Security Clan Chat: Government Backs Away from the Cloud

Thanks for hanging in there, Chris.  You gave me some food for thought.

Well, thanks for making my day go.  I was quite tired of updating my storm tracker, so I decided to see what the boards were about!  Been ages.  Just like Michigan; Great Lakes, Great Times.

Ciao IE.

Did it really though?  It's easy for the cyber bourgeoisie to believe that would spurn something, but the proletariat is oft forgetful and prone to being complacent.

The kind of huge loss of credit card info which the Sony breach initially seemed to threaten would concentrate minds.  Hundreds of thousands of people canceling their credit cards.

Much like anything, it will take a generational growth, for we as people to realize our vulnerabilities in an anonymous world.  A quick Google search, highlights one organization touting basic cyber security knowledge that will be taught in schools.  I mean, we have driving education in schools, and more people have access (especially under the age of 16 :P) to a computer than a car.

Defintely, it's not in the publics mind

The main reason for this, is the consumer.  We don't ask, or 'require' it.  I mean lets be honest.  How many people use the same exact user name and password for most of the online forums, or shopping websites?  I think it would be fair to say that most do.  I'm also quite certain that the IE servers are not as secure as say Amazon's or Ebay's.  But if you follow my logic, you clearly see the gaping security risks that an 'atypical' user subjects themselves to. Most users have the 'won't happen to me' syndrome when it comes to online identity theft, because to them, it is a very distant thing.  It's intangible unlike their credit card or drivers license.  While we can posit on security breakthroughs, we are in the vast minority.  Vast. 

Quite definitely, Kim. 

Chris, is it fair to say that the private sector is steaming forward with commercial applications for tech, but still falling behind on security?

Why, history is cyclical.  Can we not make suppositions that the same will have to take effect?  Perhaps that is the part of the problem, people focus on retrospect far too much.  We have the evidence to support it, we see symbiotic growth around us all the time.  We realize it now.  Yet it is the pace of the growth which is the issue, I am pertaining to.  The government is falling behind, while the market is steaming forward.  This lapse will lead to something, yes possibly that Kim.  This 'lapse' whatever it will be, will lend itself to the next arm of the government.  At least in my eyes. 

Great analysis Chris.  When you talk about a catalyst, are you thinking of a really serious security breach?  Like the national grid being taken down?

But that's the kind of realization we can only come to way after the fact.

Chris, really interesting points regarding government intervention and creativity.

The biggest problem facing the State is this question: How do you handle annonymity versus accountability? We scream red in the face to protect the anonymity that the internet gives us, but that runs counter intuitive to accountability, which is a primary concern of the state.

Guess who is back... me.

Very interesting Chris

But in a nutshell, it does all of the above.  It's the perfect conundrum.  The problem is that there were catalysts for most of the state to market growth.  For the Cloud and increasing technological concerns (as we grow with it), it will take a catalyst of some accord to spark the state into thinking large and give birth to new innovation and technology.

Kinda synopsis.  In the American experience, despite political rhetoric,  state and market development go hand in hand. One only has to look at the Homestead Act, GI Bill, Land Grant Act (which gave rise to our extensive university system), etc. to see that federal power and investment (especially in railroads during the 19th century, and later highways and infrastructure in general) spurred economic development. The rise of the federal patent system, coupled with extensive investment in universities created innovation and fostered market development. The rise of the TVA brought electricity and economic productivity to a once maligned and marginalized part of the country.

I'm still here -- but I'll be right back. Give the synopsis of the conversation for me to read upon my return.

We had an interesting discussion at work the other day, does intervention from the federal government create innovation, foster market development, or limit creativity? 

Wait, is everyone leaving me? 

Thanks!

I think we'll take you at your word Chris.  See y'all later.

Thanks for all the words of wisdom Chris... you better head somewhere safe, too.

Not at all, do I see cloud services in the future as being mainstay, yes.  Are we there yet, no.  Will we, possibly but the timeline is out 10 years.

@NY, get out while you can...

