White Paper

Coalition Information
Sharing in the Ageof Great Power
Competition© 2024 Zscaler, Inc. All rights reserved.

Carl von Clausewitz, the 19th century military
strategist, spoke on the importance of lines
of communication (LOC) while observing
Napoleon. That observation is as relevant
today in all warfighting domains, including
the cyber domain, as it was then.
As Clausewitz wrote, LOCs were necessary tomove critical supplies to the front line, as wellas provide an egress route for forces moving
away from the front line.

© 2024 Zscaler, Inc. All rights reserved.

White Paper

Introduction

2

Securing LOCs is paramount. Every military

domain. As Welch further cautioned, there isbranch has incorporated LOCs into their own

a temptation to construct the cyber domain

domain operational art for mission success. The

EVERYWHERE friendly forces will operate.

Army establishes Ground LOCs, the Navy must

Military-specific networks like Secret IP Routersecure Sea LOCs, and the Air Force identifies

Network (SIPRNet) and uNclassifed IP Network

Air LOCs into and out of the area of operations(NIPRNet), military-only clouds for compute and(AOR). This concept is also relevant in thestore, and other unique hardware and software

cyber domain. Zero trust—as a cybersecurity

components like cross-domain solutions (CDS),

paradigm—enables cyber operators to securely

are examples of how the cyber domain is

move critical information around the battlefield,

constructed for military-specific requirements.

including to and from our coalition partners and

The challenge for those that design and develop

everywhere it is needed for mission success.

cyber capabilities is to determine the appropriate
mix of general purpose commercial and legacy
military-unique cyber infrastructure, all while

Coalition Information
Sharing Through Cyber Linesof Communication

ensuring critical information is protected.
As an example, the Navy cannot secure all
the waterways on the globe. Therefore, theThe cyber domain, where we share information

Navy must secure only that portion of the sea

across the coalition and joint force, is unique.

where the service must operate depending on

Much has been written about the cyber domain

the missions being executed. This operatingvis-à-vis the other domains. In 2011, Generalenvironment is the Sea Line of Communication

Larry Welch, former Air Force Chief of Staff and(SLOC). As the cyber domain is constructed,

previous Institute for Defense Analyses President,

the mix of commercial vs. government (COTS vsmade the point that every military domain must

GOTS) should strike the right balance to leverage

accomplish certain activities to be effective .

private industry’s innovation against

Those activities are:government paramount need to protect national• Passive Defense

security information.

• Active Defense

Zero trust is not only a modern security paradigm,• Exploitation (Operational Prep of the Domain)

but it also allows cyber operators to secure only1

• Attack• Defining and Developing Needed Capabilities
However, according to Welch, in the cyberdomain, there is one other activity that makes
it unique to the other warfighting domains:constructing. The combination of commercial
information technology with unique governmentthat portion of the cyber operating environment
needed to exchange coalition and joint
information. Like the other warfighting domains,
Cyber Lines of Communication (CLOC) creates the
secure pathway to exchange information while
fully exploiting existing commercial information
technology purchased through Internet and Cloud
Service Providers.

infrastructure makes up the cyber warfighting

1. Cyberspace – the fifth operational domain. (n.d.). https://www.ida.org/-/media/feature/publications/2/20/2011cyberspace---the-fifth-operationaldomain/2011-cyberspace---the-fifth-operational-domain.ashx© 2024 Zscaler, Inc. All rights reserved.

White Paper

3

Lessons Learned - Afghanistan
Mission Networkand task the appropriate military formations.

The Afghanistan Mission Network (AMN)2

across the full range of military operations is theleveraged a federated network architecture

goal articulated in the 15-Star memo written

to connect coalition partners onto a common

in 2015, but is still not available to regional

information sharing platform. The AMN

combatant commanders to this day.

Designing, developing, and deploying a MPE thatenables the level of information sharing neededarchitecture required each International Security
Assistance Force (ISAF) country to connect
to a NATO core network using their own
infrastructure. The alternative approach—creating a network enclave dedicated to themission requirements of the coalition—meant
the coalition partners gave up control of theirinformation and data to the country (presumably
the US) responsible for the coalition enclave. Even
with the benefits of federation, the evolutionof the AMN required overcoming numerous
technical and policy challenges, including
data tagging, guard technology to aggregate
the networks, and determining operational
procedures for using the AMN to achieve desired
mission objectives.
There is a realization by DoD leadership that
future conflicts require a coalition network
capable of rapidly onboarding coalition partners(both military and nonmilitary) with theflexibility of supporting operations that spandisaster response to full-scale war. In a rare
moment of unity across the entire DoD, thedeputy commanders from each of the regional

