GDIT unveils revolutionary modular approach to zero trust

sponsor content What's this?

Nearly a decade after the National Institute of Standards in Technology (NIST) released its first formal publication about zero trust architecture, agencies are now past the theoretical approach and solidly in practical mode. Technology leaders are no longer simply rethinking how to approach data in the age of zero trust or how to ensure continuous authorization within perimeters, they are acting. What that means for each agency, however, can differ drastically.

“We are in the ‘how’ stage of zero trust,” said John Sahlin, vice president of Cyber Solutions at General Dynamics Information Technology (GDIT). “And as we’ve seen a ton of different agencies, we know each is different and on their own zero trust journey.”

On top of differing needs across agencies and departments, artificial intelligence (AI) and advancing agentic systems are further requiring zero trust to evolve. AI agents represent a new entity — not quite human users or devices, but something separate comprising aspects of both.

“AI forces us to rethink some of the assumptions of how we treat entities, both person and non-person entities, in the environment,” Sahlin said. “Do we have to create a new set of zero trust rule sets for agents and AI systems?”

Building on these observations and the breadth and depth of GDIT’s federal agency experience across use cases and mission requirements, the organization developed a unique perspective and approach to operationalizing zero trust. The key to successful zero trust no matter where on the adoption journey an agency may be, Sahlin said, is a modular approach.

Effective zero trust requires flexibility and speed

Across various mandates and executive orders, including President Trump’s Cyber Strategy for America and Promoting Advanced Artificial Intelligence Innovation and Security , the current administration is prioritizing accelerated innovation, interoperability and public-private collaboration to deliver new capabilities faster than ever.

At the same time, AI-powered solutions and other emerging technologies are becoming increasingly critical to success at the tactical edge. A modern zero trust approach must address all environments — enterprise to edge — and take into account varying mission needs. Even within the military, for example, how the Navy defines and acts at the tactical edge may be different from the Marine Corps approach and the Air Force approach. Needs can further differ across various regions, theaters and bases.

“You may not need every component at the tactical edge that you need at the enterprise, and the way you deploy for the enterprise may be very different from how you deploy for a tactical edge,” Sahlin said. “You have to think in terms of modularity, you have to think in terms of interoperability and you have to think in terms of usability.”

A zero trust solution made of individual components that can be integrated into data, applications and user base maximizes agility. A modern stack that can be deployed as a full set or in whatever elements a mission may call for enables agencies to adapt to sudden changes and move at the speed of the mission.

“I don't think anyone can afford to supersize a solution set and replicate an exact copy at every base, post, camp, station, ship in the fleet, fill in your blank of the use case for tactical edge that you would also deploy at an enterprise,” Sahlin said. “Focusing on the mission and how that mission changes is important for us, and that's one of the reasons why we focused our zero trust development efforts on a modular stack of capabilities.”

GDIT’s unique zero trust solution

This novel approach has already resulted in a successful government cyber red team assessment that demonstrated its resilience against cyberattacks. It is the first and only solution assessed with a modular deployment model.

“If data is the king on the chessboard, then the modularity of our solution is the queen, the most powerful player on the board,” Sahlin said. “That gives us the ultimate flexibility to address our clients’ mission and data protection needs, while meeting them where they are in their journey.”

In addition to enhancing adaptability, the new approach enables technology leaders to leverage existing investment in zero trust rather than wasting time and resources on a wholesale replacement of agencies’ current zero trust architecture.

“We know that they're somewhere along the journey, so we're not saying, ‘rip out and replace everything you've already invested,’” Sahlin said. “If you have an ICAM stack already, great. If you have a SIEM/SOAR solution, sweet. We bring the rest of the pieces that you need to fill in the gaps, and we integrate with what you have, but we don't start from zero.”

Because while each mission differs and each agency develops at its own pace, the overall goal remains the same: Accelerating delivery to the warfighter.

What’s next for zero trust?

Throwing a new complication into the zero trust landscape, recent guidance from CISA, Adapting Zero Trust Principles to Operational Technology , urges organizations to plan zero trust implementation for OT systems over three to five year horizons. Securing OT systems raises different challenges, both due to the breadth of functions — from digital and cyber operations to physical light switches, locks, railway switches, water treatment facilities, the electric power grid and more — as well as the inherent criticality. If such systems fail, there is a higher likelihood of immediate threat to human lives.

“OT sits at the nexus between the digital and physical world, so the stakes are higher,” Sahlin said, “but also the way OT systems react to security controls is different.”

Much like in the IT space, legacy and outdated systems create hurdles to modernization. In the OT world, however, “outdated” can be a matter of multiple decades. OT systems also cannot tolerate much latency without causing potentially catastrophic failures.

Achieving the 2030 mandate requires assessing how these differences will impact the current zero trust approach, a conversation that must go beyond cyber and IT professionals to include the direct operators of the OT systems. GDIT is already investing in zero trust for OT to help lead this charge.

“As we think about OT systems and control systems combined with IT systems, we have to start thinking about weapons systems platforms — ships, autonomous vehicles, tanks and aircraft,” Sahlin said. “If you look at the General Dynamics portfolio … it's natural for GDIT to be thinking about how we protect those types of systems, because those are the types of systems that the rest of the General Dynamics family makes and delivers.”

Learn more about GDIT’s novel, modular approach to zero trust.

This content is made possible by our sponsor GDIT; it is not written by and does not necessarily reflect the views of GovExec ’s editorial staff.

