Category Archives: tech

tech

The Cloud First Mandate for Government Demands an Open Architecture for Cloud

From my post, Virtual Integrated System Blog – Government – The Cloud First Mandate for Government Demands an Open Architecture for Cloud, on the Virtual Integrated System Blog at Ziff Davis Enterprise:

The federal government is moving toward a “cloud first” policy for new applications. Jeffery Zients, the government’s first-ever Chief Performance Officer, announced in mid-November that the Office of Management and Budget will require that all agencies will be required to use cloud-based options for new system acquisitions “whenever a secure, reliable, cost-effective cloud option exists.”

The Washington Post reported Zients’ announcement of the changes, first outlined at a Northern Virginia Technology Council meeting on November 19. According to the article, “The government’s been trying to do this for a long time,” he said, “but obstacles have always gotten in the way.” Now, he said, “we finally clear out those obstacles and allow agencies to successfully apply the agile, modular development approach.”

That policy will certainly boost the acceptance rate of cloud-based services within the federal government. But it will take more than simply requiring cloud-based solutions for new systems to meet the government’s goal of a 40 percent reduction in the number of Federal data centers by 2015. Existing systems will also need to be migrated to the cloud, and migrated toward an architecture that takes advantage of self-service IT and a shared cloud infrastructure. And there will also need to be substantial improvements in standards for data integration between applications residing in the cloud in different types of infrastructure–whether the clouds are outsourced or operated in federal data centers.

To make the move from the current mix of virtualized and non-virtualized systems to more of a cloud model for computing, and have the same sort of agility in infrastructure as they gain in cloud-based software solutions, agencies are going to need an open architecture that allows them to move their systems from whatever hypervisor or physical server operating system they currently reside on into a cloud-based virtual environment without having to worry about what hypervisor environment is being used to manage the cloud. They’ll need to be able to extract those virtual servers and redeploy them as well, to ensure that the cost of exit from a vendor’s cloud contract, for example, isn’t higher than the cost of the contract itself. And for agencies that decide to run their own private cloud, those capabilities will be even more important to ensure that they don’t get locked into specific hardware architectures going forward, and can more easily inject new technology into existing environments.

Standard
Cyberdefense and Information Assurance

The Next WikiLeaks – TwitterLeaks?

For those who think the whole WikiLeaks thing is awful, it’s time to suck it up. Because, in all honesty, WikiLeaks is just the beginning.

Tomorrow, I’ve got a column running in InternetEvolution that briefly discusses the problem. But in even briefer form, here it is:

DOD does not have full situational awareness of its networks. And DOD is at least thinking about this stuff–many organizations have even less control over information systems.

Audit trails are only good for closing the barn door after the cow is gone.

There are plenty of ways to exfiltrate data that look like normal system usage.  Hell, people can exfiltrate data using their iPod’s camera now, and worry about text indexing later.

Distributed social networks, URL shorteners, and plenty of places to hide data mean that the next leaker won’t need a WikiLeaks.org web address to get the information disseminated.

There will be more leaks because people will always have a reason to.

And there will always be someone in an adversarial role willing to host the content (thank you, Uruguay).

So, rather than crying over spilt cables, and pursuing investigations of the New York Times, perhaps people who care about security should start thinking about what security really means, and what information should be classified and what shouldn’t.  And be thankful that some Army specialist didn’t have access to a CD-R connected to a JWICS terminal.

Standard