Implementation of Cloud Computing Solutions in Federal Agencies: Part 4 - Cloud Computing for Defense and Intelligence

(This is part 4 of the series entitled "Implementation of Cloud Computing Solutions in Federal Agencies". First published on Forbes.com, this series provides the content of a whitepaper I recently authored. A copy of the complete whitepaper will be available at NJVC.com starting September 7, 2011.)

The defense and intelligence communities are not immune to cloud computing. Arguably more than any other government agencies, their missions require a fabric of utility computing that scales on demand and enables self discovery and self-service access to secure, timely and relevant information in support of mission: individual or shared. The traditional IT model requires system engineering that binds most software to the hardware and does not provide an enterprise suite of functionality or allow for increased flexibility and a governed lifecycle of services. Designing software independence from the hardware allows an operating system, applications and data to “live” across the enterprise and is fundamental to the transformation of compute, storage and network functionality.

Defense is dealing with a $78 billion budget cut—the first since September 11, 2001—and another $100 billion in other cost-cutting measures over a five-year period commencing in FY 2012. Defense Secretary Robert Gates is directing that the budget be cut from agency administrative and structural areas (e.g., the Office of the Assistant Secretary of Defense for Network Intelligence and Information, the Business Transformation Agency, and the Joint Forces Command are in the process of being eliminated or disestablished with some essential functions transferred to other organizations with the Pentagon).

In an official statement on the proposed budget costs provided on January 6, 2011, Secretary Gates said: “First, reforming how the department uses information technology, which costs us about $37 billion a year. At this time all of our bases and headquarters have their own separate IT infrastructure and processes, which drive up costs and create cyber vulnerabilities. The department is planning to consolidate hundreds of data centers and move to a more secure enterprise system, which we estimate could save more than $1 billion a year.” Department of Defense Chief Information Officer Terry Takai also publically commented about the potential IT budget cuts at an April 21, 2011, INPUT event. Takai commented on DoD’s support of the move of some of its IT operations to the cloud—particularly data centers.

Cloud Computing and Mission Support 

Information is often the decisive discriminator in modern conflict. Studies of recent mission failures highlighted this fact, finding that many of these failures were caused by:

• Existence of data silos
• Human-based document exploitation process
• Reliance on “operationally proven” processes and filters typically used to address the lack of computational power or decision time

Also disturbing is that in most of these cases, the critical piece of information necessary for mission was in possession. The failure wasn’t in obtaining the information, but in locating and applying it to the mission at hand. Cloud computing uniquely addresses all of these important issues.



Data silos evolved from a system-centric IT proc urement policy and an almost reflexive reliance onrelational database technology. In developing early data processing systems, the high cost of memory and storage led to a premium being placed on the efficiency of application data access and retrieval. Relational database technology effectively addressed this need, which in turn led to its pervasive use across government. In modern IT system development, memory and storage are cheap—and getting cheaper—which has led to internet-scale storage and search paradigms that are the stuff of everyday use today. The world’s largest databases cannot, in fact, be searched quickly using a relational database management approach. Today’s ability to search multi-petabyte data stores in milliseconds virtually eliminates the need for data silos. This capability is realized in cloud-based storage. Documents are the persistent records of human activity. As such, they are used to provide insight into the societal structure and processes of our opponents. Conflict, however, is entity and event centric. The intelligence professional must, therefore, interpret documents and translate that data into operationally relevant entities and events. The time and resource intensive nature of this skillcraft is perfectly suited for the precision search and analytic capabilities of the modern compute cloud. The use of highly standardized and virtualized commodity infrastructure, not only make the automation of this function possible, but it enables real-time continuous processing of the now digital document flow of our adversaries. This commodity also removes the human from this tedious task, allowing intelligence professionals to apply higher order professional analysis and insight.



The human-based document exploitation process led directly to an institutional reliance on the aforementioned “operationally proven” processes and filters. Instantiated by the use of multi-page structure query language and the ubiquitous goal of obtaining an appropriate “working set” of data, these time-honored processes were born from the need to meet critical decision timelines within a computationally inadequate environment. Cloud techniques and technologies can now be used to work on all the data. And with an ability to leverage the power of a supercomputer at will, the working set requirement is now an anachronism and critical decision timelines can now be more easily met.

