At the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore last month, Randy Resnick, director of the Zero Trust Portfolio Management Office, said tagging and labeling, the practice of assigning metadata and identifiers to pieces of data, has been a long-term challenge for the department.

“They’ve been apparently working on this for 12 or more years —15 years — and I think it’s time enough to do something,” he said.

By way of an update on these efforts, Resnick said he approved three pilot programs in conjunction with the U.S. Department of Defense Chief Data and Artificial Intelligence Office and the Department of Homeland Security to develop a plan that would allow for all the necessary conversions and interpretations to process any data tagging and labeling standard in an understandable,repeatable way.

The goal is to have a successful demo of a schema by the end of the calendar year. Resnick also set a deadline of October for an internal working group to brief his office on a solution, even a partial one.

“We’re not looking for perfection,” he said at TechNet. “We have to start implementing something, and then it’ll grow over time as people agree to more tags and more labels. It’s got to be flexible enough to allow for growth.”

In a January study by Defense Innovation Board, researchers found “data access remains the central enterprise-level obstacle to the sharing and use of data for the warfighter.” Part of that is because military departments are “haphazardly” placing data leaders throughout the organization while top-level tech leaders are struggling to enforce their position as a unifier. Other persistent issues like a lack of uniform guidance, sustained funding, workforce gaps and technical silos also make progress on broader zero-trust difficult.

For now, there remain roadblocks that separate the DoD from the data economy it wants, but Resnick is realistic about these challenges and said a solution in development is better than nothing at all.

“That’s the type of solution that I personally am looking for, because that’s what the department needs,” he said.

Randy Resnick, director of the Zero Trust Portfolio Management Office at the Pentagon, said there’s a need to independently validate whether vendor products and services are, in fact, up to snuff. And creating a standardized, multistep process for ensuring zero-trust compliance will give the DoD confidence in what it buys.

The evaluation begins with an assessment that will give an overall reading of cybersecurity design and pinpoint areas where developers can address gaps early in the process.

“You can’t really game it because it’s 250 questions, and odds are you’d have to lie on a lot of them to skew the results,” Resnick said at the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore on June 25. “And if you’re in design with something and you honestly go through the process … it’s going to tell you your gap between wherever you are and the 91 [minimum] activities. That’s a useful thing to know because then you could design or engineer or fix whatever you have to do to get to target.”

The Pentagon’s Chief Information office is pushing 2027 as the year for the department to be fully aligned with zero trust. It has already offered a roadmap for doing this, called the ZT Strategy from 2022 that Resnick said is unlikely to be updated. Instead, the department is focused on finding ways to reliably test its designs for security against vulnerabilities. The department has received ZT plans from the services and other DoD agencies, but it now seeks a more automated, replicable process for evaluating them to free up man hours and keep to aggressive pacing.

After the initial assessment, Resnick said then a tool will go through a simulation that will actually test for weaknesses, providing feedback as many times as needed to fix holes. Then, the tool will need to go through a “purple team” report that summarizes the outcome of defensive and offensive attacks on the system.

“We are testing for specific ZT outcomes as each part of the step of the test,” said Resnick. “This is not just a random experiment for red teaming. This is actually very detailed, very specific on what we want the purple team to go after to prove it’s a zero-trust configuration.”

The process is well outlined, but there are some challenges in actualizing it. Resnick said his biggest constraint is the lack of purple-team experts.

“We don’t have enough talent,” he said. “We don’t have enough people. It is a drain. They have other missions that they need to do.”

To accelerate designs through purple teaming, Resnick said he wants to find a way to enlist the help of industry and to test in a neutral environment with minimal costs. He mentioned there has been thought around bringing in multicomponent Reserve or Guard personnel to perform some purple-team duties, but they have to be National Security Agency approved, and that’s hard to find, he added.

The end goal is to use technology and automation to create repeatable, efficient processes that ultimately result in a department official signing off on a ZT solution that has the backing of a well-informed examination.

