DOD & Cloud Computing: Rapid Access Computing Environment (RACE) A Case Study

Transcription

1 DOD & Cloud Computing: Rapid Access Computing Environment (RACE) A Case Study Henry J. Sienkiewicz Technical Program Director Computing Services Digital Government Institute s Cloud Computing Conference December 2009

2 Defense Information Systems Agency: Vision & Mission Vision Leaders enabling information dominance in defense of our Nation Mission DISA, a Combat Support Agency, engineers and provides C2 capabilities and enterprise infrastructure to continuously operate and defend a global netcentric enterprise in direct support to joint warfighters, National level leaders, and other mission and coalition partners across the full spectrum of operations Network Services Program Executive Offices Computing Services

3 Defense Enterprise Computing Centers (DECC) Maintenance Command and Control Medical 4,000,000+ users 2,900+ Computing Services team members 14 facilities 445,000 sq ft raised floor 34 mainframes 6,100 servers 3,800 terabytes of storage 2,800 application / database instances 215 software vendors Financial Logistics

4 The Cloud A model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. (NIST) Acquisition Model: Based on purchasing of services Business Model: Based on pay for use What s new? Access Model: Over the network to ANY device Technical Model: Scalable, elastic, dynamic, multitenant, & sharable Computing As A Service Source: Gartner

5 Develop & Deploy Within The Decision Cycle Observe Orient Decide Our strength is in our ability to make decisions better and faster than adversaries Web 2.0 technologies accelerate this cycle Software development has to keep up Governance & policy must keep up Act Military Decision Making Cycle Requirement Traditional Approach Procure Code Test Certify 6 Months 6-12 Months 6 Months Total Time to Production Months Cloud Approach 24 Hours 2-6 Months Days 3-6 Months

6 RACE Drivers Why Do It A Combat Support Agency Support faster application development/deployment Reduce hardware provisioning from months to hours Provide standard platforms to encourage standardization Developing under security guidelines reduces implementation delays to retrofit security Reduce development and operating cost Self-service model reduces costs Standardization reduces support costs Centralizing resources in the cloud Improve overall security posture No servers under desks Secure facilities Uniform application of security guidelines

7 RACE: The Solution A Combat Support Agency Increased Speed 24 hour T&D provisioning 72 hour production provisioning Online self service Credit card acquisition Increased Scalability Increase capacity ~ 24 hours Turn On / Turn Off monthly Capacity on demand Reduced Risk No capital dollars needed DECC Infrastructure Develop under DoD IA standards Reduced Cost Pay only for what you need Month-to-month service No annual maintenance fees User Self-Service ~ Standardized

8 Rapid Access Computing Environment (RACE) 1 October 2008 Development/Test 24-hour automated provisioning Customer root access Ability to promote from Dev to Test Standard CSD Operating Environments Minimized and streamlined accreditation Increase capacity ~ 24 hours Month-to-month service Reduced cost Today Production User self-service provisioning within the PRODUCTION environment Ability to promote from test to production Streamlined/Automated accreditation Pre-established inherited IA controls FY10 Initiatives SIPRNet deployment Complete integrate accreditation automation processes Continue to refine RACE Portal Interface with Forge.Mil Projects Complete integration with DISA standardized configuration management system (BladeLogic) User Self-Service ~ Highly Standardized ~ Cost Effective ~ Fast

9 RACE: User Interface

10 RACE: Current Configuration NIPRNet NIPRNet DECC 1 COIN COIN DECC 2 DECC DECC Legacy Production Legacy Production SAN SAN DEV DEV TEST TEST RACE HP SAN

11 DISA Cloud Services Portfolio Data-as-a-Service Software-as-a-Service Forge.mil Software Development Platform/Infrastructure-as-a-Service RACE Compute/Store GCDS Content Delivery