Cloud computing is unique in its ability to address these critical defense and intelligence mission needs. That’s why cloud computing is critical to our national defense. As a bonus, cloud computing offers defense and intelligence agencies the ability to increase efficiencies and incur marked cost savings during their lifecycles to alleviate some of the pressure of budget reductions. Moving IT operations to the cloud also will assist in enhanced collaboration.

http://www.defense.gov/speeches/speech.aspx?speechid=1527

( Thank you. If you enjoyed this article, get free updates by email or RSS - KLJ )

Implementation of Cloud Computing Solutions in Federal Agencies : Part 3 - Cloud Transition Lessons Learned

(This is part 3 of the series entitled "Implementation of Cloud Computing Solutions in Federal Agencies". First published on Forbes.com, this series provides the content of a whitepaper I recently authored. A copy of the complete whitepaper will be available at NJVC.com starting September 7, 2011.)

While the benefits and value of the federal cloud computing policy can be debated, the world’s transition to cloud computing as an integral component of any IT infrastructure cannot be denied. The prudent government executive should, therefore, heed the lessons learned from the many private industry corporations that already have miles behind them on this journey.

When identifying a potential cloud computing project, one should always count on a multi-year transition. Organizations should always use a consistent cloud opportunity identification process to reduce the risk of project failure by leveraging data from successful cloud implementations. Clients need to determine set metrics (economic, operational and service) with direct linkage to specific mission requirement(s). Use of a gate-driven cloud adoption process designed to terminate failed projects early in the project lifecycle and deliver measurable capabilities within a quick timeframe (weeks—not years) is highly recommended.

A risk mitigation plan also must be formalized that addresses each of the following concerns:²

• Loss of Governance. When moving to a cloud environment, clients relinquish control to the CP on a number of security-related issues. A gap in security defenses may also exist as service level agreements may not adequately address CP-related security requirements.
• Portability. Issues related to provider lock in are outlined in the Challenges section of this white paper on page 5.
• Isolation Failure. Multi-tenancy and collaboration are at the core of cloud computing. Resource isolation failure addresses mechanisms separating storage, memory, routing and reputation among different clients on the same cloud (e.g., guest-hopping attacks). However, it must be noted that attacks on these mechanisms are not as pervasive and much more difficult to attempt versus attacks on traditional operating systems.
• Compliance Risks. Investments in certifications (e.g., industry standard or regulatory requirements) may be compromised or lost when moving to the cloud.
• Management Interface Compromise. Security is an issue with client management interfaces with the public cloud provider. The reason? These services are provided via the internet and permit access to a larger set of resources than traditional operating systems. Security risk can dramatically increase when this is combined with remote access and web browser vulnerabilities.
• Data Protection. It may be difficult for clients to effectively check the data-handling practices of their CPs to ensure critical and sensitive data is handled lawfully and ethically. This problem can be aggravated in cases of multiple transfers of data (e.g., between federated clouds). However, it must be noted that some CPs share information on their data-handling practices with clients and others offer certification summaries on their data processing and data security activities and their various security controls (e.g., Statement on Auditing Standards 70 Certification.
• Insecure or Incomplete Data Deletion. As with most operating systems, when a request to remove a cloud resource is made, a true erase of data may not happen. Adequate or timely data deletion also may not be feasible (or undesirable from a client perspective) because extra copies of data are stored but not readily available or the disk to be destroyed also houses other data from other clients. When multi-tenancies and the reuse of hardware resources are added to the mix, this risk can increase.
• Malicious Insider. Cloud architectures necessitate the creation of certain staff positions (e.g., CP system administrators and managed security service providers) that can be extremely high risk in terms of internal security threats.

Creating a Cloud Computing Roadmap for Federal Agencies First Steps

According to, GovCloud: Cloud Computing for the Business of Government, when a government agency is ready to undertake the implementation of a cloud-based solution, it must determine which IT services, business functions and processes to deploy in the cloud environment. A five-year roadmap should be created that includes the desired order to move each of the services to the cloud for each year during that time period.³ Requirements for each service to be deployed in the cloud should be developed and a cost/benefits analysis performed to establish the rationale why each targeted service should move to the cloud.  

