A Shift Towards Security in Defense Technology
The Department of Defense (DoD) aims to meet a soft deadline for implementing zero-trust architecture in weapon systems by 2035, as outlined by Randy Resnick, director of the Zero Trust Office within the Pentagon’s Chief Information Office. This initiative encompasses critical systems like aircraft, tanks, and ships, marking a significant challenge in enhancing security across military platforms.
Collaboration is Key to Implementation
Achieving zero-trust architecture represents a complex task, especially when integrating such security models within the physical frameworks of weapon systems. Resnick acknowledged the need for collaboration with various Pentagon elements and the vendors responsible for designing these military assets. “We’re talking about stuff that potentially is inside the skin of this weapon system. That’s not our expertise,” he noted during the ATARC’s DoD Zero Trust Symposium. He emphasized the formidable nature of this transformation, suggesting that it may require over a decade to fully realize.
Legislative Mandates Driving Change
The push for zero trust across defense frameworks stems from language in the 2022 National Defense Authorization Act, which instructed the Pentagon to prioritize zero trust strategies for information technology (IT), operational technology (OT), and weapon systems, the latter being the final frontier for implementation, according to the DoD’s Zero Trust Strategy.
In a previous effort, the Pentagon began strategizing to achieve full zero-trust implementation for IT systems by the end of fiscal year 2027. Resnick characterized this goal as ambitious yet attainable, particularly for an organization as large and complex as the Pentagon, where five years can be considered remarkably swift for such undertakings.
Evolving Focus Amid Rising Threats
Addressing the current threat landscape, Resnick announced a strategic pivot towards zero trust in operational technology due to a surge in adversarial attacks targeting critical infrastructure. He differentiated OT from IT, explaining that operational technology involves systems controlling physical processes, such as manufacturing machinery and environmental controls.
Resnick anticipates the release of official guidance on implementing zero trust for OT by October, with potential for an earlier rollout depending on feedback after internal circulation. He highlighted that zero trust for operational technology should be fully operational by 2030, thereby informing future guidelines for weapons systems compliance.
Navigating Challenges in Weapon Systems
Although Congress has mandated a zero trust approach for weapon systems, Resnick emphasized the need for flexibility in this initiative. “It may not make sense for every system to be zero trust compliant,” he said. He called for open discussions around the applicability of zero trust elements within weapons systems, indicating that the Pentagon is still in the early stages of evaluating this transition.
“The spirit of wanting to enhance control over these systems is there. We’re open-minded,” Resnick concluded, signaling a thoughtful approach to redefining defense security practices in alignment with contemporary challenges.
