An official website of the United States government
Here's how you know
A .mil website belongs to an official U.S. Department of Defense organization in the United States.
A lock (lock ) or https:// means you’ve safely connected to the .mil website. Share sensitive information only on official, secure websites.

Home : Media : News : News Article View
NEWS | Nov. 29, 2022

DOD Releases Path to Cyber Security Through Zero Trust Architecture

By C. Todd Lopez DOD News

WASHINGTON -- The Defense Department on Tuesday released its Zero Trust Strategy and Roadmap, which spells out how it plans to move beyond traditional network security methods to achieve reduced network attack surfaces, enable risk management and effective data-sharing in partnership environments, and contain and remediate adversary activities over the next five years.

"Zero trust is a framework for moving beyond relying on perimeter-based cybersecurity defense tools alone and basically assuming that breach has occurred within our boundary and responding accordingly," David McKeown, the department's acting chief information officer, said.

McKeown said the department has spent a year now developing the plans to get the department to a zero trust architecture by fiscal year 2027. Included in that effort was development of a Zero Trust Portfolio Management Office, which stood up earlier this year.

"With the publication of this strategy we have articulated the 'how' that can address clear outcomes of how to get to zero trust — and not only accelerated technology adoption, as discussed, but also a culture of zero trust at DOD and an integrated approach at the department and the component levels."

Getting the Defense Department to reach the goals laid out in the Zero Trust Strategy and Roadmap will be an "ambitious undertaking," McKeown said.

Ensuring that work will largely be the responsibility of Randy Resnick, who serves as the director of the Zero Trust Portfolio Management Office.

"With zero trust, we are assuming that a network is already compromised," Resnick said. "And through recurring user authentication and authorization, we will thwart and frustrate an adversary from moving through a network and also quickly identify them and mitigate damage and the vulnerability they may have exploited."

Spotlight: Engineering in the DOD

Resnick explained the difference between a zero trust architecture and security on the network today, which assumes a level of trust for anybody already inside the network.
"If we compare this to our home security, we could say that we traditionally lock our windows and doors and that only those with the key can gain access," he said. "With zero trust, we have identified the items of value within the house and we place guards and locks within each one of those items inside the house. This is the level of security that we need to counter sophisticated cyber adversaries."

The Zero Trust Strategy and Roadmap outlines four high-level and integrated strategic goals that define what the department will do to achieve that level of security. These include:

  • Zero Trust Cultural Adoption — All DOD personnel understand and are aware, trained, and committed to a zero trust mindset and culture to support integration of zero trust.
  • DOD information Systems Secured and Defended — Cybersecurity practices incorporate and operationalize zero trust in new and legacy systems.
  • Technology Acceleration — Technologies deploy at a pace equal to or exceeding industry advancements.
  • Zero Trust Enablement — Department- and component-level processes, policies, and funding are synchronized with zero trust principles and approaches.

Resnick said development of the Zero Trust Strategy and Roadmap was done in collaboration with the National Security Agency, the Defense Information Systems Agency, the Defense Manpower Data Center, U.S. Cyber Command and the military services.

The department and its partners worked together to develop a total of 45 capabilities and more than 100 activities derived from those capabilities, many of which the department and components will be expected to be involved in as part of successfully achieving baseline, or "target level" compliance with zero trust architecture within the five-year timeline, Resnick said.

"Each capability, the 45 capabilities, resides either within what we're calling 'target,' or 'advanced' levels of zero trust," he said. "DOD zero trust target level is deemed to be the required minimum set of zero trust capability outcomes and activities necessary to secure and protect the department's data, applications, assets and services, to manage risks from all cyber threats to the Department of Defense."

Across the department, every agency will be expected to comply with the target level implementation outlined in the Zero Trust Strategy and Roadmap. Only a few might be expected to achieve the more advanced level.

"If you're a national security system, we may require the advanced level for those systems," McKeown said. "But advanced really isn't necessary for literally every system out there. We have an aggressive goal getting to 'targeted' by 2027. And we want to encourage those who have a greater need to secure their data to adopt this advanced level."

Resnick said achieving the target level of zero trust isn't equivalent to a lower standard for network security.

