DoD Zero Trust Reference Architecture.pdf

Department of Defense (DoD) Zero Trust Reference Architecture

Version 2.0 July 2022

Prepared by the Defense Information Systems Agency (DISA) and National Security Agency (NSA) Zero Trust

Engineering Team

HanesKL Cleared ii

July 2022 DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited.

Document Prepared By Date Name: Robert Freter June 2022 DISA Zero Trust Program Lead (ID2) iii

Table of Contents

1 PURPOSE AND STRATEGIC GOALS

1.1 Introduction

1.2 Purpose

1.3 Scope

1.3.1 Stakeholders

1.3.2 Organization of the Reference Architecture

1.3.3 Timeframe

1.4 Vision and Goals (CV-1)

1.4.1 Vision and High-Level Goals (CV-1)

1.4.2 Zero Trust Strategy

1.5 Cybersecurity (Transition) Problem Statement (OV-1)

1.6 Overall Target Environment (OV-1)

1.7 Assumptions

1.8 Constraints

2 PILLARS AND PRINCIPLES

2.1 Overview

2.2 Concept and Tenets of Zero Trust

2.3 Pillars

2.4 Reference Architecture Principles (OV-6a)

3 CAPABILITIES

3.1 Capabilities Taxonomy (CV-2)

3.2 FFP: Pillars, Resources & Capability Mapping

4 USE CASES

4.1 Data Centric Security Protections (OV-1)

4.2 Data-Centric Security Protections (OV-2)

4.3 Data Encryption Protections (OV-2)

4.4 Coordinating Policy for Data-Centric Security Protections (OV-2) iv

4.5 Data Analytics & AI (OV-1)

4.6 Data Analytics & AI (SV-1)

4.7 Centralized Orchestration & Policy Management (OV-1)

4.8 Centralized Orchestration & Policy Management (OV-2)

4.9 Dynamic, Adaptive Policy Feedback Loop (OV-1)

4.10 VPN-Less Implementation (OV-1)

4.11 East-West Segmentation (OV-1)

4.12 Global Uniform Device Hygiene (OV-1)

4.13 Global Uniform Device Hygiene (OV-2)

4.14 Dynamic, Continuous Authentication (OV-1)

4.15 Dynamic, Continuous Authentication (OV-2)

4.16 Conditional Authorization (OV-1)

4.17 Conditional Authorization (OV-2)

5 TECHNICAL POSITIONS

5.1 Emerging Technologies

5.2 Standards, Associated Architectures and Guides

5.3 Linkages to Other Architectures

5.3.1 DoD Cybersecurity Reference Architecture (CS RA) Integration

5.3.2 DoD ICAM Reference Design (RD)

5.3.3 NIST Special Publication 800-207 Zero Trust Architecture

6 SECURITY ASSESSMENT

6.1 Governance

6.2 Data Governance (OV-2)

6.3 Securing Supply Chain (OV-2)

7 ARCHITECTURE PATTERNS

7.1 Architecture Patterns (CV-4)

7.1.1 Domain Policy Enforcement for Resource Access (SV-1)

7.1.2 Software Defined Perimeter (OV-2)

v

7.1.3 ZT Broker Integration (SV-1)

7.1.4 Micro Segmentation (SV-1)

7.1.5 Macro Segmentation (SV-1)

7.2 External Services

7.2.1 SvcV-1: External Services(SvcV-1)

7.2.2 SvcV-2: Enterprise Federated Identity Service (SvcV-2)

8 TRANSITION ARCHITECTURE PLANNING (FFP)

8.1 Maturity Model (FFP)

8.2 Baseline (OV-1)

8.3 Transition (OV-1)

9 APPENDIX (AV-2)

9.1 Systems

9.2 Services

9.3 General Terms

9.4 DIV-1

9.5 StdV-1-2 References

9.6 Capability Table

10 REFERENCES

vi

LIST OF TABLES

Table 1 Reference Architecture Principles (OV-6A)

Table 2 Design Pattern Table (CV-4) vii

LIST OF FIGURES

Figure 1 Legend for Performers

Figure 2 Zero Trust Vision (CV-1)

Figure 3 Cybersecurity Problem Statement (OV-1)

Figure 4 Target Environment (OV-1)

Figure 5 Zero Trust Pillars

Figure 6 Capability to Pillars Mapping (FFP)

Figure 7 Zero Trust Authentication and Authorization Capability Taxonomy (CV-2)

Figure 8 Zero Trust Infrastructure, Workload and Data Capability Taxonomy (CV-2)

Figure 9 Zero Trust Analytics and Orchestration Capabilities Taxonomy (CV-2)

Figure 10 Zero Trust Enabling Capabilities Taxonomy (CV-2)

Figure 11 FFP: Pillars, Resources & Capability Mapping (CV-7)

Figure 12 Data Centric Security Protections (OV-1)

Figure 13 Data-Centric Security Protections (OV-2)

Figure 14 Data Encryption Protections (OV-2)

Figure 15 Coordinating Policy for Data-Centric Security Protections (OV-2)

Figure 16 Big Data Analytics & AI (OV-1)

Figure 17 Data Analytics & AI (SV-1)

Figure 18 Centralized Orchestration & Policy Management (OV-1)

