Army’s Project Gatekeeper aims to cut software approval times from months to ‘minutes’

U.S. Army 2nd Lt. Tiffany D. Jessop, assigned to 4th Squadron, 10th Cavalry Regiment, 1st Armored Brigade Combat Team, 4th Infantry Division, operates the ODIN software platform during a division reconnaissance and security experiment as part of Project Convergence Capstone 6 at Fort Irwin, California. (U.S. Army photo by Staff Sgt. Ger’vonni Straun)

WASHINGTON — In just ten days, the Army will activate Project Gatekeeper, a new AI-enhanced cybersecurity sandbox designed to vet commercial software for use on Army networks, officials announced today.

Launching Oct. 23, Project Gatekeeper is creating a single sandboxed environment — running on the Army’s cloud but isolated from operationa l networks and sensitive data — where companies can bring their software for assessment, even if they don’t have an Army contract or a program manager to sponsor them. Officials say Gatekeeper will cut the time required to get software approved fro m months to “minutes” — without sacrificing security in the process.

“Success, to me, looks like a company, within minutes, is able to log in, submit their code and get the green check mark from our pipeline that says you are good to go,” acting Army Chief Information Officer Gabe Chiulli told reporters at the annual AUSA conference here this morning.

Compare that with the current, cumbersome clearance process that can take days or weeks — stalling some software projects for as long as nine months, Chiulli and other officials said. That’s a long time to wait for a software upgrade, especially under a process that officials say lack consistent cybersecurity practices, transparency for contractors and visibility for Army leaders into what’s actually happening on their networks.

“We have had to do a lot of weird janky things to get code into our environments,” Chiulli said. Sometimes, he said, “I’m not sure how they’re getting code over to us.”

The root of the problem, officials said, is that the Army has lacked a single, standardized, centralized process for bringing commercial software onto its secure networks. Instead, “it was up to every program manager,” explained David Markowitz, the service’s chief data and analytics officer.

But many program offices lacked the capability or willingness to conduct cybersecurity assessments of new and unfamiliar code. Rather than evaluate the software themselves, they would wait for another organization to vet the company and officially grant its software Authority To Operate (ATO) on military networks.

“A lot of times, organizations in the Army won’t talk to [companies] until they have this ‘golden ATO,’” Chiulli said.

That created a kind of Catch-22 : The companies best positioned to win Army software contracts where often the ones that already had them. Meanwhile new, innovative entrants — the kind of companies that the Pentagon’s been courting for over a decade — struggled to navigate the combined complexities of cybersecurity rules, procurement regulations and Army bureaucracy.

If a program manager did decide to give a new piece of software a chance, moreover, they rarely had a dedicated, isolated sand box in which t o test it. Instead, they had to bring it onto an Army network and assess it there. That, in turn, required the company’s personnel to get cleared for Common Access Cards (CAC) so they could access the Army system.

“We spent a lot of time and energy trying to get people CAC cards simply to help work with us,” Chiulli said. “This is to get rid of all that [and] lower barriers to entry.”

Gatekeeper will let companies test their software before they have an Army contract, a program manager sponsoring them or even a formal request for proposals to respond to, the officials emphasized, allowing prospective vendors to identify and address cybersecurity problems before trying to do business with the service.

Companies will still need CAC cards to access the platform initially, officials acknowledged. But the Army is finalizing an agreement with the General Services Administration (GSA) to use its Login.gov platform, which allows secure access to government systems for members of the public.

“We’re looking at mid-November to have that integrated, at which point we’ll be able to make this actually commercially accessible,” said David Wright, chief engineer at the Army Software and Innovation Center (ASIC).

Once a company gets access to the Gatekeeper platfor m, it can upload its software and run it through the Army’s standardized cybersecurity tools, including an AI assessment, offi cials explained. In minutes, the automated system will either tell the company its software passed the test or give detailed, actionable feedback explaining why it failed.

Gatekeeper will also include the Army’s DevSecOps software development kit, Wright said, giving companies a secure environment in which to address problems using tools the Army itself has vetted.

“The idea here is not to lessen the security requirements,” Wright emphasized, “but more to make the process more accessible and available, so that they can get immediate feedback and understand what it is that needs to be adjusted or corrected before these things are brought into an Army environment.”

