While the IC’s research organization looks into adding security to cloud environments, in the here and now, intelligence agencies are sharing more data.
Although federal IT chiefs say they hear the siren song of cloud providers on hybrid cloud storage — “come on in, the water’s fine” — for now, most have only begun to dip their toes in the water.
Both the Social Security Administration (SSA) and the Department of Housing and Urban Development (HUD) are prime examples of how government agencies intend to ramp up programs to take advantage of hybrid clouds.
At SSA, the technology team has started using a public cloud as a development environment to gain experience and test different scenarios, says Rob Klopp, CIO and deputy commissioner of systems. Klopp’s team is also exploring whether to develop an on-premises cloud in the next year to integrate its public and private cloud use, but that effort will likely be a fiscal 2018 project.
At HUD, Chief Technology Officer Mark Hayes envisions opportunities to save money and provision storage more efficiently by using hybrid cloud. “We moved to Office 365 and run web pages in Microsoft Azure, but storage is something we’ll look at throughout 2016,” he adds.
Both Klopp and Hayes agree that agencies need time to detail how the hybrid approach will fit within the government’s broader cloud efforts. Hybrid cloud storage is appealing because it will let agencies store their most sensitive data on-premises and move less sensitive data to the cloud. And for many agencies, that is a big need.
But given the vast size of many government data storage environments, it’s a move that will take a little time. While Klopp says he sees likely benefits for adopting the hybrid approach at SSA, it’s premature to fully commit to that storage strategy just yet.
“Our hybrid cloud solution is several years off, and we just started using the public-cloud development environment,” he says. “Our exploration into developing an on-premises cloud is also still in the initial stages, but we are excited to explore new options.”
At HUD, the shift is under way. “The one thing we’re moving forward on now is eliminating Tier 3 storage,” Hayes says. “We really don’t use tape.”
As nonsensitive data moves to the cloud, it still must be encrypted during transmission. The type of Tier 2 data that HUD will migrate to the cloud includes its inventory system and file-sharing data — neither of which contains personally identifiable information.
“Anything with PII, we’ll store in-house, in Tier 1,” Hayes says, adding that any provider HUD uses will be approved by the Federal Risk and Authorization Management Program.
And for any agency looking at hybrid cloud, there are multiple cost-benefit factors to weigh. It’s not just a matter of evaluating only infrastructure hard costs.
“We have to really look at this closely because moving to the cloud doesn’t always save an agency money. However, we may get improved response times and overall efficiencies in terms of being able to spin up storage more easily,” Hayes says.
Moving to the cloud presents a certain amount of risk, and it’s also something agencies must commit to for the long haul, points out Scott Sinclair, an analyst who covers storage for the Enterprise Strategy Group.
“Organizations have to ask themselves how much latency they are willing to accept,” he says. “Plus, IT departments never know how it will work out until they make the move. These transitions take time. The latency an organization will experience on day one is often much different than in year three or year five.”
When managing a hybrid environment, a lot of an IT shop’s efforts must go into optimization and defining data policies so that:
Because of these factors, many agencies — like SSA and HUD — will take their time moving to a hybrid cloud model. With budgets as tight as they are, adds Sinclair, agencies must fully define their cloud strategies before focusing on hybrid cloud storage.
A two-tier storage system makes sense, Hayes agrees. It’s just not something an agency can jump into without sufficient planning.