Implementation of a Low-Risk Test Case

A low-risk test case should be implemented prior to undertaking a wholesale transfer of services to the cloud.⁴ This is harder than it may sound as some IT services that may seem simple to deploy to the cloud are not so easy. Four questions should be asked (and answered) to decide which IT services are best suited to live in the cloud⁵:

1. Can compliance requirements be balanced with other IT prioirities?
2. Is this an IT function or service the agency has mastered?
3. Can the agency use a standardized service?
4. Is the test case easily implementable?

A misconception may exist that just because an application or service being deployed to the cloud isn’t mission critical, the process will be simple and straightforward. This is not always true. If the agency is new to the cloud and wishes to establish a private cloud it will take time to determine the appropriate split of responsibilities between the service provider and the agency’s IT team.⁶ Compliance and liability issues can also be tricky, as defining compliance conditions and establishing liability for intellectual property protection with cloud vendors reach well beyond the IT world—and, as such, with so many moving parts may take time to properly address and resolved.⁷ NIST has launched the U.S. Government Cloud Computing Business Case Working Group to assist agencies with the development of cloud-compatible user cases. Email, geospatial data exchange and services management are among the first user cases currently in development.  

Additional Recommendations

The authors of GovCloud: Cloud Computing for the Business of Government also offer seven recommendations that must be considered during the development and implementation of an agency’s cloud roadmap:

• Own the information, even if you own nothing else. An agency must claim its right to own the information even if it doesn’t own the infrastructure, application or service associated with that information. Any agency is liable for its information—regardless of where it lives—and some education will likely be needed about this fact among its IT team. While it may be unrealistic to prevent departments from provisioning their own cloud application, the agency must institute policies and procedures to ensure it can monitor how information deployed to the cloud is managed. As it is often hard to envision future uses of information, it also is recommended that agencies make sure cloud-dwelling data can be brought back into the enterprise if needed.
• Don’t take terminology for granted. It is vital to ensure that important terminology is defined in the same way by the agency and the cloud service provider—room for different interpretation always exists. A review of information governance policies must take place to identify the areas of highest risk so authoritative definitions for vocabulary in these areas can be developed and adopted.
• Hope for standards, but prepare to integrate. In short, the cloud is young and isn’t established enough to have developed standard specifications for platform interoperability and data exchange. Strategic groundwork for future data integration needs to be laid in the early stages of any movement to the cloud. Agencies must insist that their cloud service providers provide clear documentation on the data formats and schemas used for information storage in their systems.
• Control cloud platform proliferation. Agencies should minimize the number of different cloud platforms that require support to limit information fragmentation and decrease the chance of a future huge integration effort. To the greatest extent possible, an agency’s IT team should help departments look for shared requirements in standardized business functions. The team can identify cloud platforms that meet these needs and consolidate the agency’s services on them, when possible. Not only will the ability to share information increase, this will result in greater leverage when negotiating contract terms and pricing.
• Make the information “cloud ready.” Agencies that organize their data sets well enough for use across multiple platforms will be best positioned to take advantage of cloud services, and will be better able to deploy enterprise information to the cloud more easily.IT teams need to get into the habit of encrypting data into one common format (probably XML)—a process even more important if data moves through externally operated resources to the cloud.
• Master solution integration. The shift to the cloud requires IT professionals to change their focus from owning and operating enterprise systems to becoming master information service integrators. In addition to linking legacy databases to SaaS, IT teams need to connect their private and public clouds to create a seamless technology environment that works like a single cloud custom-made for their specific enterprises.

( Thank you. If you enjoyed this article, get free updates by email or RSS - KLJ )

Implementation of Cloud Computing Solutions in Federal Agencies : Part 2 - Challenges of Cloud Computing

(This is part 2 of the series entitled "Implementation of Cloud Computing Solutions in Federal Agencies" that first appeared on Forbes.com. This series provides the content of a whitepaper I recently authored. A copy of the complete whitepaper will be available at NJVC.com starting September 7, 2011.)

