Welcome to Thunderdome: Pentagon awards zero trust architecture prototype

WASHINGTON — The Pentagon’s top IT office issued a nearly $7 million contract to develop its zero trust IT architecture, the Department of Defense announced Tuesday.

The cyber threat landscape has shifted in recent years, becoming much more dynamic. As a result, traditional defenses have proven to not be up to the test. The federal government has now shifted to what it calls a zero trust model, which assumes networks are already compromised and validates users, devices and data continuously.

The contract, awarded to Booz Allen Hamilton, is for Thunderdome, the Defense Information Systems Agency’s implementation of zero trust. The contract is for a six month prototype effort in which the agency will operationally test how to implement its zero trust architecture involving technologies such as Secure Access Service Edge and Software Defined-Wide Area Networks.

“Over the course of the next six months, we plan to produce a working prototype that is scalable across the department,” said Jason Martin, director of DISA’s digital capabilities and security center.

Officials have explained that Thunderdome is not intended to be the DoD’s sole solution. It will not be mandated across DoD or the services, meaning the services can opt to partner with DISA or implement their own zero trust system.

Officials also noted that Thunderdome and zero trust represents a shift in how the DoD conducts cybersecurity.

“Rooted in identity and enhanced security controls, Thunderdome fundamentally changes our classic network-centric defense-in-depth security model to one centered on the protection of data and will ultimately provide the department with a more secure operating environment through the adoption of zero trust principles,” said Chris Barnhurst, DISA deputy director.

Following a series of high profile cyber breaches – such as when Russian intelligence personnel planted malicious code in software updates provided by government supplier SolarWinds, allowing unprecedented access for months across federal networks – the Biden administration issued an executive order in May 2021 to strengthen cybersecurity across the federal government. One of the key tenets of that order was for agencies to implement zero trust.

A follow on Jan. 19 national security memorandum establishing metrics for improving the cybersecurity of national security systems requires agencies to develop a plan to implement zero trust architectures.

Last summer, the DoD also decided to do away with the Joint Regional Security Stacks, initially established to shrink the cyberattack surface by consolidating countless classified entry points around the world to 25 sites, in favor of the zero trust Thunderdome approach.

More In IT and Networks

Opinion

Congress should address recurring cases of cyber espionage at home

It should be focusing on improving the cybersecurity practices of the domestic actors who repeatedly allow this foreign hacking to occur.

All the US assets that helped repel Iran’s attack on Israel

Multiple Navy warships, Air Force fighter jets and a missile defense battery helped take out Iran's attack on Israel.

Marines pick three companies for loitering munitions program

The weapon would give squads and platoons air firepower at their fingertips.

Here’s the air-defense system that protected Israel from Iran’s drones

The system shot down the vast majority of about 350 drones and missiles Iran launched over the weekend.

Air Force to get F-15E jet with fresh electronic warfare tech in summer

EPAWSS, an advanced electronic warfare system, will allow F-15EX and some F-15E jets to monitor, jam and deceive threats in highly contested environments.