RESPONSIVE ENTERPRISE COMPUTING SERVICES

RESPONSIVE ENTERPRISE COMPUTING SERVICES Cloud Solutions A Silver Lining for Intelligence Missions Salient Federal Solutions Proprietary Information For comments or questions regarding this white paper, please contact: Ricky Garris, Senior Director for Operations and Technical Solutions at ricky.garris@salientfed.com. www.salientfed.com Salient Federal Solutions, Inc. Proprietary i

Table of Contents Section/Title Page 1 Introduction... 1 2 Background... 2 2.1 Managing Security and Data Rights... 2 3 Delivering Cloud Services... 3 3.1 Cloud Use Cases... 5 3.2 Cloud Systems Integration Requirements Focus... 5 4 Delivering Cloud Computing Solutions... 6 4.1 Baseline, Plan, and Execute the Enterprise Evolution... 6 4.2 Applying the Right Solution... 7 4.3 Rough Order of Magnitude Estimate... 9 5 Conclusion... 10 6 About Salient Federal Solutions... 11 Salient Federal Solutions, Inc. Proprietary i

1 Introduction This paper provides a perspective on Cloud Computing as applied to Intelligence Community (IC) enterprises with an approach to realize tangible benefits that include reduced information technology capital and operating costs while enabling simplified, flexible, and agile infrastructure management. The Cloud phenomenon involves multiple perspectives such as public clouds, hybrid clouds, and private clouds, all described in this paper. Cloud Computing is evolving quickly as a computer science practice and discipline given the twin pressures of reduced budgets and the need for greater efficiency, which have led the Federal Government to advocate Cloud Computing as a solution whenever possible. This computing framework or idea has actually been around for several years conceptually where implementation practices have continued to evolve. The name Cloud Computing was derived from the implementation principal that data and applications exist on a "cloud" of web servers and services. Most often, servers and computing platforms do not operate at full design capacity, resulting in less than efficient use of technology investments and minimizes return on investment (ROI) compared to information technology (IT) potential. In most data centers the result is unused processing power going to waste. Single threaded IT solutions comprised of applications, application servers, and storage systems are often acquired or assembled together as a system. The new system is purchased to satisfy specific mission operational needs versus leveraging existing enterprise data center assets with unused capacity to meet the operational needs. Reducing IT investment costs is one of many incentives for managing enterprise IT infrastructures more efficiently and satisfying user needs in a more timely and cost-effective manner. Most IC organizations operate in protected private cloud environments. The capability to effectively provision custom applications, commercial-off-the-shelf (COTS) applications (to include managing enterprise license agreements for approved commercial products) along with computing assets, offers the opportunity to optimize efficiency, improve productivity, and contain IT investment costs. Cloud Computing can be considered a philosophy for managing an IT infrastructure more effectively and when coupled with proven implementation methods and applied technologies, the tangible results can be amazing. Tangible benefits of Cloud Computing are: Reducing the physical space requirements for data centers and operating costs (power/hvac) Implementing the capability to monitor, meter, and detect performance Issues resolution by way of implementing enterprise core services and web services to effectively manage your IT portfolio Un-tethered access to applications and data from any CONUS or OCONUS location using mobile devices Security benefits associated with managing enterprise firewall configuration baselines to mitigate vulnerabilities (e.g., intrusion detection and prevention), and securing data flows and access controls applicable to Cloud governance Energy efficiencies resulting in optimizing data center space and lowering carbon footprints. The following sections of this white paper explore the key cloud services and introduce a blueprint to enable Cloud Computing in the IC. Beyond Cloud Computing, autonomic computing is on the horizon and features self-managing and self-healing capabilities featuring the ability to monitor itself while following measures to prevent, contain, or repair system problems Salient Federal Solutions, Inc. Proprietary 1

