5 février 2019 | International, C4ISR

A tweaked DoD cloud strategy looks beyond Amazon

By:

A recent Department of Defense memorandum indicates that the agency wants to pursue multiple commercial cloud vendors as it attempts to modernize its IT and data infrastructure, though a single provider will still have singular influence over the agency's “general purpose cloud.”

“DoD is driving toward an enterprise cloud environment that is composed of a general purpose cloud and multiple fit-for-purpose clouds,” the memorandum to Congress, released Feb. 4, said.

“In addition, it should be recognized that the Department will still need non-cloud data center capability for applications that are not suited for the cloud. Over time, with the adoption of an enduring enterprise cloud strategy, the non-cloud environment should become smaller.”

That general purpose slot will be filled by the awardee of the $10 billion Joint Enterprise Defense Infrastructure contract, which has been criticized for its single-award intent as giving the winner an outsized control of the defense cloud market.

Many companies vying to support the Pentagon's cloud requirements claimed that the odds were stacked in Amazon's favor. The approach spurred protests and a lawsuit in fact.

According to the memorandum, the fit-for-purpose environment will be made up of the Defense Information Systems Agency's milCloud suite, as well as other unnamed vendors.

Throughout the cloud migration process, DoD will stick to four guiding principles:

  1. War-fighter First — any cloud solution must at all times address the needs of improving lethality while not jeopardizing the safety and mission of American war fighters.
  2. Cloud-Smart, Data-Smart — cloud solutions must streamline transformation and embrace modern capabilities while enhancing data transparency and visibility.
  3. Leverage Commercial Industry Best Practices — the cloud strategy should promote competition and innovation while preventing lock-in of one particular solution or technology.
  4. Create a Culture Better Suited for Modern Technology Evolution — the strategy will need to create a culture of learning and innovation while discouraging custom, federated approaches.

This approach to commercial cloud is not entirely unexpected, as DoD Chief Information Officer Dana Deasey said during an October 2018 press event for the Defense Enterprise Office Solution cloud contractthat the agency would be delineating between general purpose and fit for purpose contracts.

"This marks a milestone in our efforts to adopt the cloud and also in our larger efforts to modernize information technology across the DOD enterprise," Deasy said in a statement on the memo to Congress.

“A modern digital infrastructure is critical to support the war fighter, defend against cyberattacks and enable the department to leverage emerging technologies like machine learning and artificial intelligence.”

The new strategy also means that DoD will move away from a cybersecurity posture that focuses on perimeter defense and instead prioritize the protection of data and systems.

“DoD will produce a unified cybersecurity architecture that addresses cloud and the needs of classified and unclassified missions and data. The capabilities will be tested and assessed independently and frequently to ensure that cybersecurity attributes remain effective against developing threats,” the memo said, adding that the CIO will determine the command and control requirements between the agency and the cloud service providers.

Cloud contracts will also likely include requirements for training and workforce development to ensure that DoD can develop the expertise necessary to use and protect their new cloud environments.

And any potential migrations to cloud will have to come with thorough evaluations of legacy DoD applications.

“It is imperative that DoD has a cloud strategy to ensure that legacy applications are not moved to cloud without properly re-architecting them to make use of the data, security, resiliency and application advantages that cloud provides,” the memo said.

“Additionally, DoD should independently test and assess cloud network security to verify security compliance and incident response and review all contractor and third-party testing results to ensure that performance and security monitoring are sufficient.”

https://www.federaltimes.com/it-networks/cloud/2019/02/04/dod-to-officially-pursue-a-multi-vendor-cloud-strategy

