re used and how they handle data.

“We’re not super far along, truthfully … we’re really focused on the wide open backfield that is our traditional devices, our applications, our networks,” Bonci said. “But as we develop and deploy the infrastructure for zero trust starting in fiscal year 2023, we’ll be able to have support for doing more of these things, allowing bases to make smarter choices about hybrid compute … and allow us to understand how you bring these types of devices on.”

While the Air Force has one big enterprise, many sub-enterprises with challenges specific to their ecosystem make implementing zero trust particularly difficult.

“We’re in a phase right now where we’re gathering,” Bonci said. “We understand what our plans are … We are starting to execute on those and then gathering up in places where other lessons are being learned … What do we need to learn from each other? What are the policy pieces? What are the gaps? There’s a lot of documentation, and truthfully, work that we need to do so that we can hit ‘publish’ even internally to understand where those areas are, and then how we’re prioritizing the infrastructure upgrades across our 180 locations.”

The Air Force is preparing to publish its own zero trust roadmap at the beginning of 2023 to build on previous security strategies.

“There’s a bunch of different efforts. Really, the first step is just to write them all down and publish it and to make sure that we have a really clarified way ahead so that people in the field know what’s coming,” Bonci said. “They know what the various other siblings are doing out there. Whether or not you are in a space mission, or a nuclear mission, or a weather mission, or an enterprise mission, or logistics mission, to understand where … and when the enterprise is going to come in and provide the infrastructure necessary to keep moving.”