1. How Does DoD View the Cloud National Defense Industrial Association 12 October 2011 Mr. Robert J Carey Deputy Chief Information Officer Department of Defense

2. The Warfighter & DoD Workforce Expects, Deserves & Requires …Access to information… Anytime and Anywhere… 2 Risk Management vs. Risk Avoidance approach From fixed bases to the tactical edge…

3. 3 …and this is where we do our work

4. VIEWS OF THE ENTERPRISE 4

5. 5

6. 6

7. OUR ENTERPRISE IS NETWORKED PEOPLE, ORGANIZATIONS & TECHNOLOGY THAT ENABLE AN INTEGRATED, HIGHLY CAPABLE WARFIGHTING TEAM. VIEWS OF THE ENTERPRISE 7

8. IT Systems >$ 38 Billion in FY12 >$16 Billion in IT Infrastructure >$3 Billion for Cyber Security 1.4 million active duty personnel 750,000 civilian personnel 1.1 million National Guard and Reserve personnel 5.5+ million family members and military retirees 146 + countries 6,000 + locations 600,000 + buildings and structures >10,000 Operational systems (20% mission critical) ~750 Data Centers ~67,000 Servers ~7+ million computers and IT devices Thousands of networks Thousands of email servers, firewalls, proxy servers, etc. DoD IT User Base Total IT Budget DoD Information Enterprise - Working Toward Cloud Computing 8 Enormous Size, Scope, Diversity and Complexity

9. DoD’s Strategy for Operating in Cyberspace (DSOC) 5 Pillars Cyberspace as a domain New defense operating concepts Extending cyber defenses International partners Technology and innovation 9 Keep Pace With Technology - Get In Front of the Threat

10. DoD’s Strategy for Operating in Cyberspace (DSOC) 5 Pillars Cyberspace as a domain New defense operating concepts Extending cyber defenses International partners Technology and innovation 10 Cloud Computing supporting DoD’s Cyber Strategy

11. DoD IT Enterprise Strategy and Roadmap 11 Cyber Security Improve the security of DoD networks and information from all threats Efficiency Reduce duplication in the DoD IT Infrastructure, and deliver significant efficiencies across the Department Effectiveness Improve mission effectiveness and combat power throughout the Department Consolidate Infrastructure to Better Operate and Defend

12. 1.Data Center & Server Consolidation 2.Consolidate Security Architecture 3.Implement Cross Domain Solution 4.Network Standardization / Optimization 5.Implement Enterprise Identity Management 6.Enterprise Messaging & Collaboration 7.Enterprise Hardware/Software Procurement 12 IT Enterprise Strategy and Roadmap – Initial Actions

13. 13 All data reachable through the “Enterprise Information Environment” User’s/systems accessed using Identity and Access Management Web Enabled Applications available to manipulate data in the “Environment” Access with Thick Client/Thin Client/PDA/any waveform/the Internet from Anywhere Easily accessible, reliable and survivable computing platforms Supported by a flexible, robust and protected mesh of communications media Thin Client Mobile Device “Enterprise Information Environment” Identity and Access Management Thick Client Personal StorageData Sources Web Enabled Applications ?? The Vision

14. Data Center Optimization 14 Core Computing Infrastructure for DoD’s Cloud Global Footprint “Franchise” data centers

15. Enterprise Data Center Evolution 15 -200% 0% 200% 400% 600% 800% 1000% 1200% 1400% 1600% 1800% 2002200320042005200620072008200920102011 Percentage Change Mainframe Processing IBM & UNISYS platforms Centralized database processing Full data replication (since FY00) Silos Virtual Tape Systems Distributed Processing Client-Server solutions Internal storage Storage Area Networks (SAN) Enterprise resource Planning (ERP) implementations Cloud Computing Server Virtualization Services- based acquisitions Dynamic provisioning Utility pricing 1994-2002 Storage Workload Server Workload Cost Continuous DECC consolidations and transformations have yielded significant reductions in unit cost 1994-2002 2008 2002-2008

16. Enabling Data Center Consolidation through Virtualization 16 Leveraging excess capacity created by the rapid growth in the speed and capacity of processors, memory, network and storage Current virtual environments: 1012 VOEs 147 Hosts 4 Racks 253 Windows Licenses 160 Network Cables 20 SAN Cables If these weren’t virtualized: 1012 Blade/Servers 22 Racks 1012 Windows Licenses 1024 Network Cables 128 SAN Cables Driving additional consolidation: Current CPU utilization often <20%

17. Delivering the DoD Cloud from the Core Data Centers 17 Facility Physical Infrastructure Virtual Infrastructure Facility Physical Infrastructure Virtual Infrastructure Facility Physical Infrastructure Virtual Infrastructure Facility Physical Infrastructure Virtual Infrastructure Orchestration and Monitoring Automated Provisioning & Deployment Self-Service Portal & App Store Core Data Centers Secure, turnkey cloud for DoD application developers and enterprise service providers Automated Security, Performance & Functionality Testing/Reporting Hybrid Cloud

18. 18 Hosted within globally accessible code data centers that are secure, reliable and robustly interconnected Common Enterprise Services Delivered from the Cloud Computing Infrastructure Services On demand, self-serviceBroad network access Rapid elasticity Measured service Platform Services Identity ManagementAuthentication/Authorization Application Platforms MessagingContent Delivery Enterprise Software as a Service (SaaS) e-MailOffice Productivity Collaboration Content MgmtCustomer Relationship Mgmt

19. Agile Development & Continuous Delivery across the DoD Cloud 19 DoD Enterprise Cloud Environment Agile development Rapid IA C&A Cloud IaaS Initial Enterprise Capabilities

