Military looking to DISA for clear direction on security in the cloud

While there are potential benefits for the Defense Department moving applications and data to the cloud, there are also serious security risks. No defense organization knows this better than the Defense Information Systems Agency (DISA), the agency charged with overseeing DOD's cloud computing resources.

However, some industry observers say DISA is not moving fast enough to keep pace with emerging security threats and the rapid changes to cloud computing technology. Critics point to DISA's Field Security Operations (FSO), which for nearly 15 years has played a critical role in enhancing the security posture of DOD security systems by providing Security Technical Implementation Guides (STIGs).

Developed by FSO and updated periodically, STIGs contain technical guidance to lock down information systems and software that might otherwise be vulnerable to cyberattacks. Nevertheless, FSO has yet to issue a STIG for cloud computing.

"There is no guidance, no directives. That is, to me, an area of great concern and great risk because programs are pushing to get stuff into the cloud," said Cameron Matthews, chief technology officer at Sentek Global, a technology service provider for government IT security program management.

"We're looking right now at the different security aspects of cloud computing and how our current processes of STIG development, certification, and network defense tie into cloud computing," said Bill Keely, DISA's FSO director. "It impacts all these processes, and we're just beginning to look at that. We're going to have to do some process re-engineering to make sure cloud computing can be done in a secure way."

Time is of the essence. In July, DOD CIO Teresa Takai released a cloud computing strategy that was "expanded to address use of commercial cloud services." According to the new strategy, which was refined by Takai's office and DISA, DOD will now adopt commercial cloud computing solutions to the greatest extent possible.

"I see a lot of danger there with the use of commercial clouds," said Matthews. "If you think about it, underlying that cloud is a commercial entity that's running the cloud. Personally, it worries me a lot."

Defense and government IT planners aren't the only ones who are worried about public clouds and data protection. In a recent survey conducted by Mezeo Software of more than 150 CIOs in the private sector, more than 80 percent of corporate IT executives rated their concern over data leakage onto the public cloud as high.

New DOD cloud strategy

The new DOD Cloud Computing Strategy acknowledged the cloud's cybersecurity and information assurance challenges, insisting that the department is taking a "cautious approach as it works to fully understand the challenges and establish the appropriate risk mitigations."

To meet these challenges, the DOD CIO is updating the department's information assurance (IA) policies and instructions, and aligning IA controls and processes with those used across the federal government. All cloud services must comply with the department's IA, cybersecurity, continuity of operations and other policies, the DOD Cloud Computing Strategy stated.

"Moving DOD information into commercially provided clouds that operate outside of DOD security protections and operational control can increase these risks," according to the strategy. "The department will leverage commercially offered cloud services that offer the same or a greater level of protection necessary for DOD mission and information assets."

DOD is also leveraging the Federal Risk and Authorization Management Program (FedRAMP), which will establish a standard approach to assess and authorize cloud computing services and define requirements for the continuous auditing and monitoring of cloud computing providers.

Initially, DOD will use commercial cloud providers to support low-risk information and mission functions that "do not present significant impacts on mission effectiveness or operational readiness" and consist of systems handling "non-sensitive information" for day-to-day business that "does not materially affect support to deployed or contingency forces in the short term."

In addition, commercial cloud services that meet FedRAMP control levels will support moderate-risk data and information. This moderate-risk level requires additional IA safeguards to mitigate the risks "that could seriously impact mission effectiveness or operational readiness," the strategy stated.

When it comes to high-risk information and missions, however, DOD will not use commercial cloud services that are generally available to the public.

Brave New World

Cloud services promise to accelerate DOD's IT delivery, efficiency and innovation, while decreasing costs. But, as the DOD Cloud Computing Strategy warns: "The department must be careful not to jeopardize its mission by trading the confidentiality, integrity and availability of DOD information for desired benefits."

For DISA's FSO, an organization tasked with putting together configuration standards for DOD IA-enabled devices and systems, they are still weighing the tradeoffs of the different cloud computing models.

"[Private, hybrid, and public cloud computing] each have their own security challenges, with a security-versus-risk operational tradeoff and cost benefit," said DISA's Keely. "I don't feel comfortable saying what that tradeoff would look like. To me, until you make that tradeoff decision, you can't really say whether they are viable options or not."