Fast Track For Air Force

Air Force’s New Fast-Track Process Can Grant Cybersecurity Authorizations In One Week

By Aaron Boyd,
Senior Editor, Nextgov

MARCH 27, 2019

The process is a mix of quick but comprehensive testing up front followed by continuous monitoring through the life of the app.

The Air Force is taking one of the longest, most difficult, critical aspects of cybersecurity and IT deployment in the public sector and fast-tracking the process.

Last week, Air Force Undersecretary Matthew Donovan signed a memo authorizing officials to grant IT systems an authority to operate—the designation certifying the application is reasonably secure from cyberattacks—on an expedited timetable.

Obtaining an ATO is often an arduous process that can take months, especially for military systems that are constant targets for bad actors worldwide. During pilot tests earlier this year, officials at the Air Operations Center used the Fast-Track ATO process to certify a system in just one week, according to Frank Konieczny, the Air Force’s chief technology officer.

Prior to developing the fast-track process, the Air Force relied on the Risk Management Framework, a schema developed by the National Institute for Standards and Technology to establish a baseline cybersecurity posture. However, that largely led to check-the-box compliance rather than real security, Konieczny said during a panel Tuesday at the RSA Federal Summit.

“People always complained RMF was too long, too onerous and didn’t provide anything except a lot of paperwork,” he said. “So, now we’re trying to get back to the operational side, let’s look at it from an operational viewpoint: What do we really need to do to actually support it going forward and doing it faster than just paperwork?”

Rather than go through each security control individually, the fast-track process allows project owners to run a penetration test—in which cybersecurity experts attempt to break the system—to establish a security baseline, then incorporate continuous monitoring of those systems into the future to ensure it remains secure.

“It comes down to the premise that RMF is a compliance issue. It doesn’t mean you’re secure, it means you’re compliant,” Konieczny said. “We’re saying, basically, if you want to do a fast ATO, you need to think about looking at some of the controls that you’re going to monitor, doing a pen test and doing continuous monitoring after that. … The pen test will actually answer some of those controls [questions] right away. And it’s a better case because it’s not just compliance anymore, it’s how you operationally put the information out there.”