Skip to content
cairnenclaveIL5 and below · National security
Menu
HomeMethodWorkbench

Access plane · how people arrive

Your people need a way in. Thunderdome is that path — without the mission owning the network.

For sponsors still running on-prem: this is how testers and operators reach the environment cleanly. It accelerates arrival. It does not replace your landing zone, your hygiene work, or the AO’s decision.

Security permit

Brokered decision. Distributed attributes.

Security permit flow · four gates, then PDP / PEP
  1. Gate 1 · CFTIATT / ATO on the LZ
  2. Gate 2 · catalogApp is published
  3. Gate 3 · ThunderdomeUser + device at the edge
  4. Gate 4 · CFTLZ accepts the permit

Then the session

  1. MissionUserCAC / PIV
  2. MissionDeviceC2C · EDR
  3. SessionContextwhere · what
  4. DISA ICAMPersonsource of truth

2 · Decision (brokered · Thunderdome PDP)

  1. CatalogPublished?APP-1
  2. ThunderdomeEvaluateuser + device + app
  3. PermitIssue
    DenyStop

3 · Enforcement (PEP · landing zone accepts)

  1. Prisma AccessAllowedUser-ID · App-ID
  2. TunnelConnectorVM appliance · SNAT
  3. Mission appPath onlySG = connector

Residual — not on this path: PAM / TCCM · CMK · SCCA · ATO · IL of data at rest

ICAM is the person. Entra is a relying party. Not a second source of truth.
DISA ICAMThe personAuthoritative identity. CAC/PIV. Active or not. Thunderdome evaluates this before any tunnel.
ThunderdomeMay arriveIf ICAM says no — disabled, revoked, no CAC — the session never hits the connector. That is the edge PDP.
Mission Entra / IAM ICMay useFederated relying party. Trusts ICAM's signed assertion. Local groups and app roles still live here. Stale, cloud-only, or disabled local accounts are a second deny — or a second door if you left them as production. Federation is not automatic sync of 'active.'
How the app binds the permit · three mechanisms, not a token the app verifies
ZTNA Connector · PEPThe app trusts the pathPermit is decided at Thunderdome (Prisma Access): User-ID, App-ID, Device-ID, deny by default. If allowed, traffic rides an automated tunnel to the connector in the IL VPC/VNet. Connector SNATs. Security groups: connector only. The app never sees a permit object — it only sees private traffic from the PEP. That is the integration.
SAML / OIDC · relying partyThe app trusts the personSeparate from the path. AWS IAM Identity Center / Azure Entra / the app validates a signed assertion from ICAM (signature, audience, expiry). That is how the workload knows who. It is not how ZTNA opens the port. No active identity — disabled, missing, wrong role — the app denies even if Thunderdome already permitted the path.
SCP / Azure Policy · IaCThe LZ refuses every other user pathNo 0.0.0.0/0, no public user ingress, no IAM user as production. If path-trust is the permit, a second door makes the permit theater. This is Gate 4.
Same tunnel. Identity is wired, or the user is SNAT — masked.

Bespoke three-tier · LAMP

  1. 1 · PathTunnel only
  2. 2 · IdentityThe person
  3. No active IDApp denies

Connector → SG on the web tier. Apache never sees a permit object. SAML/OIDC in front of the stack (oauth2_proxy / mod_auth_mellon). PHP session is the person. If you skip this, LAMP sees only the connector SNAT — a masked user.

Distributed AWS / Azure services

  1. 1 · PathTunnel only
  2. 2 · IdentityThe person
  3. No active IDApp denies

Connector → SG on the ALB / private API. Same PEP. Architecture does not change the tunnel. ALB OIDC / API Gateway authorizer / IAM Identity Center / Entra. The service principal is not the user. The assertion is. If you skip this, the workload runs as a shared role — a masked user.

ICAM integration

Identity is upstream of the permit. Entra is not the person.

