Department of the Air Force

I n t e g r i t y - S e r v i c e - E x c e l l e n c e

1

DoD Enterprise DevSecOps Initiative

& Platform One 

Keynote Presentation

Mr. Nicolas Chaillan

Chief Software Officer, U.S. Air Force

Co-Lead, DoD Enterprise DevSecOps Initiative

Chair, DSAWG DevSecOps Subgroup

V2.0 – UNCLASSIFIED
I n t e g r i t y - S e r v i c e - E x c e l l e n c e

CSO Website – Continuously Updated!

n Want to find information about the DevSecOps initiative and the CSO?

n Our latest documents/videos: https://software.af.mil/dsop/documents/

n Our latest training videos/content at: https://software.af.mil/training/

n Platform One Services: https://software.af.mil/dsop/services/

n More information about :

n Platform One On Boarding: https://software.af.mil/team/platformone/

n Cloud One: https://software.af.mil/team/cloud-one/

n Repo One: https://repo1.dsop.io

n Iron Bank: https://ironbank.dsop.io

n Registry One: https://registry1.dsop.io

n DevStar: https://software.af.mil/dsop/dsop-devstar/

n Our Events/News: https://software.af.mil/events/

2
I n t e g r i t y - S e r v i c e - E x c e l l e n c e

Why Kubernetes / Containers?

n One of the most critical aspect of the DevSecOps initiative is to ensure we avoid any vendor lock-in so the DoD mandated:

n Open Container Initiative (OCI) containers (no lock-in to containers/container runtimes/builders)

n Cloud Native Computing Foundation (CNCF) Kubernetes compliant cluster for container orchestration, no lock-in to 

orchestration options/networking/storage APIs.

n Containers are immutable and will allow the DoD to centrally accredit and harden containers (FOSS, COTS, GOTS) (think of a true 

gold disk concept but that actually scale and works).

n Continuous Monitoring is a critical piece of our Continuous ATO model and the Sidecar Container Security Stack (SCSS) brings those 

capabilities with Behavior, Zero Trust and CVE scanning.

n Kubernetes will provide:

n Resiliency: Self-healing so containers that crash can automatically be restarted,

n Baked-in security: thanks to automatic injection of our Sidecar Container Security Stack (SCSS) to any K8S cluster with Zero 

Trust,

n Adaptability: containers are “Lego” blocks and can be swapped with no downtime thanks to load balancing and modern routing 

(A/B testing, canary release etc.),

n Automation: thanks to our Infrastructure as Code (IaC) and GitOps model,

n Auto-scaling: if load requires more of the same container, K8S will automatically scale based on compute/memory needs,

n Abstraction layer: ensure we don’t get locked-in to Cloud APIs or to a specific platform as K8S is managed by CNCF and 

dozens of products are compliant with its requirements.

3
I n t e g r i t y - S e r v i c e - E x c e l l e n c e

Cloud Native Access Point

n Provided by a managed service by Platform One.

n Brings a full Zero Trust stack enforcing device state, user RBAC and Software Defined Perimeter/Networks based on 

Google BeyondCorp concepts

n Allows access to Cloud One (AWS GovCloud and soon Azure Government) and Platform One without having to go 

through the DISN/DoDIN

n Allows access from thick clients on BYOD, government owned devices (both mobile and desktop) while enforcing 

their device states by using AppGate as a zero trust client.

n Allows for VDI options for zero / thin clients

n Enables internet egress at IL5 in Dev enclaves

n Brings DMZ/Perimeter stack with break and inspect, IDS/IPS, WAF capability, full packet capture as an elastic Cloud 

based stack

n Brings Single Sign On with various DoD PKI options and IL2 MFA options.

n Centralizes/Aggregates logs and pushes to CSSP

4
SDP VPC

Mmgt. VPC

Public Services VPC

Teradici PCoIP •Adheres to RBAC

•Utilizes PCoIP protocol to prevent 

data exfil capabilities

Keycloak (SSO)

•Provides Single-Sign On (SSO)

•SAML, OpenID, Oauth

•LDAP / AD Integration with 

Internal and External Identity 

Providers

•MFA Auth 

JAMF (Policy)

