ISA 201 Intermediate Information Systems Acquisition

Lesson 21 DoD Cloud Computing Homework Video LESSON INFORMATION*************************************************************************************************** *Lesson Point of Contact: * Name: Ric Nordgren * Phone: 703.805.4874 * Email: ric.nordgren@dau.mil Read Ahead: See Homework folder *Length of Presentation: * Presentation: 2.5 hours Class Exercise: 1.0 hour *ELO ID: ELO 31.1.1.1 Identify the basic terms of Cloud Computing ELO 31.1.1.5 Recognize some DoD Concerns of Using Cloud Services ELO 31.1.1.6 Summarize some Program concerns when purchasing cloud services from a vendor. ELO 31.1.1.7 Identify the advancements in technology that enabled the rise of cloud computing. ELO 31.1.1.8 Recognize the five essential characteristics of a cloud service. ELO 31.1.1.9 Identify the Three Cloud Service Models defined by NIST. ELO 31.1.1.10 Recognize characteristics of Infrastructure as a Service (IaaS). ELO 31.1.1.11 Recognize characteristics of Platform as a Service (PaaS). ELO 31.1.1.12 Recognize characteristics of Software as a Service (SaaS). ELO 31.1.1.13 Describe the problems with Legacy software applications and Cloud. ELO 31.1.1.14 Recognize public, private, community and hybrid cloud deployment models (NIST). Quiz Questions(s) and correct answers(s): (NOTE: see Quiz folder in the Instructor folder) True or False, the 2012 National Defense Authorization Act mandated the Department of Defense move to a “cloud first” policy? Correct Answer: False The _________________________________ specifies “Agencies must focus on consolidating existing data centers, reducing the need for infrastructure growth by implementing a Cloud First policy for services, and increasing the use of available cloud and shared services.” Correct Answer: Federal CIO’s 25 Point Implementation Plan to Reform Federal Information Technology Management Which is/are the purpose(s) of the Cloud Computing Security Requirements Guide? Correct Answer: All of the Above True or False: According to the DoD Chief Information Officer (CIO), DoD components are required to use the Defense Information Systems Agency (DISA) to acquire cloud services. Answer: False Multiple Choice: The _____________ provided cloud services must be considered as part of the Enterprise IT Business Case Analysis (BCA) performed by the Component for cloud services. Answer: Defense Information Systems Agency The __________________________ is intended to give cloud providers a stable security requirement, and to help DoD cloud customers move more rapidly and securely into the cloud. Answer: DoD Cloud Computing Security Requirements Guide Which of the following is NOT a benefit of Cloud Computing per the DoD Cloud Computing Strategy? Answer: De-coupled from private sector innovation What is the desired outcome of DoD’s adoption and use of cloud computing? Answer: All of the above According to the DoD Cloud Computing Strategy, what are the three areas DoD can benefit from by moving to cloud computing? Answer: Efficiency, Agility, Innovation Which is NOT one of the five essential characteristics of a cloud service, according to the National Institute of Standards and Technology Special Publication 800-145? Correct Answer: Fixed Price According to the National Institute of Standards and Technology Special Publication 800-145, what are the three cloud service models? Correct Answer: Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) Using the cloud deployment model definitions from the National Institute of Standards and Technology Special Publication 800-145, what type of cloud deployment model is the Defense Information System Agency’s milCloud? Correct Answer: Private _________________ infrastructures operate in a multi-tenant environment whose resources are allocated for the general public? Correct Answer: Public cloud A __________cloud’s infrastructure is isolated from that of other organizations, thus improving security and privacy.

