Paratroopers with the 25th Infantry Division establish communications during an exercise at Joint Base Elmendorf-Richardson, Alaska, on March 18, 2015. U.S. Air Force photo/Alejandro Pena
The US Military Gets A Guidebook to the Cloud
DISA rolls out a collection of best practices for a Pentagon herding its myriad information services toward their cloud-based future.
The Defense Department’s information technology arm has unveiled a guide for IT shops in the defense and military space planning a move to the cloud.
Released by the Defense Information Systems Agency, the guide is aimed at DOD “mission owners” wanting to migrate an existing information system from a physical environment to a virtualized cloud environment. The framework is based on real-world cloud pilot efforts within DOD.
The contents are not official DOD policies, security requirement guides or security technical implement guides, but rather “a collection of best practices discovered during the DOD [chief information officer] cloud pilots effort for the benefit of the DOD community.”
(See also: Top-Down IT Approach Too Slow To Meet Threats)
While somewhat technical, the best practices guide is worth a read. It contains a short intro to the cloud, impact-level requirements, a breakdown of available cloud services and a detailed section dedicated to understanding shared security responsibility within the cloud – vital reading considering the recent data breach headlines.
A portion of the document also details how to achieve high availability (i.e. limited downtime) and the importance of the risk management framework, which recently became DOD’s default model for information security.
Finally, there’s also a “useful tips/lessons learned” section that highlights common problems cloud mission owners will run into, including what instance types to deploy, how to deploy a Web front-end server and how to estimate bandwidth usage.
The latter is important because, as the document points out, estimated bandwidth usage-based billing “can be difficult,” and it’s better to overestimate than underestimate it.