Sometimes in the alphabet soup of military parlance, an acronym emerges that actually hits the mark. Take, for instance, C-RAPID, a product of the Army’s Program Executive Officer - Enterprise Information Systems.
The Cyberspace Real-time Acquisition Prototyping Innovation Development promises to do just what it says: Generate cutting-edge solutions to evolving cyber threats. Unlike other military efforts to partner with industry for real-time solutions, C-RAPID will be an actual place, a “forge” where cyber troops will test emerging defenses for quick deployment.
The cyber forge is slated to open at Fort Belvoir, Virginia, in April and to be fully operational by June.
Early trials of the C-RAPID approach suggest it could dramatically speed delivery of cyber solutions. In one test case, a team was able to remediate an emerging network threat in just eight days, a task that normally takes weeks. “We can do it. But it takes a revolutionary approach in terms of how we look at the problem and look at the tools we can use,” said LTC Scott Helmore, the product manager for Defensive Cyber Operations (DCO) at PEO EIS.
Here’s how C-RAPID plans to reinvent cyber.
First, it will engage industry using the increasingly popular other transaction authority, or OTA, a government buying mechanism that allows the military to make quick buys from preapproved vendors. The plan also calls for engagement with a consortium of industry players, with the help of a consortium management firm.
“A lot of times those smaller companies are not used to the Department of Defense rules, and so the consortium management firm will help them to understand: When government asks for a risk management framework, for example, what is that?” Helmore said.
The risk management framework is itself another key element in the quick adoption of cyber solutions. Government rules calls for the application of RMF as a means of integrating new solutions into the technology cycle. Through C-RAPID, “we will create a group that will work with industry to help them build the products so that when they enter the pipeline, they have already produced that documentation,” Helmore said.
All these efforts could help to get new ideas to the starting gate faster, but one more key element is required to get cyber solutions up and running: A place to test them. C-RAPID has that, too.
“There are labs with similar capabilities. There are OTAs being used,” said Col. Chad Harris, project manager I3C2 (Installation Information Infrastructure Communications and Capabilities) in PEO EIS. “But we are bringing together all those pieces in an actual the facility. That’s what is remarkable about this.”
At the forge
Planners envision a number of activities unfolding at the forge.
New ideas will emerge through a rapid, 30-day prototyping process that beings with a request for white papers. Industry partners will have just five days to produce a two-page brief on their proposed solutions to a cyber problem.
The C-RAPID team will pick a few likely candidates to present in a “Shark Tank” environment, and the strongest solutions will move on to the “Crucible” phase, where military cyber pros will put the solution through its paces. That should bring a solution into play in not more than 30 days, after which C-RAPID will hand it over to war fighters for 30 days of field testing.
“We want to let the war fighter figure out whether this is the capability they want to push to the rest of the service,” Helmore said. “We will use that 30-day operational assessment to make sure the proper controls are in place, to make sure we have properly identified all the risks around this product and worked out a mitigation plan.”
Bottom line: That’s some very fast cyber in action. But what will it produce? C-RAPID planners have their eye on a couple of pressing problems.
PEO EIS has an undisclosed operational need for advanced analytics, which it won’t discuss for security reasons.
C-RAPID also will likely seek a new, more agile toolkit for cyber warriors. “We have an upcoming requirement for a very small, lightweight, deployable hard system for defense of cyber operations, specifically for our cyber defensive teams,” Helmore said. “Right now we have something about the size of an overhead carry-on. We want something small enough to go under the seat of an airplane.”
The team also will be seeking advanced sensors, sometimes known as “canaries,” that will scan the cyber front and alert analysts to possible threats.
“It’s the ability to put a sensor into a tactical or strategic formation that can remain prestaged and activate when the trigger is found. There will be physical hardware, things the size of a miniaturized notebook, and it would be deployed anywhere on the network where we need eyes and ears,” Helmore said.
Artificial intelligence and other software tools could trigger an alert; for example, when a certain IP address connects to the network or when data comes through via specified protocols. “When it hits that trigger, it turns itself fully on and alerts the cyber protection team,” he said.
Finally, C-RAPID likely will be looking for more advanced early-warning tools, meant to detect cyberthreats before they even reach the network. “Today we have a hard time seeing what is beyond the Department of Defense network,” Helmore said. “We want to work with companies on software capabilities and services that allow us to see a lot more of the internet, to give us a better understanding of inbound threats.”