Defense Information Systems Agency (DISA)

Chronicle

2022: US Department of Defense announces partnership with IT industry to create "combat" cloud services

On November 9, 2022, the Pentagon-controlled Defense Information Systems Agency (DISA) announced that it wants to quickly provide military personnel with "combat" cloud technologies and seeks to expand cooperation with industrial partners as part of this effort.

Sharon Woods, director of DISA's Center for Hosting and Computing, said the agency is in the process of creating a fourth collaborative research and development agreement by November 2022 - a joint agreement between federal research laboratories and technology transfer partners, for example, industrial enterprises, to develop new solutions - to provide infrastructure code complete with pre-accredited, pre-configured source data.

US Department of Defense announces partnership with IT industry

According to the DISA website, CRADAs are the agency's primary technology transfer tool for developing new applications. Because CRADAs are not technically an acquisition contract, they are not regulated by the Federal Procurement Regulation or the Federal Defense Procurement Regulation Supplement, meaning DISA does not allocate funds for research but can offer resources such as personnel, equipment, or intellectual property to assist.

The new project could help the military build cloud environments in 2-4 hours rather than 2-4 weeks or months, Woods said, adding: This is a really important opportunity for mission partners to quickly enter the cloud.

The center focused on aligning proposed software products with the agency's 2022-2024 strategic plan, Woods said, as well as working with industry partners and the military to better understand how to accelerate cloud adoption and what private cloud services should be deployed, such as account tracking and automation.

There is no one-size-fits-all solution for these types of capabilities and needs, Woods said, noting that DISA is exploring hybrid cloud and other potential offerings. All of this opens up opportunities - whether it's subcontracting with our existing contractors using something like CRADA, even getting new contracts if it makes sense - but I think all of this opens up ample opportunities for us to partner.[1]

2020: Launch of a project from the Pentagon and the NSA to identify users of secure IT systems

In mid-July 2020, it became known that the US Department of Defense Information Support Office (DISA) joined forces with the National Security Agency (NSA) to develop a zero trust reference architecture for identifying users with access to secure information systems. The results of the project should be presented by the end of 2020, as announced by DISA head Vice Admiral Nancy Norton.

Once the project is complete, US defense agencies will be able to use the reference architecture to implement zero-trust environments. This term means that in such a system, the user is constantly authenticated during operation, while single authentication by the traditional login-password method is not recognized as reliable.

Pentagon and NSA launch joint project to identify users of protected IT systems

Norton explained that the new approach does not change the entire architecture from scratch, but uses old equipment to implement new principles. Special protocols, if used, should work in existing data networks. The details of the project were not disclosed, but the developers intend to combine empirically found methods and promising practices of cloud storage access providers.

DISA Cloud Server Office Chief John Hale explained that new technologies will be introduced "case by case," as some cloud service providers are "more focused on the future than others." As part of the DISA project, you will have to solve many problems that are not necessarily related to security. For example, it is necessary to ensure the transmission of large amounts of data through cloud access points (BCAPs), which are often criticized for the low speed of network traffic. Indeed, even with a zero-trust architecture, the Pentagon will still need BCAPS.^[2]

Notes