automatically. If autonomic computing evolves to mainstream use over the next decade as predicted by most computer science experts involved in autonomic computing research, it could eliminate the need for many hands-on IT services support personnel. The evolution continues. 2 Background The National Institute of Standards and Technology (NIST) defines Cloud Computing as a model for convenient, on-demand, network access to a shared pool of configurable computing resources (e.g., applications, servers, storage, networks, and services) that can be rapidly provisioned and deployed with minimal management effort or service provider attention. This definition is largely supported within the computer science industry. For a common understanding of Cloud Computing, it is helpful to view any cloud system as an enterprise information system with a front-end and a back-end, with both ends interfaced via a network (e.g., mobile or wireless networks and/or fixed points of presence that might be geographically disbursed). The front-end of the enterprise system typically includes an operational user s computer and/or mobility device along with the applications required to access the infrastructure and/or accompanying enterprise core services, including web services such as e-mail. The back-end of the system includes various application servers and data storage systems that create a "cloud" of computing capabilities. It is common place to partition a physical server into multiple logical servers, each running an independent operating system, commonly known as server virtualization. Virtualization has been largely adopted as an asset utilization practice to maximize the output of individual servers across the enterprise. Server virtualization nominally reduces the need for additional physical machines and can help optimize IT infrastructure performance IT virtualization can be confused as a Cloud Computing end state, but it is not. Important to virtualization and the evolution to Cloud Computing is the enablement of a central server or controller or hyper-visors that administer the enterprise system, monitoring the data and information traffic and user computing demands to assure the network technology runs efficiently. This only works by establishing and following protocols and standards while using middleware to enable the networked IT assets to communicate with each other. Cloud Computing is related to grid computing. For example, in a grid system, networked computers access and use the resources of all computers on the network, which have formed or clustered to create super computers to increase computational power that rivaled high-end mainframe super computers more cost effectively. With Cloud Computing systems, networked access to and utilization of computing assets on the network often applies only to the back-end of the enterprise system. In a utility outsourced system or services model, one company pays another to access computer applications or store data under a service contract or service level agreement (SLA) for a specified availability and reliability performance delivery. This business model applies easily to cloud public services, which have become common place from online services providers such as Google, Microsoft, and Amazon. 2.1 Managing Security and Data Rights A chief concern with Cloud Computing is data security and data rights management for information sharing, collaborating, and IT hosting. Identity management and privacy are concerns for the banking, finance, and healthcare market sectors but these concerns are obviously shared by the IC. The idea of sharing or transferring important data to another Agency or company in the form of a shared service is often a major concern for data owners; therefore, Salient Federal Solutions, Inc. Proprietary 2

Government and corporate executives hesitate with embracing Cloud Computing services and systems that span enterprise boundaries. Their primary concern is keeping proprietary information properly controlled along with assuring high reliability and data integrity. From a commercial public cloud perspective, companies such as Microsoft, Yahoo, and Google benefit from establishing reliable and advanced security safeguards for their web services to protect user data and assure robust computing infrastructure availability. If users can log in from any location to access data and/or applications from the web, it's possible that the user s identity or credentials can be compromised without established security safeguards. Security safeguards commonly used to protect data are authentication techniques and employing authorization formats so that each user can access only the data and applications relevant to their needs. Both methods have been employed effectively in the IC. Salient suggests a role-based and attributebased access control security services approach based on our experiences in the IC for implementing IC private clouds that facilitate the need to share. 3 Delivering Cloud Services Figure 1 illustrates three primary cloud delivery services currently defined by the industry: Software-as-a-Service (SaaS); Platform-as-a-Service (PaaS); and Infrastructure-as-a-Service (IaaS), and examples of public, private, and hybrid clouds. From these services, depending on specific needs, private and hybrid cloud approaches are more likely to be used by the IC. Figure 1. Common Cloud Delivery Services Figure 2 illustrates the five evolutionary steps for cloud implementation or maturity: Salient Federal Solutions, Inc. Proprietary 3