•Provides OS X / 

IOS Policy 

Enforcement

SAML

External Identity Providers

Active Directory

•Identity provider for SSO

IDAM VPC VDI VPC

Zero Client / Thin Client

• No AppGate Client, no C2C

•MFA to VDI via DoD PKI, CAC, 

ECA, PIV-I

Dev VPCs Dev VPCs Dev VPCs

Cloud

Services

Container 

Orchestration

DevSecOps 

Pipelines

Central 

Services

Dev VPCs Dev VPCs Test VPCs

Cloud

Services

Container 

Orchestration

DevSecOps 

Pipelines

Central 

Services

Dev VPCs Dev VPCs Staging VPCs

Cloud

Services

Container 

Orchestration

DevSecOps 

Pipelines

Central 

Services

Dev VPCs Dev VPCs Prod VPCs

Cloud

Services

Container 

Orchestration

DevSecOps 

Pipelines

Central 

Services

CAP / IAP / BCAP

•Used as last resort only

•GitOps and CaC should be 

leveraged to push from 

Dev/Test to Staging/Prod

HTTPS/443 by default

Any Endpoint for Chat only

Mattermost

Management Tools

•Logging (EFK stack)

•SIEM

•Scanning

•Configuration Management

•Administrative Tools

Ingress VPC

AWS GovCloud & Azure Government

Egress VPC

Interface Traffic Mirror

Internet

HTTPS & HTTP by default Port 443 & 80

•Egress for Dev VPCs and resources

•Egress for Thick Endpoints / Mobile 

clients connected to AppGate VPN

•Used to pull software updates and 

patches

Log Data – aggregated to EFK stack 

Management VPC for all VPCs 

throughout CNAP

Break / 

Inspect TLS

Break / 

Inspect TLS

C5ISR CSSP VPCs

• Vulnerability Scanning

• Configuration Management

• Incident Management & Response

• User Monitoring / Insider Threat

• Intrusion Prevention / Detection

• Log Aggregation, Analysis, & 

NOC/SOC

• INFOCON / CPCON Notification

Egress Palo Alto

•Border firewall protection

•Layer 1-7 security

•Break & inspect TLS

•Only egress for internet traffic

HTTPS

Port 443

HTTPS

Port 443

Internet

Thick Endpoints / Mobile 

•Comply2Connect enforced on 

required endpoints for VPN 

connectivity. Endpoint origins such as 

DoDIN can be whitelisted from C2C.

•MFA via DoD PKI, CAC, ECA, PIV-I, etc.

Ingress Palo Alto

•Border firewall protection

•Layer 1-7 security

•Break & inspect TLS for non 

AppGate destined traffic

•L7 WAF-like functionality to 

detect protocol anomalies 

and vulnerability exploits

•Only ingress point for CNAP 

access

HTTPS

Port 443

HTTPS/443 

PCoIP Port 4172

• All elements of the CNAP are 

monitored and controlled by CSSP 

services

• TLS break & inspect at both Palo Altos, 

(ingress and egress) with logs 

forwarding to CSSP

• Full log aggregation throughout all 

elements of DAP stack using Fluentd

• Integrated with elements of C5ISR 

CSSP capability

LDAPS

Port 636

HTTPS

Port 443

HTTPS/443

Internet Egress for Thick & Mobile Endpoint

HTTP/80 HTTPS/443 by default

Zeek

•Network intrusion detection 

for Dev egress

•Live analysis of network events

•Custom alerting to network 

activities

•Enables full packet capture

HTTPS

Port 443

AppGate (SDP VPN)

•Zero Trust VPN

•Micro-segmentation of resources

•Enforces Comply2Connect 

•Utilizes RBAC for access

•Provides mTLS tunnel

•Outbound traffic mirrored to Zeek

Cloud Native Access Point

(CNAP)

Zeek SSO HTTPS

Port 443 • Network intrusion detection 

for CNAP Ingress

• Live analysis of network 

events

• Custom alerting to network 

activities

• Enables full packet capture

HTTP/80 HTTPS/443 by default
I n t e g r i t y - S e r v i c e - E x c e l l e n c e

Service Mesh (ISTIO)

6

n Turnkey Service Mesh (ISTIO) architecture

n ISTIO side car proxy, baked-in security, with 

visibility across containers, by default, without 

any developer interaction or code change

n Benefits:

n API Management, service discovery, 

authentication...

n Dynamic request routing for A/B testing, 

gradual rollouts, canary releases, 

resilience, observability, retries, circuit 

breakers and fault injection

n Layer 7 Load balancing

n Zero Trust model: East/West Traffic 

Whitelisting, ACL, RBAC...

n TLS encryption by default, Key 

management, signing...
I n t e g r i t y - S e r v i c e - E x c e l l e n c e

“Infrastructure as Code” 

Benefits

The “Infrastructure as Code” concept is a critical DevSecOps ingredient to ensure that production 

environments do not drift from development/testing environments. No human should make changes 

in production environments. Changes should only be made in source code and redeployed by the 

CI/CD pipeline. 

n No drift between environments, whether classified/disconnected/Cloud/on-premise,

n Immutable,

n Replicable, 

n Automated,

n No human in production environments: reduces attack surface (disable SSH etc.), insider threat 

and configuration drifts,

n Everything is code: including playbooks, networking, tests, configuration etc. 