HOMEWORK Cloud Laws, Policies, Guidance and Standards Cloud Basics Lesson Plan Cloud Laws, Policies, Guidance and Standards Cloud Basics HOMEWORK SLIDE INFORMATION*************************************************************************************************************************** *Slide Type: *Supporting ELOs ID: *Policy / Directive / Standard / DTM ID: ********************************************************************************************************************************************************** Key Points: Key Questions to Ask and Anticipated Answers: Terms \ Definitions \ Acronyms: DoD Cloud Computing

Cloud Computing Laws, Policies, Strategies and Guidance U.S. Chief Information Office developed the 25 Point Implementation Plan to Reform Federal IT directing agencies to default to cloud‐based solutions that are secure, reliable and cost‐effective Agencies must focus on consolidating existing data centers Federal Cloud Computing Strategy – “Cloud First” whenever a secure, reliable, cost-effective cloud option exists DoD’s Cloud Computing Strategy is consistent with Federal Cloud Computing Strategy for accelerating cloud adoption Benefits DoD can derive from Cloud Computing include efficiency, agility and innovation Challenges include governance, continuity of operations, cybersecurity, network dependence, service acquisition, data migration and interoperability ELO 31.1.1.3 Recognize the laws, policies and standards that apply to Cloud Computing MT 3.1 OMB published the “Federal Cloud Computing Strategy” on February 8, 2011, that states “To harness the benefits of cloud computing, we have instituted a “Cloud First” policy. This policy is intended to accelerate the pace at which the government will realize the value of cloud computing by requiring agencies to evaluate safe, secure cloud computing options before making any new investments.“ MT 3.2 On December 15, 2014, the DoD CIO issued a memo entitled, “Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services” to clarify DoD guidance when acquiring commercial cloud services. The DoD CIO also released a Cloud Computing Security Requirements Guide (SRG), Version 1, Release 1 on January 13, 2015 for cloud service providers to comply with when providing the DoD with cloud services. MT 3.3 DFARS subpart 252.239-7010 Cloud Computing Services, has twelve requirements for contracts and Contracting Officers. It provides standard definitions, Cloud computing security requirements, limitations on access to, and use and disclosure of Government data and Government-related data, Cloud computing services cyber incident reporting, malicious software and seven other related provisions. MT 3.4 ISO/IEC 27017 Information Technology: Security techniques and Code of practice for information security controls based on ISO/IEC 27002 for Cloud Services. MT 3.5 December 15, 2014, DoD CIO Memo, “Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services,” mandates that the Enterprise IT Business Case Analysis (PS BCA) be performed on any requested purchase of cloud services and that the DISA Cloud be considered as one of the options. Rationale: Federal Cloud Computing Strategy says “Consistent with the Cloud First policy, agencies will modify their IT portfolios to fully take advantage of the benefits of cloud computing in order to maximize capacity utilization, improve IT flexibility and responsiveness, and minimize cost.” DoD Cloud Computing

Cloud Computing Laws, Policies, Strategies and Guidance The 2012 National Defense Authorization Act mandates DoD CIO submit a plan that includes a strategy to address migration of Defense data and government-provided services from Department-owned to cloud computing services DoD CIO established a mandatory Enterprise IT Business Case Analysis (BCA) for cloud services, Dec 15, 2014 Memo removed DISA as the ONLY cloud service provider a Component may engage for cloud services, mandates DISA cloud services MUST be considered as part of the BCA DoD Cloud Computing Security Requirements Guide (v1 rev2) helps DoD cloud customers move more rapidly and securely into the cloud Per DoDI 5000.02: Program managers will acquire DoD or non-DoD provided cloud computing services when the business case analysis determines that the approach meets affordability and security requirements ELO 31.1.1.3 Recognize the laws, policies and standards that apply to Cloud Computing MT 3.1 OMB published the “Federal Cloud Computing Strategy” on February 8, 2011, that states “To harness the benefits of cloud computing, we have instituted a “Cloud First” policy. This policy is intended to accelerate the pace at which the government will realize the value of cloud computing by requiring agencies to evaluate safe, secure cloud computing options before making any new investments.“ MT 3.2 On December 15, 2014, the DoD CIO issued a memo entitled, “Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services” to clarify DoD guidance when acquiring commercial cloud services. The DoD CIO also released a Cloud Computing Security Requirements Guide (SRG), Version 1, Release 1 on January 13, 2015 for cloud service providers to comply with when providing the DoD with cloud services. MT 3.3 DFARS subpart 252.239-7010 Cloud Computing Services, has twelve requirements for contracts and Contracting Officers. It provides standard definitions, Cloud computing security requirements, limitations on access to, and use and disclosure of Government data and Government-related data, Cloud computing services cyber incident reporting, malicious software and seven other related provisions. MT 3.4 ISO/IEC 27017 Information Technology: Security techniques and Code of practice for information security controls based on ISO/IEC 27002 for Cloud Services. MT 3.5 December 15, 2014, DoD CIO Memo, “Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services,” mandates that the Enterprise IT Business Case Analysis (PS BCA) be performed on any requested purchase of cloud services and that the DISA Cloud be considered as one of the options. Rationale: Federal Cloud Computing Strategy says “Consistent with the Cloud First policy, agencies will modify their IT portfolios to fully take advantage of the benefits of cloud computing in order to maximize capacity utilization, improve IT flexibility and responsiveness, and minimize cost.” DoD Cloud Computing