“That would be the gate to allow the components to assuredly procure target or advanced level ZT solutions prior to 2027,” he said. “We want to allow the department to choose from a menu of solutions … to reduce the risk that what they’re buying doesn’t work.”

At the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore, leaders from the Pentagon discussed capabilities for public, private and hybrid networks. Officials acknowledged there’s a natural appetite for the most exclusive, secure networks in the national security space. And sometimes there is no wireless network infrastructure available in remote warfighting locations far from population centers.

So as the services determine appetite for private networks that offer more control over information sharing, the DoD is guiding them to use open radio access networks, or ORAN, said Juan Ramírez, the director of the 5G Cross-Functional Team at DoD.

“I think what industry wants to hear is there’s actually going to be requirements that come out that … necessitate an open RAN architecture,” he said at the conference. “So you’ll start to see those come out in the next couple of years, pending budgets.”

Certainly, private networks aren’t the only way to go. In fact, sometimes that’s not the best solution, said Lt. Col. Benjamin Pimentel, who leads the Camp Pendleton 5G experiment for Expeditionary Advanced Base Operations.

“Think about when we deploy in a theater,” he said. “A lot of countries that we go to or locations that we go to already have roads and bridges, and it’d be silly to then go and build my own private roads and my own private bridges separate and apart from that to get where I need to go. If those roads and bridges meet my transportation requirement, and they’re not going to fall under the weight of a ‘seven ton,’ we’re going to drive over it.”

But, somewhere like the first island chain, for example, may not have adequate coverage to put up sensors for long-range precision fires. In cases like those, he said, it would make more sense for units to bring private capabilities.

Given China’s rising aggression and U.S. efforts to deter it in the Taiwan Strait, what Pimentel described is the type of environment where current threats seem to colocate.

Regardless, to ensure there is connectivity wherever the need is, Ramirez said the department is looking at ORANs, which allow multiple vendors to operate as one network and provide more flexibility to scale.

ORAN is something the DoD has been pushing aggressively to explore as it simultaneously journeys toward more standard 5G adoption on military installations and “smart bases.”

Ramirez said the department is hopeful it will get additional support from Congress via future defense spending bills that will backup forthcoming requirements with dollars.

The Pentagon’s 2024 budget requested $143 billion in research, developing and testing of emerging technologies including 5G, but also artificial intelligence. Much of the spending in recent years has been for prototyping, and though the Office of the Secretary of Defense has the lion’s share, Ramirez said his office is offering direction to the services for them to budget for 5G.

“We think that pursuing ideas like [ORAN] advanced by the ORAN Alliance all the way to fully open-source code … provides the feature velocity the DoD needs and the ability to innovate quickly,” said Pimentel.

Steve Wallace, the agency’s chief technology officer, said at the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International that this is a way of getting at a common problem in the Defense Department: a focus on emerging technology without a clear understanding of the problem its intended to solve.

“How does the department understand what you all can bring forward?” he said to a crowd of industry leaders and other cyber professionals in Baltimore June 26. “And then at the same time, how do you understand what the heck we actually need? There’s always that friction there.”

It’s not just an attempt to speed up the acquisitions process as the Pentagon is in a race for digital dominance against China and other nation-state hackers. So much of the conversation around cybersecurity in national defense is around pacing, but with industry constantly coming to market with new tools, there’s a need by government to be a wary purchaser.

These problem statements are a potential way for the Defense Department buy the tools, not just the shiniest ones.

“I think there is that risk that we get excited by new things — which are exciting — and we want to play with them and explore and see what’s possible,” said Scarlett Swerdlow, a senior technical strategist in the DISA’s Emerging Technology Directorate. “But at the end of the day, we have to make sure we’re solving a real problem that a real person has.”

The government often tries to emulate industry. But startups in Silicon Valley aren’t tied to a congressional budget cycle. And they have the room, and often the in-house expertise, to fail fast and pivot often. And though the Defense Department is at the mercy of a constantly changing threat landscape, DISA officials said at the conference that it can be enough for DoD to allow industry to do what it does best and be an evaluator when it comes time to settle on a solution.

