The Defense Department Cyber Crime Center wants to expand its partnership with the private sector through its Defense Industrial Base Cybersecurity program. The DIB CS already includes more than 1,200 companies who give threat information to DoD and receive actionable intelligence to protect their systems and networks.

This expansion of the program to more prime and subcontractors means DC3 will receive even more data on a daily basis. That data, plus the constant stream of cyber information that comes to the cyber center from the networks run by the military services and defense agencies, makes finding that proverbial needle in the haystack that much more difficult.

Kajal Pal, the Defense Cyber Crime Center’s architecture management of data and enterprise division chief, said for these, and many other, reasons, the organization is implementing a data mesh fabric to create more structure, which will lead to better and faster decisions.

“We are also working with not only the DoD cloud, but also the intelligence cloud. There are challenges with that and moving data between impact levels, and the type of work we do, digital forensics where you have to protect and preserve that information to litigate those cases are at the core,” Pal said on Ask the CIO. “The other kind of work we do is protecting the supply chain, and that requires not only the data flow between the government, the vendor and the supply chain, but also across the geographical nature and across every level. We are implementing zero trust, but the challenge right now I’m facing is, how do you move data across different impact levels and different boundaries? We do follow certain mechanisms, like the segmentation of the network, micro segmentation and continuous monitoring of the network.”

Pal said the data fabric has to include metadata tagging to pull information from software development efforts as well as what is shared from partners. DC3 is joining a growing list of DoD agencies in implementing a software factory to further manage and protect the Pentagon’s technology ecosystem.

“Let’s focus on the technical piece of it. When the application developer deploys an application, they change the databases, and databases have fields in relational database management system, and nowadays if you do not have a data fabric or data mesh built into the deployment pipeline, this becomes out of sync so it doesn’t match with the source of truth of the data. The most important thing is mapping the data requires a database that should be in sync with the actual source of the truth,” he said. “This is one of the key parts for our data lake to get utilized in a more dynamic nature. The other part that we need to focus on is, I have the data now and the data mesh is created, but how can I create the data product?”

Pal added that DC3 can tap into the data lake, and using the same data through the use of dynamic tagging, they should be able to get more information about that code, any real or potential risks associated with that deployment and details about the product itself.

DC3 already works with the software factories run by the Air Force and the intelligence communities to address potential or real risks. Pal said as it builds its own software factory, DC3 will integrate it within the federated data fabric or data mesh, both at the classified and unclassified levels.

“If we properly implement this software factory and use dynamic data tagging through this process, I think we will cut down almost 30% to 40% of operational overhead manpower to get software approved for use,” he said. “Our target for the software factory to launch is the end of this fiscal year. Why I’m talking about this is because of security and the fact that every artifact coming out from the software factory, eventually it will provide support or capabilities to our defensive or offensive mission areas.”

The other thing having a data fabric will do for DC3 is better integrate internal cyber data with business data from financial management or human resources systems.

Pal said all of this data is helping to drive cybersecurity decisions in more real-time because of how much both types of data rely on each other these days.

“When you talk about internal data, which a lot of time we collect from the network to make a decision within our network, that relies on an extended network detection and response (XDR) type of tool. The data has to be tagged properly and sent to a centralized data location like a data lake. Then you have the artificial intelligence modeling that we utilize to help make a decision,” he said. “A lot of times this is from the network behavioral side of the data. It gives you the option that either it’s an insider threat or external threat. This is where I think AI is playing a good role.”

DC3 is using XDR and similar tools to help with automated policy enforcement efforts, make certain network protection cyber decisions and help them manage their risks.

Pal said DC3 also has rely on the military services and defense agencies to provide them with cyber-related data from their business systems. Since cyber threats cross multiple boundaries, he said working in silos would leave them with blind spots.

“We have to collaborate with all the agencies in how we do this. That’s where the data fabric comes in to allow us to collaborate and interchange data within the agency at the appropriate class or impact level,” he said. “If we are able to communicate, then we’ll be able to fetch the data whenever we need it to make a decision. With the federated data fabric, if you are constantly, dynamically modifying and updating your data, to stay on top of it, any federal agency should be able to develop their product on top of the data lake, using the data fabric that we are creating. I think this will be the ultimate solution. Then, if you go into the future, any AI model can tap into this and can build their decision making at the right point and right time.”

Like most organizations, DC3 is facing an ever-increasing volume of data. Pal said that creates a bigger problem for cyber defenders because they have to worry about missing something in all the mountains of information coming in every hour or day.

“The best option for us is optimizing and fine-tuning the data model. We have to know what we’re looking for, what kind of event we’re looking for and how to avoid both false positives and false negatives,” he said. “How would you isolate those things? It is not a one-time job. It’s a continuous improvement and part of continuous monitoring.”

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.