Figure 19 Centralized Orchestration & Policy Management (OV-2)

Figure 20 Dynamic, Adaptive Policy Feedback Loop (OV-1)

Figure 21 VPN-Less Implementation (OV-1)

Figure 22 East-West Segmentation (OV-1)

Figure 23 Global Uniform Device Hygiene (OV-1)

Figure 24 Global Uniform Device Hygiene (OV-2)

Figure 25 Dynamic, Continuous Authentication (OV-1)

Figure 26 Dynamic, Continuous Authentication (OV-2)

Figure 27 Performers Requiring Authentication

Figure 28 Conditional Authorization (OV-1)

Figure 29 Conditional Authorization (OV-2)

Figure 31 Standards Profile for DoD Zero Trust Architectures

Figure 32 Securing the Supply Chain (OV-2) viii

Figure 33 Domain Policy Enforcement for Resource Access (SV-1)

Figure 34 Design Pattern: Software Defined Perimeter (OV-2)

Figure 35 SoS Design Pattern: Zero Trust Broker Integration (SV-1)

Figure 36 SoS Micro Segmentation (SV-1)

Figure 37 SoS Micro Segmentation (SV-1)

Figure 38 SoS Micro Segmentation (SV-1)

Figure 39 Design Patterns: SoS Macro Segmentation (SV-1)

Figure 40 External Services (SvcV-1)

Figure 41 Enterprise Federated Identity Service (SvcV-2)

Figure 42 ICAM Service ( SvcV-2)

Figure 43 Maturity Model (FFP)

Figure 44 Transition Architecture Baseline (OV-1)

Figure 45 Transition Architecture Transition (OV-1)

1 PURPOSE AND STRATEGIC GOALS

1.1 Introduction

“Zero Trust is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources. Zero Trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the Internet) or based on asset ownership (enterprise or personally owned).”1 Zero Trust (ZT) requires designing a consolidated and more secure architecture without impeding operations or compromising security. The classic perimeter/defense-in-depth cybersecurity strategy repeatedly shows to have limited value against well-resourced adversaries and is an ineffective approach to address insider threats.

The DoD Cybersecurity Reference Architecture (CS RA) documents the Department’s approach to cybersecurity and is being updated to become data centric and infuse ZT principles.

ZT supports the 2018 DoD Cyber Strategy, the 2019 DoD Digital Modernization Strategy, the 2021 Executive Order on Improving the Nation’s Cybersecurity, and the DoD Chief Information Officer’s (CIO) vision for creating “a more secure, coordinated, seamless, transparent, and cost-effective architecture that transforms data into actionable information and ensures dependable mission execution in the face of a persistent cyber threat.”2 ZT should be used to re-prioritize and integrate existing DoD capabilities and resources, while maintaining availability and minimizing temporal delays in authentication mechanisms, to address the DoD CIO’s vision.

1.2 Purpose

An architecture is built for a defined purpose and should answer a specific set of questions to enabling data-driven, informed decisions. The Reference Architecture (RA) establishes a framework that provides guidance via architectural Pillars and Principles. It identifies which of the overall strategic needs (goals and objectives) are the focus of the RA. The RA is a conceptual, capability-centric description of the architecture and primarily supports capability planning, portfolio management, and Information Technology (IT) investment decisions. It establishes high-level service and operation concepts, architectural questions of importance, and technology opportunities and constraints that shape the domain of an approach. The RA also includes a synopsis of current industry and DoD approaches and identifies key determining standards that together describe constraints and opportunities.

1 NIST SP 800-207 Zero Trust Architecture, August 2020

2 DoD Digital Modernization Strategy, June 2019.

1.3 Scope

The DoD Zero Trust Engineering Team developed this Zero Trust Reference Architecture (ZT RA) to align with the DoD definition: “Reference Architecture is an authoritative source of information about a specific subject area that guides and constrains the instantiations of multiple architectures and solutions.”3 This Reference Architecture describes Enterprise standards and capabilities. Single products/suites can be adopted to address multiple capabilities. Integrated vendor suites of products rather than individual components will assist in reducing cost and risk to the government. This document will evolve as requirements, technology, and best practices change and mature. ZT promotes an individual journey to a collaborative goal of continuous enhancements, while also incorporating best practices, tools, and methodologies of industry.

1.3.1 Stakeholders

The DoD ZT RA will be used by DoD Mission Owners (MOs) to guide and constrain the evolution of existing DoD IT and Enterprise Environments. MOs are individuals/organizations responsible for the overall mission environment, ensuring that the functional and cybersecurity requirements of the system are being met.

The ZT RA provides an end-state vision, strategy, and framework for MOs across the DoD to utilize in order to strengthen cybersecurity and guide the evolution of existing capabilities to focus on a data centric strategy.

ZT embeds security principles throughout the architecture for the purpose of protecting data and service operations, preventing, detecting, responding, and recovering from malicious cyber activities. The perspective of the ZT RA is to guide the developer, operator, manager, and user of ZT in the development of solutions to implement a ZT framework within an existing environment.

This ZT RA’s intent is to:

• Provide stakeholders with operational context needed to better understand principles and rules when applying a ZTA.

• Define capabilities required to enable a ZTA.

• Provide baseline description of ZT for use in managing change and risk associated with evolving operational needs.

