P2-SARLACC: Software Automation, Resolution, Logistics and Containers Cross-Domain

This proposal addresses USAF needs to streamline software logistics and improve cyber posture by automating delivery of continuously assured source code (e.g. for DCCSCR) and containerized binaries Cross Domain with end-to-end traceability and audit. Ion Channel can deliver live-state assurance and continuously updated (and remediated) software components and containerized applications for Air Force applications, regardless of the fabric in which those applications are developed (low side, Secret, Top Secret, compartmented). Software Bills of Materials are generated and delivered with all transfers. This capability will enhance cross-domain situational awareness of software supply chain risk, cyber hygiene and supplier risk on a continuous basis and will automate verifiable delivery of containerized applications with full chain of custody, tamper-proofing and continuous assurance. Auditability of this data enables (and can automate) enforcement of security SLA requirements for development that occurs on a different fabric than deployment. Ion Channel’s continuous out-of-band upstream monitoring measures the time interval from when a containerized capability becomes vulnerable to when a supplier pushes a remediated update. This allows customers to quantify time-to-remediation and differentiate security responsiveness as a quantified performance metric for software suppliers. On an engineering level, technical extension of Ion Channel’s current payload types to include software containers has been demonstrated for COTS capabilities and will enhance existing Air Force assurance methods (e.g. CVE detection) to include continuous monitoring of open source supplier and ecosystem risk. Scheduled or event-driven transfer of machine-readable assurance data along the same vector as the container transfer ensures that security-relevant analysis stays current (i.e. daily) to maintain continuous authorization. Beyond technology extension, a cross domain container transfer capability requires an adaptation in business process that Ion Channel is ready to enable. To automate workflows outside of the development/deployment cycle, software logistics data (including software telemetry and transfer records) must be accessible to audit, security and software life cycle management. Ion Channel’s fully open, portable and machine-readable data can be freely ingested by automated processes and third-party platforms to accelerate audit, security and SAM workflows, as well as life cycle management and SCRM that includes supplier risk. Ion Channel transfer and assurance data is fully portable, API-accessible, and there are no seat licensing constraints on utilization. Ion Channel’s logistics automation methods enables automated detection and cross domain transfer of supplier risk indicators, risky patterns of maintenance and change in control of open source components and inclusion of these metrics in machine-readable assurance data for SCRM.