Secret and Below Releasable
Environment (SABRE)
To fully ealize the vision articulated in the 15Star memo while incorporating the lessons
learned from the AMN, the DoD has set out todevelop SABRE. According to Danielle Metz,
chief IT strategist for the office of the secretaryof defense, SABRE, will “blend the intel aspects
as well as the [command and control aspects]
together in a cloud-based approach.” During the
AFCEA TechNet Cyber 2022 conference Metzsaid, “I think that we have struggled for a very
long time on the mission partner environment.”
Metz went on to comment that, “The combatantcommanders have been screaming for the need
to be able to seamlessly… collaborate not onlyinternally with themselves, but across the mission
partners. And a mission partner can mean
anything to anybody depending on where you
are located and depending on what that actual
mission is.”combatant commands and Special Operations

To fully realize the vision of an MPE, SABRE will

Command signed out the “15-Star Memo”

need to look beyond networks and focus on theto accelerate the development of a coalition

data that must be shared for operational andnetwork and deliver it by the end of 2016.

mission success. The temptation is to look at data

To support Multi-Domain Operations, the US

sharing in terms of network access through aleverages coalition partners in a Mission Partner

dedicated network coalition accessible enclave or

Environment, or MPE. In this coalition network

federation of coalition networks. This network-

environment, data is fluidly exchanged between

centric approach will prevent advancing an MPE

interoperable systems so forces can contributeto full operating capability. The alternatives

to a common operational picture from which

discussed in the lessons learned from the AMN

commanders can make informed rapid decisions

come from two competing requirements.

2. Serena, Chad C., Isaac R. Porche III, Joel B. Predd, Jan Osburg, and Brad Lossing, Lessons Learned from the Afghan Mission Network: Developing a
Coalition Contingency Network. Santa Monica, CA: RAND Corporation, 2014. https://www.rand.org/pubs/research_reports/RR302.html.

© 2024 Zscaler, Inc. All rights reserved.

White Paper

4One, is the need for an episodic information

on rules for either the transferring of data or user

sharing capability that is effective for the specificaccess to data. A CDS can be used to strike therequirements of the contingency, including thebalance between information security to only

participating coalition partners and the type andthose with a need to know with fully enablingscale of the information sharing needs fromour coalition partners for mission success throughhumanitarian operations to full-scale war. The

granting data access because of a need to share.

second is the need for a persistent capability

However, a CDS solution that strikes the rightthat enables regional combatant command

mission balance while not being overly complex

planners and the Special Operations Commandhas eluded the DoD.

to begin sharing information quickly. Striking the

The SABRE solution must tackle the competingbalance between these two competing priorities

requirements in an MPE as discussed above:is an MPE that is both tailored to the needs of

episodic vs. persistent and need to know vs.

the coalition partners (episodic) and available

need to share, while recognizing that the data

immediately (persistent).

that will inevitably be needed will originate on

Cross-domain solutions (CDS) are often discussed

the US-only SIPRNet and have to be moved

as the way forward to achieve the flexibility

through CDS for coalition partners. However,needed for episodic data sharing while also therecasting the challenge not just as granting data

availability necessary for persistent MPE data

access while protecting network infrastructure,access for coalition partners. The value of a

as a CDS is designed to do, but granting access

CDS is in enabling connection between different

to protected data independent of the network

domains which could allow for exchanging

the data resides on is needed. This reframing of

information across security boundary levels, likethe MPE challenge to establishing Cyber Linessecret to top-secret or from a partner networkof Communication from a coalition user to theto a US network. According to Department ofapplication access where the data resides greatly

Defense Instruction 8540.01, a CDS is deployedsimplifies the SABRE solution and enables theto limit access between the two domains based

MPE vision.

Notional MPE with
Cross-Domain Solutions
Cross Domain
Solution

JTF HQ

Cross Domain
Solution
Coalition
Network

Coalition
Network
Azure
West

Internet
SaaS

Cross Domain
Solution

Azure
East

GCP

Internet
SaaS

Azure
East

GCP

Coalition
Network

AWS

AWS
DC

DC

Azure
West

Deployed

Azure
West

Base/Post
Camp/Station

Internet
SaaS

Azure
East

GCP

AWS

Deployed

Base/Post
Camp/Station

DC

HQ

HQ

Deployed

Base/Post
Camp/Station
HQ© 2024 Zscaler, Inc. All rights reserved.