• Define the importance of ZT by showcasing how the model constantly limits access when required, continuously monitors, and identifies anomalies or malicious acts.

1.3.2 Organization of the Reference Architecture

3 DoD Reference Architecture Description – June 2010

This RA contains the following sections:

• Strategy and Vision (with broad Operational Views)

• Pillars and Principles

• Conceptual Capability Architecture (capabilities organized into a functional taxonomy, here associated with the Pillars)

• Use Cases and associated requirements

• Technical environment describing emerging technology, common industry approaches and key standards

• Security Assessment

• Architecture patterns (The scope of alternate ways to realize a conformant design and the refining of Performers into Systems and Services)

• Example, Transition Architecture direction meeting the above constraints and being pursued at the time of the RA (Maturity Model, baseline, transition, target, phases)

Following DoD standards, the artifacts in this RA are from the Department of Defense Architectural Framework (DoDAF). Because of the broad audience that needs to understand and adapt ZT, an informal style is used for the artifacts. Informal drawings are easier to understand by a wide audience, not all of whom are familiar with Unified Profile for DoDAF/MODAF (UPDM) model representations. These drawings should allow a common representative of the target stakeholder to grasp the meaning of the artifact. With the RA, it is the content that is important. However, this is still a digital architectural model and includes artifacts with descriptions, lists of definitions, and tables of interaction. Entities (the nouns of DoDAF) are defined and used in the artifact drawings which tell a story of function and entity relationships. The All View Integrated Dictionary (AV-2) is organized by type of entity and most of these tables are in the appendix. From this RA, Reference Designs (RD) can be created that capture a ZT logical architecture for specific environments and functional needs.

The conceptual capability architecture predominately is captured in several Operational Views [OV-1: High-Level Operational Concept Graphic, OV-2: Operational Resource Flow Description] and Capability Views [CV-1: Vision, CV-2: Capability Taxonomy]. Strategies are captured in a CV-1. Here, OV-1s describe the problem and the opportunities for a specific functional environment. Then capabilities are explained in relation to the OV-1 opportunities. The (entity type) capabilities appear in the drawings with a thin line. These are captured in a capability taxonomy (CV-2) organized by their associations with Pillars and resources. The other main view type is the OV-2: Operational Resource Flow Description. This captures specific resources and how they interact in a specific use case or architectural pattern (with some conceptual SV- 1: Systems Interface Description & SvcV-1: Services Context Description).

Figure 1 Legend for Performers

1.3.3 Timeframe

These are the general timelines associated with the development of the ZT RA.

• 30 September 2020: Initial ZT RA v0.9 submitted for review by DISA, NSA, DoD CIO, and United States Cyber Command

• 04 November 2020: ZT RA v0.9 submitted to Enterprise Architecture Engineering Panel (EAEP) for feedback

• 04 December 2020: Zero Trust Joint Engineering Team received feedback and began adjudication

• 24 December 2020: Submission of ZT RA v0.95 submitted to EAEP

• 04 January 2021: EAEP members voted on ZT RA release

• 11 Febuary 2021: Digital Modernization Infrastructure Infrastructure Executive Commitee approval of ZT RA v1.0

• 13 May 2021: ZT RA v1.0 published on DoD CIO Library

• 30 September 2021: ZT RA v2.0 draft development complete

• 21 November 2021: DCIO CS Chief Architect directed ZT RA 2.0 to be staffed through

CS RA Steering Group on its way to EAEP and/or DMI EXCOM

• 7 February 2022: CS RA Steering Group - Joint O-6/GS-15 CATMS review of draft ZT

RA v2.0 completed

• 24 May 2022: EAEP completed assessment

• 1 June 2022: Briefed the EAEP results of assessment with complete concurrence of the panel members

1.4 Vision and Goals (CV-1)

Figure 2 Zero Trust Vision (CV-1)4

By reconfiguring, reprioritizing, and augmenting existing DoD capabilities, the DoD will be able to evolve towards a next-generation security architecture, ZT. With these augmented capabilities, the agency will be able to secure and defend DoD information, systems, and critical infrastructure against malicious cyber activity, including DoD information on the non-DoD-owned environments. The ability to detect, deter, deny, defend, and recover from malicious cyber activities and develop a scalable, resilient, auditable, and defendable framework will require several different ways to strategically protect DoD environments. The concept of trusted networks, devices and endpoints geared towards perimeter based defenses will shift toward a never trust, always verify approach. Moving security away from the perimeter and towards an integrated security architecture focusing on protecting data, applications, and servers will be critical to achieving the ZT vision. As cyber threats evolve and become more and more sophisticated, ZT implementors will need to stay current on existing and emerging cyber technologies to systematically improve enterprise environment defenses that are in line with ZT concepts. These new strategic goals enable the implementation of security in a more consistent and efficient manner.

4 2018 DoD Cyber Strategy

1.4.1 Vision and High-Level Goals (CV-1)

Vulnerabilities exposed by data breaches inside and outside DoD demonstrate the need for a new and more robust cybersecurity model that facilitates mission enabling decisions that are risk aware. ZT is a cybersecurity strategy and framework that embeds security principles throughout the Information Enterprise (IE) to prevent, detect, respond, and recover from malicious cyber activities. This security model eliminates the idea of trusted or untrusted networks, devices, personas, or processes, and shifts to multi-attribute-based confidence levels that enable authentication and authorization policies based on the concept of least privileged access. Implementing ZT requires designing a consolidated and more efficient architecture without impeding operations to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services viewed as compromised.

