How Does DoD View the Cloud

National Defense Industrial Association

12 October 2011

Mr. Robert J CareyDeputy Chief Information Officer

Department of Defense

2

The Warfighter & DoD WorkforceExpects, Deserves & Requires

…Access to information…

Anytime and Anywhere…

Risk Management vs. Risk Avoidance approach

From fixed bases to the tactical edge…

3

…and this is where we do our work

VIEWS OF THE ENTERPRISE

4

VIEWS OF THE ENTERPRISE

5

VIEWS OF THE ENTERPRISE

6

OUR ENTERPRISE IS NETWORKED PEOPLE, ORGANIZATIONS & TECHNOLOGYTHAT ENABLE AN INTEGRATED, HIGHLY CAPABLE WARFIGHTING TEAM.

VIEWS OF THE ENTERPRISE

7

IT Systems

• >$ 38 Billion in FY12

• >$16 Billion in IT Infrastructure

• >$3 Billion for Cyber Security

• 1.4 million active duty personnel

• 750,000 civilian personnel

• 1.1 million National Guard and Reserve personnel

• 5.5+ million family members and military retirees

• 146 + countries

• 6,000 + locations

• 600,000 + buildings and structures

• >10,000 Operational systems (20% mission critical)

• ~750 Data Centers

• ~67,000 Servers

• ~7+ million computers and IT devices

• Thousands of networks

• Thousands of email servers, firewalls, proxy servers, etc.

DoD IT User Base

Total IT Budget

DoD Information Enterprise - Working Toward Cloud Computing

8

Enormous Size, Scope, Diversity and Complexity

9

DoD’s Strategy for Operating in Cyberspace (DSOC)

5 Pillars• Cyberspace as a domain• New defense operating

concepts• Extending cyber defenses• International partners• Technology and innovation

Keep Pace With Technology - Get In Front of the Threat

10

DoD’s Strategy for Operating in Cyberspace (DSOC)

5 Pillars• Cyberspace as a domain• New defense operating

concepts• Extending cyber defenses• International partners• Technology and innovation

Cloud Computing supporting DoD’s Cyber Strategy

11

DoD IT Enterprise Strategy and Roadmap

CyberSecurity

Improve the security of DoD networks and information from all

threats

EfficiencyReduce duplication in

the DoD IT Infrastructure, and deliver significant

efficiencies across the Department

EffectivenessImprove mission effectiveness and

combat power throughout the

Department

Consolidate Infrastructure to Better Operate and Defend

1. Data Center & Server Consolidation

2. Consolidate Security Architecture3. Implement Cross Domain Solution4. Network Standardization /

Optimization 5. Implement Enterprise Identity

Management6. Enterprise Messaging &

Collaboration7. Enterprise Hardware/Software

Procurement12

IT Enterprise Strategy and Roadmap – Initial Actions

13

All data reachable through the “Enterprise Information Environment”

User’s/systems accessed using Identity and Access Management

Web Enabled Applications available to manipulate data in the “Environment”

Access with Thick Client/Thin Client/PDA/any waveform/the Internet from Anywhere

Easily accessible, reliable and survivable computing platforms

Supported by a flexible, robust and protected mesh of communications media

Thin ClientMobile Device

“Enterprise Information Environment”Identity and Access Management

Thick Client

Personal Storage Data SourcesWeb Enabled Applications

??

The Vision

Data Center Optimization

14Core Computing Infrastructure for DoD’s Cloud

Global Footprint

“Franchise” data centers

15

Enterprise Data Center Evolution

-200%

0%

200%

400%

600%

800%

1000%

1200%

1400%

1600%

1800%

2002 2003 2004 2005 2006 2007 2008 2009 2010 2011

Percentage Change

Mainframe Processing

IBM & UNISYS platforms

Centralized database processing

Full data replication (since FY00)

Silos Virtual Tape Systems

Distributed Processing

Client-Server solutions

Internal storage Storage Area Networks (SAN)

