Case Study

Gigamon Adds Crucial
Network Visibility to
Zero Trust at theDepartment of Defense

Challenges• Zero Trust initiative lacked visibility across theentire network

The Gigamon platform enables us to• Vulnerable to lateral movement

feed all the different tool sets we have• Privilege escalation from adversaries

acquired and offers us X-ray capability,
not only in the physical world but also inthe virtual world.
DAVID JONES
Department of Defense

Customer Benefits• Brought full visibility across on-premises, virtual, andcloud networks• Reduced noise to allow for deeper analysis• Enabled intricate packet inspection to get to the rootof issues• Integrated tasks to boost overall efficiencySolution• GigaVUE-FM (fabric manager)• GigaVUE® V Series• GigaVUE HC Series• GigaVUE TA Series• GigaSMART® Application Metadata Intelligence• GigaVUE OS• GigaSMART Packet De-Duplication© 2024 Gigamon. All rights reserved.

1

CASE STUDY | DEPARTMENT OF DEFENSE

Addressing Network Vulnerabilities
at the Department of Defense
The problem all started in late 2018, when theDepartment of Defense (DoD) conducted anassessment on certain classified networks. They
discovered alarming shortcomings in both network
visibility and security.
“We’d known for years that the perimeter defense wasa bit aged,” says David Jones, Chief Architect for Zero
Trust Cloud, at the DoD. Security was based on when
the internet first started, and being able to defend it
was getting harder.”Of the shortcomings, three stood out:

Protecting the Crown Jewels: Data
David says that Zero Trust enables protection of anorganization’s crown jewels: the data. It lets you
switch from focusing on protecting network flows,
where you might trust things that shouldn’t betrusted. Instead, “With Zero Trust, we protect the dataand work outward from there to applications, servers
and networks.”
Starting in January 2019 and over several months, theteam worked on a prototype to demonstrate that a
Zero Trust Architecture could solve many of the DoD’s
network security challenges. “We wanted to create arudimentary Zero Trust environment that enabled us tosee what was going on in the network and respond inreal time versus just depending on logs,” he says.

• First, the network was vulnerable to lateral movement.
The agency needed to limit East-West traffic once
someone had gotten beyond the perimeter.
• Second was privilege escalation: People who didn’t
have privileges—including adversaries—weregarnering credentials and gaining access where
they shouldn’t.
• Third and most notable was the lack of visibility
across the physical, virtual, and cloud network.
“We didn’t have a global picture of what was goingon. During the assessment, we conducted tests
that should have—but didn’t—trip any alarms
because the visibility wasn’t there to sound thealarm,” David adds.

A Push Toward a Zero Trust
Architecture
In response to the discovery, the Defense Information
Systems Agency (DISA), United States Cyber
Command (USCYBERCOM) and National Security
Agency (NSA) joined forces to evaluate the potential ofmoving toward a Zero Trust Architecture to shore up
network security.

© 2024 Gigamon. All rights reserved.

A cybersecurity architecture based on
Zero Trust principles moves away from
implied trust based on network locationand perimeter-based security alone andinstead continuously evaluates trust
on a per-transaction basis to ensure
data is protected. This makes Zero Trust
particularly well-suited for defense andintelligence applications as users become
more geographically distributed and as
public cloud usage grows.

2

CASE STUDY | DEPARTMENT OF DEFENSE

Early Decision Not to Include Visibility
Threatened the ProjectAt first the implementation did not include Gigamon
visibility solutions, but midway through the teamdetermined that the Gigamon Deep Observability
Pipeline was critical to tie everything together andprovide crucial visibility into the physical, virtualized,and cloud environments.
“We ran a test and realized we couldn’t see certainevents because we’re weren’t inspecting the packets
going across the wire. At that point, phone calls were
made, and we brought Gigamon on,” he says.

Phase 1: The Visibility Implementation
The team and Gigamon started with the physicalnetwork, and as the project moved along, implemented
the virtual Software-Defined Networking (SDN)
environment, where they were able to leverage
GigaVUE-HC3 appliance to gain pervasive visibility into
both physical and virtual traffic. Gigamon controls anddecouples packet collection, aggregation, and deliveryof data to tools. This provides each tool or sensor withthe exact data needed, dramatically reducing tool loadand enhancing tool efficiency and scalability.