Cloud Basics and Benefits Lesson Plan Status Cloud Laws, Policies, Guidance and Standards Cloud Basics and Benefits Cloud Computing Definition Concerns with using Cloud Using the Cloud (Assessment & Authorization) Exercise SLIDE INFORMATION*************************************************************************************************************************** *Slide Type: *Supporting ELOs ID: *Policy / Directive / Standard / DTM ID: ********************************************************************************************************************************************************** Key Points: Key Questions to Ask and Anticipated Answers: Terms \ Definitions \ Acronyms: DoD Cloud Computing

What’s the Cloud? Okay, so we know there are Federal and DoD policies and direction to consolidate data centers and move our IT infrastructure to the cloud when it makes fiscal and security sense, but what is “the cloud”? SLIDE INFORMATION*************************************************************************************************************************** *Slide Type: Content *Supporting ELOs ID: ELO 31.1.1.1 Identify the basic terms of Cloud Computing *Policy / Directive / Standard / DTM ID: ********************************************************************************************************************************************************** Key Points: Key Questions to Ask and Anticipated Answers: Terms \ Definitions \ Acronyms: It’s fluffy, it’s hard to grasp, it’s everywhere, I’m not really sure… It’s the means by which we connect all of our computers, mobile devices, smart things together so we can pass data and get our pictures and emails anywhere. It’s a marketing technique DoD Cloud Computing

Basic Cloud Computing Terminology Grid Computing Grid computing is the collection of computer resources from multiple locations, working together to reach a common goal. Virtualization Virtualization is the act of creating a virtual (rather than actual) version of something, including virtual computer hardware platforms, operating systems, storage devices, and computer network resources. Hypervisor Multi-Tenancy SLIDE INFORMATION*************************************************************************************************************************** *Slide Type: Content *Supporting ELOs ID: ELO 31.1.1.1 Describe the basic terms of cloud computing. *Policy / Directive / Standard / DTM ID: ********************************************************************************************************************************************************** Key Points: Key Questions to Ask and Anticipated Answers: Terms \ Definitions \ Acronyms: MT 1.1 “Cloud computing” means storing and accessing data and application programs over the Internet instead of your computer’s local hard drive. MT 1.2 Grid computing is the collection of computer resources from multiple locations, working together to reach a common goal. MT 1.3 Virtualization is the act of creating a virtual (rather than actual) version of something, including virtual computer hardware platforms, operating systems, storage devices, and computer network resources. Virtualization is accomplished by dividing a physical resource into multiple virtual instances of a resource (e.g. compute, storage, and network). These virtual machines might exist across many actual machines. Virtual machines are enabled by the ability to separate the execution of software from the underlying hardware. Virtualization is the “primary” enabling technology behind cloud computing. MT 1.4 The hypervisor creates and manages virtual machines on a single computer. MT 1.5 Bare metal is a single-tenant server. This is you and your laptop. Only one user/tenant is using the resources of this server. This is called a single-tenant server model. MT 1.6 Multi-tenancy allows multiple users or tenants to reside on the same computer. Multi-Tenancy allows for cloud efficiencies. Multi-tenancy can be impacted by the “noisy-neighbor” effect. The “noisy-neighbor” effect is one user impacting the performance and stability of other users within the same server. Multi-tenancy is a design principle allowing a single instance of a computing resource to provide separate environments to serve multiple client organizations. A software application is an example of a shared resource with a co-mingling management capability to ensure each client’s data is protected. MT 1.7 Service-oriented architecture (SOA) is a software design in which application components provide services to other components via a communications protocol, typically over a network. The principles of service-orientation are independent of any vendor, product or technology. SOA is the notion of turning functionalities of existing and new applications into a set of discrete components enabling software vendors to provide their products as services from which clients can use/reuse and combine to satisfy business requirements quickly and easily. The hypervisor creates and manages virtual machines on a single computer Multi-tenancy allows multiple users or tenants to reside on the same computer. DoD Cloud Computing