Enterprise resource Planning (ERP) implementations

Cloud Computing

Server Virtualization

Services- based acquisitions

Dynamic provisioning

Utility pricing

1994-2002

Storage Workload

Server Workload

Cost

Continuous DECC consolidations and transformations have yielded significant reductions in unit cost

1994-2002 20082002-2008

16

Enabling Data Center Consolidation through Virtualization

Leveraging excess capacity created by the rapid growth in the speed and capacity of processors, memory, network and storage

Current virtual environments:• 1012 VOEs• 147 Hosts• 4 Racks• 253 Windows Licenses• 160 Network Cables• 20 SAN Cables

If these weren’t virtualized:• 1012 Blade/Servers

• 22 Racks• 1012 Windows Licenses• 1024 Network Cables• 128 SAN Cables

Driving additional consolidation: Current CPU utilization often <20%

Delivering the DoD Cloud from the Core Data Centers

17

Facility

Physical Infrastructure

Virtual Infrastructure

Facility

Physical Infrastructure

Virtual Infrastructure

Facility

Physical Infrastructure

Virtual Infrastructure

Facility

Physical Infrastructure

Virtual Infrastructure

Orchestration and Monitoring

Automated Provisioning & Deployment

Self-Service Portal & App Store

Core Data Centers

Secure, turnkey cloud for DoD application developers and enterprise service providers

Automated Security, Performance & Functionality Testing/Reporting

Hybrid Cloud

18

Hosted within globally accessible code data centers that are secure, reliable and robustly interconnected

Common Enterprise Services Delivered from the Cloud

Computing Infrastructure ServicesOn demand, self-service Broad network access

Rapid elasticity Measured service

Platform ServicesIdentity Management Authentication/Authorization

Application Platforms Messaging Content Delivery

Enterprise Software as a Service (SaaS)e-Mail Office Productivity Collaboration

Content Mgmt Customer Relationship Mgmt

19

Agile Development & Continuous Delivery across the DoD Cloud

DoD Enterprise Cloud Environment

Agile development

Rapid IA C&A

Cloud IaaS

Initial Enterprise Capabilities

Cloud Computing: Enabling a new application delivery approach

8/23/2011 Unclassified 20

Large, expensive,

static systems

Yesterday’s system development process

Continuous delivery enabled by the cloud

• Automated testing• Enterprise services• Compliant platforms• On-demand

infrastructure

Emerging needs

Continuous delivery

Program managersDevelopersTestersDecision authorities

Unclassified 21

Using cloud computing to achieve our cyber security goals

9/7/2011

Core Computing Infrastructure

Strong perimeter protections with a vigorous internal sensor grid to detect attack, malicious code, staged exfiltration

Cloud Infrastructure Services

Highly resilient infrastructure supporting dynamic scalability, failover, backup/recovery, and continuous monitoring/alerting

Cloud Platform Services

Application Services

Standardized, STIG’d Platforms with automated patch and configuration management

Identity management and access control services

Mission AppsApplications inherit the security controls from the lower layers enabling accelerated delivery and improved security

22

Using Commercial Provided Cloud Services: Significant IA Challenges

• Issue 1: Cyber Protection: Commercial clouds move computing & storage outside of DoD’s layered cyber defenses and cyber attack detection, diagnosis, and reaction infrastructure.

• Issue 2: Cyber C2: There is no mechanism to effectuate Cyber command and control needed to identify and respond to emerging cyber threats

• Issue 3: IdAM: Maintaining the DoD’s cyber identity credential, direct authentication, and access control models and services when using the cloud is a major concern

• Issue 4: Multi-tenancy: The commercial cloud is shared with non-DoD customers, and the provider must ensure DoD processing and data stays separate, and that other customer’s problems or malicious behavior do not spill over to DoD in a way that causes risk to DoD missions

• Issue 5: Data/Application Visibility – need to ensure that both data and applications are monitored in real or near real time.

• Issue 6: Data Rights: make sure understand who has them over the long term?