DoD E-ICAM · three systems. Thunderdome is none of them.
IdPAuthenticateSAML 2.0 / OIDC. CAC/PIV certificate-based auth against DoD PKI. This is the person at the door.
MUROne recordMaster User Record. EDIPI, persona, CAC dates, certificates. Fed from DMDC and Service directories. Not a cloud account.
AAPProvisionAutomated Account Provisioning / SAAR. Access request is not the same as a SAML assertion. SCIM, if used, is this plane — not login.
Federation hub · one picture of the person. Then Thunderdome enforces.
DISADoD E-ICAM4th estate / DoDNet default.
ArmyArmy E-ICAMFirst onto the DISA hub (FY25).
Navy · USMCNavy E-ICAMFederated next. Do not dual-home.
DAF · SFAir Force E-ICAMFederated by end FY25.
DISADISA federation hubOne picture of who may access what. Deconflicts roles across Service ICAMs. Then DMDC. Classified federation is later — not this IL5 kit.
EnforcementThunderdome PDPMay arrive
Relying partyIAM IC · GovCloudMay use
Relying partyEntra · Azure GovMay use
Six hops a stand-up shop wires. Order is the order.
  1. 01 · CFT · PLZ-3Name the source
  2. 02 · CFT · DSO-4Exchange metadata
  3. 03 · ICAM · deviceTrust the card
  4. 04 · CFT · PLZ-3Map groups
  5. 05 · App ownerWire the app
  6. 06 · AO · RMF-3Name residual
01 · CFT · PLZ-3Name the sourceService E-ICAM or DISA E-ICAM. One. Thunderdome consumes it. Entra is not it.
02 · CFT · DSO-4Exchange metadataSAML 2.0. AWS GovCloud ACS signin.amazonaws-us-gov.com/saml. Azure Government enterprise app. Audience restricted. Signed.
03 · ICAM · deviceTrust the cardCAC/PIV via DoD PKI. OCSP / CRL. Derived PIV (800-157) for mobile. No CAC — federated hub, not a local cloud account.
04 · CFT · PLZ-3Map groupsICAM groups → IAM IC permission sets / Entra app roles. Mapping is not SCIM. SCIM does not mean 'active.'
05 · App ownerWire the appThe workload is a relying party: oauth2_proxy, ALB OIDC, Entra. Path-trust is SNAT. Identity-trust is the assertion.
06 · AO · RMF-3Name residualPAM / TCCM on the IL. Workload identities / NPEs. Break-glass. Disable cloud-only. Federation is not a standing admin.
Credential is the person. A local cloud account is not.
cacCAC / PIVDoD PKI. The default person. Thunderdome will not issue a permit without an active credential.
derivedDerived PIVNIST 800-157. Mobile / BYOAD. Bound to the same person. Not a second identity.
hubFederated, no CACContractors, other agencies, allies. Trust the partner IdP through the DISA hub. Never a local Entra cloud-only account as production.
  • Not ThunderdomeEnforcement. ICAM names the person. Thunderdome decides if they may arrive.
  • Not Entra / IAM IC as SoTRelying parties. If they become the person, you have two sources of truth.
  • Not Privileged pathTCCM / PAM on the IL. User ICAM is not standing admin.
  • Not Non-person entitiesService principals, workload identity federation. Not a CAC. Not this hop.
  • Not SCIM as 'active'Provisioning is AAP. Login is IdP. Disabled in ICAM must still deny at the RP.

Data vs access

DISA brokers the session. The mission holds the payload.

Data flow · two planes
Access plane · DISA Thunderdome
  • Identity assertion
  • Device posture
  • Catalog lookup
  • Permit + access telemetry
Data plane · mission LZ
  • CUI / data at rest
  • CMK in GovCloud
  • SCCA boundary
  • CloudTrail / ConMon
User on-ramp · pick one PEP. BCAP stays as DISN protection.
SCCA · DISN boundaryBCAP hairpinUser → DODIN → BCAP → LZProtects DISN from the cloud. Connects NIPR to a PA'd CSO.Not Thunderdome's user path. Residual: cloud→DISN, some S2S, SCCA VDSS/TCCM.
DISA · SASE + ICAM + CESSThunderdomeUser → SASE → connector → LZDirect to the cloud workload. No DODIN hairpin as production.Join lever for 4th estate / DoDNet. Mission occupancy if they take DISA commodity.
DoD CIO ref design · P1 buildCNAPUser → CNAP PEP → LZCloud-native access point. Same problem as Thunderdome: don't hairpin users through BCAP.Platform One / Service occupancy. Cousin, not a Thunderdome part. Do not run both as production user paths.

Catalog of applications

Published or deny. Not a mesh of trust.

Catalog · published or deny
  1. Mission agencyInventorynamed owners
  2. ThunderdomePublishpermit path
  3. In catalogMay permit
    UnpublishedDeny

Two planes

Handshake first. Then packets. DISA never hosts the payload.

