David McKeown, acting principal deputy chief information officer at the Department of Defense, said the Pentagon plans to take additional measures—including red teaming and network monitoring—to check the security of commercial cloud environments that host military data, Defense One reported Thursday.
“We’ve had some incidents recently that have shown that we probably need to shore [up] some visibility issues where maybe we do some outside-in looks at the clouds that they built for us,” the 2023 Wash100 awardee said.
In addition to continuous monitoring and reporting by cloud service providers, McKeown wants to “take a deeper look from a red-team perspective inside” their perimeter.
The planned active defense will also involve scanning IP addresses to identify vulnerabilities in various systems.
“We could just do external scans of that and see what’s exposed to the internet. And if it’s vulnerable, and if we find something vulnerable, we would of course, tell them and have them get on that right away. And we would do the same thing on our side of the cloud,” McKeown explained.
A 2023 National Defense Authorization Act provision requires that all defense cloud contracts include provisions allowing DOD to conduct threat assessments for cloud infrastructure housing classified data.
