Future Directions for Cloud Computing

in Government

David L. McClure, Ph.D.

Associate Administrator

Office of Citizen Services and Innovative Technologies 3/9/2011 1

 Cloud Computing Can Change the Way Government
Leverages Technology….
Cheaper
• Drive Innovation:
Work with private industry
encouraging innovation and
furthering competition among
providers to drive best value
solutions for the Government
• Use Only What’s Needed:
Eliminate high upfront costs by
aligning costs with actual use
or consumption of IT resources
• Put the Power in the
Hands of the End Users:
Move operating complexities to
the Cloud, allowing Agencies
to focus on core mission
objectives
Faster
• Provide One-Stop Shop:
Simplify acquisition of IT
services by making it as simple
as buying a book, booking an
airline ticket, or making a dinner
reservation online
• Turn Up of IT Quickly:
Services can be provisioned in
hours or days versus traditional
IT methods which may take
months to deploy
• