Closing the Air Gap: Enhancing Security, Analytics, and Efficiency

From IC Insider Red Hat

The Intelligence Community (IC) and commercial enterprises have historically relied on private networks to provide various information security protections. The IC’s security protections are more stringent than most and often called the air gap, creating multiple domains – the “low-side” and the “high-side.” As the IC removes the isolation the air gap falsely provides, it widens the door to collecting and analyzing openly available sources from an array of publicly accessible entities. To be effective with this new way of operating, the IC must manage a healthy data flow between commercial, open-source, and public sector sources. The same approach is seen in how Red Hat cultivates and enables the widely distributed open-source communities to develop trusted products that provide a high degree of security assurance.

Working across domains brings tremendous penalties – increased costs, reduced efficiency, workforce challenges, and operational complexity. Current intelligence production activities are focused on utilizing a trusted chain of production  – the IC owns the entire process and all the tools and infrastructure to execute it. Enforcing the air gap is an important part of establishing and maintaining the trust of this production pipeline and its resulting intelligence products and protecting side channel information about the process itself (the sources and methods).  But maintaining these production pipelines also means the IC often has to own everything – an expensive and complex task. The cost and complexity of owning every step in the process then limit the number and diversity of the production pipelines the IC can manage, and need-to-know means there are little efficiency gains by collaborating or sharing across these pipelines. Each becomes a critical asset, and protecting that asset is paramount to continued operations, even though every new data collection starting point is a risk to the IC, and an adversary denying or compromising any part of the production process or its source data removes the entirety of its value. Operationally, not only are there no efficiency gains because of the soloed nature of operations, but there is lost efficiency because of the extra hurdles of dealing with the air gap – delays or merely extra tools and people needed to push data through CDSs or DTOs, or replicating systems in multiple, and often different deployment locations. Every gap presents an opportunity (that inevitably is realized) for drifting processes, configuration, metadata, versions, standards, and all the infrastructure needed to run IT systems. Segmented network domains are still useful and cannot be completely abandoned: defense in depth can still serve important functions and safeguards.

In a great state competition, staying ahead of our adversaries is far more difficult with the drag of the air gap.  The only way the IC will be able to scale (technically and budget. The intelligence community is frequently building tools to facilitate data and intelligence collection without understanding where the value and utility of the data to decision-makers lies. Meanwhile, commercial businesses are increasingly building introspective tools to understand their business structure the impacts of changes, and hunt for efficiencies or gain a competitive advantage. Incidental to this, the commercial sector collects enormous and diverse data with the freedom to explore and try new sources and applications. They can and do deploy huge fleets of IoT, sensors, and devices that could be opportunistically utilized, especially with the new generation of AIML with unsupervised training methods. The intelligence community needs to tap into this existing scale and access to capture information and signals from non-traditional sources. And by leveraging commercial capabilities, they can avoid replicating existing capability that is already optimized by competitive pressures for business efficiency.

Under the lens of the EO 14028 zero trust mandate, it has become apparent that the air gap has served as a cybersecurity crutch, resulting in underinvestment and weaknesses. It has resulted in waiving more robust security control by claims of other control mitigations via air gap protections. The presence of this crutch results in lower demand signals for potentially better tools and technology with correspondingly lower development of more specialized tools. It is also the case that the perception of the air gap is not the reality nor a panacea. The air gap has always been useful but ultimately a fiction: there is plenty of interconnection in various ways to facilitate collection and analysis; even though employed extensively, even the best CDS can’t fully protect systems on the other side of the air gap from various classes of attacks, and there are ways human and human nature has circumvented those technological protections with unsophisticated methods. Fortunately, a zero-trust approach is also part of the answer.