Thanks to Chris and everyone for joining us.

Pretty much.

We can consider this weekend an interesting experiment to gauge the strength of the national infrastructure.

Okay, well I think Chris has bad news for both me and Mary there.  I am wondering whether it's time to go and start piling up our sandbags?

lol interesting choice of words, CB.

I'm glad to see I can still keep you on the edge of your seat Nicole...

Oh there he is.

How sad for you guys.

Kim, you are recruiting the best brains in the 'publicized' world of private security.  They will always be bested by the hidden minds of the people trying to access that information.

Mary, to be honest the cloud isn't an infant by any means, but it's still a toddler in terms of growth to market.  Yes, everyone and their mother screams about 'the cloud', but to be honest large scale implementation is virtually unheard of unless you are large business who creates their own, or a small business with deep pockets.  This toddler still puts things in its mouth all the time!  And right now, a lot of cloud services are just a rape fest in terms of charges and price gouging to the end consumer.

Chris has left you both hanging.

Chris: In your view, on a scale of one to ten, where are we relative to vendor solutions for cloud security?

That's interesting Chris.  You're definitely not signing up to my Manhattan Project on cybersecurity?  Even if I am recruiting the best brains from the private sector and imposing public goals and timetable?  Results to be open source?

Chris... well... I can't have it all.

@ Mary, unfortunately I don't.  There will always be vulnerabilities when you access a cloud service.  @Kim, the private sector can adapt to current threats a lot more quickly than the Gov't can.

@ Nicole, sorry it wasn't a tune from Next to Normal

Yes, Chris. Congrats for bringing not only a musical reference into the discussion, but one from a B'way classic!

We always come back to musical theater, somehow.  You do have a good point, Chris, and govt is looking very leaden footed in this context.

Hi Chris! Also, do you think there is one true way to secure cloud services?

Extra points for Chris for bringing a musical reference to the conversation.

It takes ages for government regulations to be placed into effect, and once complete they are static.  By this time new technologies have evolved or are evolving, which regulations and measures need to be tested and implemented.  It's a vicious cycle.  How do you solve a problem like Maria?!? 

No question that government regulations are outdated.

Welcome, Chris.Browne.

Hi Chris.  You don't perceive a degrading security environment in the private sector?

Vendors aren't failing, the government regulations are behind the times. 

Identities is the part of the puzzle NSTIC plans to solve over the next five years.  Important part.

A bit.

Sorry, Mary, misunderstanding.  Vendors are failing badly at security in general. 

Ah, okay, @Kim. So identity management -- that narrows things a bit. A bit.

@Kim: How can you say the vendors are failing to secure clouds?

@Mary.  I don't mean to suggest there is one magic bullet.  Just agreed best practices would be a step in the right direction.  I think NSTIC is looking for a magic bullet on identities.

LOL @Nicole. It just doesn't make sense to me -- yet. I am not saying it won't eventually make sense, that I won't open my eyes and see Kim as a true visionary.

@Nicole.  We have evidence that vendors are failing badly.  I think a best-minds solution is an alternative which should be considered.  The problem is that it would be called "Obama-Security" and be labeled socialist.

Mary's getting upset, Kim... she doesn't like your solution.

Yes, and I'm still hung up on why you think there is one magic bullet for cloud security, Kim! I mean, there are tons of different application interfaces for cloud use.

Sometimes it's easier for the gov to mandate stuff for the private sector than for itself

But I don't know why the government would have a better shot at security than the vendors.

Maybe!

Visionary, yes?

Hmm. I'm quietly pondering Kim's suggestion.

I think the govt's current strategy is that e-commerce is so valuable we'll tell the private sector that it's in their interests to fix security, then we'll take whatever they come up with and apply it to the infrastructure.

Dunno, guys, I think you're oversimplifying to say the least.

I think all I need to assume is that there must be at least one way and recruit people to find out what it is. 

I'm with Kim, we need the hunter seeker algorthim secret project! that's key to the game

You're assuming that there is just one way to do security int eh cloud and it's discoverable, like nuclear fission.

