DoD Zero Trust Capability Mapping Solution Guide

 

Cisco + Splunk

A Zero Trust model of security prompts organizations to assess trust at every access attempt.

Our view is that a Zero Trust approach should:

●      Establish trust for users, devices and applications trying to access an environment

●      Enforce trust-based access based on the principle of least privilege, only granting access to applications and data that users/devices explicitly need

●      Continuously verify trust to detect any change in risk even after initial access is granted

●      Respond to change in trust by investigating and orchestrating response to potential incidents

With this approach, agencies gain better visibility across users, devices, networks, containers, and applications, because they can verify temporal security state and apply risk-based policy with every access attempt. Organizations can also reduce their attack surface by segmenting resources and granting the absolute minimum access needed per request. Applying this Zero Trust model helps entities comply with DoD Comply-to-Connect (C2C), Executive Order 14028, NSM-8, and OMB mandates. End users ultimately get a more consistent and productive security experience - regardless of their location, which endpoints are used, or where their applications live in today’s hybrid cloud environments.

Establish Trust

●      User / Device / Service Identity

●      Posture + context

●      Risk-based authentication

Enforce Trust Based Access

●      Micro-segmentation

●      Unified access control

●      Least privilege + explicit trust

Continuously Verify Trust

●      Re-assessment of trust

●      Indicators of compromise

●      Shared signals

●      Behavior monitoring - threat and non-threat activity

●      Vulnerability management

Respond to Change in Trust

●      Prioritize incident response

●      Orchestrated remediation

●      Integrated + open workflows

Better together

Cisco and Splunk help create a digital world that is safer and more resilient. Our technologies can assist the DoD in their Zero Trust (ZT) initiative, as stated in the DoD Zero Trust Capability Execution Roadmap and the DoD Zero Trust Strategy. Cisco and Splunk enable “Cross-Pillar Capabilities” with data and network telemetry this provides profound Visibility and Analytics and empowering Automation and Orchestration.

Cisco’s Security portfolio offers extensive threat intelligence and advanced analytics which enhances visibility and control across users, devices, networks and applications. Splunk is a data-driven, open, integrated networking and security platform with hundreds of integrations to other technologies supporting existing environments. Splunk also supports multicloud monitoring and Splunk Cloud SaaS offering is authorized and accredited to FedRAMP Moderate, High, and IL5 standards. Additionally, Splunk has numerous existing deployments in on-premises and highly-classified environments throughout the DoD and Federal Government. Our architects are available to help find the best solution for any situation.

The DoD Zero Trust Strategy outlines a seven pillar zero trust model and associated capabilities, to standardize the way missions and programs implement and adopt zero trust principles. The comprehensive portfolio that Cisco and Splunk brings to the DoD can help integrate data, networking, and security solutions to bring together zero trust outcomes more efficiently with improved user and operator experience.

Identity

Continually verify trust at every access decision

User and Device

Access

Provide least privilege access for users, devices, apps: across networks and clouds

Network and Cloud

Response

Detect and stop threats faster powered by AI/ML

Application and Data