1. Consolidation Baselines the infrastructure and consolidates servers, storage, networks, and applications with the goal of reducing unintended redundancy, eliminating wasted space, and increasing existing portfolio efficiencies. Planned upgrades or in-flight technology refreshes would continue during this step. 2. Virtualization Establishes the foundation for cloud architectures. As a critical enabler for aggregating all data center resources, virtualization creates a unified platform or pool of assets (at different abstractions such as servers and storage devices) that can be shared by applications and user loads as opposed to discrete system threads. As a result, the physical IT infrastructure is decoupled from the applications and services to be hosted to allow a framework for greater flexibility, efficiency, and infrastructure performance productivity. 3. Services Definition Identifies the service(s) an organization intends to provide within the cloud. As the most critical step, this is where core enterprise services and web services must be defined and evolved. When defined, cataloged, and implemented, services facilitate the orchestration between the front-end and the back-end of the cloud infrastructure. 4. Automation Optimizes virtualized IT assets to enable control and reduces labor workflow processes for improved run-time efficiency. Service levels and success factors are also defined and updated to monitor and measure tangible performance aspects for the enterprise. 5. Cloud Computing Enables seamless communication between previously separated systems and between IC enterprises. This is accomplished as networks are federated to facilitate asset sharing and the movement of computing and data loads between private clouds which would enable a systems cloud framework. Figure 2. Salient Steps to Cloud Computing Evolution Salient Federal Solutions provides a proven systems development life cycle (SDLC) methodology (Figure 3) that is adaptable for delivering each step of the Cloud Computing evolution and is tuned for agility and incremental success. We formulate and design enterprise architecture solutions to capitalize on and leverage prior IT resource investments in legacy technologies, while successfully implementing new or improved functional capabilities critical to mission agility and sustained mission success. The key attributes and features of our methodology include the ability to define and link strategic business and operations planning objectives and user requirements with organizational workflows, services and technology delivery, and support capabilities. This methodology is easily adapted to organizational business governance processes and decision boards that exist to facilitate and improve decision support, manage and reduce costs, enhance compliance with reporting and security guides, bring new systems on board, foster communications while mitigating risks, and reduce configuration and change management complexities. Salient Federal Solutions, Inc. Proprietary 4

Figure 3. Salient s Proven SDLC Methodology 3.1 Cloud Use Cases Enterprise cloud use cases are useful for enterprise considerations and notionally consist of the aspects depicted in Table 1. These use cases provide context for developing the strategy and implementation plans and were developed by the Cloud Computing Use Case Discussion Group, which leverages experiences from various public domain experiences. USE CASE TABLE 1. CLOUD USE CASE * DESCRIPTION End Users to Cloud Applications running on the cloud and accessed by end users Enterprise Cloud to End Users Applications running in the public, hybrid, or private clouds accessed by employees and customers Enterprise to Cloud Cloud applications integrated with internal IT capabilities Enterprise to Cloud to Enterprise Cloud applications running in the public or private cloud that are interoperable with stakeholders or mission partner applications Private Cloud A Cloud hosted by an Agency or organization inside the organization s firewalls Changing Cloud Vendors An organization using cloud services that decides to switch cloud service providers or add new providers this might include private cloud enterprise license agreements Hybrid Cloud Multiple clouds that work together (combination of public and private clouds coordinated by a cloud broker that federates data, applications, user identities, security, and other details.) *Source: Cloud Computing Use Case Discussion Group 3.2 Cloud Systems Integration Requirements Focus The general requirements for integrators to focus on that cross-cut all use cases are defined in Table 2, which are important considerations consistent with evolving to Cloud Computing enterprises. Salient Federal Solutions, Inc. Proprietary 5