“It is our ability to interface with industry, but knowing that the dollars that mature the technology are industry dollars, and not tax dollars, and then understanding where to apply some tactical patience as industry develops tech and [then we] insert ourselves,” said Army Maj. David Courter, chief of combatant command plan integration with the J-5. “I think that’s much different than us writing an initial capabilities document and saying, ‘I need you to build this cool tool.’”

Cautionary tale

One cautionary tale came to mind: the Joint Regional Security Stacks, an ambitious plan to massively consolidate the DoD’s sprawling IT infrastructure that set to be wound down in 2021 following reports of cost overruns and unresolved complexities.

At inception, it was supposed to be a gamechanger for the department, but a 2019 inspector general audit revealed it ultimately wasn’t meeting end users’ needs.

“The whole notion behind JRSS was best of breed for every component in the doggone stack,” Wallace said. “We are going to have the very best of everything. And then we are going to attempt to integrate or interoperate between all these components. Didn’t go well.”

The other issue is ensuring that DoD can verify for itself whether a tool actually does what it claims to do when its adapted for military or defense purposes. That comes into play when the department thinks about how buying one system must be able to operate with existing ones and those to come.

“[That’s] another reason to add that in-house talent that can … test some of those claims that products make,” said Swerdlow.

At the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore on June 25, Resnick said his office received pushback on its aggressive goals for meeting zero-trust and saw a need to codify its role in the governmentwide race toward network security.

The memo will give Resnick’s office “bite” and an “ability to command and control zero trust in the Department of Defense,” he said.

At the inception of the portfolio office, which was stood up in 2022, Resnick said he was told his office didn’t have Title 10 authority to set zero-trust requirements or priorities. Military officials said they had to hear orders from their commands. In a nutshell, Title 10 is what gives DoD power to make decisions. It assigns the defense secretary “authority, direction and control” over all subordinate agencies and commands.

When the zero-trust office came on the scene, it was new, and Resnick is now working to ensure his team has the ability to act as subject-matter experts on zero trust.

“You will see language in it that makes it very clear what the portfolio office’s capabilities are and the power that we have over telling the department just how to do things in terms of policy deadlines,” he said. “But it also clearly outlines … the military departments’ [and] the agencies’ roles and responsibilities for zero trust.”

Resnick did not give a date for the memo but said it was imminent.

In the next couple of months, Resnick is also aiming to clarify gray areas of shared responsibility of zero-trust, since both civilian and military agencies are tasked with implementing it.

Directive-type memos tend to have an expiration date, but they can be converted into instructions that establish policy.

That means he knows — more or less — what he’s got, and what he needs. And what he needs, is people.

“[In the services], we’re not having a problem recruiting cyber talent,” he said at the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore. “Our retention is where we’re having a challenge.”

Gorak, the principal director for resources and analysis for the Pentagon’s Chief Information Officer, said DoD has 27,000 vacancies, down from 30,000 last year. The total cyber defense workforce is comprised of roughly 225,000 service members, civilians and contractors.

Gorak said there is interest in working for the government or serve in the military. The public sector has always been able to emphasize a unique mission and a stable career. While that has been — and is — a selling point, leaders said they also need to use authorities to pay competitively and offer training. Otherwise, government will lose workers to the private sector or other agencies who are also competing for this great need.

Messaging is a part of the problem, Gorak said, especially in the search for early career talent.

“I talk to students and I tell them, ‘You can join the Department of Defense as a civilian,’” Gorak said. “They look at me like I’m cross-eyed. [They say], ‘I had no idea that we have 900,000 civilians in the DoD.’”

There is some headway being made, with the department announcing on June 12 its new Cyber Academic Engagement Office, led by Gorak. The goal is to have a dedicated office for coordinating and funding academic engagement programs for the department.

The other aspect of solving the people problem is organizing all the different pay authorities, work roles, skill requirements and types of hires across the Defense Department.

