DOD can benefit from private-sector cloud experience, say industry execs

The private sector has a lot of experience the Defense Department can exploit to speed efforts to secure computer networks from attack, industry leaders said Sept. 18.

As the Pentagon transitions to a cloud-based environment, private-sector experience in web filtering, identifying new malware, controlling the supply chain and managing the "bring-your-own-device" policy can be adapted for military use, industry executives told the Defense Systems Summit.

A study by the computer security firm Blue Coat found that the average business confronts some 5,000 threats per month, and the number of malicious websites has increased by 240 percent since 2010.

This has caused a shift in attitudes toward an emphasis on security over privacy, as clients realize that it's easier for security firms to block attacks if they have detailed information about which sites are being visited -- something people had been reluctant to share in the past, said Chris Larsen, leader of the malware research team at Blue Coat. "The more of your data I can see, the safer I can keep you," he said.

Cloud computing also allows system administrators to push web filtering, anti-malware and antivirus defenses to the edges of their networks, said Mike Wilkerson, a senior director for public-sector sales engineering at VMware, which specializes in cloud infrastructure. "We're taking a huge evolutionary step" toward better control of access points, he said.

These security measures can be built into a system as it is set up, added Duke Butler, principal systems architect for Brocade. "Shoehorning security on the back end of an operation is a bit harder than doing it upfront," he said. "We're very focused on securing the target."

Technology also exists in the commercial market to help safely integrate individual devices into the military network, such as software that can wipe a device clean if it's lost, or stolen, Susie Adams, chief technology officer for Microsoft's federal government business. "It's really about the device, the data on the device and the user that accesses the data on the device," she said.