Sur le même sujet

  • Pentagon, Lockheed Martin Failed to Ensure Proper Parts for F-35

    20 juin 2019 | International, Aérospatial

    Pentagon, Lockheed Martin Failed to Ensure Proper Parts for F-35

    CHARLES S. CLARK A major contractor and the Pentagon's top management office came in for criticism from an inspector general for cutting corners in assuring that the massive joint-service F-35 stealth fighter is equipped with ready-for-issue parts. In a report dated June 13, the Defense Department watchdog found that parts for the department's largest acquisition—with an estimated $406 billion price tag and sales planned to foreign allies—were not being received according to the contracts and performance incentives. The parts contracted for delivery by Lockheed Martin Corp. include wheel, seat, and window assemblies, said the audit addressed to the Defense secretary for acquisition, the Air Force secretary, the Air Force inspector general and the Defense Contract Management Agency. The federal contracting offices and the corporate teams working on the plane are supposed to ensure the sustaining parts are delivered “ready for aircraft maintenance personnel to install on the aircraft,” as well as have an Electronic Equipment Logbook assigned that spells out each part's history and remaining life. Too often, however, the parts arrived not ready in accordance with contracts and incentive fees on the sustainment contracts because of “inflated and unverified F‑35A aircraft availability hours. This occurred because the [Joint Program Office] did not conduct adequate oversight of contractor performance related to receiving F‑35 spare parts and aircraft availability hours,” the report said, calling the inflation of hours unintentional. As a result, the department received non-ready spare parts and spent up to $303 million in labor costs since 2015, “and it will continue to pay up to $55 million annually” for such parts until a fix is made. In addition, the Defense Department has “potentially overpaid” $10.6 million in performance incentive fees by not independently collecting and verifying aircraft availability hours. “The lack of available [ready-for-issue] spare parts could result in the F‑35 fleet being unable to perform required operational and training missions,” the report warned. The Joint Program Office was aware of the problem, auditors found during their review from June 2018 to April 2019, but did not resolve the issue or require the services to better track the non-compliant parts. Interviews with the Joint Program Office staff in Arlington, Va.; the DCMA administrative office in Lockheed Martin's facility in Fort Worth, Texas; and Lockheed staff at three sites found, for example, that of 74 spare parts delivered to Hill Air Force Base in Utah from Sept. 17-30, 2018, 59 spare parts (80 percent) were non-ready for issue. Of the 263 spare parts delivered to Luke Air Force Base in Arizona in June 2018, 213 spare parts (81 percent) were non‑ready. And of 132 spare parts delivered to the Marine Corps Air Station in Beaufort, S.C., in September 2017, 58 spare parts (44 percent) were non‑ready. The IG recommended that the F-35 program executive officer improve oversight by coordinating with DCMA to pursue compensation from the contractor for the costs of mishandling the supply of spare parts since 2015. It also recommended that he direct the contracting officer to add clarifying language to future sustainment contracts, and task the lead contracting office with updating its Quality Assurance Surveillance Plan. Navy Vice Adm. Mathias Winter, the program executive, agreed, stating that there is value added in tracking and using contractor performance data. https://www.govexec.com/defense/2019/06/pentagon-lockheed-martin-failed-ensure-proper-parts-f-35/157822/

  • CENTCOM looks to industry for data-centric network

    21 septembre 2020 | International, C4ISR

    CENTCOM looks to industry for data-centric network

    Andrew Eversden WASHINGTON — U.S. Central Command needs industry's help in designing a network infrastructure that provides improved secure information sharing with allies and partners, its top IT official said Sept. 17. Brig. Gen. Jeth Rey, director of command and control, communications, and computer systems at CENTCOM, said his team is working to establish a data-centric architecture that uses artificial intelligence and machine learning to limit access to data based only on what a user needs. “What I have the team looking at is working in that transport agnostic, looking at a data-centric connection, and then how can we then use attributes to then release information to that person who is trying to access the data. And so that's where data centricity is at the end of the day trying to use machine learning and AI,” Rey said at the 2020 Intelligence and National Security Summit. “That's where we need help from industry.” Rey compared CENTCOM's need to the service provided by banks, where a person logs in with credentials, and then the bank reaches into its massive database, pulling out only the information specific to that person. CENTCOM, the largest combatant command, also has data and information sharing requirements with more than 50 nations, adding another degree of difficulty in developing a secure architecture where users can only access the necessary data. “We here at CENTCOM are going to work with partners, and we need to share our information with them,” Rey said. “We need that help in order to display from a single document with multiple security measures ... but release only that information on that document to that person by their credential.” The need Rey described is similar to an architecture developed by the U.S. intelligence community for its data access needs. That platform, known as IC GovCloud, enabled users to store data in one place and the community to implement security measures to limit personnel access to what they “need to know,” said Greg Smithberger, chief information officer at the National Security Agency and director of the agency's Capabilities Directorate. “We built the GovCloud from the ground up with this thought in mind so that with the data comes knowledge of where it came from and what the rules are in terms of how it needs to be handled and who has the need to know. And the systems are enforcing that need to know, so that if the humans make a mistake, there's a safety net there,” he said during the same webinar. https://www.c4isrnet.com/battlefield-tech/it-networks/2020/09/18/centcom-looks-to-industry-for-data-centric-network/