Take, for example, the basic IT job in the government, called a “2210.” Gorak said there are 54,022 employees with this position description performing 72 different work roles, illustrating how one occupation can manifest into different work depending on the office.

That’s part of what makes classification difficult, especially as technology constantly evolves to require new skills or training. The DoD Cyber Framework originally had 54 distinct work rules; now it has 72.

So, recruiters need to understand the actual work being done in order to look for it in the job market, classify it correctly, and then compensate it competitively, Gorak said.

“If you’re a GS-12 and you’re an expert, you should get paid a lot more than a GS-12 who’s at a basic level,” he added. “Pay for performance. Pay for what your actual expertise is. That’s the system we have to get.”

DoD has a number of authorities available that allow it to pay recruitment and retention bonuses, set higher starting salaries and reward high achievers. The department has direct hire authority to circumvent the USAJobs application process. The DoD Cyber Excepted Service offers a market-based pay structure that can offer as much as a 40% salary increase, Gorak said.

So far, about 15,000 positions are eligible for CES, but only 9,000 of them have actually been converted. Gorak’s team has worked to make some improvements to encourage conversion, including allowing individuals to convert instead of requiring that of an entire organization and letting the services delegate that process in-house instead of relying on one office process all conversion packets.

The only combatant command that is fully eligible for CES is Cybercom. Army Cyber Command is the second biggest.

Still, part of the reason available flexibilities haven’t been used is they’re expensive. In other cases, HR personnel don’t know they exist or aren’t trained on how to use them. That’s also why time-to-hire even for positions that should be fast-tracked remains lengthy.

On the civilian side, hiring timelines hardly improved from 2022 to 2023, and 2210 IT workers remain among the slowest to onboard.

In the meantime, the department — alongside other civilian agencies — has recognized that young people can attain digital skills without a college degree. The government is coming around to that trend, but it’s still a new way of thinking for some.

“I contend to you that there are people out there today … working in their bedroom upstairs who are outstanding cyber professionals who can do this job, but because they don’t have the experience and they don’t have the degree and they don’t have whatever certs we think are hot right now, we don’t hire them,” he said. “I think that is a mistake by the federal government, and we have to get past it.”

“So, imagine the [Defense Department] being a really big ship, with the smallest rudder you ever saw in your life trying to try to turn that ship,” he said at the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International on Tuesday. “That’s what the Department of Defense is.”

He doesn’t mean it derogatorily. He said it as more a statement of fact than a judgment. And, to the department’s credit, with help from outgoing Chief Information Officer John Sherman and a great deal of documents to keep these offices on the same page, they’ve made progress on the “gargantuan challenge” of getting workforce culture to support cyber security imperatives. But there’s still some work to be done.

Much of the discussion Resnick led at the event in Baltimore centered around the complex technology undergirding zero-trust, which both the military services and civilian agencies are tasked with implementing to some effect in the next few years. The DoD offices has until 2027 to hit almost a hundred different targets for zero trust. Meanwhile, the department’s 2025 budget requested roughly $977 million for zero-trust transition, C4ISRNET previously reported.

Zero-trust is, as Resnick said, just that: nothing is trusted, and as a result, there are behind-the-scenes tests that verify and validate access with, ideally, minimal intrusion on user experience. It’s an access control strategy, but it’s also analytics, automation and data.

Zero-trust is very specific but it’s also seemingly ubiquitous. The White House, even, has made cyber defenses a priority of every federal agency.

“Really, zero-trust is all of us,” said Leslie Beavers, the principal deputy CIO at the Defense Department, on Tuesday.

However, for it to work, zero-trust needs to be defined. And all the players need to be one the same page. That’s something that has happened only recently, said Resnick.

“Industry was all over the map with zero trust,” he said. “Everybody had a ZT solution. Everybody was approaching government employees and purchasers, and people were very, very, very confused in the government.”

