Bitstream ZTA Gateway Zero Trust Access Gateway for Tactical Networks with Per-Session Authentication Micro-Segmentation and DISA STIG Compliance

The Bitstream ZTA Gateway is the zero trust network gateway designed to replace the perimeter security model in military tactical networks — the model where any device inside the local area network is implicitly trusted once it has passed the perimeter firewall — with a model where every access to any network resource requires explicit authentication and per-session authorization, regardless of whether the device is inside or outside the physical installation perimeter.

In the context of a brigade or division tactical network, the traditional perimeter model fails in two frequent scenarios: when a legitimate device (planning laptop, ATAK tablet) is compromised by a hostile actor obtaining physical device access in the field — with perimeter access, that compromised device can move laterally through the entire network without restriction — and when the tactical network extends beyond the physically controlled perimeter via mesh radio links, SATCOM, or encrypted WAN, making the concept of 'inside the perimeter' lose geographic meaning. The ZTA Gateway authenticates the device via its device identity X.509 certificate issued by the organization's PKI, and authenticates the user via FIDO2 token (physical USB or NFC security key) or CAC/PIV certificate — both authentication layers are simultaneously required to establish any session, so device compromise without the user's physical token, or vice versa, provides no access.

The ZTA Gateway's identity-based micro-segmentation replaces static VLANs with dynamic access policies based on user identity, device certified role, and session context — time, device GPS location, classification level of requested resource. A platoon sergeant's ATAK tablet can access the tactical map server and messaging server, but not the battalion-level operations planning server, even if they are on the same physical network, without VLANs or ACLs manually configured by a network administrator.