As DoD moves forward with adopting the framework to implement a C2C solution,
it should also take into account a goldmine that offers a trove of value for defense agencies.
(Jackie Niam/Getty Images)
By Bill Wright
The increased attack surface born from the digital age has caused the security threat level to rise, and in recent years, major retailers, consumer credit reporting agencies and credit card companies have seen substantial breaches rattle their organizations. When it comes to our nation’s Department of Defense, the threats remain as significant, but the stakes are even higher.
With tens-of-millions of endpoints and connected devices, clear visibility and full situational awareness into the DoD’s network is far from easy. As recent research shows, organizations lacking visibility and struggling with dark data are failing to gain valuable insights that aid in more efficient and effective decision-making.
Helping to solve this issue is the development of the Comply-to-Connect (C2C) platform, designed to ensure compliance (control and identity) of the devices that are entering the network. The emergence of C2C is welcome news for operational security and will greatly improve the DoD security mission should it become a Program of Record. As DoD moves forward with adopting the framework to implement a C2C solution, however, it should also take into account a hidden goldmine that offers a trove of value for defense agencies: data.
The driving force behind C2C
Defense agencies continually face sophisticated cyberthreats from nation-state adversaries. This is a challenge that impacts all branches of the Armed Forces and also industry partners. C2C enables an automated, self-service way to credential endpoints before connecting to the network. Think of it like a security guard that won’t let you into a venue unless you adhere to the proper dress code.
C2C aids in providing a more efficient and automated system that keeps operational security at the forefront of the DoD mission, helping to minimize system vulnerabilities and maximize asset management with the help of continuous monitoring and automation tools. Like the DoD’s Cybersecurity Strategy identifies, automation and large-scale data analytics are essential to defending against cyberattacks and creating secure computing zones. These tools can offer so much more than just serving a security purpose.
How the DoD can make it successful
It’s hard to look at C2C and not draw a comparison to the Department of Homeland Security’s Continuous Diagnostics and Mitigation (CDM) Program, which addresses similar challenges. Both programs aim to secure a system of government networks and employ a multiagency strategy in the process. Both also hinge on visibility and automation as central pillars to their success.
One of the crucial capabilities C2C will have to deliver is visibility across a wide variety of networks and agencies, and into thousands of different categories of devices and millions of endpoints from hundreds if not thousands of manufacturers. Ingesting that volume and variety of data and then being able to make sense of it will require a highly flexible data platform that is able to handle complexity at scale.
C2C must, then, be able to continuously evaluate the current state of those endpoints and automate a compliance audit to determine if a device should be authorized to remain on a DoD network. And it must do this seamlessly with minimal user experience impact.
The good news is that this challenge is not insurmountable and there are existing examples upon which DoD can continue to build. Looking at early movers so far, both the Navy and Marine Corps have begun to implement their own plans with regard to C2C at the enterprise level. This means other defense agencies can continue to build upon their successes and lessons learned. But the fundamental question that C2C doesn’t address is: What’s next? What comes after everyone has followed proper procedures and is connected to the unified network? That’s where the DoD data journey continues.
The hidden value in C2C
No doubt I do not need to prove to the DoD the importance of cyber hygiene and data security. But here’s where C2C can really shine: It gives the DoD a goldmine of data it can use for purposes outside of security.
It would be shortsighted to ignore the added potential that C2C can offer. Imagine millions of connected devices, sensors, machines, and cameras all sharing data.
That’s endless amounts of information that the DoD can use across the department to improve management, prioritize investments, shift behavior and improve the defense mission, all with the help of data to make more informed decisions. The ability to remove the barrier between data and action will solve many of the current challenges DoD leaders cite including a lack of end-to-end awareness and collaboration.
C2C provides a strong vision for what an agencywide security program could look like. What many don’t realize is that it provides a foundation for a much larger departmentwide data framework that can have compounding positive benefits across IT, security and the overall success of the mission at hand.
The road ahead
My charge to the leaders of C2C and other defense leaders is to dream big now that the framework is still nascent. Don’t miss an opportunity to assess how data can empower everyone, from private to four-star, to better serve the mission. If the C2C mission is executed correctly, it will enhance DoD security. If the program embraces more than merely its security purpose, it will reshape the DoD’s mindset toward data centricity and enable the department to bring data to every question, every decision, and most importantly, every action.
Bill Wright is director of federal government affairs at big-data analysis corporation Splunk and a former senior operations officer at the Office of the Director of National Intelligence.