So, Resnick’s office put structure around zero-trust. The goal, first and foremost, was to stop adversaries’ exploitation of DoD data, he said. Then, they got to work on a number of foundational documents to lay out goals and plans for achieving them, including the DoD Zero Trust Strategy and Roadmap and the “Overlays” plan.

It was an effort to synchronize the theory and actual approach of zero-trust, but inadvertently, it also influenced other countries’ zero-trust plans and reset industry’s understanding of what DoD needs, Resnick said.

“Without a doubt, I now have conversations with industry that are completely aligned to the DoD zero trust approach,” he said. “We didn’t have this two years ago. It’s a pleasure to have a conversation now, because now we’re all on the same page.”

Now that the level setting has been done, there remains the issue of change management.

The federal workforce, for one, skews older than the private sector. Data from 2022 less than 6% of government IT employees are under the age of 30, and 30% are 55 or older. While officials said the Defense Department often has more reliable and robust funding to go after new technology, federal civilian agencies may not, creating an environment where government is at various stages of adoption, and not always willing to embrace change. The pervasiveness of legacy systems also makes change hard, especially when the skills needed versus the skills available vary.

Resnick said he has seen the spirit of innovation in leadership, but it’s the mid-tier of the workforce that sometimes pushes back — the “permafrost,” as he calls it.

“They feel threatened because they do the old style of cybersecurity,” he said. “I did it myself; I totally understand. But … if they haven’t learned now, then [they’re] never going to learn. And so I truly believe it’s a generational thing. We’re going to have to wait them out until they retire out.”

That’s not to say training isn’t happening. Resnick said they worked with Defense Acquisition University to get access for CAC-holders to cyber classes that vary in length and intensity.

He said he sees a gap in industry training for zero-trust and urged members to populate that space.

On June 20, Deputy Defense Secretary Kathleen Hicks approved the strategy, and the department announced it on June 25, coinciding with the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore.

“Fulcrum describes ‘what’ the DoD must achieve with respect to advancing IT for the warfighter and ‘why’ it matters,” according to a department statement.

The strategy offers specifics on broad, sweeping goals by the Pentagon to communicate faster and more securely with warfighters and allies. To date, the government has issued a number of strategic plans and frameworks to double down on cybersecurity and accelerate the military’s development of tools like AI, but this plan takes that a step further by prioritizing user experience and scalable, agile investments.

“It’s called ‘fulcrum’ because it sits at the nexus between our national security strategy, our strategic management plans — our really ‘big thinking’ strategies,” said Leslie Beavers, principal deputy chief information officer, on Tuesday.

With so many tools coming to market from different vendors and small businesses also hoping to break in, the strategy gives leaders guideposts for how to assess what tools and internal resources are needed.

Critically, it also devotes a category to developing the workforce, specifically by broadening the DoD Cyber Workforce Framework to focus more intently on roles for data, AI and software engineering.

The DoD has long said this is an established need.

“There is a recognized shortage of skilled cyber personnel that could potentially impact operational readiness across the Department and put national security at risk,” according to the department’s 2023 Cyber Workforce Strategy. “Despite the vast expansion of cyber educational and experiential opportunities, the nation’s cyber talent pipeline remains limited.”

As in the private sector, government, too, is struggling with too few tech practitioners that make new cybersecurity practices difficult to implement. At the same time, much of the technical guidance handed down by experts in tech shops is written for the actual programmists, not senior executives, so there needs to be an available reserve of workers, DoD officials said at the conference.

“Leadership is a force multiplier and to outpace [adversaries] we have to maximize the talent from our broad array of partners, and recruit and retain our own talent,” said Gen. Timothy D. Haugh, commander of U.S. Cyber Command and director of the National Security Agency, at the conference.

Finally, the new strategy also seeks to streamline governance and enhance use of data to backup decision-making and identify cost savings to deliver joint warfighting capabilities faster amid high-tempo, multi-domain operations.

“We must challenge legacy approaches and move move toward rapid innovation for them,” said Haugh. “We cannot succeed when our existing processes move slower than the rate of innovation change.”

