 December 2010 US Chief Information Officer Vivek Kundra released the Federal Cloud Computing Strategy. This became to be what is known as “Cloud First” and called for agencies to evaluate cloud-based solutions before making any new investments.  2012 the first 20 cloud migration plans were submitted to the Government Accountability Office for approval.  June 4, 2012 FedRAMP is launched.  July 2012 DoD Cloud Computing Strategy is released.

 Fear!!!!!!!!  Lack of Understanding of the Rules.  FedRAMP  DoD IL 2? 4? 5?  Choosing What is Right.  IaaS  PaaS  SaaS  FedRAMP?

IaaS PaaS SaaS U.S. Government Cloud First Initiative and FedRAMP

IaaS PaaS SaaS SaaS - Software as a Service Management of the full stack up to the application layer and user experience … PaaS - Platform as a Service OS or DB as a Service, aids to logging, monitoring, backup, authentication … IaaS - Infrastructure as a Service Physical servers, virtual machines, Storage systems, network hardware….

To ensure a deployment is FedRAMP compliant, an agency must have in place at least 325 total controls Using a FedRAMP Cloud Services Provider (CSP), an agency can have many of these controls taken care of

When an agency deploys an application in the cloud, they still need to satisfy all 325 total controls Using a FedRAMP IaaS CSP fully takes care of 74 (23%) of them IaaS covers 23% The agency still has to put in place at least 251 controls. PaaS can cover up to 40%, depending on the definition

CONTROLS AN AGENCY MUST DO WITH IAAS Above the IaaS level, an Agency must do these Virus scanning Intrusion detection Log correlation, alerting & review Vulnerability scanning Risk categorization & POA&M management CIS & FIPS compliance scanning Configuration management Maintain audit trail Implement & Test backup & recovery Implement & Test Contingency Plan Implement & Test Incident Response Implement & maintain executable “white lists” Configure application with access banner Change passwords every 60 days Disable inactive accounts after 90 days Alert when atypical Audit execution of privileged functions Lock sessions after 15 minutes of inactivity Impleme Update audited events with threat level Review audit logs at lea Annual security assessment Annual penetration testing Manage Interconnect Maintain baselines for applications Retain copies of past baselines Analyze patches for security before Script to regenerate servers after disaster Script to restore access controls after disaster 251 controls

When an agency deploys an application in the cloud, they still need to satisfy all 325 total controls Using a FedRAMP SaaS CSP fully takes care of 306 (94%) SaaS covers 94% The remainder have to do with an agency implementing FISMA compliant PIV or CAC cards and authorizing its own users

 All Clouds are not created equal.  Choose what makes the most sense for your situation.  Don’t be afraid. Your data is safe.  Know the players. 