Pentagon Watchdog: DOD Stumbles in Cloud Computing Plan

It’s one thing to have a plan. It’s another to carry it out.

That’s the message conveyed in an inspector general report regarding the execution of the Defense Department’s cloud computing strategy.

DOD created the plan in July 2012 in an effort to explore and use potential cost savings and benefits in commercial cloud computing.

But the DOD IG audit -- the first in a series -- found Pentagon policymakers did not fully execute numerous elements of the strategy.

According to the IG, the DOD chief information officer “did not develop an implementation plan that assigned roles and responsibilities as well as associated tasks, resources and milestones,” despite promises an implementation plan would directly follow the cloud strategy’s release.

It’s important to note Teri Takai held the position of DOD CIO from 2010 to May 2014, during which the majority of the DOD IG audit took place. Terry Halvorsen became the acting DOD CIO on May 21.

In addition, the IG report states DOD failed to fully develop skills training for acquisition and contract specialists whose job is procuring cloud computing services and developing cloud service broker management capabilities. DOD components, including the U.S. Army, also failed to obtain proper waivers to use non-DOD approved cloud service providers, thereby putting sensitive data at increased risk to adversaries.

“This occurred because the DOD chief information officer did not develop an implementation plan that included assignment of roles and responsibilities and associated tasks, resources, and milestones,” the audit stated. “In addition, the [DOD CIO] did not have a detailed written process for obtaining a cloud computing waiver.”

The net result of DOD’s incomplete execution of its own cloud strategy will be that “DOD may not realize the full benefits of cloud computing such as cost savings, increased mission effectiveness, and increased cybersecurity,” the IG concluded.

DOD officials partially agreed with the recommendations, but justified the lack of an implementation plan after deciding the maturing Joint Information Environment, or JIE, would “cover much of the same material.”

But the audit noted that department officials failed to provide documentation, including a copy of the JIE Master Schedule, to back up their claims.

In addition, DOD officials said the department’s “DOD Cloud Way Ahead” report – an update to DOD’s cloud strategy document – would help it realize cloud computing’s full benefit potential.

DOD officials also stated they began offering cloud acquisition training in June 2014 in an effort to educate and guide acquisition efforts. The DOD CIO is working to publish a supplement to defense acquisition rules for cloud service contracting by September 2015.

The DOD’s retooled cloud strategy suggests the agency is taking a more agile approach to cloud services.

Cloud Contracts Miss Waivers  

The DOD IG’s audit also examined three cloud computing contracts held by DOD agencies in which the cloud provider hadn’t obtained a DOD provisional authorization or been granted a cloud computing waiver from the Global Information Grid, or GIG. DOD authorization certifies cybersecurity requirements at given impact levels have been met.

To date, only a few cloud service providers have made headway handling DOD’s data – even its least sensitive, public-facing data.

Yet, the IG report shows two Army blanket purchase agreements and a National Defense University deal used non-DOD approved cloud service providers and did not obtain waivers because “DOD CIO did not have a documented waiver process for cloud computing,” according to the IG. This inherently led to security risks, the IG said.

“As a result, DOD was at greater risk of not preserving the security of DOD information against cyber threats,” the report stated. “Further, the DOD CIO did not know how the DOD information hosted on the cloud was protected and therefore could not assess the security risk to the GIG.”

In responding to the IG report, the acting principal deputy DOD CIO, Dave DeVries, disagreed DOD components didn’t obtain waivers because they lacked a process for doing so. DeVries said “components were well informed of the requirement through DOD CIO memoranda, DOD cloud forums and meetings,” though he acknowledged documentation could be improved.

The confusion is concerning, and it raises red flags for how DOD components handle cloud computing contracts.

Whether the Army and NDU – which both agreed to apply for waivers per IG recommendations – acted negligently in acquiring cloud services that hadn’t been vetted because they didn’t know the process or did so because it was simply easier for the components to go off the reservation, the DOD IG makes it clear that such instances pose enormous risks DOD’s sensitive workloads.

There’s also a question of fairness. Cloud service providers must invest hundreds of thousands of dollars – in some cases, millions – as well as significant time to ensure they comply with DOD’s rigorous security requirements. 

Whether and how select vendors may be given a shortcut on these security processes screams in the face of an even playing field, and likely leads to increased risk to DOD systems.       

“We were not aware of any compromises of DOD information hosted by a commercial CSP,” the audit stated. “However, according to DOD CIO representatives, commercial cloud computing services were at risk of providing unauthorized access to DOD information because the information was placed outside of the DOD security perimeter.”

(Image via Maksim Kabakou/Shutterstock.com)