Agencies grow to trust the cloud, but still must verify
Connecting state and local government leaders
Although the cloud has demonstrated its utility, agility and scalability, federal execs underscore the importance of security.
Only a few years ago plenty of agency IT execs were skeptical that the cloud could replace their trusty, on-site servers.
That apprehension has largely dissipated as the technology proved itself and cloud service providers adhere to strict security standards, experts said in a May 9 panel discussion on the use of cloud in government.
Three years ago agencies were trying to answer basic questions about cloud and identifying potential use cases, according to Sara Mosley, the strategic technology and architecture chief in the Department of Homeland Security’s CTO Office.
“Today, they know,” Mosley said at the event hosted by BMC Federal Exchange and presented by FCW, GCN’s sibling publication. “They know what they have, and they know what they can do in the cloud.”
The culture change, in many cases, was led by lower-level employees or “mission owners” that wanted more agile access to services for citizen-facing applications, she said.
That is also how Gene Hayman, a vice president and division manager at CACI International, observed the transition. “There is a groundswell from the bottom up,” he said. “The folks in the field that support the mission see the value of cloud … they want agility, they want to be able to have the information at their fingertips.”
Sometimes, however, mission owners are wedded to the idea of owning their own infrastructure. But the value of moving to the clould was so clear to Small Business Administration Deputy CIO Guy Cavallo that he was willing to rethink the agency's typical disaster response model when three hurricanes hit the United States last year.
After disasters the SBA must manage a surge of additional loan processing, which traditionally has meant buying thousands of computers for the staff sent into the field. “The traditional model of SBA was to buy hardware when you have something like this,” Cavallo explained.
The agency was going through its preliminary cloud implementation when the storms hit, and it decided to push the cloud implementation instead. So while SBA loan processors still needed laptops to take with them into the disaster zones, using cloud-based virtual servers and desktops eliminated the need for costly new infrastructure on the SBA network back at headquarters.
“We put our necks on the line," he said, but we knew that when the post-storm loan processing work wound down, we'd "have hundreds of thousands of dollars of hardware sitting there waiting for the next disaster.” The cloud approach also allowed SBA to deploy far more quickly, he added.
Although the cloud has demonstrated its utility, agility and scalability, panelists underscored the importance of security.
Because using the cloud means a vendor is handling jobs once performed by agency employees, an important part of securing an agency cloud environment means knowing who is in charge of what, according to Department of Health and Human Services Deputy CTO Ed Simcox.
“So it’s really, really important that we care for governance and compliance upfront as we start to have more mature conversations about how to move our cloud operations forward,” Simcox said.
Part of finding a solid security footing is deploying a cloud management platform that makes security a priority but also monitoring security and performance in real time, he said.
Securing the cloud requires a pretty big shift in how agencies think about cybersecurity. An agency can’t just use the same old tools it used on its legacy systems because the cloud is “a completely different environment,” Mosley said.
“We have to actually look at [cybersecurity] from a data-focused perspective, and that’s kind of where some of the work on IT modernization comes in,” she said. This will mean more of a focus on internal security and less emphasis on securing perimeters, she said.
Having security professionals in the room as much as possible is one more way to ensure security is a priority for cloud operations, Simcox said.
“Security must fully ingrained in your development and your operations,” he said.
NEXT STORY: Securing the public cloud with HSM as a service