Introduction to Platform One

Platform One: DoD Enterprise DevSecOps Services is a program offered by the U.S. Department of Defense (DoD) to provide enterprise-level development, security, and operations (DevSecOps) services to its various agencies and partners. The goal of the program is to streamline the process of developing, deploying, and maintaining software and other digital assets within the DoD.

The Iron Bank

Iron Bank is a groundbreaking central repository of digitally-signed container images, including open-source and commercial off-the-shelf software, hardened to the DoD’s exacting specifications. Approved containers in Iron Bank have DoD-wide reciprocity across all classifications, accelerating down to weeks a security process that can otherwise take months or even years. The Iron Bank container repository is the DoD-wide container repository, a product of DoD’s Platform One, the first DoD enterprise DevSecOps managed service. Iron Bank containers are an integral part of Big Bang, Platform One’s DevSecOps platform.

To be considered for inclusion into Iron Bank, container images must meet rigorous DoD software security standards. It is an extensive, continuous, complicated effort for even the most sophisticated IT teams. Continuously maintaining and managing hardening pipelines while incorporating evolving DoD specifications and addressing new vulnerabilities (CVEs) can severely stretch your resources, even if you have advanced tooling and experience in-house.

Tetrate First to Provide Hardened Istio to DoD’s Iron Bank

Game of Thrones fans know the Iron Bank as a lender to governments, businesses, and individuals across the known world. But Iron Bank is also the repository for digitally signed container images that are accredited for use across the US Department of Defense. Iron Bank software is accessible to anyo…

TetrateFloyd

While inclusion in Iron Bank will enable your sales team to get tremendous exposure within the DoD userbase and beyond, getting the first version completely through the process is where most product companies struggle.

NGINX Plus Authorized by U.S. Department of Defense’s Iron Bank

It was recently confirmed by the U.S. Department of Defense (DoD) that NGINX Plus has received formal authorization from the DoD’s Enterprise DevSecOps Initiative, Iron Bank. This gives DoD teams expanded capabilities as part of a verified digital infrastructure, while also signaling the company’s g…

F5

https://oteemo.com/oteemo-helped-saas-achieve-fedramp-ato/

Agile Development and Continuous Integration and Delivery (CI/CD)

In order to achieve this goal, Platform One provides a range of services including agile development methodologies, continuous integration and delivery (CI/CD), and secure code development practices. It also offers a range of tools and technologies to support these services, including cloud-based infrastructure, containerization, and automation.

Secure Code Development Practices

The Platform One program is designed to support the DoD's overall mission of providing the best possible support to its personnel and partners and to help the organization keep pace with the rapid evolution of technology and software development practices.

English (US)

F5 application services ensure that applications are always secure and perform the way they should—in any environment and on any device.

F5

The program is designed to provide a range of services and support to the various agencies and partners within the DoD, including the military branches, civilian agencies, and contractors.

• One of the key goals of the program is to streamline the development and deployment process for software and other digital assets within the DoD. This includes implementing agile development methodologies, which emphasize rapid iteration and delivery, as well as continuous integration and delivery (CI/CD) practices, which allow for the rapid and reliable deployment of code changes.
• In addition to supporting the development process, the Platform One program also focuses on ensuring the security and stability of the DoD's digital assets. This includes implementing secure code development practices, such as static and dynamic testing, and using tools and technologies like containerization and cloud-based infrastructure to improve security and scalability.
• The Platform One program also provides a range of tools and technologies to support its services, including cloud-based infrastructure, automation tools, and containerization technologies like Docker and Kubernetes. These tools and technologies are designed to help the DoD quickly and reliably deploy and manage software and other digital assets.

https://oteemo.com/how-devsecops-transforms-organizations/

Tools and Technologies for DevSecOps

Tools and technologies that may be used as part of the Platform One: DoD Enterprise DevSecOps Services program, along with short descriptions of their purpose and functionality:

• Cloud-based infrastructure: This refers to the use of cloud computing platforms like Amazon Web Services (AWS), Microsoft Azure, or Google Cloud to host and manage software and other digital assets. The cloud-based infrastructure allows for greater scalability, flexibility, and security compared to traditional on-premises infrastructure.
• Automation tools: Automation tools are used to automate various tasks and processes within the software development and deployment lifecycle. Examples of automation tools include continuous integration servers like Jenkins, configuration management tools like Ansible, and build automation tools like Gradle.
• Containerization technologies: Containerization technologies like Docker and Kubernetes allow for the creation and management of lightweight, portable containers that can be easily deployed and scaled across multiple environments. These technologies can be used to improve the security and stability of the software and other digital assets and make it easier to deploy and manage applications in the cloud or on-premises.
• Static testing tools: Static testing tools are used to analyze the source code of a software application without actually executing it. These tools can identify potential security vulnerabilities or other issues in the code that may need to be addressed before the application is deployed.
• Dynamic testing tools: Dynamic testing tools, also known as runtime testing tools, analyze the behavior of a software application while it is running. These tools can identify issues like memory leaks or performance bottlenecks that may not be detectable through static testing.
• Monitoring and logging tools: Monitoring and logging tools are used to track the performance and availability of software and other digital assets. These tools can generate alerts when issues arise, and provide detailed logs and metrics for troubleshooting and analysis.

These are just a few examples of the types of tools and technologies that may be used as part of the Platform One program. The specific tools and technologies used may vary depending on the needs and goals of the organization.

Conclusion: The Benefits of Platform One for the DoD

The goal of the Platform One program is to provide the DoD with the tools, technologies, and expertise it needs to effectively develop, deploy, and maintain software and other digital assets in support of its mission.