ZT focuses on protecting critical data and resources, not just the traditional network or perimeter security. ZT implements continuous multi-factor authentication, micro-segmentation, encryption, endpoint security, automation, analytics, and robust auditing to Data, Applications, Assets, Services (DAAS). As the Department evolves to become a more agile, more mobile, cloud-instantiated workforce, collaborating with multiple federal and non-governmental organizations (NGO) entities for a variety of missions, a hardened perimeter defense can no longer suffice as an effective means of enterprise security. In a world of increasingly sophisticated threats, a ZT framework reduces the attack surface, reduces risk, and ensures that if a device, network, or user/credential is compromised, the damage is quickly contained and remediated.

State-funded hackers are well trained, well-resourced, and persistent. The use of new tactics, techniques, and procedures combined with more invasive malware can enable motivated malicious personas to move with previously unseen speed and accuracy. Any new security capability must be resilient to evolving threats and effectively reduce threat vectors, internal and external.

ZT end-user capabilities improve visibility, control, and risk analysis of infrastructure, application and data usage. This provides a secure environment for mission execution. Enabling ZT capabilities address the following issues and high-level goals:

• Modernize Information Enterprise to Address Gaps and Seams. Over time, DoD environments have been decentralized. Usability and security challenges stem from years of building infrastructure along organizational, operational and doctrinal boundaries, with multiple security and support tiers, enclaves and networks. Capabilities developed in silos have inevitably resulted in disconnects and gaps in the command structure and processes that preclude establishing a comprehensive, dynamic, and near-real time common operating picture. Adversaries have exploited these logical, technological, and organizational gaps and seams.

• Simplify Security Architecture. A fragmented approach to information technology and cybersecurity has led to excessive technical complexity, creating vulnerabilities in enterprise hygiene, inadequately addressing threats and results in high levels of latency.

Complex security techniques render the user experience unresponsive and ineffective.

This is a factor that drives the use of unapproved or unsecure technologies as users look to complete their mission.

• Produce Consistent Policy. This is a critical lesson-learned from industry that automated cybersecurity policies must be consistently applied across environments for maximum effectiveness. System owners have a responsibility to define governance practices. This enforces reliability and consistency aligning with policy and requirements.

• Optimize Data Management Operations. The success of DoD missions, ranging from payroll to missile defense, are increasingly dependent on structured tagged data within and external to originating systems. Advanced analytics also depend on these dependencies. While data standards and policy exist, they are disparate and inconsistently implemented. This results in:

o Interoperability challenges between applications, organizations, and with external partners o System inefficiencies and vulnerabilities o Poor user experience o Inability to fully leverage cloud computing, data analytics, machine learning, and artificial intelligence

• Provide Dynamic Credentialing and Authorization. Persona based identities, credentials, and attributes are not dynamic or context aware and come from disparate sources. Two factor authentication, in the form of the Public Key Infrastructure (PKI) Common Access Card (CAC), while secure, has not kept pace with more user-friendly multi-factor authentication advances in industry. In industry, Non-person entities (NPE) are not widely addressed beyond basic service accounts, nor are entities for bots or the Internet of Things (IoT). The DoD Identify Credential and Access Management (ICAM) Reference Design provides further guidance on identity, credentialing, and access management implementations.

1.4.2 Zero Trust Strategy

ZT principles, Pillars and culture will guide mission owners in their efforts to reconfigure, re-prioritize and augment existing DoD capabilities to evolve portfolios and resources towards a revised, data centric DoD Cybersecurity Reference Architecture (CS RA). It instantiates tenets of the 2019 DoD Digital Modernization Strategy, the 2018 DoD Cyber Strategy Lines of Effort, and the 2019 Cybersecurity Risk Reduction Strategy. It supports the DoD vision of “a more secure, coordinated, seamless, transparent, and cost-effective IT architecture… that ensures dependable mission execution in the face of a persistent cyber threat.”

ZT supports an incremental migration approach to cybersecurity with an end state of an interoperable, fully functioned, optimized cybersecurity architecture that secures our critical assets and data from malicisous threats and unintentional incidents. 5The desired outcome is the roll out of an employable set of enterprise ZT capabilities each consisting of standards, devices, and processes that are measurable, repeatable, supportable, and extensible, to any organization on the DoDIN, and federated across the DoDIN. The DoD CIO Zero Trust Strategy outlines the vision, approach, principles, goals and objectives, and roadmap for the DoD’s migration to ZT.

1.5 Cybersecurity (Transition) Problem Statement (OV-1)

Figure 3 Cybersecurity Problem Statement (OV-1)

Traditional approaches to cybersecurity architectures, such as defense in depth, have resulted in complicated and redundant capabilities across the DoDIN. The prevalence of teleworking and adoption of cloud computing have caused a crossing of DoD data into new platforms; often hosted in industry and user environments. This change in the digital experience introduces new security challenges but also opportunities for leveraging important technology evolutions and ZT principals to revolutionize cyber defense.

