DON27BZ02-NV010 TITLE: Automated Hardening for Cyber Secure Operating Systems
OUSW (R&E) CRITICAL TECHNOLOGY AREA(S): Applied Artificial Intelligence (AAI)
COMPONENT TECHNOLOGY PRIORITY AREA(S): Advanced Computing and Software;Sustainment;Trusted AI and Autonomy
PROJECTED CMMC LEVEL REQUIREMENT: Level 2 (Self)
OBJECTIVE: Develop an automated tool to cyber harden various platform instantiations built on a Linux operating system.
DESCRIPTION: Navy platforms have computing devices that drive their operational capabilities, especially autonomous or unmanned systems. Many platforms such as autonomous vehicles have some version and distribution of Linux as their operating system (OS) as well as an application running on it. Providing cybersecurity to these platforms is not only challenging due to their complexities but also very time consuming from a manpower perspective. This workload includes analyzing all levels of software (to include the OS) and configuring them to make them more secure as well as other cyber hardening operations such as software debloating to remove unnecessary functionality. The Navy has many platforms so each would require its own analysis and hardening. There are various means for improving the cybersecurity posture of the platform, each either manual or with its own tool, which creates undue burden on the developer of the platform for hardening without missing certain security features.
The focus of this SBIR effort is strictly on the OS, in this case Linux. The tool should determine the Linux OS functionality actually required by a specific platform instantiation, remove unnecessary OS components and functionality, and configure the remaining Linux OS to improve cybersecurity posture while preserving required system functionality. The goal is to create an automated tool that analyzes the various specifications, configurations, applications, etc. to harden the cybersecurity posture of the underlying Linux OS. The performer should propose their own platform, preferably either a commercial off-the-shelf (COTS) or open source platform that has a Linux OS and use this for design and experimentation on how to automate the cyber hardening of just the OS. It is preferred that the device be some type of autonomous vehicle. The performer will produce an overall software architecture for the automated OS hardening tool as well as a demonstration of the conceptual capability in Phase I while Phase II will involve development of a prototype in cooperation/guidance with Navy personnel. Metrics to demonstrate the improvements from the automated tool should be provided in the proposal.
PHASE I: Determine a conceptual software architecture for an automated cyber hardening tool for the Linux OS. Ensure that this tool will (1) leverage available runtime information for an existing system to identify the minimal set of OS functionality required for system functionality and (2) then recommend and/or configure the OS, removing unnecessary OS components and functionality and add/or configure recommended security features/functionality. At the conclusion of Phase I, present the proposed software architecture (i.e., the tool’s design and specification of functionality) and a demonstration on a representative platform (e.g., COTS or open-source autonomous platform) that shows improvement in cybersecurity posture (e.g., code analysis, pen testing, etc.). Tools will be compared on cybersecurity OS hardening completeness and approach (i.e., architecture) for ingesting various sources to automate the tool’s execution.
PHASE II: Develop a functional prototype of the automated tool. Interact with Navy personnel who own a platform and who will provide guidance and experimentation against the prototype OS cyber hardening tool. In conjunction with the Navy, devise, develop, and implement means for verifying the automated OS cyber hardening. Demonstrate that the tool can automatically ingest data sources (e.g., specifications, test plans, other hardening tools capabilities, etc.), and harden and minimalize the Linux OS footprint on the Navy platform. (Note: Navy personnel will examine metrics such as code reduction in the Linux OS, configurations, debloating, code analysis, and pen testing results to measure the effectiveness of the automated OS hardening.) Prepare a Phase III commercialization/transition plan.
PHASE III DUAL USE APPLICATIONS: Support the transition to Navy use.
Many commercial platforms leverage the Linux OS (e.g., IoT and Smart Home technology). The manufacturers of those devices often implement them on Linux and also need cyber hardening.
REFERENCES:
KEYWORDS: Cybersecurity; Operating System; OS; cyber hardening; Automation; Zero-Trust
TPOC 1: Dan Koller
daniel.p.koller.civ@us.navy.milTPOC 2: Ryan Craven
ryan.m.craven2.civ@us.navy.mil
** TOPIC NOTICE ** |
The Navy Topic above is an "unofficial" copy from the Navy Topics in the DoW FY-27 Release 2 SBIR BAA. Please see the official DoW Topic website at www.dodsbirsttr.mil/submissions/solicitation-documents/active-solicitations for any updates. The DoW issued its Navy FY-27 Release 2 SBIR Topics pre-release on November 4, 2026 which opens to receive proposals on December 2, 2026, and closes January 6, 2027 (12:00pm ET). Direct Contact with Topic Authors: During the pre-release period (November 4, through December 1 , 2026) proposing firms have an opportunity to directly contact the Technical Point of Contact (TPOC) to ask technical questions about the specific BAA topic. The TPOC contact information is listed in each topic description. Once DoW begins accepting proposals on December 2, 2026 no further direct contact between proposers and topic authors is allowed unless the Topic Author is responding to a question submitted during the Pre-release period. DoD On-line Q&A System: After the pre-release period, until December 16, 2026, at 12:00 PM ET, proposers may submit written questions through the DoW On-line Topic Q&A at https://www.dodsbirsttr.mil/submissions/login/ by logging in and following instructions. In the Topic Q&A system, the questioner and respondent remain anonymous but all questions and answers are posted for general viewing.
DoW Topics Search Tool: Visit the DoW Topic Search Tool at www.dodsbirsttr.mil/topics-app/ to find topics by keyword across all DoW Components participating in this BAA.
|