Pentagon Shifts to Data-Centric Security to Boost Resilience

The Pentagon is turning to tech to improve data quality and break silos, Department of the Navy officials said during GovCIO Media & Research’s Defense IT Summit Thursday in Arlington, Virginia.

“We’re looking at the things that we are bringing in. It’s not just retrofitting and modernizing the things that we’ve got in [our current architecture] currently,” Department of the Navy Deputy CTO Michael Frank said. “How do we ensure that it’s meeting the standard and trying to leapfrog where we’ve been, rather than making incremental progress?”

Moving to Data-Centric Security

Frank said the Navy is shifting from network-centric security to a data-centric approach under the War Department’s zero-trust requirements.

“Things like access control and other things to focus more on really securing at the data level, rather than the network level. We’re trying to get to a better point of ensuring the accessibility, ensuring the availability of that data when and where needed,” Frank said.

Identity credential and access management (ICAM) principles are central to that shift, Lt. Col. Benjamin Pimentel, assured C2 lead of Project Dynamis at the Marine Corps, said. Project Dynamis is a new project of the Marine Corps. It supports the Pentagon’s Combined Joint All-Domain Command and Control (CJADC2) initiative by enabling Marines to share weapons-quality data at speed and scale.

“How do you leverage the ICAM capability that the enterprise already has within a tactical mission network where that’s not been traditionally accessible?” Pimentel said. “It’s difficult to bring those zero-trust principles at the tactical edge … [Project Dynamis] is still employing that same zero-trust principle of citation, access control and so forth. We’re starting to see those come together.”

Powering the Tactical Edge with Commercial Innovation

Officials emphasized that data must move quickly across the battlespace to support decision-making.

“Data at rest is great, but it’s not doing anything for you if it’s at rest, if it’s not getting where you need it to,” Pimentel said.

Project Dynamis is designed to allow data to flow securely across tactical, enterprise and joint networks. Pimentel said the Marine Corps is also exploring how to leverage commercial infrastructure and use integrated cellular capabilities to align operational needs with commercially-driven, already-built, multi-trillion-dollar infrastructure.

“Data has become the rocket fuel for us to make the important decisions that are going across our globe in a much more important fashion than that before, and so we’re at a new critical stage and not just siloing that data, but creating a centricity around that data,” said Bryan Thomas, vice president of U.S. public sector at Everpure.

Building Resilience Through Diversification

Officials stressed diversification to protect critical data pipelines from adversarial attacks.

“If you want to make sure something is resilient, operational, resilient, whatever, you just have to diversify risk. You have to have a diversified portfolio,” Frank said. “You have got to have a couple different ways that things are talking, with a couple different ways to connect back. If one goes down, you’ve got other options.”

Pimentel said mesh networks can help move data in contested or low-connectivity environments by routing information through the nearest available node for processing and mission execution. He added the Marine Corps is also testing ways to send sensitive data through mesh network systems to support data transport resiliency.

“Things like kits that we’re starting to experiment with at the sensitive and unclassified, encrypted or [sensitive but unclassified] level have a variety of different mesh networking radios, both narrowband and wideband, to really give that commander some flexibility,” he said.

Speed itself can be an advantage, Pimentel added.

“Operational tempo generates advantage,” Pimentel said. “Resilience doesn’t just have to mean you can’t break in. It may just mean I’m moving faster than you.”

Breaking Down Silos

The War Department needs interoperable data for operations, officials said. Thomas said organizations must rethink closed data architectures and adopt technologies such as Kubernetes and containerization to operate across multi-cloud environments.

“The silo effect that has happened – which is creating closed systems for all the secure reasons … makes all the sense in the world, but it does not allow for your operability and the capabilities to share that data within organizations,” Thomas said. “The good news is it is starting to turn the corner to allow for … new data standards.”

Pimentel said vendors increasingly recognize that interoperability is a competitive advantage.

“I think the most valuable thing that you should first present when you pitch is: ‘these are all the different partners that I have and all the different partners with which I’m interoperable and my data formats can exchange it,'” he said.

Tackling Technical Debt

Legacy systems and vendor lock-in continue to create technical debt across the department, Frank said. The Navy’s Operation Cattle Drive initiative aims to divest redundant or outdated systems and has accelerated over the past 18 months.

“It’s about divesting of things that either are no longer delivering value to us or redundant in a certain way,” Frank said. “That is somewhere where we’ve seen an actual moving of the needle around tech debt. But it’s still a massive problem, and one that we are actively trying to push.”

Pimentel said acquisition reform is helping by expanding opportunities for nontraditional contractors and fostering a more competitive ecosystem.

“We‘re shifting away from tightening monolithically integrated systems with a single vendor,” Pimental said. “[Acquisition reform] is creating that competitive ecosystem. We’ve allowed ourselves more options to pull best of breed and also lowered the barrier to entry for smaller companies.”

Thomas added that industry, government and academia are continually surfacing new ideas for data architectures, making modernization easier. Frank added that, ultimately, the data modernization projects will rely on industry and the military to work together to build the mission and to focus on the warfighter.

“Data specific companies that are dealing in this world, I spend a lot of my working with them to help them better understand what this really means,” Frank said. “We need to be good partners. We need to actually get tactical.”