Smart cloudmonitoring

ToolToolThe Gigamon Deep Observability Pipeline gives
agencies adopting Zero Trust a single pane of glass tocollect, process and forward data to the policy engine
supporting their implementation, as depicted in Figure 1.

Added Benefit: Efficient Tools
By reducing irrelevant and duplicate packets, Gigamon
also brought new efficiency to the team’s networkand security monitoring tools. Greater efficiency isaccomplished by using GigaSMART® traffic intelligencecapabilities, such as De-duplication, SSL/TLS Decryption,
Packet Slicing, Application Metadata Intelligence, andApplication Filtering Intelligence, to generate efficientcustom data sets for tools and sensors.
“Being able to shrink the packets and metadata lets us
monitor more data because we’re giving tools exactly
what they need instead of the whole universe,” he says.
David further states that the tools not only performbetter because they’re no longer overstressed, but theyalso produce better data. “It’s almost like an efficiency
drill by getting rid of a lot of the waste,” he says. For tool
costs that are based upon consumption of data, thiscan produce significant cost savings and control for
operational budgets.

Tool

Tool

Tool

Tool

Visibility & Analytics FabricTechnology
Virtual machines

Platforms

Containers

AWS
Microsoft
Outposts Azure Stack

Kubernetes

Service mesh

Any physicalnetwork

Figure 1. G igamon technology and platform coverage© 2024 Gigamon. All rights reserved.

3

CASE STUDY | DEPARTMENT OF DEFENSE

Phase 2: Cloud Visibility
Following the success of the DoD physical deployment,a second project phase has extended the referencearchitecture to cloud platforms to support the next
generation of DoD IT initiatives.
Gigamon is playing a central role in this phase throughits ability to provide a unified view of activity acrosstraditional data centers, private cloud environments
and multi-provider public cloud deployments, as
shown in Figure 1. This approach aligns well withbroader DoD and IC security requirements, including
those outlined in the “DoD Cloud Computing Security
Requirements Guide.”

About Gigamon
Gigamon offers a deep observability pipeline thatharnesses actionable network-level intelligenceto amplify the power of observability tools. Thispowerful combination enables IT organisations toassure security and compliance governance, speed
root-cause analysis of performance bottlenecks, andlower operational overhead associated with managing
hybrid and multi-cloud IT infrastructures. The result:modern enterprises realize the full transformational
promise of the cloud. Gigamon serves more than 4,000
customers worldwide, including over 80 percent of
Fortune 100 enterprises, nine of the 10 largest mobile
network providers, and hundreds of governments andeducational organisations worldwide. To learn more,
please visit gigamon.com.

David’s Advice For a Successful
Zero Trust Rollout#1 Use universal visibility to truly know
your network
The biggest key to Zero Trust is understanding
what data you want to protect, where it’slocated and what data gets into your visibilitylayer. And only full visibility will tell you if you’re
successful at protecting access to your data.
In contrast, if you cannot see what’s going on,
you’ll be blindly applying security rules andwon’t know if they’re effective. Furthermore,
you don’t want service tickets to act as yourleading indicator of a problem. Instead, youneed to see problems before they arise to thelevel of a user problem.
#2. Work hard to change the culture
Equally important, you’ve got to work
continuously to your organization’s culture toembrace Zero Trust—including from the CTO’soffice. Zero Trust will bring difficult growing
pains, but if you get enough people onboard
at the beginning, it’s much easier.
“The new expectation is that everyone does
NOT need access to everything—even if you
are the CTO,” David says. “In the end, however,these rules benefit everyone.”Worldwide Headquarters
3300 Olcott Street, Santa Clara, CA 95054 USA+1 (408) 831-4000 | gigamon.com© 2020-2024 Gigamon. All rights reserved. Gigamon and Gigamon logos are trademarks of Gigamon in the United States and/or other countries.
Gigamon trademarks can be found at gigamon.com/legal-trademarks. All other trademarks are the trademarks of their respective owners. Gigamon
reserves the right to change, modify, transfer, or otherwise revise this publication without notice.
03.24_06© 2024 Gigamon. All rights reserved.

4