23

Commercially Provided Cloud Services: Mitigating the Risks

• DoD extension of Federal Risk and Authorization Management Program (FedRAMP)

– Provides a standard approach to assessing cloud computing services and products for the Federal Government

– Certification driven by NIST Special Pub 800-53 IA Controls– Emerging requirements for audit and monitoring – Joint Approval Board chaired by DoD(CIO), DHS, and GSA– DoD will establish a similar process internally.

• Using cloud pilots to identify additional mitigations– Boundary defenses between sensitive DoD information and non-DoD information– Information encryption in transit and at rest– Use of DoD Internet Access Points (IAP) and Internet Firewalls– Use of certified Computer Network Defense Service Providers (CNDSPs) that

monitors the firewall, IDS and responds to USCYBERCOM tasking

Challenge: Delivery to the tactical edge

Unclassified 24

Cloud

Optimized information delivery, interoperability, synchronization, failover, continuity

25

Way Ahead

• Consolidating DoD infrastructure (networks, applications, servers and data centers)

• Adapting cloud technologies and approaches to enhance our enterprise service efforts– Increasing IT complexity and shrinking budgets is driving switch from

asset ownership to consuming services from others– Initial focus on DoD offered services while defining requirements and

methods to securely leverage commercially provided services

• Publishing DoD Cloud Computing Strategy and developing guidance on the use of commercially provided cloud services– Fall 2011

• Collaborating with the DoD Components, Intelligence Community, other Federal Agencies, and industry partners

Thank YouNational Defense Industrial Association

12 October 2011

Mr. Robert J CareyDeputy Chief Information Officer

Department of Defense Robert.Carey@osd.mil

27

NS1 - Consolidate Security Infrastructure

NS2 - Consolidate NetOps Centers

NS3 - Implement Cross Domain Solution as an Enterprise Service

NS4 - Implement Standard Certification & Accreditation Process

NS5 - Extend Joint Networks Over SATCOM

NS6 - Implement Video over IP as an Enterprise Service

NS7 - Implement Voice over IP as an Enterprise Service

NS8 - Joint Enterprise Network (JEN)

NS9 - Enterprise Network Infrastructure Reliability

NS10 – Defense Red Switch Network (DRSN) Rationalization

CS1 - Data Center & Server Consolidation

CS2 - Computing Infrastructure & Services Optimization

CS3 - Cloud Computing

CS4 - Service Desk Consolidation & Optimization

ADS1 - Enterprise Messaging & Collaboration Services (including Email)

ADS2 - Identity & Access Management Services

ASD3 - Enterprise Services

ASD4 - Records Management

EUS1 - Next Generation End-User Devices

EUS2 - Multi-Level Security Domain Thin-Client Solutions

EUS3 - Interoperability Within DoD & Between Mission Partners

BP1 - Consolidate Software Purchasing

BP2 - Consolidate Hardware Purchasing

BP3 - Optimize IT Services Purchasing

BP4 - Common Business Process Foundation

BP5 - Promote & Adopt “Green IT”

Candidate Efforts

Efficiency, Effectiveness & Cyber Security

Initiative Near Term Use Case

Challenge: Delivery to the tactical edge

Optimized information delivery, Interoperability, synchronization, failover, continuity

Enterprise Core Data Centers Regional

Data Centers DeployableNodes

Edge/TacticalNodes

3G

3G

3G

DISN Core NetworkEdge

Network Edge RF Network

29

IaaS: Accelerated Delivery of New Capabilities

UNCLASSIFIED

Current Development

ProcessDev Provision Build QA

ProvisionQA + IA Deploy

Continuous Delivery

DEV QA + IA

Start Finish

Self-service provisioning Consume portfolios of

standardized, policy compliant services. platforms and applications

Build Automation Eliminate manual

build environment config/setup

Automate testing during off-hours

Environment Promotion Seamlessly migrate and

promote environments from Dev through delivery to desired environments.

Accelerate delivery to cloud or bare metal

DEV