The growing issues in security protections align with the evolution of endpoints to multiple platforms, inclusive both traditional and non-traditional devices such as IoT (Internet of Things), Supervisory Control and Data Acquistion (SCADA) and OT(Operational Technology), challenges in managing numerous security stacks, threats from privileged users and controlling access to cloud environments. Authentication and authorization of endpoints to the environment

5 DoD Zero Trust Strategy, July 2022 is inconsistently implemented and does not always consider device hygiene. Security stacks such as Joint Regional Security Stack (JRSS,) while providing numerous security capabilities, are challenging to manage and lack integration with data center and identity capabilities capable of providing a holistic security solution. Insider threats continue to compromise data and systems through unintegrated security policy and lateral movement. The adoption of the cloud computing has shifted data off-premises and has generated the need for a more robust security model beyond a perimeter defense. ZT concepts and principles impact each of these scenarios and provide centralized, standardized and integrated controls to mitigate these security challenges.

Beyond the issues identified above, there are existing capabilities within the enterprise which are key enablers for operationalizing ZT. Software defined enterprise (SDE) capabilities, such as automation, orchestration, and network function virtualization (NFV), combined with analytics for our defensive cyber operators enables the scale and confidence scoring necessary to achieve ZT security policies. Many of these capabilities have already been implemented throughout DoD and provide a great baseline for ZT when tuned with the proper configuration.

NFV capabilities can also be rapidly deployed to protect legacy applications and enable resource authorization decisions for an enhanced security posture.

1.6 Overall Target Environment (OV-1)

Figure 4 Target Environment (OV-1)

ZT cybersecurity architecture introduces new security concepts such as data centricity and conditional access to achieve the core concept of never trusting a request for data, applications, or resources. Beyond the notion of never trusting and verifying explicitly, assuming a breach in the environment brings new levels of granularity to the security policies implemented within these capabilities.

A data-centric security architecture starts with identifying sensitive data and critical applications for introducing ZT. This discovery process will include identification of the users and flows for development of the security policy. The control plane consisting of the ZT policy controller and automation and orchestration capabilities will be an insertion point for new conditional access policies. The integration between these technologies will be achieved via APIs. Evolution of artificial intelligence (AI) and robotic process automation (RPA) will modernize and enrich the policy deployed from the control plane.

The ZT security policy is executed on numerous policy enforcement points throughout the architecture. The first steps in a flow from user to data are authenticating and authorizing a user which requires integration with an enterprise ICAM solution, global device management and continuous vetting of identity and attributes. The attributes required for authorization will be specific to the user's level of access, hygiene of the device, and activities performed in the environment. The combination of these elements develops into a confidence score which dynamically changes based on conditions and telemetry.

Virtual access points and gateways are the next phase in authorization. A Policy Decision Point provides a confidence score of the user or endpoint. A Policy Enforcement Point then enforces segmentation policy and connects the user or endpoint to the requested resource.

Depending on the implementation, certain cloud access points should align to the DoD Cloud Native Access Point Reference Design (CNAP RD). Within these access points are numerous security capabilities to include firewall and inspection technologies. Software defined perimeter capabilities also align to the requirements for implementing virtual access points.

The deployment environment requires the adoption of software defined data center technologies such as software defined networking (SDN) to truly enable ZT controls. SDN technologies integrate at the host level to provide micro segmentation which is a key control to lateral movement. Beyond the traditional implementation of segmentation which focuses on port and protocol, processes should be evaluated along with identity to ensure east-west network flows within application components are not threats.

The data itself is protected through a combination of data loss prevention (DLP) and data rights management (DRM) to control data exfiltration. DRM will tie encryption to relevant security policies and attributes to protect access to the file. This will enable data-in-use protections to provide additional controls around how data can be manipulated and extracted from files.

Throughout each of these transactions data is logged, filtered, and analyzed. Unified analytics enrich confidence levels used in authorization decisions to provide relevant data beyond user attributes and device hygiene. User and entity behavior analysis (UEBA) will baseline normal activity and provide indicators of threats and additional risks to limit authorization transactions.

1.7 Assumptions

The following core assumptions drive planning, risks assessment, and implementation considerations for deploping a ZT architecture:

• The CS RA remains the authoritative cybersecurity reference architecture for the DoD.

The ZT RA does not replace the CS RA but augments the CS RA. The CS RA and ZT RA will continue to converge over time whereby principles and Pillars of the ZT RA will be infused into ongoing agile updates to the CS RA.

• Technologies will exist, will be mature, and available/implementable to achieve a DoD ZT migration across the information enterprise.

• ZT assumes continued and mandated use of communication encryption to the greatest extent possible.

• Multiple decentralized Service pilots and proof-of-concepts will require integration and synchronization for a common ZT end-state.

• No single device or capability produces a ZT framework. ZT is a holistic approach to security that leverages several different technologies to enable a ZT end-state.

• Security policies will be universally and consistently automated and orchestrated at the macro level for the DoD enterprise. Granular security policies and access controls will be automated and orchestrated at the micro level by mission owners.

• Interoperability standards must emerge to enhance data security protections.

1.8 Constraints

The following core constraints drive planning, risks assessment, and implementation considerations for ZT.

