Khung chính sách DoD (DoD Cybersecurity Policy Framework)
Bộ Quốc phòng Mỹ (Department of Defense - DoD) vận hành một trong những môi trường mạng phức tạp, quy mô lớn và bị tấn công nhiều nhất thế giới. Khung chính sách được xây dựng trên:
- DoD Instruction (DoDI) 8500.01 "Cybersecurity" – Chính sách cấp cao (Chief Information Officer - CIO DoD ký).
- DoD Instruction (DoDI) 8510.01 "Risk Management Framework (RMF) for DoD Systems" – Quy trình ATO (Authorization to Operate) cho mọi hệ thống thông tin (IS) & Platform IT (PIT).
- CNSSI (Committee on National Security Systems Instruction) 1253 – Security Categorization & Control Selection cho National Security Systems (NSS).
- NIST SP 800-53 Rev 5 (Security & Privacy Controls) – Bộ điều khiển (Control Baseline) bắt buộc: Low / Moderate / High Impact.
- DoD SRG (Security Requirements Guides) / STIGs (Security Technical Implementation Guides) – Cấu hình bảo mật chi tiết cho từng sản phẩm (Windows, Linux, Cisco, Oracle, Kubernetes, Database, Cloud...).
Ba sứ mệnh mạng DoD (DoD Cyber Strategy 2023)
- Defend the DoD Information Network (DoDIN): Bảo vệ mạng, hệ thống, dữ liệu DoD – Continuous Monitoring, Threat Hunting, Active Defense.
- Defend the Homeland & U.S. Critical Infrastructure: Hỗ trợ DHS/FBI/USCYBERCOM phòng chống tấn công quốc gia (Critical Infrastructure: Energy, Water, Transport, Finance, Health).
- Prepare for Cyber Operations in Conflict: Phát triển năng lực Offensive/Defensive Cyberspace Operations (OCO/DCO) hỗ trợ Joint Force.
Mô hình không gian mạng DoD (DoD Cyberspace Model)
DoD định nghĩa Cyberspace gồm 3 tầng:
- Physical Layer: Hardware, cáp, vệ tinh, spectrum, data center, sensor.
- Logical Layer: IP routing, DNS, BGP, PKI, Directory, Virtualization, SDN, Cloud Control Plane.
- Cyber-Persona Layer: Identity, Credential, Access Management (ICAM), Role, Attribute, Mission Thread.
DoDIN (DoD Information Network) – Mạng lưới trung tâm
- DISN (Defense Information Systems Network): Backbone toàn cầu (SIPRNet, NIPRNet, JWICS, GWAN, CPN) – do DISA vận hành.
- SIPRNet (Secret Internet Protocol Router Network): Mạng mật級 SECRET.
- NIPRNet (Non-classified IP Router Network): Mạng UNCLASSIFIED (nhưng敏感).
- JWICS (Joint Worldwide Intelligence Communications System): Mạng TOP SECRET/SCI.
- Zero Trust Architecture (DoD ZT Reference Architecture v2.0): 7 Pillars (User, Device, Network, Application, Data, Visibility/Analytics, Automation) + 45 Capabilities.
RMF (Risk Management Framework) – Quy trình ATO 7 bước
- Prepare (Chuẩn bị): Org-level risk management, common controls, authorization boundary.
- Categorize (Phân loại): FIPS 199 / CNSSI 1253 → Low / Moderate / High Impact (Confidentiality, Integrity, Availability).
- Select (Chọn control): NIST 800-53 Rev 5 Baseline + Overlays (Cloud, IoT, PIT, Cross Domain, Space...).
- Implement (Triển khai): STIGs, Hardening Guides, IaC, DevSecOps Pipeline.
- Assess (Đánh giá): Independent Assessor (SCA) – Security Control Assessment (SCA Report), POA&M (Plan of Action & Milestones).
- Authorize (Chấp thuận): Authorizing Official (AO) ký ATO (Interim, Full, Denied) – Accept Risk.
- Monitor (Giám sát liên tục): Continuous Monitoring (ConMon) – CDM (Continuous Diagnostics & Mitigation), SIEM, SCAP, STIG Compliance Scan hàng tháng/quý.
Các yêu cầu kỹ thuật đặc thù DoD
| Yêu cầu | Chi tiết |
|---|---|
| PKI / CAC / PIV | Common Access Card (CAC) / Personal Identity Verification (PIV) – 2-factor (Cert + PIN) cho mọi user/device. DoD PKI Root CA. |
| Host-Based Security System (HBSS) / Endpoint Security | McAfee/Trellix HBSS (legacy) → chuyển sang Microsoft Defender for Endpoint / CrowdStrike / Tanium – EDR, HIPS, FIM, App Control. |
| Network Segmentation & Cross Domain Solutions (CDS) | High-assurance Guard (Radiant Mercury, Owl, Nexor) cho transfer giữa NIPR↔SIPR↔JWICS. Data Diode cho one-way. |
| Encryption Standards | NSA Suite B / CNSA 2.0: AES-256, SHA-384, ECDSA P-384, ECDH P-384, RSA-3072+. Quantum-resistant (PQC) roadmap. |
| Software Assurance / Supply Chain | SBOM (SPDX/CycloneDX), SLSA Level 3+, Binary Provenance (Sigstore/Cosign), CMMC 2.0 Level 2/3 cho DIB (Defense Industrial Base). |
| Cloud (DoD Enterprise Cloud - DEOS, JWCC, MilCloud 2.0) | FedRAMP High + DoD SRG/STIG overlay. IL4/IL5/IL6 Authorization. Iron Bank (Hardened Container Registry). |
CMMC (Cybersecurity Maturity Model Certification) – Dành cho nhà thầu (DIB)
- Level 1 (Foundational): 17 practices (FAR 52.204-21) – Self-assessment.
- Level 2 (Advanced): 110 practices (NIST 800-171 Rev 2) – Third-party assessment (C3PAO) cho CUI.
- Level 3 (Expert): 110+ practices (NIST 800-172) – Government-led assessment cho high-value programs.
Tài nguyên tham chiếu chính thức
- DoD Cyber Exchange (public.cyber.mil) – STIGs, SRGs, Policy, Tools.
- DoD CIO Policies – DoDI 8500.01, 8510.01, 8520.01 (Cloud), 8530.01 (Comms).
- NIST Cybersecurity Resource Center – SP 800-53, 800-171, 800-37 (RMF), 800-207 (Zero Trust).
- DISA (Defense Information Systems Agency) – DISN, DEOS, Comply-to-Connect, Zero Trust PF.