White Paper

5Zero trust is a game-changer for building out theLegacy coalition interoperable architectures

MPE. Implemented as a network independent,

leveraging a CDS to exchange data do notdevice independent, and location independent

provide an optimal user experience because theysolution, a zero trust architecture enabling

introduce unneeded latency and complicated

SABRE will allow combatant commanders therouting to reach wherever the data are hosted.

flexibility to quickly grant access to critical mission

SABRE should focus on granting direct access toapplications regardless of where they reside, fromcoalition data securely regardless of location of

an Impact Level 6 SIPRNet cloud to a coalition

the user or where the data resides, regardlesspartner’s unclassified data center.

of network. Zero trust enables security
transformation - a move away from the networkbased castle-and-moat model, which is built

Zero Trust to Enable SABRE

on the installation, operation, and maintenanceStriking a balance between need to know andof firewalls, VPNs and CDSs. A zero trust

need to share is not a unique challenge toarchitecture (ZTA) transforms both data security

combatant commands integrating coalition

and information access - striking the rightpartners into regional operations. Over thebalance between need to know and needlast 30 years, private industry and the federal

to share.

government have built “hub-and-spoke

The challenges caused by legacy network

networks” where connectivity to the data center
requires access through a virtual private network
hardware and software to access enterprise
resources. They then deployed numerous anddisparate security appliances or networking
appliances, like routers, switches, and firewalls, toprotect the data center where all the applications
reside. This was called a “castle-and-moatand security architectures are pervasive andlong-standing and require rethinking the way
connectivity is granted in today’s current nation
state threats characterized by Great Power
Competition. Warfighter information and data
are everywhere, from commercial cloud service
providers to unclassified/secret/top secretdata centers to coalition partner hosted data

security” model. The combination of crossdomain security appliances, meant to exchange
data between security classification levels as wellfrom US-only to partner networks, withinrepositories. This is where ZTA is leveraged–
an architecture where no user or application istrusted by default. Zero trust is based on leastprivileged access, which ensures that trust is only

today’s operate from anywhere VPN-based

granted once identity and context are verified,security infrastructure is a tremendous andand policy checks are enforced.

complex challenge.

NIST SP 800-207, Zero Trust Architecture
Control Plane

CDM
SystemPolicyEnginePolicyAdministrator

Industry
Compliance
ThreatIntelligence
Subject

Activity
Logs

SystemUntrusted

PolicyEnforcement
Point

Data AccessPolicyPolicyDecision
Point

PKI
ID
Management
TrustedEnterprise
Resource

SEIM
SystemData Plane© 2024 Zscaler, Inc. All rights reserved.

White Paper

6The National Institute of Standards andit. Ultimately, this inherent trust, violating theTechnology (NIST) Special Publication 800-

DoD’s Zero Trust Reference Architecture Principle

207 defines the underlying principle of a zero

#1, leads to risk from an over-privileged network

trust architecture as “no implicit trust granted

access methodology. The security paradigm

to assets or user accounts based solely on theirneeds to shift from a static network perimeter

physical or network location (i.e., local area

and, instead, focus on the entity, resource, andnetworks versus the internet) or based on asset

user device, as described in NIST SP 800-207.

ownership (enterprise or personally owned)”. The
Department of Defense describes seven principles
that guide the development of the zero trust
reference architecture, with #1 being “assume no
implicit or explicit trusted zone in networks.”

Zscaler Private Access (ZPA) is a clouddelivered zero trust service that uses a distributed
architecture to provide fast and secure access to
private applications running on-prem or in the
public cloud. The service provides access based

This approach treats all network communications

on four key principles:

as hostile, where communications between• Application access is based on context andusers and applications or data are blocked until
validated by identity-based policies. It ensuresthat inappropriate access and lateral movement
are prevented. This validation carries across
any network environment, where the network
location of an entity is no longer a factor and notreliant on rigid network segmentation.

should not require network access• Outbound-only connections make applications
invisible to unauthorized users• Application segmentation connects users to a
specific app and limits lateral movement• The internet becomes the enterprise’s newtransport network

Zscaler Private Access
Today, the security perimeter extends wellbeyond garrison and tactical military networks
to anywhere warfighters connect globally towherever applications run and data resides.
Traditional network security architectures,
anchored in on-premises data centers that rely
on appliances, have become less effective formodern warfare.

