Within the United States Air Force, the Civil Engineering Control Systems (CECS) program secures all the operational technology used by Air Force personnel and mission partners globally. Think: the industrial control systems that support data acquisition and processing; the automated fire suppression networks, the alarms and emergency response systems on bases; and the specialized control systems for airfield lighting, aircraft arresting systems, and fuel depot management.
In 2024, GDIT was chosen as the cybersecurity partner to continue securing nearly 30,000 OT devices, operating on more than 600 different systems at 188 sites around the world.
Challenge: Support Three Core Objectives
The team’s work involves supporting three critical objectives. The first involves providing a physical network environment for the Civil Engineering Community of Interest Network (CE COIN) so that mission partners can coexist on the Air Force network. Second, the team is also responsible for getting all CE COIN systems their own authorization to operate (ATO) accreditation. Third, the network must balance the need for cyber protection with the need for availability of critical infrastructure systems.
Approach: Combine Cybersecurity and OT Expertise, Partnerships, and Collaboration at Scale
Doing this work, doing it well and consistently across all three mission objectives demands both cybersecurity and operational technology expertise. It requires partnering with many internal and external stakeholders, and prioritizing collaboration at every turn.
Additionally, the complexities of the program mean that traditional cyber controls don’t necessarily apply, and a more bespoke approach is necessary. Here’s why: very often, operational technology systems are managed by operators with specific OT system expertise. Our approach brings together OT operators and cybersecurity professionals who understand the nuance of the unique OT system so that, together, they can work in partnership to deliver a zero trust for OT solution that ensures every OT device is functional, available, and secure. We have team members travel to field locations and help with everything from cyber hygiene to cyber readiness and risk management.
In a similar vein, when our team receives alerts from partners about potential vulnerabilities, we perform the analysis centrally and pass it out to the field. Driving further awareness, our Network Operations Center (NOC) continues to scan for vulnerabilities well after the initial alerts are shared, performing 24/7 incident monitoring and response. We also perform field training and assessments to ensure teams are able to act on alerts, respond quickly and remain both vigilant and resilient. Finally, we created a standardized ATO submission and tracking process across the base locations to create a consistent package, accelerate approval and shorten review cycles for the government. Ultimately, the ATO process identifies risk, surfaces opportunities for improvement, and establishes a stronger overall cybersecurity posture.
Impact: Thousands of Evaluations, Alerts and Testing Supporting Secure OT Systems and Devices Globally
To date, the team has evaluated thousands of threat notices, sent out hundreds of alerts from those notices, performed dozens of penetration tests, supported more than 460 ATOs and is in the process of helping the Air Force transition to the newest security control guidance for RMF (NIST SP 800-53 Rev 5). Taken together, these metrics represent secure devices, safeguarded systems and data and an enhanced overall security posture for the customer.
The volume of work and the execution of the mission was only made possible by the way in which the team recognized the inherent differences in securing operational technology versus traditional enterprise IT, the skillsets team members brought to bear, and the consistently collaborative way every contributor approached the work. Today, the team is continually reimagining new ways for the Air Force customer to protect national security and critical infrastructure, leading the charge to deliver zero trust for OT.