That probability is what senior-level military, government and industry leaders will be discussing at this year’s flagship TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore, Maryland.

This year’s theme of the three-day event beginning Tuesday is about “outpacing the threat,” and innovators in the defense technology space will discuss how their tools fit within the military’s goals to align their defenses with the nature of cyber warfare, adapt to rapidly changing environments, and accelerate ahead of global adversaries. All the topics du jour will be on the table, including artificial intelligence, large language models, contested logistics and data strategy.

Knowing future battles will transcend borders and go beyond just physical assaults on adversaries, experts in the U.S. government and industry know the tools of the future must be secure. Knowledge in itself will become an edge in battle. As nations like China seek to advance their use of artificial intelligence for military gain, so, too, are the U.S. and its allies working to understand and leverage this technology in defense of its infrastructure.

Attendees will hear from top officials from the Defense Information Systems Agency, the Defense Innovation Unit, the Joint Force Headquarters, federal chief information officers and chief technology officers, and the service’s cyber commands on the range of multidimensional threats facing their warfighters and the nation.

Registration for interested parties is open here. Here are a few highlights to note.

A keynote address kicks off the event on June 25, during which attendees will hear from Air Force Gen. Timothy Haugh, commander of U.S. Cyber Command, and AFCEA President and retired Lt. Gen. Susan Lawrence. The two will open the conversation on ensuring resiliency in the defense industrial base.

Other sessions that morning will highlight progress being made on the Defense Department’s sprint toward achieving “target level” zero trust by 2027 with insights from within the Pentagon’s information office itself.

Leaders from the Army will also discuss the role of generative AI and knowledge management in warfare, and several branch officials will come together to talk about the need for establishing an Office of the Assistant Secretary of Defense for Cyber Policy.

The showroom floor will also be open to display the latest technology in cybersecurity from dozens of companies.

But the tools cannot be discussed without also identifying a workforce to use them. An afternoon session on Tuesday will offer a status update on the DoD Cyber Workforce Framework.

For highlights of the conference, follow along at c4isrnet.com.

As it so often does, the U.S. government is looking to the private sector for inspiration, and it’s seeing commercial partners leveraging these tools already, officials from the U.S. military and the Pentagon said at the 2024 C4ISRNET Conference on Wednesday. That’s in no small part due to the fact that many of these companies have the workforce on hand to use them and can recruit competitively on pay.

“We have seen Big Tech and large tech companies embracing some of these tools, and they’re moving out with it because they see the value in these methods,” said Benjamin Bishop, deputy director of transition in the Adaptive Capabilities Office of DARPA. “But a lot of those companies … can pay salaries for this talent that may not translate to other companies in the defense industrial base because their focus area is different.”

There’s also a need, he said, to make these capabilities accessible not just to certifying organizations and those with specialized training or expertise, but to the broader workforce to move U.S. military strategy forward holistically. And it needs to happen fast enough so that the latest technology is not mired in acquisition regulation and rendered obsolete.

“How do we navigate the the non-technical barriers to our transition?” said Bishop. “How do we get the tools into the hands of the warfighters in order to maximize their success?”

The proliferation of digital threats in recent years has forced cybersecurity to become the responsibility of every Pentagon office, civilian and military. Bishop noted that the cyber-contested environment is rapidly become a standard character of war, and the Biden Administration, too, has set top-down goals for every aspect of government to be equipped with security measures in place, whether they contribute directly to national defense or not.

“To me, that’s not necessarily a technology problem,” said Bishop. “How do we get the technology to be … understood by the systems that have to certify these products, but also understood by the workforce that’s across our defense industrial base and also in uniform?”

And while partnering with the private sector can and does work, the military itself must develop its own cyber expertise, he said.

On top of trying to meet general manpower goals, the services, too, are recruiting cyber experts to their ranks and contend with how to compensate them uniformly despite different pay scales, [Military Occupation Specialty] titles, and promotion processes, according to Bishop.