Fewer DOD data centers will result in reduced enemy attack vectors

As the Defense Department moves toward its 2013 goal of reducing its number of data centers by 30 percent and its number of servers by 25 percent, the department is also striving to maintain current security levels while simultaneously safeguarding systems and data against future threats.

The situation is challenging. Yet many security experts feel that a combination of careful planning and technology selection will enable DOD to meet both its budget and security goals.

Howard Teicher, former senior director of political-military affairs for the National Security Council, noted that data center consolidation by itself can have a positive impact on security. "By reducing the number of data centers through consolidation, enemy attack vectors are actually reduced," observed Teicher, who is currently public- sector vice president for Radware, a security technology vendor headquartered in Tel Aviv. "The effectiveness of active defenses against external threats can ... be simplified and enhanced, and the DOD’s ability to detect insider threats and prevent data leakage [can be] improved," he said.

Fewer data centers can also help DOD establish a more comprehensive and uniform security environment, said Owen Rodgers, director of systems engineering for Fortinet, a security technology company based in Sunnyvale, Calif. "Consolidation is an opportunity to conform compliance with security practices and ensure that practices are standardized across data centers."

Consolidation should create opportunities for optimizing the location of data centers and increase access to redundant utilities, said Mike Mostow, vice president of government systems for AMAG Technology, a data center access control systems vendor located in Torrance, Calif. He added that consolidation should also help DOD streamline the design and construction of systems and technologies that are used to control or limit user access, enabling better detection of intrusion attempts.

Short-Term Challenges

Yet before these benefits can be achieved, bureaucratic inertia, along with the time required to develop new and updated standards and procedures, could temporarily increase system and data vulnerability, Teicher said. "In addition, it can be time-consuming to train and deploy proficient cyber warriors," he added.

"Invariably, lessons will be learned along the way," said Bobby Caudill, Director of Federal Solutions at Cleversafe, a data storage systems technology company in Chicago. "In the meantime, the security of the data and systems could be at risk from the unknown and unexpected."

The work required to get newly consolidated and virtualized data centers up to speed could cause security to take a backseat to more immediate demands. "The consolidation that is occurring is not only the migration of technologies into a data center, but also the collapsing of several distinct operations into one," said John Topp, federal sales engineering manager for Splunk, a data analytics software vendor located in San Francisco.

As DOD assesses the security vulnerabilities created by consolidation and virtualization, Teicher feels that the department shouldn't waste its resources on point security solutions that apply ‘patches’ to cyber attacks after the fact. "Instead, [the DOD should] invest in holistic, multi-vector protection systems that protect applications and the network at all points along the infrastructure," he said.

Topp feels that DOD should view the challenge of protecting consolidated and virtualized data centers as a chance to embrace modern data-management techniques. "Instead of thinking of it as a security problem, DOD should think of it as an opportunity to take a top-down approach to data management to maximize data use opportunities," he said.

Rodgers, agreed, noting that DOD's remaining data centers, numbering about 530, must become more efficient in order to ensure seamless security. "The best course of action would be to conduct a top-to-bottom technical and operational review to remove slack from the overall system of security delivery," he said. "Consolidation itself can help because you can use a single platform at a single data center where many devices were in use previously, but that’s only part of the efficiency equation."

Rodgers noted that wherever possible, policies should be consolidated to reduce the number of employee hours spent managing devices. "Likewise, managers should ask their equipment vendors which features they could use to consolidate functions on deployed equipment—unused processing power on a piece of hardware is just as real a waste as an employee sitting at a desk with nothing to do," Rodgers said.

Into the Cloud

Former McAfee Chief Technology Officer Stuart McClure feels that DOD will eventually follow the strategy of most major enterprises by moving most of its data center infrastructure into the cloud.

"The DOD will have the same challenge that any company has in consolidating data centers into the cloud—security—and it will be 10 times harder because they will no longer have control [over their infrastructure]," said McClure, who is currently CEO of Cylance, a security software developer located in Newport Beach, Calif. "They will rely on contracts and SLAs [service level agreements] to ensure the security of their systems rather than physical controls, and they will have to get their legions of lawyers to stay on top of their vendors when they lapse in their security vigilance."