DIU awards prototype deals for next-generation defensive kits for Cybercom

The Defense Innovation Unit has issued contract awards to prototype the next generation of kits for U.S. Cyber Command’s defensive teams that are charged with protecting Pentagon networks.

Sealing Technologies — a Parsons company — World Wide Technology and Omni Federal were tapped to develop prototypes for the Joint Cyber Hunt Kit, self-contained “fly away” technology that provides a security operations center in a box, according to DIU and budget documentation.

DIU is running the acquisition on behalf of Cybercom.

The effort is significant because the new kits will, for the first time, create a baseline standard for the gear cyber protection teams use for both the traditional defensive missions of the network as well as hunt-forward operations performed by the Cyber National Mission Force, Cybercom’s elite unit tasked with protecting the nation against significant digital threats. Hunt-forward operations, conceptualized over five years ago, involve physically sending defensively oriented CPTs to foreign countries to hunt for threats on their networks at the invitation of host nations.

Since Cybercom’s inception, there has never been a standardized defensive cyber kit for cyber protection teams — groups that hunt for malicious activity on Pentagon networks and respond to incidents — despite efforts in the past to create them. Those systems, referred to as Deployable Mission Support Systems (DMSS), varied across all the services.

Cybercom’s forces are constructed such that each of the services are responsible for providing a set number of offensive and defensive teams to the command to conduct operations. In many cases, the kits across each service varied despite cyber protection teams being largely trained to the same missions and standards, albeit with some variation.

As currently planned, the JCHK kits will provide a baseline of standardization across all the types of defensive CPTs, but offer a level of customization and tailoring for specific purposes and missions.

“The big thing is that flexibility and that modularity and the scalability, just to have the ability to tailor what they’re taking to the mission at hand. Whether that mission is going out and doing a vulnerability assessment or whether it’s a onboard mission where you’re looking for bad guys on an active network, being able to dial your kit into exactly what you’re going to do just makes things much easier and the outcomes from the missions are much better,” Brad Hatcher, chief product officer for SealingTech, said in an interview. “Sometimes what they need might be constrained by their space and how many people they can take to a location. Sometimes it will be more driven by the size and the volume of a network. And we build a kit that lets them tailor it specifically to each mission and take what they need and get there quick and do their mission and report back.”

According to budget documents, the forthcoming JCHK kits will be used by CPTs to secure and protect DOD networks and data centers by hunting, clearing and assessing in friendly, neutral and adversary cyberspace.

“Definitely a step forward in that it’s the latest and greatest technologies that we can put into a kit to run their missions faster to give them the ability to pull in more data, do more analytics — bigger, better everything than previous versions,” Hatcher said. “One of the bigger requirements and what can often be a limitation is the storage space that you’ve got. You’re hooking these kits up to networks and you’re trying to pull in all the traffic that’s flowing across that network to do analysis, to see what should be there, what looks odd. And those bigger storage capacities really allow the teams to really get in there and analyze as much as possible to find any anomaly on a network.”

Omni Federal’s offering, dubbed REDHOUND, provides proactive threat detection, comprehensive network analysis, threat intelligence integration, scalable investigation tools, incident response support and behavioral monitoring. The technology also boasts fast speeds leveraging a modular ARM processor architecture augmented with NVIDIA GPUs for low power for high compute in edge environments to provide flexibility, the company said in a statement.

The companies that were awarded deals will develop their prototypes between now and this summer. They’ll be tested in a lab-based environment with actual users for a period of time, and the government will eventually select one vendor to move on to the next phase of the program.