Service Oriented Architecture SLIDE INFORMATION*************************************************************************************************************************** *Slide Type: Content *Supporting ELOs ID: ELO 31.1.1.1 Describe the basic terms of cloud computing. *Policy / Directive / Standard / DTM ID: ********************************************************************************************************************************************************** Key Points: Key Questions to Ask and Anticipated Answers: Terms \ Definitions \ Acronyms: MT 1.7 Service-oriented architecture (SOA) is a software design in which application components provide services to other components via a communications protocol, typically over a network. The principles of service-orientation are independent of any vendor, product or technology. SOA is the notion of turning functionalities of existing and new applications into a set of discrete components enabling software vendors to provide their products as services from which clients can use/reuse and combine to satisfy business requirements quickly and easily. Service-oriented architecture (SOA) is a software design in which application components provide services to other components via a communications protocol, typically over a network. DoD Cloud Computing

Advancements in technology that enabled the rise of cloud computing The present availability of high-capacity networks and low-cost computers (commodity hardware), together with the adoption of virtualization, widely adopted open standards, and service-oriented architecture, have led to present day cloud computing. Low-cost Commodity Hardware High Capacity (Storage and Processing) Broadband/always-on network access Virtualization (primary enabling technology behind cloud computing) Programmable Infrastructure/Auto-configure (i.e. elasticity) Open Application Program Interfaces Service Oriented Architecture SLIDE INFORMATION*************************************************************************************************************************** *Slide Type: Content *Supporting ELOs ID:ELO 31.1.1.7 Identify the advancements in technology that enabled the rise of cloud computing. *Policy / Directive / Standard / DTM ID: ********************************************************************************************************************************************************** Key Points: Key Questions to Ask and Anticipated Answers: Terms \ Definitions \ Acronyms: MT 7.1 Overall: The present availability of high-capacity networks and low-cost computers (commodity hardware), together with the adoptions of virtualization, widely adopted open standards, and service-oriented architecture, have led to present day cloud computing. MT 7.2 High Speed Networks: We now have pervasive high speed networks to move the “bits.” Broadband. High-speed internet access enabled systems and data to reside separate from one another, while users access them from a third location, possibly across the world. MT 7.3 High Capacity Networks: More Storage Capacity) Cloud services are also able to provide efficient storage and processing of the ever-increasing amount of data that industry collects. MT 7.4 Low-cost commodity technology has allowed increased processor availability leading to cloud. The predominate computer hardware architecture, that the vast majority of all enterprise applications run on, is the Intel X86 and the predominate operating system in use today is Microsoft-based and, to a lesser degree, Linux, which has helped simplify the developer environment, improve efficiencies and lower costs. MT 7.5 Virtualization: Virtualization is a means to divide a physical resource into multiple virtual instances of a resource (e.g. compute, storage, and network). The ability to separate the execution of software from the underlying hardware allows for virtualization. Virtualization is the primary enabling technology behind cloud computing. Most physical servers are estimated to be idle 90% of the time, thus allowing a physical server to host numerous virtual machines on a single physical server. The ability of a network to do this is called Grid Computing. Virtualization is further enabled by multi-tenancy managed by a Hypervisor. MT 7.6 An Application Programming Interface (API) is a doorway to a software application’s services. The API of each software application describes how to open its door to its services. An API is made up of a set of programming instructions and standards for accessing another software application, a Web-based software application or Web tool. A software company releases its API to the public so that other software developers can design products that are powered by its service. These are called Open APIs. Open APIs are descriptions that are open to the public, anyone can understand how to request services. Open APIs are used to integrate, manage, and control virtual resources. Popular open APIs are examples of widely adopted standards. MT 7.7 Programmable Infrastructure (or Infrastructure as Code) are software scripts that can automatically configure a network. This orchestration of configuring network resources on the fly is needed to run your software application on the most efficient set of network resources available at the time. This process automates the job of your typical system administrator so that the developer of your software application can ensure proper infrastructure is always made available without help. To call this infrastructure capability, you need a Web API. Web APIs are the defined interfaces through which interactions happen between an enterprise and applications that use its assets. MT 7.8 Use of Service Oriented Architecture. A service-oriented architecture (SOA) is an architectural pattern in computer software design in which application components provide services to other components via a communications protocol, typically over a network. The principles of service-orientation are independent of any vendor, product or technology. The notion of turning functionalities of existing and new applications into a set of discrete components enabling software vendors to provide their products as services from which clients can use/reuse and put together to satisfy business requirements quickly and easily. The primary example of web services via SOA is Web 2.0. Advances in web technologies, such as RSS, Blogs, Portals, Wikis, XML, Web Services help organizations offer their information as sets of easily accessible services. DoD Cloud Computing