Despite the myriad benefits of cloud computing solutions, several challenges still exist. Being a young industry, there are few tools, procedures or standard data formats or service interfaces in place to guarantee data, computer application and service portability. As evidenced with the recent situation involving the services failure of Amazon’s Elastic Compute Cloud, outages can be a potential risk—and can have widespread implications for consumers of cloud services. This risk becomes even more severe if a mission-critical environment could be impacted.

A benefit as well as a challenge, security concerns have also slowed the widespread adoption of cloud computing. A variety of security concerns exist. According to the article, “Three Cloud Computing Risks to Consider,” in Information Security Magazine (June 2009), “the logging and auditing controls provided by some [cloud] vendors are not yet as robust as the logging providing within enterprises and enterprise applications,” which can put critical and sensitive data and information at risk. Security, of course, becomes increasingly critical in defense and intelligence IT environments.

For the government market, the lack of regulations and compliance standards are also cause for concern. Currently, no federal regulations are in place to govern cloud computing, and according to an April 2011 Information Systems Audit and Control Association survey of 1,800 Chief Information Officers (CIOs), compliance is a top risk. Approximately 30 percent of the CIOs surveyed said that “compliance projects are the biggest driver for IT risk-related projects”—particularly in public clouds. Specific to federal environments, data sovereignty is a challenge. According to a speech given by Federal CIO Vivek Kundra at an April 7, 2010, National Institute of Standards and Technology (NIST) forum," [Data sovereignty] is not going to be a question of technology. [Data sovereignty] is going to be a question of international law, and treaties that we will need to engage in the coming years.” CIO Kundra later added: “We've got a very diverse interpretation and a very diverse perspective when it comes to privacy or international security, if you look at our neighbors—Canada or Mexico—versus what's happening in the European Union.”



Cloud Computing and the Federal Government

The Obama administration has identified cloud computing as a means to achieve savings in IT budgets across federal agencies—across the board—and to address various other challenges (e.g., delays to capabilities and other inefficiencies) that have negatively impacted IT implementations. In his Fiscal Year (FY) 2011 budget, President Barack Obama ordered a three-year freeze in spending for non-defense, intelligence and national security programs and the trimming of the budgets of some federal agencies by five percent. At a July 1, 2010, House subcommittee hearing, CIO Kundra testified: “To do more than less [in terms for federal spending], we need game changing technologies. Cloud computing is one such technology.” The federal government is in the early stages of a decade-long process to “move to the cloud,” but has taken definitive steps in its adoption. Several key milestones have been achieved during the past two years in support of this effort:

• 2009: Establishment of the General Services Administration (GSA) Cloud Computing Program Office to coordinate the government’s cloud computing efforts; assembly of a public-private sector Industry Summit to discuss the benefits and risks of cloud computing; and creation of Security and Standards Working Groups to encourage collaboration and discussion on cloud computing by federal agencies
• 2010: Commencement of the development of federal security certification and accreditation processes for cloud services; convening of a NIST-hosted, public-private sector “Cloud Computing Forum and Workshop” to collaboratively develop cloud standards; release of 25-point federal IT reform plan; announcement by GSA and Federal Chief Information Officers Council on the requirements for the Federal Risk and Authorization Management Program, a standard approach for the federal government to access and authorize secure cloud-computing services and products
• 2011: Release of the Federal Cloud Computing Strategy (per the Obama administration’s 25-point IT reform plan) and award of 12 GSA IaaS blanket purchase agreements

The Obama administration adopted a “cloud-first” policy as part of its earlier referenced 25-point federal IT reform plan. This plan was developed after extensive review of federal IT projects with a particularly hard eye on 26 large-scale projects at risk due to being over budget and behind schedule. This policy is part of the 2012 budget process. One of the first steps in the “cloud-first” adoption is the requirement for every federal agency to develop and implement one cloud-based solution by December 2011 and three cloud-based solutions by June 2012. As of April 2011, agencies are making progress in this endeavor. During a special White House event, CIO Kundra said that CIOs from 15 agencies have already informed the Office of Management and Budget that they will evolve to cloud-based email solutions by the December 2011 deadline.



