Defending those who defend us

Advancing national and agency security with zero trust

Modern military operations are more advanced and sophisticated than ever. While high-ranking defense officials strategize how best to neutralize threats to national security from abroad, the respective branches under their command must deal with unprecedented challenges in their everyday cyber, data collection and analytics, enterprise IT, and software engineering operations.

For more than 50 years, ManTech has provided advanced mission-focused technology solutions — from cybersecurity and secure mission IT to advanced analytics and missions operations — and services for federal intelligence, federal civilian, and defense agencies. But protecting the systems and information the military needs to protect the nation demands advanced tools and protocols.

“We played a key role in the DoD’s Zero Trust Reference Architecture and helping federal agencies implement the President’s Cybersecurity Executive Order,” says Robert Lara, Technical Director of Cybersecurity Programs for ManTech. “Secrets management is a huge part of an effective zero trust environment and doing it manually just isn’t effective for doing it at scale.”

Modernized security posture to protect high-value targets

Things change quickly in the defense space, meaning they have to move quickly in tech, too. ManTech saw a lot of core infrastructure changes in the market — the systems in use and how users’ access impacted security postures — due to natural evolution and from outside influences like the war in Ukraine as well as a sharp rise in nation-state cyber warfare.

“Given our focus on DoD and Intelligence agencies, the types of information we deal with are among the most sensitive and high-value around, but our previous processes for securing access were built around manually managing certificates and copying and pasting keys from one system to another,” Lara says. “With just a small central DevOps team manually managing secrets and these processes, we felt like we would be unnecessarily inviting risk continuing this way as our team and business expanded.”

Lara and his colleagues, including Automation Engineer Benjamin Lara, wanted to both improve the company’s — and by extension, its clients’ — security posture while also modernizing its core operations to align with rapidly changing market demands.

That was especially important as ManTech began building out its microservices app, which had to integrate with many systems that each had to authenticate via a unique ID that was manually managed in Kubernetes and required an operator to continuously update tokens. And, as a DevOps-first organization, ManTech needed a DevOps-friendly approach for identity-driven privileged access to machines that could both create credentials while avoiding exposing secrets.

After a thorough search for a secrets management solution, ManTech adopted HashiCorp Vault, alongside HashiCorp Boundary, because of the cloud-agnostic solutions’ unique and expansive automation capabilities. Unlike other solutions that require extensive manual copy/paste inputs and depend on security information and event management (SIEM) tools for log visibility, HashiCorp solutions tackle each operation without manual intervention.

With Vault, developers follow a dedicated path for securely deploying both infrastructure and content. Using security as code accelerates end users gaining access to the resources they need all within the confines of a security audit apparatus.

Automated database credential rotation significantly mitigates the cyber threat from stolen keys by automatically creating, rotating, and revoking database credentials through an automated workflow and API. At the same time, Boundary’s automated access management uses granular, logical roles and services to enable access to applications and critical systems without the need to manage credentials or expose the network.

“Ultimately, we wanted security baked right into all of our processes from the very beginning for simplicity and enhanced protection,” Benjamin Lara says. “Along with policy-driven infrastructure through Terraform, Vault automatically rotates credentials instead of forcing users to store information locally and risk inadvertent exposure. Add in Boundary for standardizing language and protocols for accessing infrastructure and services across our environment, and it creates an end-to-end security posture in line with our zero trust charter.”

ManTech uses HashiCorp Terraform, Vault, and Boundary to securely and automatically provision essential digital infrastructure, manage essential keys and secrets, apply granular role-based access, and accelerate service and product delivery within a zero trust environment.