TABLE 2. REQUIREMENTS FOCUS AREA * REQUIREMENT DESCRIPTION Cloud Management Location Awareness Common Virtual Machine Formats, Data Formats, and APIs Security *Source: Cloud Computing Use Case Discussion Group Cloud Computing is not feasible without services management, governance, metering, monitoring, federated identity, service level agreements, data applications federation, and life cycle management Identifying the physical location of machines hosting the cloud infrastructure is required to support government regulations Virtual machines, data and applications created for one private enterprise, if intended for crossenterprise cloud usage, should run on another cloud enterprise without need for changes Security in Cloud Computing is vital for the IC stakeholders. Security and levels will vary depending on application, data types, and classification guidelines 4 Delivering Cloud Computing Solutions Salient s engineers and systems analysts create complex enterprise computing solutions using an enterprise s portfolio of assets to the extent practical, sound planning, and technology implementation as appropriate to provide needed flexibility for dynamic future requirements. We make sense of confusing buzz-words, the industry hype, and commercialism. We establish architecture-level measures of performance that are relevant such as availability with associated quality controls and also conduct trade studies and evaluations of various implementation alternatives and technologies to produce a sound execution strategy and enablement road map. Our team defines functional workflows and/or improvements with the customer to determine the optimum solutions, and the right resources, options, with identified risks to meet best value decisions that complete the organization s mission IT-strategy and infrastructure effectiveness. As previously described and summarized here, Cloud Computing represents an evolutionary phase, in progress for over a decade with respect to systems architecture. The Cloud is an architectural model that employs many of the same components currently used in datacenters around the world for achieving flexible, responsive, and efficient IT infrastructures. The key is how these components are integrated via a dynamic control plane that helps the architecture interpret and provision rapidly in response to the changing requirements of users functional applications and data management needs. The dynamic control plane must intercept traffic as it traverses the cloud, interpret the data, and instruct the cloud architecture on how to connect the user to the appropriate application instance. The Cloud must be designed with security and elastic attributes (e.g., scalability, adaptability, extensibility, and manageability) and these attributes must be continuously assessed. 4.1 Baseline, Plan, and Execute the Enterprise Evolution The cloud architecture template in Table 3 represents a modular, reusable, mission-relevant framework that leverages established open technology standards to enable the access, integration, and on-time delivery of an enterprise cloud, and equally important, the data services throughout the enterprise and across enterprise domains at the proper security levels. The array of various enterprise services defined enable the ability to access, integrate, cleanse, and deliver data regardless of data location or structure while evolving to a reliable Cloud Computing environment. This approach greatly simplifies an organization s ability to achieve a single, consistent view of all disparate enterprise and cross-enterprise holdings to capitalize on managing and accessing information in a timely manner. Using Salient s expertise and SDLC methodology we can assess relevant technology forecasts, technology maturity, and applied research scenarios. Salient s lessons learned in delivering Salient Federal Solutions, Inc. Proprietary 6

SECURITY ARCHITECTURAL BUSINESS PROCESS ORGANIZATIONAL Cloud Solutions A Silver Lining for Intelligence Missions complex, mission-critical, services-based enterprise solutions at the National Geospatial- Intelligence Agency (supporting the Geospatial Information Management System as part of the GeoScout Program), as well as other relevant national security delivery programs, has resulted in our Enterprise Services Evolution Model which is depicted in Table 3. These evolutionary categories serve as your road map to guide the way ahead and assess tangible progress. Salient couples this framework with our architecture template described in Section 4.2 to enable the services and automation necessary for successful Cloud implementation. TABLE 3. SALIENT S ENTERPRISE SERVICES EVOLUTION MODEL RIGID REACTIVE DEFINED ADAPTIVE OPTIMIZED Stove piped organizations No view for service funding mode Local or functional level of authority/autonomy Enterprise level governance framework established along with business rhythms Services model defined Establish & embed benchmarks in management reporting Manage to SLAs Communications amongst directorates flows freely Service funding model complete, in place, and running Agile organization capable of quick response to changing mission needs No relation of process to IT strategy Long reaction cycles Departmentally focused Static Business Processes Advancing appreciation of strategy in process improvement Reaction improves to hours Assets orchestration and foundations in place Consistent alignment of strategy considerations Allocation of process impacts to strategy Enterprise level processes and workflows some automated Fully transitioned from functional to process focus Availability and timeliness attributes improve response times from hours to minutes or seconds Key processes flow seamlessly across departments fully automated Updates to processes are quick and often don t require code changes (i.e. composition) IT projects are built on an ad-hoc basis in response to business needs Lots of redundant efforts Minimal technical standards Service enabled legacy applications Layered architecture, some standardization Roadmap for transition in place Re-usable service library of core services with growing number of loosely coupled services Common computing environment available on demand Integration of workflows and services orchestration Runtime governance and policy validation framework deployed Virtualization of infrastructure services Dynamically reconfigurable service Data sharing crosses technical + functional boundaries Independent security silos Multiple systems logins Conceptual centralized security design in development Limited Single Sign On capability discrete security layers and systems Centralized security framework supporting virtual enterprise Data rights and federated data holdings defined and managed Security framework in place including service + component level authentication, auditing, adjudication Single Sign On to multiple networks/systems concurrently Secure data sharing across network systems at multiple security levels 4.2 Applying the Right Solution Instead of installing a suite of software for each network computer, imagine loading one application. That application would allow users to log into a public, private, or hybrid web-based service that hosts or accesses all the programs a user would need for his or her job. Back-end enterprise system machines would run everything from e-mail to word processing to complex data analysis programs from the data centers. In a Cloud Computing system, there's a significant workload shift. When it comes to running applications, local computers no longer have to do the heavy lifting because the network of Salient Federal Solutions, Inc. Proprietary 7

