While the IC’s research organization looks into adding security to cloud environments, in the here and now, intelligence agencies are sharing more data.
Agencies need to weigh two critical questions when they think about cloud computing: Will delivering IT from a cloud provider meet the agency’s mission? And if so, will it save money?
Managers should assess each IT application or service against those two questions. For example, if an agency requires an IT service to have .99999 availability, but a cloud provider can only offer .999 uptime, then it can’t meet the agency’s needs.
Even the best cloud providers go down. That’s why agencies need to decide how much of a service outage they can handle. Most recently, a major cloud provider was down for about four hours, dragging several commercial sites with it. Can the agency withstand that kind of outage?
But think of uptime as just one measure of mission effectiveness in the decision-making calculus. For example, agencies must also evaluate the sensitivity and integrity of the data they’re thinking about moving. Most important, IT leaders must compile the security controls they require for an application or service and then double check that the cloud provider accounts for each of those required controls.
Next, if an agency determines that the cloud is a mission-effective way to deliver IT services, then department leaders must decide if the cloud provider saves them money. For example, many agencies look to store data in the cloud to take advantage of the economies of scale it offers.
As a result, moving large amounts of data to a provider instead of purchasing an expensive storage solution makes sense. However, cloud providers often charge for the data agencies retrieve from their infrastructure. This means IT leaders must know exactly how much and how often the data would stream back into their networks. In that case, the regular retrieval of cloud-based data can quickly offset any economies of scale.
Additionally, agencies need to remember the changes that would be required for their enterprise when they calculate cost-effectiveness. When IT services are internal to a data center, data travels east to west. However, once an application migrates to the cloud, traffic runs north to south out of the enterprise and onto a virtual private network or a dedicated cloud connection. Agencies need to consider the increase in bandwidth required, or even the cost of a dedicated connection. While it may make economic sense to put infrequently used archival data in the cloud, agencies may find it still makes sense to keep in-house the data they most frequently need to access and restore.
Cost-conscious agencies face certain economic realities. Notably, it’s expensive to build or expand a data center. When agencies can stop using portions of a data center through cloud technologies, the move translates to real savings. But when agencies can avoid data center expansions or builds through cloud technologies, the savings are tremendous.
Given the costs of running a data center today, cloud providers can offer a cost-effective way to deliver IT. When I was director of enterprise operations for the U.S. House of Representatives, we reduced our data center footprint by nearly 50 percent through private cloud technologies. The savings in power and cooling costs were significant, but the cost avoidance by not having to update the facility was equally important.
We did that six years ago, but such a blueprint has value today. Agencies need to contemplate what in their enterprise can benefit from cloud technologies and what cannot. Of those that can, they should ask which can be delivered from a cloud provider and which should remain in-house. The answer will differ for each agency because such determinations are not based on the application or service, but rather the value of that application or service to the agency and its mission.
It’s impossible to overstate the importance of planning, especially when organizations start looking to move portions of their enterprise computing operations to the cloud.
Again, IT leaders should try to determine mission-effectiveness and cost-effectiveness application-by-application. Once cloud candidates are identified, they should accurately measure the resource needs of the application or service delivered from the cloud. Too often, cloud consumers don’t carefully measure their true needs and they overprovision server resources, costing the agency more money in the long run.
IT staff should work closely with a cloud provider, or cloud broker, to accurately calibrate how much computing power the agency requires. Real savings arrive when agencies can match their computing resources with what they actually use. IT managers know it’s a bad day at the agency when they’ve budgeted $10,000 for a computing service and the bill comes in at $100,000.
As the Trump administration’s goals for IT come into focus, one thing is already certain: Agencies will need to do more with less. For the right applications, the cloud will continue to make economic sense and remain the best possible option.