DevSecOps: The Benefits of a More Dynamic DOD

The Defense Department has made enormous strides in IT innovation in the past two years. Initiatives such as the Air Force’s Kessel Run program are enabling the DOD to build out in-house development teams and speed up time to deployment. A key part of this is developing in an unclassified environment then shifting into a classified one. 

Historically, development was executed in a classified environment which resulted in a far slower and less dynamic process. This is evident in the fact that, through its Kessel Run project, the Air Force significantly reduced its software development process from eight years down to roughly four months. 

Central to these initiatives’ success and speed is cross-domain security. DOD must have a cross-domain solution in place to permit communication and data transfer between unclassified and classified levels—and to reap the benefits of this newer, more agile model.

Code Low, Deploy High

Leveraging unclassified resources for the development of code to be run in a classified manner has many tangible advantages, from increased agility and cost savings to the ability to attract better talent. However, none of those benefits can be realized without a cross-domain solution in place.

A cross-domain solution represents the gateway between networks at different classification levels. Pushing data to classified networks from unclassified is a major concern, but the risk of transferring that data can be made manageable. Concerns include maliciously or inadvertently passing malware or bad code that can adversely affect missions at the classified level. Cross-domain solutions can scan and validate data prior to any of that data being pushed to a classified network, ensuring that the data is correct and safe to pass.  Additionally, it can validate new transport specifications, such as Cross Domain Unstructured Data Exchange (CDUX), to establish that the data has originated from a trusted source.

With this in place, the government can adopt a software-as-a-service model. Seamlessly pushing out code through cross-domain solutions allows for more dynamic updates, as we see in commercial software product offerings, such as Office 365 and Salesforce. Instead of releasing a 2.0 or 3.0 version of software, updates can happen dynamically—even daily. 

Attracting Talent

Beyond speed, another benefit of developing in an unclassified environment is that it gives the DOD access to a much wider pool of developers. In decades past, working for the government (and the defense industry in particular) was the high-tech job of choice. Now, many potential employees see it as an inflexible and arduous option.

For example, obtaining clearance for a government role can take anywhere from weeks to a year, as there’s currently a backlog for security clearance processing. Meanwhile, the government hasn’t always had access to cutting-edge tools for coding. Contrast that to the world of startups—which lets people work anytime and anywhere, while also accessing very robust tools in an unclassified setting and it’s easy to see why government work isn’t as attractive as it once was.

DevSecOps shifts this balance and makes government work more attractive. By using resources in an unclassified environment, people can be brought on-board immediately and jump right into the development process, while accessing the same caliber of tools that can be found in the hyper-competitive commercial tech world.

Hiring developers without clearances also saves valuable budget dollars. People with clearances are premium hires, especially at the highest levels. With a code low, deploy high approach—backed by a cross-domain solution—agencies can attract top talent, offer them a flexible working environment (particularly in the age of COVID-19, where most people are working from home), and generally improve utilization.

Looking Forward

The idea of moving from unclassified to classified is not a novel approach. Commercial applications that the DOD utilizes, like Microsoft Windows and Office, are also developed in low environments and pushed up to high ones. DevSecOps, coupled with cross-domain solutions, simply makes the transfer more dynamic and aligned with current commercial development processes today. 

Of course, pushing data up is only the first step. The next step is to start pushing data back down to developers with feedback as to whether the code works properly or not. Good development is about a feedback loop of what’s working, in what parameters. In the future, we will need transfers and feedback to be bi-directional. 

This will make the development process even more agile—and even more appealing to potential talent. Still, none of these benefits can be realized without cross-domain solutions to facilitate and secure a transfer from low to high and, eventually, back again.