The next slide is the in-class quiz and indicates which slide has the answer on it. These two slides need to be removed before packaging the file for homework. DoD Cloud Computing

In-Class Quiz Team 1 Slide 5 Team 2 Slide 5 Team 3 Slide 5 Team 4 True or False: According to the DoD Chief Information Officer (CIO), DoD components are required to use the Defense Information Systems Agency (DISA) to acquire cloud services. Slide 5 The _____________ provided cloud services must be considered as part of the Enterprise IT Business Case Analysis (BCA) performed by the Component for cloud services. Team 2 Slide 5 Team 3 The __________________________ is intended to give cloud providers a stable security requirement, and to help DoD cloud customers move more rapidly and securely into the cloud. Slide 5 SLIDE INFORMATION*************************************************************************************************************************** *Slide Type: *Supporting ELOs ID: ELO 31.1.1.1 Identify the basic terms of Cloud Computing *Policy / Directive / Standard / DTM ID: ********************************************************************************************************************************************************** Key Points: The intent is to reinforce the information contained in the readings and to generate discussion. Have each team take no more than 5 minutes to “research” and develop an answer. Go around the class and get volunteers from each team to answer the question – encourage discussion pertaining to the question. Key Questions to Ask and Anticipated Answers: Terms \ Definitions \ Acronyms: Answers to the Questions: Team 1: False – Previously DISA was the cloud broker and agencies believed they had to go to DISA. DoD CIO Terry Halvorson clarified in his Dec 2014 memo that DISA’s milCloud has to be considered as an alternative as part of the BCA. Team 2: DISA. The DoD CIO Memo from Dec 2014 specifically states that DISA milCloud must be considered as an alternative in the BCA. Team 3: DoD Cloud Computing Security Requirements Guide. DoD CIO Dec 2014 memo states this. Team 4: De-coupled from private sector innovation is NOT a benefit. Cloud computing couples it. Directly from the DoD Cloud Computing Strategy. Team 5: Agility, Innovation and Efficiency. Straight out of the DoD Cloud Computing Strategy. Which of the following is NOT a benefit of Cloud Computing per the DoD Cloud Computing Strategy? De-coupled from private sector innovation; Enables improved asset utilization; Allows for near-instantaneous increases and reductions in capacity; Shifts focus from asset ownership to service management Slide 4 Team 4 Team 5 According to the DoD Cloud Computing Strategy, what are the three areas DoD can benefit from by moving to cloud computing? Slide 4 DoD Cloud Computing