Cloud computing also has been identified by the Obama administration as a viable solution to the administration’s challenge to cut the federal budget via the consolidation of 800 of the government’s 2,094 data centers by 2015. CIO Kundra has specifically identified cloud computing as a central measure to reduce the costs and increase the efficiencies of federal data centers. Cost savings are already being achieved. At an April 12, 2011 Senate subcommittee hearing, Dave McClure, Associate Administrator, GSA Office of Citizen Services and Innovative Technologies, testified that the consolidation of just 12 data centers to three will save $2 million a year. Mr. McClure also testified that GSA’s move to a cloud-based email system will save $15 million over the next five years.

So, whether or not federal agency CIOs support cloud computing, the evolution to the cloud in their specific IT environments is not something to consider in the future: it is something to undertake today—and is mandated. Therefore, the way the federal government conceives of IT operations must change from traditional practices and operating systems to new enterprise resource controls, standards and business processes and operations. With the computing stacks functioning as a utility within the infrastructure as a platform and new business processes in place, highly automated resources provide the extensible platform needed to meet agency or mission needs.

( Thank you. If you enjoyed this article, get free updates by email or RSS - KLJ )

Implementation of Cloud Computing Solutions in Federal Agencies : Part 1-Introduction

(This post first appeared on "Cloud Musings on Forbes". This series provides the content of a whitepaper I recently authored. A copy of the complete whitepaper is available at NJVC.com starting September 7, 2011.)

Introduction

Cloud computing is a new approach in the provisioning and consumption of information technology (IT). While technology is a crucial component, the real value of cloud computing lies in its ability to enable new capabilities or in the execution of current capabilities in more efficient and effective ways.

Although the current hype around cloud computing has focused on expected cost savings, the true value is really found in the mission and business enhancements these techniques can provide. When properly deployed, the cloud computing model provides greatly enhanced mission and business capability without a commensurate increase in resource (time, people or money) expenditures.

Cloud Computing: Changing the Game



The use of commodity components, coupled with highly automated controls, enable cloud computing.¹ These characteristics also enable the economic model that makes it so disruptive to the status quo. As an example, the software-as-a-service cloud delivery model typically does not require any advance usage commitment or long-term contractual arrangements. SaaS not only changes the typical software vendor business model, but also radically changes the strategy, budgeting, buying and management options for the buyer. When Salesforce.com proved the viability of SaaS, the software subscription model was instantly endangered as a profitable business model. Amazon Web Services is similarly attacking data center hosting with its Virtual Private Datacenter Infrastructure as a Service (IaaS) offering.

Looking at this phenomenon from another angle, different cloud computing deployment models are actually changing what it means to be an IT professional. Since the days of the first computer, IT workers have prided themselves in their ability to design, build, operate and fix the enterprise hardware and software components that comprise the IT lifeblood of organizations—both in the public and private sectors. These tightly knit teams worked hard to keep these custom-made platforms updated, patched and ready to meet daily business and mission requirements. In the cloud computing world, IT infrastructure that is not delivering differentiating value is viewed as worthless cost. Critical business applications like email, Customer Resource Management (CRM), Human Resource Management and Enterprise Resource Planning are being routed to more capable cloud providers of these same services. This transition puts the enterprise IT professional into a service management role, responsible for helping his or her internal customers better use externally provided IT services. The new enterprise IT department is more a services organization than the traditional delivery organization.

The new cloud economic model also radically changes the view of what’s actually possible. Traditional IT procurement and provisioning processes have historically driven timelines associated with the delivery or fielding of improved information and data processing capabilities. Multiple threads of development, test, training and maintenance can also tax an organization’s short- and long-term financial resources. IaaS and Platform as a Service options can not only eliminate or limit capital expenditures, but can reduce or eliminate the expectation of operations and sustainment costs. The time required to realize mission or business value also is substantially reduced. With these differences, the impossible can suddenly become not only possible, but often can lead to new mission capabilities or brand-new cloud-enabled, revenue-generating businesses.

( Thank you. If you enjoyed this article, get free updates by email or RSS - KLJ )