12 Systems Development Life Cycle (SDLC) Applications-As-A-Service: Forge.mil (Software Development) DoD SDLC Analysis Design Planning Implementation Maintenance The logical process used to develop an information system Includes requirements validation, training, and user ownership Works like a library Code checked out, worked on, & checked in First standardized approach to an enormous problem Proven development model Based on the open source community s approach Forge.mil Bits & Pieces Public: Freely available to all DoD users Shared: All DoD users can access the same code development environment for DoD open source and community source software Available: General availability on March 27, 2009 Common evaluation criteria and an agile certification process to accelerate the certification of reusable, net-centric solutions Limited Operational Availability: October 2009 Private: Allows a closed development environment for DoD projects and programs Fee-for-service Availability: October 2009 DoD s Software Development Life Cycle

13 Forge.mil and RACE: Accelerating the Path to Production Production Zone Dashboard, Reporting & Monitoring Cloud Test & Certification Services Build Libraries & Code Repositories T&E Zone Development Zone Developers Testers Users Certifiers Decision Authorities Implementing the platform and services to support evolving governance processes and standards

14 Path To Production The Path To Production offers RACE Customers a migration to production environments and an accelerated C&A process Virtual Operating Environment Migration The Path-to-Production allows users to migrate their Development (Zone B) environments to Limited User Testing (Zone A) environments When Limited User Testing is completed, the customers are able to seamlessly transition to a DECC production environment Accelerated C&A Process Execution Inheritance of the RACE cloud and DECC facility is leveraged to implement IA controls in the VOEs Virtual Operating Environments that are purchased from RACE are pre-hardened, and Developer Friendly Tools that facilitate automation and workflow management of the C&A process such as emass are implemented Environment Promotion to Test Environment Promotion to Production NIPRNet / GIG 14

15 Three Principles The development of the Path-to-Production processes and supporting systems is guided by three primary principles 1 Inheritance & Duplication Analysis Identify controls that can be inherited from the RACE enclave and DECC facilities Implement mechanisms that enable the incorporation of these controls in a seamless manner for RACE customers Identify duplicate documentation that can be eliminated from the C&A workflow 2 Hardened VOEs Implement applicable STIG s and harden Virtual Operating Environments offered in the RACE cloud Reduce the Customer effort to implement these STIG s in the VOE Analyze OS, Web, and database STIGs to identify security settings that will not be implemented in Zone B to provide a developer-friendly environment 3 C&A Process Efficiencies Identify opportunities to enhance the efficiency of the workflow or the execution of checklists Streamline the approval flow of C&A packages, ensuring a scalable solution 15

16 Application Accreditation A Combat Support Agency in RACE Path-to-Production Execution Process Streamlined and automated IA C&A Standard process for customer Accreditation time reduced from 80+ days to 40 days End state objective of 7 days for C&A emass: Enterprise Mission Assurance Support System (emass) : Automates the creation of select DIACAP artifacts Populates DISA s inherited controls into the workflow process Provides customer an advanced, dynamic workflow management tool Promote to Production Test & Development

17 Enabling the Cloud Environment A Combat Support Agency Infrastructure Standardization Consolidation Capacity Services Virtualization Content Delivery Rapid Provisioning Services Software (SaaS) Applications Communications Processes Metrics & benchmarking ITIL Service Level Management (SLM) Security (Certification & Accreditation (C&A)) It s A Journey

18 Current Balancing Security and Usability User Validation Virtualization; servers, firewalls, networks Access Business processes Flexible funding; credit cards, speeding MIPR process Cultural inertia Sharing the vision Convincing Box Huggers Controlling expectations Why can t it.. Future Security optimization Shared accreditation Validation of customer applications Integrating Software as a Service Accessing federated and shared services Varying interpretations of security guidelines Business streamlining Each Service and Agency has unique processes Funding hurdles Capital (Procurement) vs. Operating Challenges and Barriers

19 Lessons Learned A Combat Support Agency Recommendations: Understand that it s a journey Recognize that the infrastructure fundamentals matter Know your marketplace What would you do differently?: More clearly define the marketplace offering Adjust the initial launch Engage with the software developers much earlier in the design What critical success factors?: Return on value analysis

20