Defense officials are increasingly turning to machine learning and automation to streamline cybersecurity processes, particularly the cumbersome process of obtaining an Authority to Operate (ATO) for software on Pentagon networks.
Automated ATOs: A Taxpayer Priority
„We need tools and capability and AI to make that faster and less expensive,” stated Katie Arrington, performing the duties of the Pentagon CIO, emphasizing the need for automated ATOs to ensure taxpayer value.
An ATO, the cybersecurity approval for software on Pentagon networks, often takes over a year to acquire, a timeframe that can render software obsolete due to emerging cyber threats.
Marine Corps Achieves Rapid ATOs
However, Dave Raley, head of Operation Stormbreaker at Marine Corps Community Services, revealed his team is using automation to achieve ATOs in under a month, sometimes even within 24 hours.
Intelligence Community Pursues „Espresso ATO”
The Intelligence Community (IC) is also exploring AI and automation to expedite the ATO process. IC CIO Doug Cossa announced the „espresso ATO,” a minimum set of controls for automated authorization. The goal is an automated evaluation process similar to a car’s emissions check.
AI Excels in Vulnerability Detection
Beyond ATOs, AI is accelerating other cybersecurity processes. Alexei Bulazel of the National Security Council highlighted DARPA’s AI Cyber Challenge, where AIs identified and patched vulnerabilities in millions of lines of code, including „zero-day” threats missed by human coders.
Beyond Technology: Agile Methodology and Documentation
Speakers emphasized that speeding up cybersecurity requires more than just technology. Agile methodology (DevSecOps) and thorough documentation, including Software Bills Of Materials (S-BOMs), are crucial.
Pentagon’s SWFT Initiative
The Pentagon’s Software Fast Track (SWFT) initiative, established in April, aims to institutionalize these best practices and leverage automation. Vendors are encouraged to provide comprehensive documentation, including SSDF adherence and S-BOMs, which AI can quickly analyze.
Overhauling Risk Management Framework
The next step involves a radical overhaul of the Risk Management Framework (RMF). The goal is to shift the focus from compliance checklists to cybersecurity, cyber survivability, and automation, with AI playing a key role in continuous monitoring and validation.
High Stakes in AI Race
Dave McKeown, the Pentagon’s chief information security officer, said, “If we don’t adopt AI and stay ahead of the AI race, China’s gonna kick our butts, and we’re gonna lose our position in the world.” He added that AI should be integrated as widely as possible.