20. Cloud Computing: Enabling a new application delivery approach 8/23/2011Unclassified20 Large, expensive, static systems Yesterday’s system development process Continuous delivery enabled by the cloud Automated testing Enterprise services Compliant platforms On-demand infrastructure Emerging needs Continuous delivery Program managers Developers Testers Decision authorities

21. Using cloud computing to achieve our cyber security goals 9/7/2011Unclassified21 Core Computing Infrastructure Strong perimeter protections with a vigorous internal sensor grid to detect attack, malicious code, staged exfiltration Cloud Infrastructure Services Highly resilient infrastructure supporting dynamic scalability, failover, backup/recovery, and continuous monitoring/alerting Cloud Platform Services Application Services Standardized, STIG’d Platforms with automated patch and configuration management Identity management and access control services Mission Apps Applications inherit the security controls from the lower layers enabling accelerated delivery and improved security

22. Using Commercial Provided Cloud Services: Significant IA Challenges Issue 1: Cyber Protection: Commercial clouds move computing & storage outside of DoD’s layered cyber defenses and cyber attack detection, diagnosis, and reaction infrastructure. Issue 2: Cyber C2: There is no mechanism to effectuate Cyber command and control needed to identify and respond to emerging cyber threats Issue 3: IdAM: Maintaining the DoD’s cyber identity credential, direct authentication, and access control models and services when using the cloud is a major concern Issue 4: Multi-tenancy: The commercial cloud is shared with non-DoD customers, and the provider must ensure DoD processing and data stays separate, and that other customer’s problems or malicious behavior do not spill over to DoD in a way that causes risk to DoD missions Issue 5: Data/Application Visibility – need to ensure that both data and applications are monitored in real or near real time. Issue 6: Data Rights: make sure understand who has them over the long term? 22

23. Commercially Provided Cloud Services: Mitigating the Risks DoD extension of Federal Risk and Authorization Management Program (FedRAMP) –Provides a standard approach to assessing cloud computing services and products for the Federal Government –Certification driven by NIST Special Pub 800-53 IA Controls –Emerging requirements for audit and monitoring –Joint Approval Board chaired by DoD(CIO), DHS, and GSA –DoD will establish a similar process internally. Using cloud pilots to identify additional mitigations –Boundary defenses between sensitive DoD information and non-DoD information –Information encryption in transit and at rest –Use of DoD Internet Access Points (IAP) and Internet Firewalls –Use of certified Computer Network Defense Service Providers (CNDSPs) that monitors the firewall, IDS and responds to USCYBERCOM tasking 23

24. Challenge: Delivery to the tactical edge Unclassified24 Optimized information delivery, interoperability, synchronization, failover, continuity

25. Way Ahead Consolidating DoD infrastructure (networks, applications, servers and data centers) Adapting cloud technologies and approaches to enhance our enterprise service efforts –Increasing IT complexity and shrinking budgets is driving switch from asset ownership to consuming services from others –Initial focus on DoD offered services while defining requirements and methods to securely leverage commercially provided services Publishing DoD Cloud Computing Strategy and developing guidance on the use of commercially provided cloud services –Fall 2011 Collaborating with the DoD Components, Intelligence Community, other Federal Agencies, and industry partners 25

26. Thank You National Defense Industrial Association 12 October 2011 Mr. Robert J Carey Deputy Chief Information Officer Department of Defense Robert.Carey@osd.mil

27. 27 NS1 - Consolidate Security Infrastructure NS2 - Consolidate NetOps Centers NS3 - Implement Cross Domain Solution as an Enterprise Service NS4 - Implement Standard Certification & Accreditation Process NS5 - Extend Joint Networks Over SATCOM NS6 - Implement Video over IP as an Enterprise Service NS7 - Implement Voice over IP as an Enterprise Service NS8 - Joint Enterprise Network (JEN) NS9 - Enterprise Network Infrastructure Reliability NS10 – Defense Red Switch Network (DRSN) Rationalization CS1 - Data Center & Server Consolidation CS2 - Computing Infrastructure & Services Optimization CS3 - Cloud Computing CS4 - Service Desk Consolidation & Optimization ADS1 - Enterprise Messaging & Collaboration Services (including Email) ADS2 - Identity & Access Management Services ASD3 - Enterprise Services ASD4 - Records Management EUS1 - Next Generation End-User Devices EUS2 - Multi-Level Security Domain Thin-Client Solutions EUS3 - Interoperability Within DoD & Between Mission Partners BP1 - Consolidate Software Purchasing BP2 - Consolidate Hardware Purchasing BP3 - Optimize IT Services Purchasing BP4 - Common Business Process Foundation BP5 - Promote & Adopt “Green IT” Candidate Efforts Efficiency, Effectiveness & Cyber Security Initiative Near Term Use Case

28. Challenge: Delivery to the tactical edge Optimized information delivery, Interoperability, synchronization, failover, continuity Enterprise Core Data Centers Regional Data Centers Deployable Nodes Edge/Tactical Nodes 3G DISN Core Network Edge Network Edge RF Network

29. IaaS: Accelerated Delivery of New Capabilities UNCLASSIFIED Current Development Process Dev ProvisionBuildQA Provision QA + IA Deploy Continuous Delivery DEV QA + IA Start Finish Self-service provisioning  Consume portfolios of standardized, policy compliant services. platforms and applications Build Automation  Eliminate manual build environment config/setup  Automate testing during off-hours Environment Promotion  Seamlessly migrate and promote environments from Dev through delivery to desired environments.  Accelerate delivery to cloud or bare metal DEV 29