computers making up the cloud handles the processes. As a result, user hardware and software demands decrease. The only application a user needs is the Cloud Computing system s interface software to access the middleware, which can be as simple as a web browser; the cloud s network handles the rest. Figure 4 illustrates a notional Cloud architecture template highlighting the critical services definitions needed for successful evolution to a private cloud enterprise. Figure 4. Template for Enterprise Services Evolving to Cloud Computing Core enterprise services such as Discovery, Security, Metadata, and Infrastructure, all supporting business process management, serve to orchestrate enterprise activities between data sources, infrastructure assets, and data consumers via web services and business intelligence tools. The core services insulate data consumers from the underlying data and the inherent complexity associated with data structures, formats, and access mechanisms while facilitating access to analytic tools and collaboration services. The template provides a single interface for the propagation of changes to applications, data sources, metadata, the data itself, or finished intelligence products, thus preserving content integrity. Finally, through orchestration workflow automation, the supporting IT infrastructure is managed and optimized and network performance is instrumented and monitored to assure critical performance metrics and quality of services are sustained. Figure 5 depicts a security management services model, as a service definition example, that facilitates role-based access controls and attribute-based access controls to authorize and authenticate people, information objects, and policies, and address data at rest and data in transit ownership and rights management. This model applies to the IC need to control access for associating people with information and providing the conveyance for the security policy rules Salient Federal Solutions, Inc. Proprietary 8

engine to rapidly configure or update the access controls as needed to assure flexibility. PKI certificates as a transport conveyance are being implemented across the IC. Figure 5. Security Service Framework Key Cloud Enabler 4.3 Rough Order of Magnitude Estimate The following program plan of action and rough order of magnitude cost and schedule estimate is provided for engineering and integration services necessary to achieve the evolution to initial operational capability of the enterprise cloud. Our five-step Cloud Computing implementation (illustrated in Figure 2 on page 4) is recommended to evolve current-state computing systems to a Cloud Computing system. Our steps include Consolidation, Virtualization, Services Definitions, Automation, and Cloud Computing (initial operating capability or IOC) for a private enterprise cloud with associated inter-agency stakeholder interfaces that span beyond the enterprise boundary. The Consolidation, Virtualization, and Services Definition steps will require an estimated 18 months to accurately baseline and, in some cases, pilot or implement each of the three phases pending the availability of funding. The expertise required for a Cloud Computing implementation, includes the following: Program Manager (1) Lead Solution Architect (1) Lead Information Systems Security Engineer (1) Lead Systems Engineer (1) Lead Data Architect (1) Lead Network Engineer (1) Lead Applications Engineer (1) Senior API Software Engineers (5) Lead Configuration Manager (1) Quality Control Specialist (1) Systems Administrators (3) Network Administrators (3) Database Administrators (3) Senior Technical Writer (1) The rough order of magnitude price estimate (assuming Firm Fixed Price/Level of Effort) for Steps 1 through 3 is: $4.75M for the 18-month effort needed. The same cadre of engineering and program management talent would be necessary for the Automation and Cloud Computing steps (Steps 4 and 5), which would follow. These phases would also require technology supplier support from applicable vendors. This follow-on effort Salient Federal Solutions, Inc. Proprietary 9

