Pentagon Watchdog: DOD Stumbles in Cloud Computing Plan

Maksim Kabakou/Shutterstock

An inspector general found Pentagon policymakers did not fully execute numerous elements of the strategy.

It’s one thing to have a plan. It’s another to carry it out.

That’s the message conveyed in an inspector general report regarding the execution of the Defense Department’s cloud computing strategy.

DOD created the plan in July 2012 in an effort to explore and use potential cost savings and benefits in commercial cloud computing.

But the DOD IG audit -- the first in a series -- found Pentagon policymakers did not fully execute numerous elements of the strategy.

According to the IG, the DOD chief information officer “did not develop an implementation plan that assigned roles and responsibilities as well as associated tasks, resources and milestones,” despite promises an implementation plan would directly follow the cloud strategy’s release.

It’s important to note Teri Takai held the position of DOD CIO from 2010 to May 2014, during which the majority of the DOD IG audit took place. Terry Halvorsen became the acting DOD CIO on May 21.

In addition, the IG report states DOD failed to fully develop skills training for acquisition and contract specialists whose job is procuring cloud computing services and developing cloud service broker management capabilities. DOD components, including the U.S. Army, also failed to obtain proper waivers to use non-DOD approved cloud service providers, thereby putting sensitive data at increased risk to adversaries.

“This occurred because the DOD chief information officer did not develop an implementation plan that included assignment of roles and responsibilities and associated tasks, resources, and milestones,” the audit stated. “In addition, the [DOD CIO] did not have a detailed written process for obtaining a cloud computing waiver.”

The net result of DOD’s incomplete execution of its own cloud strategy will be that “DOD may not realize the full benefits of cloud computing such as cost savings, increased mission effectiveness, and increased cybersecurity,” the IG concluded.

DOD officials partially agreed with the recommendations, but justified the lack of an implementation plan after deciding the maturing Joint Information Environment, or JIE, would “cover much of the same material.”

But the audit noted that department officials failed to provide documentation, including a copy of the JIE Master Schedule, to back up their claims.

In addition, DOD officials said the department’s “DOD Cloud Way Ahead” report – an update to DOD’s cloud strategy document – would help it realize cloud computing’s full benefit potential.

DOD officials also stated they began offering cloud acquisition training in June 2014 in an effort to educate and guide acquisition efforts. The DOD CIO is working to publish a supplement to defense acquisition rules for cloud service contracting by September 2015.

The DOD’s retooled cloud strategy suggests the agency is taking a more agile approach to cloud services.

Cloud Contracts Miss Waivers  

The DOD IG’s audit also examined three cloud computing contracts held by DOD agencies in which the cloud provider hadn’t obtained a DOD provisional authorization or been granted a cloud computing waiver from the Global Information Grid, or GIG. DOD authorization certifies cybersecurity requirements at given impact levels have been met.

To date, only a few cloud service providers have made headway handling DOD’s data – even its least sensitive, public-facing data.

Yet, the IG report shows two Army blanket purchase agreements and a National Defense University deal used non-DOD approved cloud service providers and did not obtain waivers because “DOD CIO did not have a documented waiver process for cloud computing,” according to the IG. This inherently led to security risks, the IG said.

“As a result, DOD was at greater risk of not preserving the security of DOD information against cyber threats,” the report stated. “Further, the DOD CIO did not know how the DOD information hosted on the cloud was protected and therefore could not assess the security risk to the GIG.”

In responding to the IG report, the acting principal deputy DOD CIO, Dave DeVries, disagreed DOD components didn’t obtain waivers because they lacked a process for doing so. DeVries said “components were well informed of the requirement through DOD CIO memoranda, DOD cloud forums and meetings,” though he acknowledged documentation could be improved.

The confusion is concerning, and it raises red flags for how DOD components handle cloud computing contracts.

Whether the Army and NDU – which both agreed to apply for waivers per IG recommendations – acted negligently in acquiring cloud services that hadn’t been vetted because they didn’t know the process or did so because it was simply easier for the components to go off the reservation, the DOD IG makes it clear that such instances pose enormous risks DOD’s sensitive workloads.

There’s also a question of fairness. Cloud service providers must invest hundreds of thousands of dollars – in some cases, millions – as well as significant time to ensure they comply with DOD’s rigorous security requirements. 

Whether and how select vendors may be given a shortcut on these security processes screams in the face of an even playing field, and likely leads to increased risk to DOD systems.       

“We were not aware of any compromises of DOD information hosted by a commercial CSP,” the audit stated. “However, according to DOD CIO representatives, commercial cloud computing services were at risk of providing unauthorized access to DOD information because the information was placed outside of the DOD security perimeter.”

(Image via Maksim Kabakou/Shutterstock.com)

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.