When a joint or coalition user attempts toaccess a MPE application, the user’s identity anddevice posture are verified via the Zscaler Client
Connector software installed on the user device.
Policy is checked, and a ZPA Service Edge, either
on-prem (or at a tactical or deployed location)or in the cloud, determines where the closest
MPE application instance exists. ZPA uses thelocation of the client and determines the closest
application to the user based on reachability to

Network-based architectures are also vulnerable

the ZPA App Connector (lightweight VM in thedue to excessive trust. Remote users connecting

app environment). Lastly, two outbound tunnels,

from an approved list of IP addresses (via VPN)

one from the Client Connector on the device andare assumed to be trusted and are granted accessthe other from the App Connector, are stitchedto network resources through a gateway which

together by a ZPA Service Edge. All of this takes

is often exposed to the internet. On-premises

place automatically and in real time.

users on the network can move laterally across© 2024 Zscaler, Inc. All rights reserved.

White Paper

7

Broker/Controller handles policy,
redirect to ICAM; acts as PDP
and hides Hybrid Cloud infrastructure

4. Policy Decision
PDPnDevice

tio
ra
st

5.

gi
Re

Identity

Private Access
Broker/Controller

1.

User

n
tio
a
r
st t
gi uese
R q
2. . Re
3

Application
Connector

ClientConnector
PEP

Agent handles
authentication hygiene;
acts as PEP

Data/Application
Resource Domain
in Hybrid Cloud

PEP

Broker hides
infrastructure-Brokers secured
channel from user to App Connector

Figure 3: DoD ZT Software Defined Perimeter: Zscaler Architecture to create secure
Cyber Lines of Communication

1

Joint or Coalition Data Resource, through a
Zscaler Application Connector, registers with thebroker anywhere in the world—as an example: acoalition on-prem data center, US-operated IL-6
private, or an unclassified commercial cloud.

2

Joint or Coalition warfighter, via their lightweight
agent, registers with broker over available
commercial or military transport (SATCOM,
Cellular 5G, or fiber).

3

Warfighter via their agent requests accessto resource

4

Broker checks security controls andaccess policy

5

The future join andcoalition information
sharing platform
must strike the rightbalance between
security, agility,
and accessibility.

Cyber Line of Communication is securely createdfrom warfighter to application© 2024 Zscaler, Inc. All rights reserved.

White Paper

8Going Forward: Securing an Agile
Coalition and Joint Forcethe requirements for security and accessibility for

Project managers and acquisition professionals areoperations. Focusing on security and agility willfamiliar with the Iron Triangle of cost, schedule,

require a trade-off with accessibility.

and performance. The theory recognizes that to

The Agile Combat Employment (ACE) visiondeliver any system it’s quite unlikely that there

requires a SABRE platform that is rapidly

are unlimited dollars, time, and scope to address

deployable and secure, but leveraging legacy

every requirement a customer can articulate. One

US only infrastructure for connectivity andway to manage the three axes is to focus on theinformation resource access will introduce

impact of how constraining any two elements

challenges integrating coalition partners. In theNATO coalition partners, it was not agile enoughto be used outside of the Afghanistan theater ofhave on the third. In other words, if keeping costs
down and schedule tight is a firm requirement,

Iron Triangle of Coalition Information Sharing

the functional requirements (scope) of what isdelivered will have to be severely limited. If scope
and time are hard requirements, the price will

Security

not be cheap. Finally, if scope and price are hardrequirements, the time to deliver will likely bemuch longer than desired.
Iron Triangle of Project Management

TacticalCommunications

Accessibility

Cost

Not Good

Afghanistan
Mission Network

AgilityFight Tonight/
HA-DR

Not Fast

future, ACE must balance security with agility andaccessibility to rapidly onboard coalition partners.
Finally, maximizing agility and accessibility will

Schedule

Performance
Not Cheap

result in an unsecure solution. An existential fighttonight with service members in harm’s way
or humanitarian assistance/disaster response
mission requires maximizing accessibility and

These same trade-offs are found in developing
the future Mission Partner Environment and Joint
All-Domain C2 (C/JADC2) platform. The threeaxes for Coalition and Joint Information Sharing
are: Security, Accessibility, and Agility. Focusing
on security and accessibility prevent SABRE
from being agile. This is a good example of theagility at the expense of security. Allowing any
one axis to dominate the requirements will resultin a less than optimal solution. The good news istechnology is in place to enable the deploymentof a capability that allows rapid sharing of joint
and coalition data and to do it in a way that issecure and agile.

Afghanistan Mission Network: while it achieves© 2024 Zscaler, Inc. All rights reserved.

