Thunderdome: Shifting DoD Cybersecurity to Zero Trust

The Defense Information Systems Agency (DISA) took a major step forward with the advent of Thunderdome Production Other Transaction Agreement (OTA), hereafter referred to as Thunderdome, an innovative early adoption toward zero trust architecture providing secure network and data access. This initiative marks a pivotal moment in the evolution of cybersecurity within the Department of Defense (DoD). In this TechSource article, we’ll delve into the transformative opportunity of Thunderdome and how it promises to shape the future of cybersecurity and defense for the DoD.

The Transformative Power of Thunderdome

Thunderdome, part of DISA's Zero Trust Program, is set to disrupt the industry’s traditional approach to cybersecurity. The innovative program offers a comprehensive suite of solutions and partners to harden DoD networks and empower warfighters to proactively defend against adversarial activity.

The program integrates a range of commercial-off-the-shelf technologies, including Secure Access Service Edge (SASE), Zero Trust Edge (ZTE), Software-Defined Wide Area Networks/Customer Edge Security Stack (CESS), Application Security Stacks and visibility and Analytics. These elements work together seamlessly to enhance both security and network performance within the existing enterprise environment, thus presenting a comprehensive approach to cybersecurity and complying with the Zero Trust Executive Order 14028 and the DoD CIO Zero Trust Strategy.

Thunderdome accelerates the achievement of the nation's cybersecurity objectives, making it a dynamic component in modernizing and strengthening national defense.

Getting to the Heart of Zero Trust

At the core of Thunderdome lies a Zero Trust concentration, a paradigm that challenges previous cybersecurity perceptions. Zero trust embraces principles that include:

• Validated user identity and access management
• Real-time device inspection and patching
• Secure application and workload development
• Network environment isolation
• End-to-end data encryption and protection
• Improved detection and response times
• Automation and orchestration across all Thunderdome components
  
  

Key Elements of Thunderdome

• Zero Trust Secure Network and Data Access: Conditional access policies for users harnessing resources both remotely and on premise. Thunderdome moves security closer to the edge and continuously validates device health posture and user identity.
• Application Security Stack: Security stack that implements Micro-segmentation and protects legacy and modern applications. Deployable through Infrastructure as Code (IaC) Templates in any Cloud on Private Data Center.
• Visibility and Analytics: Seamless continued visibility across all Thunderdome Zero Trust components.

The key design principals of Thunderdome include:

• Open Architecture: Embracing modularity to prevent vendor lock in and optimize current investments. Makes use of your existing capabilities (ICAM, EDR etc.)
• Policy, Enforcement Points (PEP): Ensuring user, device, and system access validation for critical data sets, both on-premises and through remote ZTNA services.
• Segmentation and data protection: Implementing segmentation to minimize potential impact areas and fine-tuning granular controls for safeguarding sensitive data.
• Integrated insights: Maintaining ongoing visibility by seamlessly integrating sensor data.
  

Implementing Zero Trust

Implementing Zero Trust architecture comes with its set of challenges, and Thunderdome was engineered to address these obstacles. Legacy infrastructure, data management, identity management, and the management of large volumes of logs are among the hurdles that defense departments and agencies will address to successfully implement a zero-trust approach.

With Thunderdome as part of DISA’s Zero Trust Architecture (ZTA) implementation, the goals tackle the following challenges to:

• Reduce redundant and complex cybersecurity architectures
• Increase effectiveness and end user experience
• Accelerate lessons learned, to deploy Zero Trust across DISA, Fourth Estate agencies and offer the service to Military Departments (MILDEPS) and Combatant Commands (COCOMs).
  
  

3 Ways to Leverage Thunderdome

Thunderdome offers a unique level of flexibility in its deployment, catering to the diverse needs of DISA and DoD mission partners. The implementation of Thunderdome provides tailored deployment options, empowering each organization to choose the model that aligns best with their specific requirements and operational preferences.

• DISA Managed Deployment: Thunderdome's DISA-managed deployment option provides a turnkey solution where DISA leads oversight and operations of the Thunderdome architecture. This approach allows organizations to leverage DISA's expertise in managing complex cybersecurity infrastructures, providing a seamless and professionally managed implementation of Thunderdome.
• Customer Managed Deployment: For organizations that prefer a higher degree of control over their cybersecurity operations, Thunderdome offers a customer-managed deployment option. In this model, the customer leads the deployment, operation, and maintenance of the Thunderdome architecture. This level of control enables organizations to align Thunderdome with their unique security policies, protocols, and operational workflows.
• Build Your Own Thunderdome Tailored Solution: Thunderdome's innovative approach extends further by providing organizations the opportunity to build their own customized solution. Through the Zero Trust (ZT) agreement, organizations can take charge of executing their own Agreement Order (AO) and tailor Thunderdome to their specific needs. This build-your-own option allows for a high degree of customization, enabling organizations to integrate Thunderdome seamlessly into their existing cybersecurity infrastructure.

Considerations for Choosing the Right Deployment Option

• Operational Expertise: Organizations should evaluate their internal capabilities and expertise in managing cybersecurity operations when choosing between DISA managed and customer-managed options.
• Customization Needs: The level of customization required by an organization plays a crucial role in determining whether a customer-managed or build-your-own option is the most suitable.

Implementing a Zero Trust Solution

Thunderdome stands as a testament to the innovative nature of Zero Trust. It is not merely a technological modernization but a mindset shift in cybersecurity. By assuming the core tenets of Zero Trust’s "never trust, always verify" stance and allowing only least-privileged access, Thunderdome represents a comprehensive shift in how the DoD protects high-value assets in real time.

The at-scale deployment of Thunderdome signifies a significant leap forward in the DoD's journey toward a ZTA. As cybersecurity threats continue to evolve, Thunderdome's impact will be instrumental in safeguarding the nation's critical assets and data. Its ability to provide a proactive defense cyber strategy reflects the forward-thinking approach required to defend against modern threats. Thunderdome is not just a technology; it's a new way of thinking about cybersecurity that enables the DoD to meet zero trust implementation plans today.

How to Get Started

Reach out to the Thunderdome Program Management Office at DISA:

 disa-pmothunderdome@groups.mail.mil