• Limited testing due to current environmental constraints has been completed on the capabilities that support the ZT RA version 2.0. Additional development and refinement stages should be completed to support design documentation.

• Coarse/fine grain policy is a design decision driven by constraints of DoD structure and policy management.

2 PILLARS AND PRINCIPLES

2.1 Overview

ZT Security “is an emerging initiative that DoD CIO is exploring in concert with DISA, United States Cyber Command (USCYBERCOM), and the National Security Agency (NSA). ZT is a cybersecurity strategy developing an architecture that requires authentication or verification before granting access to sensitive data or protected resources at a financial cost by reducing data loss and preventing data breaches. This security model helps transition and upgrade over time from trusted networks, devices, personas, or processes, and shifts to multiple attributes and multi-checkpoint-based confidence levels that enable authentication and authorization policies under the concept of least privileged access. Implementing ZT requires rethinking how we utilize existing infrastructure to implement security by design in a simpler and more efficient way while enabling unimpeded operations.”6

While straightforward in principle, the actual implementation and operationalization of ZT incorporates several areas which need to be smartly integrated and that include software defined networking, data tagging, behavioral analytics, access control, policy orchestration, encryption, automation, as well as end-to-end ICAM. Enterprise level considerations include identifying which data, applications, assets, and services to protect, and mapping transaction flows, policy decisions, and locations of policy enforcement. Apart from the advantages to securing our architecture in general, there are additional cross-functional benefits of ZT regarding cloud deployments, Security Orchestration and Automation (SOAR), cryptographic modernization and cybersecurity analytics.

2.2 Concept and Tenets of Zero Trust

The ZT security model re-thinks how to implement security access to resources and is determined by dynamic policy, including the observable state of user and endpoint identity, application/service, and the requesting asset and may include other behavioral and environmental attribute. Confidence levels are built from multiple attributes of the subject being

6 DoD Digital Modernization Strategy, June 2019 authenticated (identity, location, time, device security posture) and allow a much more thorough evaluation of access requests beyond credential verification.

ZT has five major tenets. These tenets represent the foundational elements and influence all aspects within ZT.

• Assume a Hostile Environment. There are malicious personas both inside and outside the environment. All users, devices, applications, environments, and all other NPEs are treated as untrusted.

• Presume Breach. There are hundreds of thousands of attempted cybersecurity attacks against DoD environments every day. Consciously operate and defend resources with the assumption that an adversary has presence within your environment. Enhanced scrutiny of access and authorization decisions to improve response outcomes.

• Never Trust, Always Verify. Deny access by default. Every device, user, application/workload, and data flow are authenticated and explicitly authorized using least privilege, multiple attributes, and dynamic cybersecurity policies.

• Scrutinize Explicitly. All resources are consistently accessed in a secure manner using multiple attributes (dynamic and static) to derive confidence levels for contextual access to resources. Access to resources is conditional and access can dynamically change based on action and confidence levels resulting from those actions.

• Apply Unified Analytics. Apply unified analytics for Data, Applications, Assets, Services (DAAS) to include behavioristics, and log each transaction

The use of mutual authentication of users with PKI-based client-authentication or mutual authentication certificates to web applications has long been the effective standard. The DoD is making strides to improve access to data by approving multiple authenticators and authorization schemes to better improve usability and access while maintaining security and visibility.

2.3 Pillars

Zero Trust Pillars are identified in the ZT Strategy and are in alignment with the common industry identification of ZT Pillars. A Pillar is a key focus area for implementation of Zero Trust controls. ZT is depicted as interlocking puzzle pieces (Figure 5) that symbolize a data Pillar surrounded by Pillars of protection. All protection Pillars work together to effectively secure the Data Pillar.

Figure 5 Zero Trust Pillars

The seven Pillars in the DoD ZT Architecture include:

User: Securing, limiting, and enforcing person and non-person entities’ access to DAAS encompasses the use of identity capabilities such as multi-factor authentication (MFA) and Privileged Access Management (PAM) for privileged functions. Organizations need the ability to continuously authenticate, authorize, and monitor activity patterns to govern users’ access and privileges while protecting and securing all interactions.

Device: Continuous real-time authentication, inspection, assessment, and patching of devices in an enterprise are critical functions. Solutions such as Mobile Device Managers, Comply to Connect programs, or Trusted Platform Modules (TPM) provide data that can be useful for device confidence assessments, authorization determination, and limiting access. Other assessments should be conducted for every access request (e.g. examinations of compromise state, software versions, protection status, encryption enablement, and proper configuration, etc.). Having the ability to identify, authenticate, inventory, authorize, isolate, secure, remediate, and control all devices is essential in a ZT approach.

Network/Environment: Segment (both logically and physically), isolate, and control the network/environment (on-premises and off-premises) with granular access and policy restrictions. As the perimeter becomes more granular through macro-segmentation, micro-segmentation provides greater protections and controls over DAAS. It is critical to, control privileged access, manage internal and external data flows, and prevent lateral movement.

Applications and Workload: Applications and workloads include tasks on systems or services on-premises, as well as applications or services running in a cloud environment. ZT workloads span the complete application stack from application layer to hypervisor. Securing and properly managing the application layer as well as compute containers and virtual machines is central to ZT adoption. Application delivery methods such as proxy technologies, enable additional protections to include ZT decision and enforcement points. Developed Source Code and common libraries are vetted through DevSecOps development practices to secure applications from inception.

