The military cloud: Balancing security and accessibility

The Defense Department's long-term IT strategy calls for storing and distributing virtually all data, even its most sensitive information, in the cloud. In January, the agency reported that it is fully committed to shifting to a cloud computing environment, citing cost, efficiency and user accessibility benefits.

The CIA is already on the path to secure cloud services. After attempting to build a private cloud, the agency and other intelligence organizations opted to turn to commercial sources and awarded a contract to Amazon Web Services in late January. IBM protested the award to the Government Accountability Office, and GAO ruled in IBM's favor. Negotiations to determine the final resolution are still under way, but observers expect the CIA to continue its migration to a cloud-based system.

Although cloud services are highly attractive to a DOD that's facing both a tighter budget and soaring IT demands, some worry that the technology isn't mature enough to ensure the safety of sensitive data shared between and within military organizations. Mark Cohn, chief technology officer at Unisys Federal Systems, based in Reston, Va., noted that it's possible to argue that "cloud technology stacks are less mature in the sense that we don't have as long a history of defending them against the most sophisticated attackers at the level of national security systems, so [they] are therefore simply less proven."

Robert Carey, DOD's principal deputy CIO, acknowledged cloud risks in a recent DOD report, noting that "the metrics of cloud security are, at best, nebulous." Carey added that the agency would need time to create secure cloud spaces. "We have lots of [pilot programs] going on...to make sure we understand...the pros, cons and risks of moving into the cloud space."

Locking down the cloud

Although DOD has obvious reasons for approaching the cloud with caution, most experts believe it should be able to transition to a secure cloud environment without encountering any major problems.

"There is nothing in the cloud technology stack or service delivery model that is inherently and necessarily less secure for hosting large-scale IT systems," Cohn said. He noted that virtualization actually makes a cloud environment somewhat more secure by providing a "clean-cut restart from known, proven configurations" and improved automated operations.

Maria Horton, former CIO of the National Naval Medical Center in Bethesda, Md., said DOD will need to pay particular attention to cloud entry points. "One of the things that's different about the cloud is that you have the point of entry where it mixes with other network capabilities," said Horton, who is now CEO of EmeSec, a company that helps government agencies address cloud security issues. "They will also need to meet the [DOD Information Assurance Certification and Accreditation Process] standards."

Horton added that the Federal Risk and Authorization Management Program will also play a role in DOD's cloud security planning. FedRAMP is a governmentwide program led by the General Services Administration that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

"DOD is currently examining FedRAMP, even though it was developed from the civilian agency-oriented cloud-first initiative," Horton said.

So far, five companies and one agency's shared-service offering have received FedRAMP certification.

As it strives for maximum cloud security, DOD must also be careful not to make access to sensitive information unnecessarily difficult for end users.

"If security controls are too restrictive and too burdensome on the user, the choice will be to not leverage or use the service, which typically leads to using another method to accomplish the same mission," said Kyle Keller, cloud business director at EMC Federal in McLean, Va. "We see [an] ever-present need for balancing security and usability."

Additional measures

Best practices for ensuring the security of multi-tenancy cloud environments should be used to implement need-to-know access restrictions, said Ken Bedford, chief technologist for the U.S. Army account at HP Enterprise Services. "Data protection should then be employed based on the sensitivity and timeliness of the data — encryption, for example, for data in flight and data at rest."

To detect and remediate threats before they can do damage, Bedford said DOD should use actionable security intelligence that capitalizes on multiple event sources delivered in context. "Near-real-time [security information and event management] tools as part of the cloud infrastructure, and integrated up to the enterprise, are an important contributor to the total [information assurance] posture," Bedford said.