"We defined target as that level of ability where we're actually containing, slowing down or stopping the adversary from exploiting our networks," he said. "Compared to today, where an adversary could do an attack and then go laterally through the network, frequently under the noise floor of detection, with zero trust that's not going to be possible."

By 2027, Resnick said, the department will be better poised to prevent adversaries from attacking the DOD network and minimize damage if it does occur.

"The target level of zero trust is going to be that ability to contain the adversary, prevent their freedom of movement, from not only going laterally but being able to even see the network, to enumerate the network, and to even try to exploit the network," he said.

If later on more is needed, he said, the requirements for meeting the target level of compliance can be adjusted.

"Target will always remain that level to which we're seeing and stopping the adversary," he said. "And for the majority of the DOD, that's really our goal."


Like Us
Follow Us



13th Marine Expeditionary Unit conducts HA/DR exercise as part of CARAT/MAREX 2023
MULLIKULAM, Sri Lanka (Jan. 23, 2023) – U.S. Marine Corps Cpl. Gage Wesley, a water support technician with Combat Logistics Battalion 13, 13th Marine Expeditionary Unit, gives a Sri Lanka Navy medical officer a sample of fresh water from a lightweight water purification system during a Humanitarian Assistance and Disaster Relief exercise, Jan. 23, in Mullikulam. CARAT/MAREX Sri Lanka is a bilateral exercise between Sri Lanka and the United States designed to promote regional security cooperation, practice humanitarian assistance and disaster relief, and strengthen maritime understanding, partnerships, and interoperability. In its 28th year, the CARAT series is comprised of multinational exercises, designed to enhance U.S. and partner forces’ abilities to operate together in response to traditional and non-traditional maritime security challenges in the Indo-Pacific region. (U.S. Marine Corps photo by Sgt. Brendan Custer)
Feb. 1, 2023 - U.S. Marines and Sailors with the 13th Marine Expeditionary Unit conducted a Humanitarian Assistance and Disaster Relief (HA/DR) scenario as part of the Cooperation Afloat Readiness and Training/Marine Exercise (CARAT/MAREX)...

U.S., Indian Airmen train side by side to sharpen airlift skills
U.S. Air Force 535th Airlift Squadron and the Indian Air Force No. 81 Squadron personnel pose for a photo during Exercise COPE INDIA 2022 at Hindan Air Base, India Nov. 18, 2022. (Courtesy photo)
Feb. 1, 2023 - On the morning of Nov. 18, 2022, with the sun peeking through a hazy horizon, the residents of Hindan Air Base, near New Delhi in northern India, were greeted by a new sight. Parked next to a neatly aligned row of Indian Air...

U.S. Indo-Pacific Commander Travels to Fiji
Adm. John C. Aquilino, Commander of U.S. Indo-Pacific Command, traveled to Fiji Jan. 30-31, to reaffirm the strength of the bilateral relationship and advance shared interests in building a more peaceful, stable, and prosperous Indo-Pacific region.
Feb. 1, 2023 - SUVA, Fiji – Adm. John C. Aquilino, Commander of U.S. Indo-Pacific Command, traveled to Fiji Jan. 30-31, to reaffirm the strength of the bilateral relationship and advance shared interests in building a more peaceful, stable,...

U.S., South Korea Want Peace in Indo-Pacific
Jan. 31, 2023 - Secretary of Defense Lloyd J. Austin III stressed that the goal of the U.S.-South Korean alliance is peace — not conflict — following meetings in Seoul, South Korea, today.The secretary made the remarks at a news conference...

U.S. Army Advisors Strengthen Partnership in Thailand
Sgt. 1st Class Justin Babb takes part in close quarters battle rehearsals with members of the Royal Thai Army. Babb is part of an SFAB Team assigned to Force Package 23-1, the 5th SFAB's forward-deployed element.
Jan. 31, 2023 - NAKHON NAYOK, Thailand – Three Advisor Teams from 2nd Battalion, 5th Security Force Assistance Brigade partnered with the Royal Thai Army across Thailand during a multi-month rotation into theater beginning in October 2022...