McAfee - Federal News Network

Listen Live

Defense Innovation Unit

Ask the CIO

Defense Innovation Unit solves a common problem with cloud services

Rick Simon, the program manager for the Secure Cloud Management project and a contractor in the Defense Innovation Unit, said the office issued success memos to the three vendors who took part in the pilot program.

Cybersecurity

Just how much has cloud usage increased during quarantine?

Contracts/Awards

NASA’s SEWP contract experiencing a surge in use during pandemic

Federal Drive

Suppliers want interoperability, data sharing across cybersecurity products

Innovation in Government: Cyber Leaders

Exclusive Cyber Leaders on Cloud Security
FedInsights by McAfee

Commentary

Why human-machine teaming is the future of cybersecurity

Reporter's Notebook

Two acquisition events mark the turning point for the CDM program

[hbidcpodcast podcastid='3710921']

For once, the Defense Innovation Unit solved its own problems.

While DIU usually works on challenges for the military services and defense agencies, a recent project showed them how a secure approach to <a href="https://federalnewsnetwork.com/dod-reporters-notebook-jared-serbu/2021/01/disas-first-ever-production-ota-eliminated-300m-in-future-costs/">using commercial cloud services</a> could work outside of the traditional Defense Department methodology.

Rick Simon, the program manager for the Secure Cloud Management project and a contractor in the Defense Innovation Unit, said of the 29 respondents to the office’s request for white papers, three prototypes made the grade.

DIU issued the three prototypes from Google, ZScaler and McAfee <a href="diu.mil/latest/defense-innovation-units-secure-cloud-management-prototypes-completed-with" target="_blank" rel="noopener">success memos</a> earlier this year, determining that each delivered on the goals of the pilot and any Defense Department entity can use the services to secure their cloud access points.

“All three of them, as it turns out, really offered some similar capabilities. They all offer what are known as SASE services, secure access edge services, and they are all offered a broad range of zero trust capabilities,” Simon said on <a href="https://federalnewsnetwork.com/category/radio-interviews/ask-the-cio/">Ask the CIO</a>. “One of the interesting things is in the original Areas of Interest (AOI), which is another word for a request for proposals, we didn't include the phrase zero trust. DoD has become very focused on zero trust capabilities and zero trust architectures, and it just so happened that all three of the prototypes offered those kind of capabilities.”

Simon said when DIU used the <a href="https://federalnewsnetwork.com/dod-reporters-notebook-jared-serbu/2017/06/dod-reexamining-cloud-policies-to-remove-bottleneck-for-sensitive-data/">traditional cloud access point</a> (CAP) security set-up, it experienced latency and made applications like video conferencing difficult to use. Much like the Trusted Internet Connections (TIC) initiative needed to be updated for the remote workforce, DoD needed an easier, but still secure approach to using commercial cloud services.

DIU employees tested out each of the prototypes to access its network. Where DIU usually procures and builds systems <a href="https://federalnewsnetwork.com/ask-the-cio/2021/06/diu-rethinking-cyber-endpoint-protections-through-advanced-deception-tools/">on behalf of others</a>, this project attempted to solve an internal problem that many other agencies — DoD and civilian — face.

“We split our population into three groups, and each group was subject to one of the prototypes. They downloaded the agents and worked through those prototypes. We wanted to ensure that we were assessing for cloud access point equivalency,” Simon said. “We partnered with the Defense Information Systems Agency to develop the assessment criteria. They drew it from the secure cloud computing architecture document because that most directly defines CAP requirements. But as the project progressed, and it became clear that zero trust was becoming a more important part of the DoD’s future. We also asked DISA to draw from a draft of the zero trust reference architecture. It's now in published form, but it was a draft at that time, the security requirement guide in various other reference architectures to develop a set of criteria.”

DIU and DISA measured the three prototypes against 77 different metrics to compare to CAP equivalency. Simon said the goal was to ensure the new approach didn’t erode trust capabilities around endpoint security, network security performance and other security and control tests.

“We engaged with each of the vendors and third-party assessment organizations to perform the actual assessments. The results were published and made widely available within the DoD,” he said. “None of the vendors passed all 77 metrics. In the assessment, there were a handful of tests, for example, that required red teaming and we did not have the wherewithal either ourselves or through our security service provider to do red teaming. So we didn't do those tests. There were a couple of tests that had to do with IPv6. But they all passed over 90% of their tests, and that was very encouraging to us.”
<h2>Taking the prototypes into production</h2>
Once the prototypes passed the tests, DIU said any DoD agency or military service can work with the vendors to take them into production.

“We will likely select one of these prototypes to go into production. It'll likely be in the first quarter of fiscal 2022. We think we could pick any of them and be very successful with them,” Simon said. “We have been talking to a lot of entities about the project and the results of the project. During the course of the project, I personally briefed probably 15 different DoD entities on what we were doing, and then they followed along through a newsletter that I created about the progress we were making in the project. Once it was complete, we put all the artifacts, all of the third party assessment result documents and a lot of other documentation about the project in a secure a place where anybody from DoD could get to it, and download and read the materials that were prepared. We think that that various DoD entities will embrace it, and, at the very least, use it as guidance as they figure out their own zero trust wave forward.”

He added that DIU also has had discussions about with other agencies about the prototypes, which he believes can help them address a zero trust architecture by enforcing specific security policies.

Federal Tech Talk

BDNA: Improving cybersecurity at your agency

Federal Acquisition, GSA

Technology

DHS, GSA kick off CDM task order 2 with $29M deal

Technology

NIST's cyber framework moves toward implementation stage

Technology

DHS appoints Schneck to senior cyber position

Federal Drive

Agencies applying threat intelligence to stem tide of cyber attacks

All News

Cybersecurity fails to live up to expectations, reflect reality

Federal Drive

Verizon teams with McAfee to offer anti-virus software

Defense

Agencies feel strain of balancing mobility, security

All News

McAfee's top cyber threats includes mobile malware

Federal Drive

U.S. as a cyberthreat drops to number three

Budget

Slow cyber progress puts critical infrastructure at risk

Federal Drive

McAfee adds to protection service with Sentrigo

Federal Acquisition, GSA

Technology

Intel acquires McAfee for $7B

Technology

McAfee: Threats to mobile devices on the rise

Federal Drive

Cybercrime on the rise, and how to fight it

Technology

McAfee: Cyber attacks on Apple products to increase