NEXT STORY: Building next-generation defense networks for future mission success

赞助商内容 这是什么？

在国家标准与技术研究院 (NIST) 发布首份关于零信任架构的正式出版物近十年后，各机构如今已超越理论阶段，全面进入实践阶段。技术领导者不再仅仅停留在重新思考如何在零信任时代处理数据或如何确保边界内的持续授权，而是积极采取行动。然而，这对每个机构的具体影响可能截然不同。

通用动力信息技术公司（GDIT）网络解决方案副总裁约翰·萨林表示：“我们目前正处于零信任的‘如何做’阶段。正如我们所接触过的许多不同机构一样，我们知道每个机构的情况都不一样，都在走各自的零信任之路。”

除了各机构和部门的需求各不相同之外，人工智能 (AI) 和不断发展的智能体系统也需要零信任机制才能进一步发展。人工智能智能体代表了一种新的实体——它既不像人类用户也不像设备，而是兼具两者特征的独立存在。

萨林表示：“人工智能迫使我们重新思考我们如何对待环境中的各种实体，包括人和非人实体。我们是否需要为智能体和人工智能系统制定一套新的零信任规则？”

基于这些观察以及GDIT在联邦机构用例和任务需求方面积累的广泛而深入的经验，该组织针对零信任的实施发展出独特的视角和方法。Sahlin表示，无论机构处于零信任部署的哪个阶段，成功的关键都在于采用模块化方法。

有效的零信任需要灵活性和速度

在包括特朗普总统的《美国网络战略》和《促进先进人工智能创新与安全》在内的各项授权和行政命令中，本届政府优先考虑加速创新、互操作性和公私合作，以比以往任何时候都更快地提供新的能力。

与此同时，人工智能解决方案和其他新兴技术对于战术边缘的成功至关重要。现代零信任方法必须涵盖从企业到边缘的所有环境，并考虑不同的任务需求。例如，即使在军队内部，海军对战术边缘的定义和行动方式也可能与海军陆战队和空军有所不同。不同地区、战区和基地的需求也可能存在差异。

萨林说：“在战术前沿部署时，你可能不需要像在企业级部署时那样使用所有组件，而且企业级部署方式与战术前沿部署方式可能截然不同。你必须考虑模块化、互操作性和易用性。”

由可集成到数据、应用程序和用户群中的独立组件构成的零信任解决方案，能够最大限度地提高敏捷性。这种现代化的技术栈既可以作为完整套件部署，也可以根据任务需要灵活地拆分成各个组件，使机构能够适应突发变化，并以与任务速度同步的方式开展工作。

萨林表示：“我认为没有人能够负担得起在舰队的每个基地、哨所、营地、站点、舰船等所有需要战术优势的场所（例如企业）都部署一套完全相同的解决方案。对我们来说，关注任务及其变化至关重要，这也是我们将零信任开发工作重点放在模块化功能堆栈上的原因之一。”

GDIT 独特的零信任解决方案

这种创新方法已成功通过政府网络安全红队评估，证明了其抵御网络攻击的能力。它是首个也是唯一一个采用模块化部署模型进行评估的解决方案。

“如果说数据是棋盘上的国王，那么我们解决方案的模块化就是皇后，棋盘上最强大的棋手，”萨林说道。“这赋予了我们极大的灵活性，能够满足客户在使命和数据保护方面的需求，同时又能根据他们所处的阶段提供相应的支持。”

除了增强适应性之外，这种新方法还能让技术领导者利用现有的零信任投资，而不是浪费时间和资源来全面替换机构当前的零信任架构。

“我们知道他们已经走在某个阶段，所以我们不会说‘把你们已经投入的所有东西都推倒重来’，”萨林说。“如果你们已经有了ICAM堆栈，那就太好了。如果你们已经有了SIEM/SOAR解决方案，那就更棒了。我们会提供你们需要的其他组件来填补空白，并与你们现有的系统集成，但我们不会从零开始。”

虽然每个任务各不相同，每个机构的发展速度也各不相同，但总体目标仍然相同：加快向作战人员交付物资。

零信任的下一步是什么？

美国网络安全和基础设施安全局 (CISA) 近期发布的指南《将零信任原则应用于运营技术》为零信任架构增添了新的复杂性。该指南敦促各组织机构制定三到五年的运营技术 (OT) 系统零信任实施计划。由于 OT 系统功能范围广泛（涵盖数字和网络运营、物理照明开关、锁具、铁路道岔、水处理设施、电网等），以及其固有的关键性，保护 OT 系统面临着不同的挑战。一旦此类系统发生故障，极有可能对人类生命构成直接威胁。

“OT 处于数字世界和物理世界的交汇点，因此风险更高，”Sahlin 说，“但 OT 系统对安全控制的反应方式也不同。”

与IT领域类似，遗留的过时系统会阻碍现代化进程。然而，在OT领域，“过时”可能意味着长达数十年的时间。此外，OT系统也无法容忍过高的延迟，否则可能导致灾难性的故障。

要实现2030年的目标，就需要评估这些差异将如何影响当前的零信任方法。这项讨论必须超越网络安全和IT专业人员的范畴，涵盖OT系统的直接操作人员。GDIT已在OT零信任方面进行投资，以引领这一变革。

萨林表示：“当我们考虑将运营技术系统和控制系统与信息技术系统相结合时，我们必须开始考虑武器系统平台——舰船、无人驾驶车辆、坦克和飞机。如果你看看通用动力公司的产品组合……通用动力信息技术公司自然会思考如何保护这些类型的系统，因为这些正是通用动力集团旗下其他公司制造和交付的系统类型。”

了解更多关于GDIT创新、模块化的零信任方法。

此内容由我们的赞助商 GDIT 提供；它并非由 GovExec 编辑人员撰写，也不一定反映 GovExec 编辑人员的观点。

下一篇报道：构建下一代防御网络，助力未来任务成功