美国陆军少尉蒂芙尼·D·杰索普（Tiffany D. Jessop）隶属于第4步兵师第1装甲旅战斗队第10骑兵团第4中队，在加利福尼亚州欧文堡参与“融合计划”第六阶段的师级侦察和安全实验，并操作ODIN软件平台。（美国陆军参谋军士格沃尼·斯特劳恩摄）

华盛顿——陆军官员今天宣布，陆军将在短短十天内启动“守门人计划”（Project Gatekeeper），这是一个全新的人工智能增强型网络安全沙箱，旨在审查可在陆军网络中使用的商业软件。

“守门人计划”（Project Gatekeeper）将于10月23日启动，旨在创建一个独立的沙盒环境——该环境运行在陆军的云端，但与作战网络和敏感数据完全隔离——企业可以将他们的软件提交到该环境中进行评估，即使他们没有陆军合同或项目经理的支持。官员表示，“守门人计划”将把软件审批时间从数月缩短到“几分钟”，同时确保安全性。

“在我看来，成功就是一家公司能够在几分钟内登录，提交他们的代码，并从我们的流程中获得绿色对勾，这表明一切就绪，”陆军代理首席信息官加布·丘利今天上午在一年一度的美国陆军协会会议上告诉记者。

相比之下，目前繁琐的审批流程可能需要数天甚至数周时间——据丘利和其他官员称，这导致一些软件项目停滞长达九个月。等待软件升级这么长时间实在太漫长了，尤其是在官员们所说的缺乏一致的网络安全措施、对承包商缺乏透明度以及陆军领导人无法了解其网络实际运行情况的流程下。

“为了把代码导入到我们的环境中，我们不得不采取很多奇怪而笨拙的办法，”丘利说。他补充道，有时候，“我都不知道他们是怎么把代码传给我们的。”

官员们表示，问题的根源在于陆军一直缺乏一个统一、标准化、集中化的流程，用于将商用软件接入其安全网络。陆军首席数据和分析官大卫·马科维茨解释说，过去“这完全取决于每个项目经理”。

但许多项目办公室缺乏对新代码和不熟悉的代码进行网络安全评估的能力或意愿。他们不会自行评估软件，而是等待其他机构对公司进行审查，并正式授予其软件在军用网络上运行的授权（ATO）。

Chiulli说：“很多时候，陆军的组织在拿到这份‘黄金ATO’之前，都不会与（公司）进行谈判。”

这就造成了一种进退两难的局面：最有希望赢得陆军软件合同的公司往往是那些已经拥有合同的公司。与此同时，那些五角大楼十多年来一直努力争取的新兴创新型企业，却难以应对网络安全规则、采购条例和陆军官僚机构交织而成的复杂局面。

此外，如果项目经理决定试用一款新软件，他们通常也没有专门的、隔离的沙箱环境来进行测试。相反，他们必须将软件接入陆军网络进行评估。而这又需要公司人员获得通用访问卡（CAC）才能访问陆军系统。

“我们之前花费了大量时间和精力，试图让人们获得CAC卡，以便他们能够与我们合作，”丘利说。“这样做是为了消除所有这些障碍，降低准入门槛。”

官员们强调，Gatekeeper 将允许公司在获得陆军合同、项目经理赞助甚至正式的提案征集之前测试其软件，从而使潜在的供应商能够在尝试与陆军开展业务之前发现并解决网络安全问题。

官员们承认，企业最初仍需使用CAC卡才能访问该平台。但陆军正在与美国总务管理局（GSA）敲定一项协议，以使用其Login.gov平台，该平台允许公众安全访问政府系统。

“我们预计在 11 月中旬完成集成，届时我们将能够真正实现商业化，”陆军软件与创新中心 (ASIC) 首席工程师大卫·赖特 (David Wright) 说。

据官员解释，一旦公司获得Gatekeeper平台的访问权限，即可上传其软件并使用陆军的标准化网络安全工具（包括人工智能评估）进行测试。几分钟内，自动化系统就会告知公司其软件是否通过测试，或者提供详细且可操作的反馈，解释其未通过测试的原因。

赖特表示，Gatekeeper 还将包含陆军的 DevSecOps 软件开发工具包，为企业提供一个安全的环境，使其能够使用陆军自己审查过的工具来解决问题。

赖特强调：“这里的想法不是降低安全要求，而是让这个过程更容易获得和使用，以便他们能够立即获得反馈，并了解在将这些事物引入军队环境之前需要调整或纠正哪些方面。”