On April 11, the US Department of Defense (DoD)'s Chief Information Officer (CIO) released the DevSecOps Continuous Authorization Implementation Guide, marking the next step in the evolution of the DoD's efforts to modernize its security and compliance ecosystem. This guide is part of a larger trend of compliance modernization that is transforming the US public sector and the global public sector as a whole. It aims to streamline and enhance the processes for achieving continuous authorization to operate (cATO), reflecting a continued push to shift from traditional, point-in-time authorizations to operate (ATOs) to a more dynamic and ongoing compliance model.
The new guide introduces several significant updates, including the introduction of specific security and development metrics required to achieve cATO, comprehensive evaluation criteria, practical advice on how to meet cATO requirements and a special emphasis on software supply chain security via software bills of material (SBOMs).
We break down the updates that are important to highlight if you're already familiar with the cATO process. If you're looking for a primer on cATO to get yourself up to speed, read our original blog post or click below to watch our webinar on-demand.
Continuous Authorization Metrics
A new addition to the corpus of information on cATO is the introduction of specific security and software development metrics that are required to be continuously monitored. Many of these come from the private sector DevSecOps best practices that have been honed by organizations at the cutting edge of this field, such as Google, Microsoft, Facebook and Amazon.
We've outlined the major ones below.
- Mean Time to Patch Vulnerabilities:
- Description: Average time between the identification of a vulnerability in the DevSecOps Platform (DSOP) or application and the successful production deployment of a patch.
- Focus: Emphasis on vulnerabilities with high to moderate impact on the application or mission.
- Trend Metrics:
- Description: Metrics associated with security guardrails and control gates PASS/FAIL ratio over time.
- Focus: Show improvements in development team efforts at developing secure code with each new sprint and the system's continuous improvement in its security posture.
- Feedback Communication Frequency:
- Description: Metrics to ensure feedback loops are in place, being used, and trends showing improvement in security posture.
- Effectiveness of Mitigations:
- Description: Metrics associated with the continued effectiveness of mitigations against a changing threat landscape.
- Security Posture Dashboard Metrics:
- Description: Metrics showing the stage of application and its security posture in the context of risk tolerances, security control compliance, and security control effectiveness results.
- Container Metrics:
- Description: Measure the age of containers against the number of times they have been used in a subsystem and the residual risk based on the aggregate set of open security issues.
- Test Metrics:
- Description: Percentage of test coverage passed, percentage of passing functional tests, count of various severity level findings, percentage of threat actor actions mitigated, security findings compared to risk tolerance, and percentage of passing security control compliance.
The overall thread with the metrics required is to quickly understand whether the overall security of the application is improving. If they aren't this is a sign that something within the system is out of balance and is in need of attention.
Comprehensive and detailed evaluation criteria
Tucked away in Appendix B. "Requirements" is a detailed table that spells out the individual requirements that need to be met in order to achieve a cATO. This table is meant to improve the cATO process so that the individuals in a program that are implementing the requirements know the criteria they will be evaluated against. The goal being to reduce the amount of back-and-forth between the program and the Authorizing Official (AO) that is evaluating them.
Practical Implementation Advice
The ecosystem for DSOPs has evolved significantly since cATO was first announced in February 2022. Over the past 2+ years, a number of early adopters, such as Platform One have blazed a trail and learned all of the painful lessons in order to smooth the path for other organizations that are now looking to modernize their development practices. The advice in the implementation guide is a high-signal, low-noise distillation of these hard won lessons learned.
DevSecOps Platform (DSOP) Advice
If you're more interested in writing software than operating a DSOP then you'll want to focus your attention on pre-existing DSOP's, commonly called DoD software factories.
We have written both a primer for understanding DoD software factories and an index of additional content that can quickly direct you to deep dives in specific content you're interested in.
If you love to get your hands dirty and would rather have full control over your development environment, just be aware that this is specifically recommended against:
Build a new DSOP using hardened components (this is the most time-consuming approach and should be avoided if possible).
DevSecOps Culture Advice
While the DevSecOps culture and process advice is well-known in the private sector, it is still important to emphasize in the federal context that is currently transitioning to the modern software development paradigm.
- Bring the security team at the start of development and keep them involved throughout.
- Create secure agile processes to support the continued delivery of value without the introduction of unnecessary risk
Continuous Monitoring (ConMon) Advice
Ensure that all environments are continuously monitored (e.g., development, test and production). Utilize the security data collected from these environments to power and inform thresholds and triggers for active incident response. ConMon and ACD are separate pillars of cATO but need to be integrated so that information is flowing to the systems that can make best use of it. It is this integrated approach that delivers on the promise of significantly improved security and risk outcomes.
Active Cyber Defense (ACD) Advice
Both a Security Operations Center (SOC) and external CSSP are needed in order to achieve the Active Cyber Defense (ACD) pillar of cATO. On top of that, there also has to be a detailed incident response plan and personnel trained on it. While cATO's goal is to automate as much of the security and incident response system as possible to reduce the burden of manual intervention. Humans in the loop are still an important component in order to tune the system and react with appropriate urgency.
Software Supply Chain Security (SSCS) Advice
The new implementation guide is very clear that a DSOP creates SBOMs for itself and any applications that pass through it. This is a mega-trend that has been sweeping over the software supply chain security industry for the past decade. It is now the consensus that SBOMs are the best abstraction and practice for securing software development in the age of composible and complex software.
The 3 (+1) Pillars of cATO
While the 3 pillars of cATO and its recommendation for SBOMs as the preferred software supply chain security tool were called out in the original cATO memo, the recently published implementation guide again emphasizes the importance of the 3 (+1) pillars of cATO.
The guide quotes directly from the memo:
In order to prevent any combination of human errors, supply chain interdictions, unintended code, and support the creation of a software bill of materials (SBOM), the adoption of an approved software platform and development pipeline(s) are critical.
This is a continuation of the DoD specifically, and the federal government generally, highlighting the importance of software supply chain security and software bills of material (SBOMs) as "critical" for achieving the 3 pillars of cATO. This is why Anchore refers to this as the "3 (+1) Pillars of cATO".
- Continuous Monitoring (ConMon)
- Active Cyber Defense (ACD)
- DevSecOps (DSO) Reference Design
- Secure Software Supply Chain (SSSC)
Wrap-up
The release of the new DevSecOps Continuous Authorization Implementation Guide marks a significant advancement in the DoD's approach to cybersecurity and compliance. With a focus on transitioning from traditional point-in-time Authorizations to Operate (ATOs) to a continuous authorization model, the guide introduces comprehensive updates designed to streamline the cATO process. The goal being to ease the burden of the process and help more programs modernize their security and compliance posture.
If you're interested to learn more about the benefits and best practices of utilizing a DSOP (i.e., DoD software factory) in order to transform cATO compliance into a "switch flip". Be sure to pick up a copy of our "DevSecOps for a DoD Software Factory: 6 Best Practices for Container Images" white paper. Click below to download.