Access handshake, then data packets — mission and DISA ThunderdomeHandshake 1: ICAM names the person, Thunderdome evaluates the device, a permit is issued. Handshake 2: the mission application accepts that permit. Then packets ride the SASE tunnel to a connector VM, SNAT into the landing zone, and the app still checks Entra. DISA brokers access. DISA does not host the payload. Unclassified demonstration.ACCESSDATAIDICAMthe person · not a packetPERMITMISSIONUser + deviceCAC/PIV · postureDISAThunderdomeAccess broker · edgeMISSIONApplicationEntra is the RPHandshake 1 · trust person + deviceHandshake 2 · accept permitREQRESUserSASE tunnelPrisma AccessConnector VMSNAT · PEPAppno Entra ID = denyAfter permit · packets ride the tunnel. Payload never hosts at DISA.
  1. ICAMName the person
  2. EdgeDevice + context
  3. PermitIssue the session
  4. TunnelSASE to connector
  5. SNATInto the VPC
  6. AppEntra, then payload
Unclassified demonstration. Access clasps first. Then data moves: user → SASE → connector (SNAT) → mission app. ICAM is the person. Entra is a relying party. DISA does not hold the payload.

Stack

ICAM + SASE + SD-WAN + CESS.

Stack DISA operates · you federate
icamEnterprise ICAM
saseCommercial SASE / SSE
sdwanSD-WAN
cessCustomer Edge Security Stack

Cairn Zero · six weeks

Prepare DISA's site survey. Do not surprise it.

  1. W1 · AR-002Occupant classification
  2. W1 · AR-005Mission and sponsor
  3. W2 · AR-009Access-plane inventory
  4. W2 · AR-008ICAM federation readiness
  5. W2 · AR-044Device pillar
  6. W3 · AR-021Application ZTNA catalog
  7. W4 · AR-009CESS site survey list
  8. W5 · AR-043Seven-pillar residual map
  9. W6 · AR-038Sponsor decision

48-month road

Access compresses. Factory and cATO do not move.

  1. M0 · Greenfield · Cairn Zerocompresses
  2. M6 · Cloud Foundation Teampartial
  3. M12 · First JWCC landing zone · IATTcompresses
  4. M18 · First ATO landing zonecompresses
  5. M24 · Multi-CSP ATO patternpartial
  6. M36 · Evidence factoryunchanged
  7. M42 · Continuous authorization pathunchanged
  8. M48 · Mature cloudpartial

Stand-up JWCC · AWS + Azure

Operate the landing zone. Occupy Thunderdome for the access plane.

  1. 01 · PLZ-3Federate
  2. 02 · PLZ-4 · DSO-4Place connectors
  3. 03 · APP-1 · APP-3Publish the catalog
  4. 04 · GOV-4 · PLZ-2Encode policy
  5. 05 · PLZ-3 · RMF-3Accept permit
  6. 06 · OPS-1 · OPS-4Watch both planes
AWS GovCloud · primary
  1. 01IAM IC · SAML gov
  2. 02Connector in VPC
  3. 03SCPs · no public user
  4. 04KMS residual

SAML ACS signin.amazonaws-us-gov.com · audience urn:amazon:webservices:govcloud

Azure Government · second
  1. 01Entra · ICAM
  2. 02Connector in VNet
  3. 03Policy · no mash-up
  4. 04PIM residual

Azure Government Entra as relying party. Clone as IaC only if the mission needs it.

Workstreams that move

Occupy · configure · accept permit · or leave on the road.

occupies
  • PLZ-3Identity and privileged access on the IL
  • OPS-3Endpoint and device trust
  • PLZ-4Network and SCCA boundary
  • RMF-3Zero Trust pillar roadmap to FY2027
configure
  • SCI-1Shared-control map
  • SCI-2Common-control designation
  • DSO-4IaC and configuration-as-code
  • GOV-4Policy as inheritable code
  • APP-1Inventory and named owners
permit
  • PLZ-3Accept permit — workloads trust the gate
  • OPS-1Logging, backup, and the 03:00 owner
unchanged
  • PLZ-0Cloud Foundation Team
  • PLZ-SEPIL5 physical separation
  • DSO-2Software factory
  • RMF-4152 on this occupancy

Seven pillars

152/152 is the solution. Residual is still yours.

PillarThunderdomeStill yours
UserICAM · the personPAM · AO · break-glass
DeviceC2C at the edgeUnmanaged privileged laptops
Network / EnvironmentSASE · no hairpinSCCA · IL5 PA
Application / WorkloadZTNA to publishedFactory / pipeline
DataData in motionCUI at rest · CMK
Automation / OrchestrationDISA operates the planeIaC of the LZ
Visibility / AnalyticsAccess telemetryLZ ConMon

Not purchased

Eight things Thunderdome does not buy.

  • JWCC landing zone
  • Mission ATO
  • SCCA for data at rest
  • IL5 physical separation
  • Software factory
  • cATO
  • CMDB / FinOps / toolchain
  • Named AO

Thunderdome PMO at DISA. Onboarding starts with a site survey and ICAM federation — not a SKU buy.

Open the workbench on this engagementPhase Zero briefingBack to Cairn