How automation can optimize zero-trust security at the multidomain, tactical edge

Story

August 04, 2023

Christopher Yates

Red Hat

The U.S. Department of Defense (DoD)is investing in multiple initiatives including the Joint Warfighting Concept (JWC) and Combined Joint All-Domain Command and Control (CJADC2) to enable coordinated military operations against current and future threats. Because these efforts involve the integration of devices and data streams at the tactical edge, they call for a zero-trust approach to cybersecurity. But achieving zero trust at the edge presents multiple challenges. One path to overcoming these barriers is an automation strategy that enables more rapid and reliable configuration of components and helps achieve data-sharing across echelons with greater security.

In April 2023, the Cybersecurity and Infrastructure Security Agency (CISA) released version 2.0 of its Zero Trust Maturity Model. The original version, released in 2021, delineated three stages in the maturity journey: “traditional,” “advanced,” and “optimal.” The new version slots in an “initial” stage before “advanced,” recognizing that organizations are struggling to make the shift away from traditional perimeter defenses.

In fact, making that transition is essential: Edge computing is foundational to initiatives including the Joint Warfighting Concept (JWC) and Combined Joint All-Domain Command and Control (CJADC2). By definition, the edge extends beyond the conventional network perimeter. The perimeter has become atomized as centralized data centers are augmented by thousands of edge sensors and devices generating and transmitting data. Traditional cyber protections like firewalls are no longer adequate.

What’s needed is a zero-trust approach in which every user, device, or other entity that wants access to networks, systems, or data needs to authenticate itself every time it wants access. But zero trust isn’t a single cyber solution; rather, it’s an end-to-end framework – as described in the U.S. Department of Defense (DoD) Zero Trust Strategy – that extends across users, devices, applications, networks, and more.

The challenges of zero trust at the edge

As challenging as zero trust is to achieve in any DoD environment, it becomes even more arduous to scale in multidomain tactical-edge environments. The mission space is increasingly shared by multiple U.S. service branches – including the Army, Air Force, and Navy – and it’s difficult enough for those mission teams to integrate networks and federate resources. More often than not, missions will include coalition partners such as the militaries of U.S. allies, NATO forces, and other organizations.

Numerous impediments exist to the goal of those organizations sharing information, especially at the edge in near-real time. One hurdle is federated identity, or the linking of a user’s identity across multiple identity-management systems. Each service branch and coalition partner is likely to have its own preferred way of enabling federated identity, and integrating those disparate approaches presents technical challenges.

A related issue is data sovereignty: Data is typically subject to the laws and governance structures of the nation where the data is generated or captured. The European Union (EU), for instance, has strict regulations on how data collected in EU jurisdictions must be managed. That decree has major implications for the cybersecurity controls put in place to protect that data.

More fundamentally, military teams need to be able to seamlessly configure networks and integrate components to meet the unique field capabilities of each mission. Additionally, they need to achieve those goals in a timely manner so that they don’t hinder mission-critical decision-making.

An automation platform for enhancing edge ecosystem security

Automation can enable an answer to these emergent problems. At a basic level, automation uses technology to replicate human tasks to accelerate processes and reduce error. In a cybersecurity context, a security engineer working without automation might follow steps in a 100-page manual to harden a device before it can be fielded. In an edge environment that involves thousands of devices, that’s a slow, cumbersome process, with thousands of opportunities for error and vulnerabilities.

That’s just for a single type of device. Now imagine that scenario in a CJADC2 mission environment, with a proliferation of devices and networks continually being added to the network, or multiple networks continually being reconfigured on the fly.

The network effect – mathematically expressed as n(n-1)/2 – dictates that two nodes result in one connection, four nodes make six connections, 40 nodes make 780 connections, and so on. Each device, each application, and so on, requires configuration, and there’s no guarantee that devices are running the same hardware or the same versions of software. The time and complexity involved in integrating and building security controls into those devices can escalate rapidly.

Automation can enable a security engineer to configure and repeatedly update those resources in a more secure manner, near simultaneously, in a repeatable, predictable way. That’s essential for multidomain operations with unique data assets and field requirements that change from one mission to the next.

Reliance on all-in automation implementations does, however, introduce the possibility that a malicious insider or an external attacker could gain control over a large number of resources. Insider threats are a common cybersecurity concern, as are external attackers who steal credentials and then move laterally through a network or escalate privileges to compromise systems and steal data.

A solution to this type of problem is a commercial automation platform. An effective automation platform gives users a central location for storing credentials for devices that need to be managed, along with playbooks to execute tasks that need to be performed on those devices.

Users can look for a platform with a credential-management mechanism to give engineers access only to the domain they need on the devices they manage. CISA recognizes five domains: identity, devices, networks, applications and workloads, and data. For example, an engineer might have permissions to manage the networking capabilities of a device but no access to the data, identities, or applications on the device.

Using this approach, missions can automate the configuration, management, and security posture of large numbers of multi-domain edge devices while mitigating the risk of introducing new security vulnerabilities.

Enabling efficient data streams across echelons

Of course, the goal of edge sensors and devices isn’t only security. It’s also to enable the generation and sharing of data in near real time to drive intelligent decisions and faster actions that contribute to mission success. An automation platform can also help here.

Connectivity in the battlespace involves overcoming denied, degraded, intermittent, or limited (DDIL) bandwidth. Connections typically are too low-bandwidth and intermittent to transmit gigabytes of sensor data from the battlespace to a centralized data center for analysis, and then ship the analytics output back to the field to be acted on. Instead, analysis and decision-making need to occur as close to the source of the data as possible.

The good news is that newer processors with lower size, weight, and power (SWaP) requirements are increasingly available at the edge, along with container technology that combines applications along with their associated configuration, dependencies, and data in a single package, or container. Groups of containers at the edge can be managed in a lightweight version of the open-source Kubernetes container orchestration system to dynamically bring up and take down applications as missions evolve.

This combination of technologies can enable real-time analytics at the edge. An automation platform enables the fast, reliable configuration of the networks, devices, applications, and cyber protections to make edge analytics possible. As an added advantage, the administrator only has to know how to use the platform and needn’t be an expert in all the complex, disparate technologies deployed at the edge.

Driving zero trust at the multidomain edge

An automation platform can help the DoD achieve its goals for zero trust at the multidomain, tactical edge; in fact, automation is fundamental to zero trust. In its zero-trust maturity guidance, the National Security Agency (NSA) lists seven zero-trust pillars, one of which is automation. The guidance also suggests that automation is required across pillars for true zero-trust maturity. CISA’s Zero Trust Maturity Model implies the same, mentioning automation more than 85 times.

Multidomain edge environments are essential to JWC and CJADC2; robust security of those environments is vital to the trusted generation, exchange, and analysis of edge data to enable the real-time decisions and actions that drive missions.

Zero trust is how the DoD will protect edge assets reliably – wherever they exist and however they need to be integrated with joint mission teams – and central to that protection is an automation platform that enables military organizations to achieve zero-trust maturity.

Christopher Yates is DoD Army chief architect for Red Hat, for which he collaborates with systems integrators, independent software vendors, and partners to develop solutions. He has more than 15 years of experience in the high-tech industry.

Red Hat Inc. https://www.redhat.com/en/solutions/public-sector