Vendors, Mary, vendors.  That's what I'd say.  I am staggered that CLOUD hedged it so much.

What's more, security probably doesn't have just one profile or design in the cloud.

Hm. Those vendors and others would say they already have secure clouds, Kim!

If my analysis of IT budget problems is roughly accurate, it would be a big money saver to develop a secure cloud solution.  Why leave it to Symantec and Sony and whoever?

Although it's politically undesirable, the govt could conclude that secure IT for military/intelligence and critical infrastructure should be a public project.  They could take ownership of it (as they did with The Bomb), recruit the key innovators and run NSTIC to their own timetable. 

It was NSTIC which made me think about this.  NSTIC farms out the trusted identity problem to the private sector to solve.  It is merely an enabler - a convener of committees.

Ok.

Explain! Explain!

@Nicole.  Right, and it needs to be more than "we need to comply with consistent standards and have trusted identity policies, blah, blah..."

I wonder if my Manhattan Project idea could actually be a money-saver in this context.  Shall I explain?

I just think, when it comes to the government, the question "what about security?" needs to be met with a related answer, not simply an answer about cost savings... otherwise it's not going to happen.

Sorry, Mary, here it is in full:

http://www.techamericafoundation.org/content/wp-content/uploads/2011/07/CLOUD2.pdf

Or maybe his departure was financially motivated.

@Kim: Your link isn't working for me!

Re: "So do you think, Kim, that Kundra left because of this particular tension between moving forward and avoiding new technology, specifically cloud tech?" That was my original thought.

Mary, I suspect there were other reasons for Kundra leaving.  He had plenty to say and I don't recall he said that specific depts were blocking his reforms.

In case anyone wants to check it out later, here's a link to the CLOUD report.  These people are even more positive about the cloud than Mary, but still aren't reassuring about security.  30 page pdf.

I mean, not good for you, but an enlightening example.

Thanks for the answer, AW! Good one

True. So do you think, Kim, that Kundra left because of this particular tension between moving forward and avoiding new technology, specifically cloud tech?

haha

Okay, everyone, stop making your hurricane plans.  We have the federal budget to sort out here.

Indeed Mary, but administrations are very reluctant to cut defense spending in any case.

@Mary I don't have any enterprise examples I can share, but with personal tech I spent $500 on a netbook when netbooks were just the new cool thing, and within 3-6 months is totally obsolete. Why pay to be an early adopter? The only people who do that to begin with are usually people who get a high off being all smug cause they have the latest and greatest

But @Kim, the old way contains risk of wasting more money!

@AW: Your assertion about early adoption intrigues me. Can you share any horror stories with us? Or any stories at all? Not being nosy, just interested. ;>

Yes.  Better be safe than sorry.

@Nicole a very good point I think.

In other words, the status quo is quantifiable; the alternatives are "risky." So let's stay with the old.

The government is typically slow to adopt. With so many private sector organizations not ready to jump into the cloud, what makes us think the government is going to get in early here?

@Kim, yes, I guess so. But using that yardstick of risk assessment, any government information is likely to be called too sensitive to expose to anything.

@Kim I hope you're ready! I spent all last night securing my house (make sure there are no plants or anything outside that can turn into a missle,) and getting my search and rescue gear ready to go.

I think you're right about NIST, Mary.  Everybody is covering themselves.  Makes progress difficult.

And I meant to say "government bodies" in my post below.

@Mary I have, that's one of the reasons I'm not buying a tablet, it doesn't pay to be an early adopter

Mary, shouldn't we think in terms of risk/benefit?  Big savings to be made versus risk of data breaches affecting very sensitive info and systems.

Is that harsh and skeptical?

@Kim: I don't anticipate NIST or other bodies making clear statements about any technology.

@AW: It sounds as though you've had some bad experiences with early adoption of tech.

AW, we may be focusing on how to deal with outages in the very near future.