The future IC workforce – composed of digital natives – will also not tolerate working behind an air gap and the encumbrances that come with it. Millennials and Gen-Z have grown accustomed to technologies that keep them constantly connected to the world around them. Attracting talent with the mission is one thing. Still, retaining this younger generation’s talent pool will be accomplished by providing new freedoms like remote work options and less restrictive on-site environments. The IC talent scarcity challenge is a growing concern for leaders across the IC and companies that support the IC. The initial efforts to resolve this problem have been to band-aid the problem by modernizing SCIF spaces with new technology and ping-pong tables, but this does not solve the problem. Employees don’t value these perks highly – what they want is flexibility to be impactful and productive. To retain talent, the IC and its supporting companies need to remove the air gap and the barrier to the flexibility that the new generation is seeking.

Shedding the air gap operating model will mean a shift to working through and organizing distributed communities and the information flow between them. As previously discussed, a wealth of intelligence is waiting to be harvested through commercial and open-source channels. Agencies are already realizing the value of Open Source Intelligence (OSINT) and other publicly available sources. If the IC were to remove the cumbersome and leakage-prone air gap, then it would need to shift more to a model not unlike Red Hat’s open-source development model to perform collection and analytics. When the IC needs to collect on a target, they can influence the commercial and public sources to collect on their behalf while still keeping their collection needs fully obfuscated. Red Hat has been driving the enterprise needs to the open source community for decades and has successfully ensured the enterprise needs are being met through the open source community’s development. When developing intelligence products, there needs to be a trusted and protected supply chain to ensure that the product has not been leaked or tampered with in the analysis process. Red Hat has to ingest source code from all over the world and ensure that all the code meets stringent requirements not to contain malicious code and to maintain its secure supply chain that the enterprise relies on. Applying the open source model that Red Hat has employed for decades to the IC can collect and analyze its sources faster.

The current complex model allows for an uncontrolled/unknown intelligence leakage. Removing the air gap will revolutionize the analysis capability by eliminating the need to transfer vast raw data to a “high side” network. Colocating the analytics with the collected data removes unnecessary data transfers and brings processing to the data. Additionally, the IC can better measure and thus control the leakage of data through obfuscated target collection and analytic techniques. The result of this is a controlled, fully managed information flow system that enables data locality, leading to rapid access to actionable intelligence to the IC.

There is an array of solutions to allow the IC to continue to be the preeminent provider of intelligence products to our nation’s decision-makers without depending on the air gap. Many of these solutions will require fundamental changes in how the intelligence community operates. The rewards will be worth The changing nature of our data environment demands it. The new approach will work even for the IC’s most treasured analytics tools and processes. These changes will not be easy and require a reassessment of the trust and risk model for the community. However, the IC does not shy away from risk.

To learn more about what Red Hat’s work in the Intelligence Community, click here: red.ht/icn.

Name

Michael Epley

Title

Chief Architect and Security Strategist

Bio

Michael Epley has been helping the US defense and National Security communities use and adopt open-source software over the last two decades with practical experience as a software developer and enterprise architect. During his tenure at Red Hat, Michael has passionately driven the adoption of key technology: cloud and Kubernetes, tactical edge/forward-deployed systems, data analytics tools and platforms, and disconnected operations — always in the context of security and compliance concerns unique to this sector. Michael has BS in Mathematics and Mechanical Engineering from Virginia Tech and a JD from The University of Texas School of Law.

Name

Austen Bruhn

Title

Specialist Solution Architect, National Security Programs

Bio

For the last decade Austen Bruhn has been developing data/IT architectures and strategies for the U.S. public sector, commercial enterprises, and nonprofit organizations. For the past 4 years, he has been working with the U.S. Department of Defense and the Intelligence Community (IC) to accelerate their mission through modernization of the applications that power our national security assets. He has worked in various roles as a software engineer, space vehicle systems engineer, infrastructure engineer, and is now leveraging that experience as a solution architect at Red Hat.

About IC Insiders

IC Insiders is a special sponsored feature that provides deep-dive analysis, interviews with IC leaders, perspective from industry experts, and more. Learn how your company can become an IC Insider.