  • Why the Navy wants more of these hard-to-find software developers

    20 avril 2018 | International, Naval

    Why the Navy wants more of these hard-to-find software developers

    By: Mark Pomerleau With a relative dearth of cyber expertise in the military, Congress mandated last year the services begin direct commissioning pilot programs. The Navy, however has been doing direct commissioning for highly skilled software engineers for a few years, albeit on a small scale. The cyber warfare engineer (CWE) program is a highly competitive program with officers on five year rotations performing software or tool development for cyber operators. CWEs serve as members of the cyber mission force, the Navy's cyber mission force teams that serve as the cyber warriors for U.S. Cyber Command, producing cyber tools, but can also conduct target analysis, vulnerability research, and counter-measure development against malicious cyber activities. Since 2011, the Navy has only recruited 25 of these commissioned officers to its ranks. “Twenty-five developers in the Navy as military officers is definitely not enough,” Lt. Christopher Liu, the most senior cyber warfare engineer told Fifth Domain in an interview at the Navy League's Sea Air Space conference April 9. With a relative dearth of cyber expertise in the military, Congress mandated last year the services begin direct commissioning pilot programs. The Navy, however has been doing direct commissioning for highly skilled software engineers for a few years, albeit on a small scale. The cyber warfare engineer (CWE) program is a highly competitive program with officers on five year rotations performing software or tool development for cyber operators. CWEs serve as members of the cyber mission force, the Navy's cyber mission force teams that serve as the cyber warriors for U.S. Cyber Command, producing cyber tools, but can also conduct target analysis, vulnerability research, and counter-measure development against malicious cyber activities. Since 2011, the Navy has only recruited 25 of these commissioned officers to its ranks. “Twenty-five developers in the Navy as military officers is definitely not enough,” Lt. Christopher Liu, the most senior cyber warfare engineer told Fifth Domain in an interview at the Navy League's Sea Air Space conference April 9. “We definitely need to increase the billets and increase the amount that we can hire ... to have more talents to be able to work on the cyber mission,” he said. “As soon as the number increases, we'll be able to expand the program rather than just five years to eight years, hopefully make it into a 20 year career so people can get trained up and work on missions and not be forced into different fields.” The Pentagon has been besieged by concerns about the DoD's ability to both retain and attract cyber talent among its ranks when similar jobs in the private sector pay significantly more. Vice Adm. Michael Gilday, commander of 10th Fleet/Fleet Cyber Command, acknowledged in recent congressional testimony that the military is not competitive with the private sector and noted that the base pay for the CWE position is around $37,000 a year. “That's what we pay somebody to answer the phones around here,” Senator Claire McCaskill, responded to Gilday interrupting him in frustration. “We're asking them to have incredible expertise. That seems to me totally unrealistic.” Some current CWEs feel the work they're doing inside the Navy has greater meaning than similar work they did in the private sector. “I find that this is a lot more fulfilling,” Ensign Jordan Acedera, the most junior CWE told Fifth Domain. “You finish a project, you're given something that's a lot more challenging and that really tests you.” For Lt. (j.g.) George John, who was formerly writing software at a stock trading company, work with the CWE provides a better environment that's not driven so much by profit margins and hitting quarterly revenue targets. “We don't have to worry about profitability or bringing to market,” he said. “We can pursue a little more ... what's possible. Throw stuff against the wall, see what sticks, take our time to figure out a plan of action.” One of the biggest challenges, however, is lack of knowledge of the program, even inside the Navy. “You still walk across captains and commander who say 'CWE, what in god's name is that,” John said. With more CWE personnel in the force, the Navy could build a more informed and skilled software engineering cadre, the group said. “There's tons of software. Everybody has some type of software pet project,” John said. “To be able to get more CWEs on those things and coordinate with one another and say here's what [Consolidated Afloat Networks and Enterprise Services] is doing with their communications and their infrastructure. How are we doing that differently on the base side? You can talk and address security concerns with one another. Just within the cyber operations realm, Liu said, as the headcount increases, the CWEs could work on the requirements the operational community within the cyber mission force rather than having to prioritize projects. They could even start to look at developing capability prior to a specific requirement coming in as a means of staying ahead of the game as opposed to waiting for and reacting on requirements from operators. https://www.defensenews.com/digital-show-dailies/navy-league/2018/04/11/why-the-navy-wants-more-of-these-hard-to-find-software-developers/

Toutes les nouvelles