would be scoped in detail during the Consolidation, Virtualization, and Services Definition steps, working jointly with the Government and their appropriate technology suppliers to determine an accurate aggregated cost, schedule, and performance estimate. 5 Conclusion Cloud Computing is becoming the dominant platform for government enterprises. Analysis of the market and research indicates that government spending on Cloud Computing will exceed $1.4 billion by 2015 with a compounded annual growth rate of 23 percent, equating to five times the overall federal IT spending growth rate. SaaS, PaaS, and IaaS offer Agencies the opportunity to build and test innovative solutions that deliver services in less time with minimal cost. No matter which Cloud services alternatives make the best sense for IC missions, the benefits are quickly becoming clear. With its Cloud-first approach, the federal government supports moving to Cloud Computing infrastructures as quickly as possible. In October 2010, Federal CIO Vivek Kundra stated that Cloud Computing services help to deliver on this Administration s commitment to provide better for the American taxpayer by making government more efficient. Salient Federal Solutions understands the IC domain and can identify the type of Cloud that makes the best sense for complex IC enterprises. We feature an agile team with the necessary IC domain experience to help assure the Cloud evolution is successfully planned, executed, and operationalized. Moving to the Cloud brings many time- and cost-saving benefits, but one size does not fit all. The type of Cloud(s) ultimately selected for implementation has much to do with the importance of the mission, but also with the relative importance of fundamental issues such as budget, network availability, data portability, security, data transfer and data rights, metrics for performance management, as well as strategic and tactical enterprise infrastructure scalability. Salient Federal Solutions, Inc. Proprietary 10

CORE CAPABILITIES CORE DOMAINS Cloud Solutions A Silver Lining for Intelligence Missions 6 About Salient Federal Solutions Founded in 2009 by the former management team of SI International, Salient Federal Solutions, Inc. is headquartered in Fairfax, Virginia with 16 offices and more than 140 locations throughout the United States and overseas. Numbering 800 employees, we are a leading provider of Federal IT and engineering solutions that enable government and industry to respond quickly to new or emerging mission requirements with the right people, skills, expertise, and technical solutions. By providing a full range of services in the core domains of Intelligence, Defense, Homeland Security, and Cyber Security, we accelerate mission results by delivering highly adaptable solutions through technology and engineering services. Our expertise enables our customers to rapidly meet the pressing requirements of today, while anticipating tomorrow s evolving challenges. During mid-2010, Salient launched its plan to become a significant industry force through the acquisition of SGIS, a $100 million Federal IT services company. Recently, Salient acquired Command Information and its wholly-owned subsidiary AnviCom, a premier provider of netcentric information technology services and solutions with CMMi-3 certification for software development and engineering. Figure 6 summarizes our markets and core competencies. Figure 6. Salient Federal Markets Served and Core Capabilities INTELLIGENCE DEFENSE HOMELAND SECURITY CYBER SECURITY Intelligence Analysis Watch Office HUMINT/SIGINT/IMINT Information Technology/Engineering Information Assurance Training Logistics Enterprise Services Management Space Solutions Global Telecommunications Long Haul Satellite Telecommunications Cyber Analysis/Malware IPV6 Distinction in Cyber Security Software Development and Maintenance Salient Federal Solutions, Inc. Proprietary 11