White Paper

9Digging into each of the components of the future SABRE or C/JADC2 platform helps articulate therequirements necessary for the acquisition community to best interact with industry to arrive at the
optimal solution.
Security
A zero trust solution that proxies connections and applies security inline resolves the challenge of building
out perimeter based security controls around critical data and resources. Zero trust security enables joint
and coalition warfighters the ability to enact a risk informed go/no-go decision for any user accessing
data and applications in real-time. The decision making available with zero trust creates a dynamic need toknow environment that can rapidly adjust to battlefield conditions. Additionally, adding to Zscaler’s policy
enforcement are the inline technologies that were once part of a sophisticated hardware and software
stack of appliances protecting the enterprise boundary. Applying everything from data loss prevention to
intrusion detection and prevention, to filtering out dangerous websites from being accessed. Ultimately,
security must follow the user, regardless of location and what data and applications they need to access.
The below graphic represents the in-line security process that shows the combination of protecting
coalition data in applications both managed by others (Internet and SaaS applications in the cloud) andthose applications managed by joint and coalition partners (military data centers, software factories, andapps hosted on commercial IaaS/PaaS). The overarching three phase approach of verifying, controlling,and enforcing is happening at scale, with over 350 billion transactions being secured everyday within the
Zscaler cloud.

Realizing the promise of Zero Trust
Per Session Policy Enforcement© 2024 Zscaler, Inc. All rights reserved.

White Paper

10Agility
Cloud-Based Command and Control (CBC2) is the right vision for the future SABRE platform. Removing
the requirement to palletize and deploy multiple pallets of command and control technology saves
deploying military forces, both US and coalition, time and expense when moving into position to execute
missions. As mentioned earlier, there is a propensity to “own” the IT infrastructure used to operate in the
cyber domain. Through zero trust, military capability developers can allow commercial cloud providers
to deliver the necessary infrastructure while security specialists focus on placing “trust zones” close
to the data and applications needed for mission execution. Replicating US-owned and operated cloudinfrastructure, to add additional layers of security, drives up costs and limits the agility for coalition forces.
Accessibility
The world is more and more connected every day being driven by commercial terrestrial fiber, 5G cellular,
and satellite connectivity from vendors like Starlink. This world of ubiquitous internet access, or ubiquitous
network transport, coupled with zero trust security that establishes secure Cyber Lines of Communicationin any region of the world, greatly enhances the coalition force’s accessibility to critical mission data andapplications. The future SABRE should harness this reality to take full advantage of available bandwidth,
and to do so securely with a zero trust inline security provider like Zscaler. This transport-agnostic
approach, that does not rely solely on US-owned and operated networks and network appliances forsecurity, would allow for seamless data exchanges where security follows the user. Gone would be theneed to build complex cross-domain solutions to make SABRE “always on” and ready for the ad-hoc
nature of today’s national security environment—an era of Great Power Competition.

Future SARBE Architectural Components

Security
Coalition
NetworkDCAWS

JTF HQ
Azure

Accessibility© 2024 Zscaler, Inc. All rights reserved.

Agility

White Paper

11Deployed Mission Partners Accessing Coalition Information Inside the Zero Trust ExchangeInternet
SaaS

Azure
AWS

GCP

JTF HQ

Azure
West

JTF HQJTF HQJTF HQ

US
Network

Coalition
Network

Internet
SaaS

Azure
East

GCP

Azure
West

AWS

Azure
East

GCP

DC

Base/Post
Camp/Station

Internet
SaaS

AWS
DC

Deployed

Base/Post
Camp/Station

Deployed

HQ

HQ

Conclusion
It is undeniable that the Department of Defense recognizes the imperative of joint and coalition warfare,and has so for a long time. Taking advantage of today’s modern information technology capabilities likezero trust, cloud computing, and ubiquitous internet access, military planners responsible for commandand control and information sharing can focus on building Cyber Lines of Communications. Managing
the temptation to control the entire portion of the cyber domain where friendly forces will operate canintroduce excessive risk and remove critical agility needed in an era of Great Power Competition. We havelearned much from past multinational contingencies, but perhaps the most critical lesson is how importantagility is to respond to threats across the entire spectrum of military operations. Zero trust is more than asecurity solution, it greatly enables connectivity on the battlefield and supports the challenge of building a
SABRE program that is secure, agile, and accessible.

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss
by securely connecting users, devices, and applications in any location. Distributed across more than 150 data
centers globally, the SSE-based Zero Trust Exchange is the world’s largest inline cloud security platform. Learn
more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134©2024 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,
ZIA™, Zscaler Private Access™, and ZPA™ areeither (i) registered trademarks or service marksor (ii) trademarks or service marks of Zscaler,Inc. in the United States and/or other countries.
Any other trademarks are the properties of theirrespective owners.

zscaler.com