@Mary.  Absolutely.  My argument was that unless NIST or comparable authorities can make clear and definitive statements about cloud security, the White House is going to be reluctant to over-rule top brass.

@Mary I'm not sure security is my biggest concern (it is one of them certainly) but impelentation hurdles, how to effecitvely deal with outages, what services to actual pay for. It's new waters and I just am adopting a conservitive approach

Is the incoming CIO as adamant about cloud as Kundra?

@Mary: are we beginning to see the post Kundra fallout in government IT?

And isn't it just possible that some government agencies that could benefit from cloud will raise the hue and cry of security as an excuse to do nothing?

@Nicole: I am just now trying to read Kim's blog and listening to his intro on IE radio

AW: If cloud was so insecure, though, why did Vivek Kundra endorse it as key to improving the government's IT profile?

Hi Paul!

Paul what's your take on this

@Kim: does the cloud really needs the government?

On a positive note, moving Medicare/aid and Social Security IT to the cloud is clearly worthwhile.

better late than ever

@Nicole maybe not for the dept of agriculture, but if you adopt a see how it worked out for them attitude, I think you can do it better afterwards.

It would be less of a big deal if military IT was 5% of federal IT spending.  We could just treat them as a special case.  But I suspect it's a massive chunk of the budget.

Pauuuuuulllllll

Hello

@Mary.  Hybrid clouds may be the most we can expect of military/intelligence in the near future.

So, AW you think it's too soon?

@Nicole.  Yes, things like Dept of Agriculture emails have moved to the cloud.

I mean I know various state governments have moved to the cloud.

@Nicole, yes, clouds are serving for email and other apps in government.

The problem is that NIST, in its tentative way, is implying that the cloud is less secure.

I'm approaching it from the angle of early adopter. I've been burned too many times by buying technology before lettering it mature (netbooks being the biggest example for me). As decentralized as it may be, there hasn't been any real distruption of it yet

Some in the government have moved to cloud already, right?

Also, what about hybrid clouds? Surely the government can and should take advantage of at least some cloud services?

@Mary.  I understand that, but people are going to take clunky secure systems every time when it comes to critical military, intelligence and infrastructure.

But @AW: Is cloud computing really less secure than government systems and networks today?

Well Mary does have a point about the fact that government data hasn't exactly been secure all along.

Hi AW!

If we're right to keep "mission critical" tech out of the cloud, the CIO may only be able to achieve fringe savings.

The argument against clouds makes me crazy, because it just gives agency IT an excuse to dig in their heels and keep the expensive and clunky status quo.

No wonder the Cloud Commission is calling for NSTIC to be accelerated: that's a five year program.  Hi AW!

Awilliams joins us at last!

I think my strongest opinion is that we need to be clear and honest about security across the board.  The more I see woolly reports and think-pieces calling for standards, the more nervous I am - especially about the national infrastucture moving to the cloud.

Hi all, I'm of the opinion that the cloud should be looked at skeptically, particularly for mission critical tech

A real cloud enthusiast, this Mary Jander of ours.

I know where Mary stands. She's wild about the cloud.

Kim: Where do you stand, opinion-wise, on the government moving to the cloud?

I tried to convey that it's the depts which consume huge IT resources, not necessarily in an organized way, which are the ones most resistant to the cloud.

Yes, Mary.  The advantages of the cloud are evident to many in government.  Agriculture wasn't a random example; it has happily been migrating data to the cloud.  But savings on Agriculture IT don't get us far.

Hello, hello.

So, Kim, the deadlock is between the agencies claiming that clouds aren't secure enough; and those lining up behind the outgoing CIO, right?

Kim makes a good point. There's no way the administration is going to push agencies to move to the cloud without assurance that it's secure.

Hmmmmmm

Yes, I own up.

,True re: internal security!

That's you, Mary.

Ooh a "once upon a time" story.

Here we goooo.

I'll have to pause the HAIR soundtrack to hear Kim's intro.

It's happening. Yay!

I wonder if I will be able to hear the audio portion on time.

Helloooooo.

Yoho!