Air Force Greatly Widens the Aperture on Zero Trust
Following the success of some initial, smaller-scale efforts, the U.S. Air Force is pursuing zero trust architecture on a level not seen before. The service’s Air Combat Command is leading the charge into many more initiatives with a comprehensive view to employ zero trust architecture across its bases, weapon systems and missions.
Taking the helm for the service’s zero trust effort from Col. James Lotspeich, USAF—the prior chief technology officer (CTO) at Air Combat Command’s (ACC’s) Directorate of Cyberspace and Information Dominance (A-6) and who is now chief of operational command and control at Kessel Run—is Stephen Haselhorst, the current A-6 CTO. Haselhorst is also dual hatted as the Air Force’s zero trust task force lead. He reports that the command has put several more significant pilot programs in place, with a goal of validating the zero trust architecture that the Air Force has developed. In addition, the command is organizing itself to support zero trust across its operations by developing tactics, techniques and procedures, shifting its culture and preparing its airmen.
“The objectives of our zero trust efforts are to be able to have freedom of movement for our airmen and impose costs to adversaries and really abolish our networks as we know them today, transforming them to a cloud-first mentality and a zero-trust model, where your location and your place in the network does not automatically grant you any access to the environment,” Haselhorst said.
The Air Force’s zero trust task force is in place, he said, conducting weekly meetings to advance priorities and unite different organizations across the service to implement the cybersecurity measure on a large scale. “We operate the task force in a manner to execute zero trust rapidly and to go after the problems in a much bigger way than we would traditionally,” the CTO shared. “We meet every Thursday with participation from just about every organization in the Air Force that you can imagine whether it's 16th Air Force operators, the program office, the CCC [the Air Force Cyberspace Capabilities Center], the ACC leaders, the 67th Cybersecurity Operations Wing or several other organizations that are just coming together to figure out what is zero trust and what we want to get after. And we are getting after some key requirements.”
The command has set forth an 18-month implementation plan, established a road map for the roll out of zero trust and developed a maturity model. “The maturity model allows us to walk through and scale the different capabilities and establish basic zero-trust capabilities, intermediate zero-trust capabilities and advanced zero-trust capabilities,” Haselhorst said.
The Air Force’s solutions architecture for zero trust is a derivative of the DOD chief information officer’s reference architecture that DISA also helped to inform. “We have a solutions architecture based on the DOD reference architecture and a maturity model that we put together to help us take bites of the elephant a little bit at a time,” he offered. “We are also always following the guiding principles of NIST Special Publication 800-207, which is somewhat the ‘Bible of Zero Trust’ that we all operate on.”
To validate that solutions architecture, the ACC will conduct several zero trust pilot initiatives, including: a program with Cloud One, the Air Force’s cloud platform; a pilot at Patrick Space Force Base; and a program at Beale Air Force Base.
“The ACC and the Air Force is moving very aggressively towards zero trust and trying to pilot as many capabilities as possible to try and make sure that we can validate the solution architecture and the plans that we have going forward,” the CTO said. “We are driving the objectives for the pilots, the goals that we want to try to accomplish and the outcomes that we want to see in order to institutionalize zero trust, learn from mistakes and push forward the ultimate and final zero trust solution for Air Force.”
The first pilot effort with Cloud One will expand zero trust capabilities to mission owners inside of the cloud platform. As part of this effort, the ACC is harnessing software-defined perimeter and orchestration solutions developed by Nicolas Chaillan, the Air Force’s chief software officer in the CIO’s office. “We are taking the software-defined perimeter implementations that Nic has implemented already as part of Platform One and now we're incorporating those into Cloud One,” Haselhorst clarified.
The second pilot aims to bring zero trust architecture into the U.S. Space Force launch enterprise. “We are very excited about this pilot,” the CTO stated. “We are trying to prove that the model that we are building transcends across cloud, regular traditional networks and also mission systems. And in this case, the launch enterprise is considered a mission system.”
The third effort with Beale Air Force Base would transform the base’s traditional network operations to one that is protected by zero trust measures. “Beale has leaned forward tremendously,” Haselhorst noted. “They want to become the first Air Force zero trust base of the future. The idea and the concept for this pilot is to explore all the challenges that would come about with transforming a full Air Force Base from a traditional network to zero-trust architecture. So, we're very, very excited about that and if this is successful that would be the model to follow for other Air Force bases.”
In addition, the service is pursuing several component-related pilot programs, involving identity, credentialing, access management, known as ICAM, and endpoint security. “These pilots are not directly about zero trust, but they are definitely requirements for zero trust,” Haselhorst added.
He acknowledged that while the technology solutions may be straightforward, the real issue will be shifting the Air Force’s culture. “Zero trust is a shift in mindset,” Haselhorst stated. “We are shifting our mindset that we’ve had for probably the last three decades of building this castle and moat model, shifting it away from that perimeter-based network control, and for a lot of people, that's a very hard shift. Just grasping their head around the fact that their perimeter is no longer their protection, that the perimeter needs to shift closer to the data resource. We need to have ICAM solutions that allow us to incorporate attributes to get access to resources. That is probably one of the biggest challenges.”
The CTO noted that the pilot efforts and the service’s shift to make zero trust a priority would not happen without Air Force leadership from CIO Lauren Knausenberger; Lt. Gen. Christopher Weggeman, the ACC deputy commander; Chaillan; and Brig. Gen. Chad Radeuge, the outgoing A-6; amongst other leaders. “We are very fortunate that the Air Force has an extremely strong set of leaders right now who are advocating for zero trust,” he said. “They are all really pushing forward and really willing to support policy on zero trust activities.”
“In order to get all of our efforts started, we will be partnering a lot with industry to learn with them and to work and deploy quicker,” Haselhorst concluded.
This article is the first part of a series of articles examining the Air Force's comprehensive push to adopt zero-trust architecture.