Data: A clear understanding of an organization’s DAAS is critical for a successful implementation of a ZT architecture. Organizations need to categorize their DAAS in terms of mission criticality and use this information to develop a comprehensive data management strategy as part of their overall ZT approach. This can be achieved through the ingestion of consistent valid data, categorization of data, developing schemas, and encrypting data at rest and in transit. Solutions such as DRM, DLP, Software Defined Environments, and granular data-tagging support the protecting of critical DAAS.

Visibility and Analytics: Contextual details provide greater understanding of performance, behavior and activity baseline across other ZT Pillars. This visibility improves detection of anomalous behavior and provides the ability to make dynamic changes to security policy and real-time access decisions. Additionally, other monitoring systems, such as sensor data in addition to telemetry will be used, will help fill out the picture of what is happening with the environment and will aid in the triggering of alerts use for response. A ZT enterprise will capture and inspect traffic, looking beyond network telemetry and into the packets themselves to accurately discover traffic on the network and observe threats that are present and orient defenses more intelligently.

Automation and Orchestration: Automate manual security processes to take policy-based actions across the enterprise with speed and at scale. SOAR improves security and decreases response times. Security orchestration integrates Security Information and Event Management (SIEM) and other automated security tools and assists in managing disparate security systems.

Automated security response requires defined processes and consistent security policy enforcement across all environments in a ZT enterprise to provide proactive command and control.

2.4 Reference Architecture Principles (OV-6a)

The ZT framework is an approach to security that utilizes a series of guiding principles in the creation of the RA and other future documents.

• Principle #1: Assume no implicit or explicit trusted zone in networks.

• Principle #2: Identity-based authentication and authorization are strictly enforced for all connections and access to infrastructure, data, and services.

• Principle #3: Machine to machine (M2M) authentication and authorization are strictly enforced for communication between servers and the applications.

• Principle #4: Risk profiles, generated in near-real-time from monitoring and assessment of both user and devices behaviors, are used in authorizing users and devices to resources.

• Principle #5: All sensitive data is encrypted both in transit and at rest.

• Principle #6: All events are to be continuously monitored, collected, stored, and analyzed to assess compliance with security policies.

• Principle #7: Policy management and distribution is centralized.

Table 1 Reference Architecture Principles (OV-6A)

3 CAPABILITIES

3.1 Capabilities Taxonomy (CV-2)

The Seven Zero Trust Pillars assist with the categorization of capabilities and technologies that can perform Zero Trust functions in an environment. Capabilities are the ability to achieve a desired effect under specified (performance) standards and conditions through combinations of ways and means (activities and resources) to perform a set of activities. Pillars align with capabilities such as identity authentication and Software Defined Enterprise. Sub-Capabilities such as enterprise identity provider or Just-In-Time analytics support capabilities. Capabilities and sub-capabilities as defined reflect the current technologies that are applicable in ZT and are subject to change in future iterations of the ZT RA. This layered approach allows for flexibility in implementing ZT controls. Overarching governance will be required to achieve proper integration across Pillars and capabilities. The Pillar and capabilities enable maximum visibility and protection of data, which are the key focuses of any implementation of ZT.

With Figure 6 Capability to Pillars Mapping (FFP), the white arrows show which ZT aggregated capability acts on what ZT Pillars. A branch of capabilities may point to more than one Pillar and some point to the entire ZT framework. This section provides an overarching description of the ZT capabilities and is intended to provide capabilities that meet a ZT architecture end state rather than provide exact implementations. Certain capabilities do require enterprise scale enablers to include an enterprise federated identity service, enterprise analytics and enterprise orchestration. Proper attributes and labeling of data during the discovery process must also be implemented for a ZT architecture. Common to all Pillars is the implementation of continuous authentication and validating the identity of entities during all access transactions. This validation is based upon current identifying standards enhanced with behavioral metrics and additional identifying factors. Further mapping of the parent capabilities and mappings to service relationships are provided below.

Figure 6 Capability to Pillars Mapping (FFP)

The ZT capability taxonomy is shown across multiple figures in this section. A table with definitions is located in Appendix (AV-2). The aggregated capabilities [main taxonomy branches] consist of continuous authentication, conditional authorization across, enabling infrastructure, securing application & workload, securing data, automation, analytics and orchestration. ZT has an interdependence with Data Governance, Risk Management, and the Software-define Enterprise. The full taxonomy CV 2 is provided below in several figures.

Figure 7 Zero Trust Authentication and Authorization Capability Taxonomy (CV-2)

When applied to the user’s Pillar, Conditional Authorization capabilities would focus on any object that would be considered a person-entity or non-person entity. The authorization to systems and resources would be conditional not only to standard roles but also attribute status, analytics of that entity, the requirement at a specific time and justification to access resources and data. When applied to the devices Pillar, Conditional Authorization capabilities center around systems and the enforcement of acceptable baselines and device state. Systems will be continually assessed for the current status of their inventories and telemetry data. Further information will be available through status scans and logging. Systems will be able to be updated on the fly or at the request of orchestration or other remediation methods. The degree of scrutiny and requirements for the systems accessing data will be relevant to the security level of the data that is trying to be accessed.