7
I n t e g r i t y - S e r v i c e - E x c e l l e n c e

What is GitOps?

n Based on Infrastructure as Code concepts, makes Git the single source of truth of the desired 

state of your Infrastructure, Platform and Applications.

n Benefits:

n Everything is code: infrastructure, networking, configuration, sealed secrets etc.

n Auditability & Compliance

n Consistent deployments and rollback (no drifts between environment)

n Configuration Management enforcement

n Disaster Recovery

n Baked-in security: Kubernetes clusters pulls from Git. CI/CD won’t have access to 

production clusters. Removing human from production environments

n Declarative manifests and playbooks

n Options:

n Argo CD, Flux as FOSS. Projects are merging into a single FOSS and be part of CNCF.

8
Continuous Authorization

9

System Development and Testing Assess System’s 

Security Controls

Authorize 

System Operate System

Traditional Authorization Approach

Continuous Authorization Approach

Authorize System

Authorize Platform, Process, Team

Authorize the 

DevSecOps Process

Authorize the Platform Authorize the Team

Teams that 

Run the 

Platform

Teams that Create, 

Build, Secure and 

Operate the Software 

Product

cATO –Continuously Pen Test, SAST/DAST testing, Continuously Manage Risk, Continuous Monitoring, 

Continuous Security Control Validation, Continuous Risk Determination, & Continuous Reporting

Deployment Frequency: 30-180 days 

Lead Time for Changes: 30-180 days

Time to Restore Service: 7-30 days

Change Failure Rate: 46-60%

Deployment Frequency: Multiple/day

Lead Time for Changes: < 1 day

Time to Restore Service: < 1 hour

Change Failure Rate: 0-15%

Industry Average Performance*

(Traditional Development Approach)

cATO Performance Targets*

(Industry Elite DevSecOps Performance)

*DORA Accelerate State of DevOps Report, 

https://services.google.com/fh/files/misc/stat

e-of-devops-2019.pdf
Continuous Authorization: Overview

10

1: 2: 3:
11

Continuous Risk Monitoring 

Continuous Risk Determination 

• Key points:

• Move away from snapshot in time towards auto-generated content displayed in a 

dashboard showing risk posture in real-time

• Extensive utilization of SW reuse, reciprocity, & inheritance from underlying 

infrastructure, platform, SW Factory, and authorized-to-use functional components

• CI/CD security findings that exceed the risk threshold trigger an event to involve 

ISSM, assessor or AO then put on the backlog for remediation scheduling in future 

sprint

• Continuous validation of security configuration hardening and implementation of 

controls

• Use of IaC to create a consistent, secure, and repeatable instance of application 

support infrastructure

• Execution of SW Product within a secure authorized Platform based on the DoD CIO 

Enterprise DevSecOps Reference Design

Through the execution of these practices, the SW Product has been through an 

automatic risk determination based on the AO’s prescribed risk tolerance resulting 

in the SW Product automatically authorized for use

Result: continuous risk analysis, risk determination, and authorization 

control gates risk tolerance checks

Security Posture Visualization
I n t e g r i t y - S e r v i c e - E x c e l l e n c e

CSO Website – Continuously Updated!

n Want to find information about the DevSecOps initiative and the CSO?

n Our latest documents/videos: https://software.af.mil/dsop/documents/

n Our latest training videos/content at: https://software.af.mil/training/

n Platform One Services: https://software.af.mil/dsop/services/

n More information about :

n Platform One On Boarding: https://software.af.mil/team/platformone/

n Cloud One: https://software.af.mil/team/cloud-one/

n Repo One: https://repo1.dsop.io

n Iron Bank: https://ironbank.dsop.io

n Registry One: https://registry1.dsop.io

n DevStar: https://software.af.mil/dsop/dsop-devstar/

n Our Events/News: https://software.af.mil/events/

12
I n t e g r i t y - S e r v i c e - E x c e l l e n c e

Thank You!

Nicolas Chaillan

Chief Software Officer, U.S. Air Force

af.cso@us.af.mil – https://software.af.mil