Figure 8 Zero Trust Infrastructure, Workload and Data Capability Taxonomy (CV-2)

The ZT-enabling Infrastructure aggregate capability includes all the capabilities that impact the Network and Environments resources Pillar. This will affect endpoints in the environment and nodes of travel among the enterprise. This can include not only on premises infrastructure but also cloud resources. Controls built around this Pillar relate to any ZT enabling infrastructure capabilities. A macro and micro segmentation policy can be designed around segmenting and isolating specific workloads as long as the workloads are strictly defined and validated. This allows for not only interconnection between required nodes and only those nodes but also the requirements of connection for Software Defined Perimeters.

The Securing Application and Workload aggregate capability includes all the capabilities that surround the Workloads Pillar. These capabilities will protect the application and devices serving data to end users. These capabilities aim to prevent lateral movement, validate good software practices, and segment the application into discrete highly contained secured areas. Connections into this zone are highly scrutinized and brokering between internal and external requests. The convergence to a standardization of application calls will aid in the proper implementation policy changes and updates.

The Securing Data aggregate capability include all the capabilities that surround the Data Pillar.

These capabilities are the closest to the data that is to be protected. Its function is all about securing data whether it be tagged data, identified sensitive data, exfiltration protections or encrypting of sensitive data. Securing Data will constitute proper protections around sensitive information regardless of the effectiveness of the supporting Pillars and their capabilities.

Figure 9 Zero Trust Analytics and Orchestration Capabilities Taxonomy (CV-2)

The Analytics aggregate capability includes all the capabilities that surround the Visibility & Analytics Pillar. The capabilities under this Pillar are an amalgamation of continuous entity monitoring, sensors, logging, event driven analytical tools, and machine learning. ZT will utilize Machine Learning to baseline environmental data and analytics. Machine Learning algorithms provide baseline data sets to enable ZT policy enforcement through Artificial Intelligence within ZT Orchestration.

The ZT Orchestration aggregate capability includes all the capabilities that surround the Automation & Orchestration Pillar.Its focus will be to provide automation for the deployment of policy changes in which to secure the enterprise and controlled around sensitive data. The automation and orchestration Pillar also be able to account for the ingestion of desired target state data from the Software-Defined Enterprise. While early capabilities will be centered around policy deployment, future iterations will augment the capabilities with artificial intelligence and robotic process automation into its core capabilities as the technologies evolve.

Figure 10 Zero Trust Enabling Capabilities Taxonomy (CV-2)

Data governance is a key element in the successful application of ZT security policy and provides the processes, tools, and framework for managing data from creation to disposition.

ZT and Risk Management are interdependent capabilities. ZT provides new discovery content to feed the Risk Management Framework (RMF). As a result of ZTA, the processes within the Risk Management Framework (RMF) will inform new discovery content for as well ZT, while adapting to modern application development practices such as DevSecOps. The major impacts will occur to the prepare, assess, and monitor steps. Prepare will require significant discovery, especially of the data flows to document and develop segmentation policies. Assessment will change as snapshots of systems become stale with DevSecOps capabilities rapidly modifying applications.

ZT will require significant monitoring activities which improve feedback to the RMF process and incident response reactions.

Software Defined Enterprise is a key enabler to the breadth and depth of a ZT architecture implementation. As compute, network and storage infrastructure is virtualized and software defined this enables the ability to isolate data and applications at scale. Domain orchestration and control provide an enterprise control plan to push configuration and policy aligned with ZT controls.

3.2 FFP: Pillars, Resources & Capability Mapping

Figure 11 FFP: Pillars, Resources & Capability Mapping (CV-7)

The ZT Pillars, Resources & Capability Mapping concept provides an operational view on how security measures would be implemented within the architecture. NPE identity and person identity are tracked independently allowing for separate paths of validating confidence levels across enforcement points. Authentication and authorization activities will occur at numerous but focused points throughout the enterprise to include users and endpoints, proxies, applications and data. At each enforcement point, logs are sent to the SIEM and analytics are performed to develop a confidence level. Confidence levels of the device and user are independently developed and then aggregated where appropriate for policy enforcement. If the non-person entity or person entity has a confidence score above a measured threshold, then they are authorized to view the requested data. Data is protected along the way by Data Loss Prevention (DLP) which also feeds the SIEM to ensure the data is being used properly.

The following bullets provide additional detail on the decision points, components, and capabilities that are depicted within Figure 11. The capabilities identified below are representative of an end-state ZT implementation. Controlling access to resources based on the risk of the user and devices is the baseline requirement for ZT and is possible without implementation of all identified capabilities.

• Enterprise Identity Service: which includes Federated Enterprise Identity Service (FEIS), Automatic Account Provisioning (AAP) and a Master User Record (MUR), identifies and manages the roles, access privileges, and the circumstances in which users are granted or denied privileges.

o FEIS: The Federated Enterprise Identity Service aggregate’s identity credentials and authorizations and shares among a federated group of organizations so users/NPE can access services in other domains.

o AAP: Provides identity governance services such as user entitlement management, business role auditing and enforcement and account provisions and deprovisioning based on identity data produced during DoD people-centric activities such as on and off-boarding, continuous vetting, talent management…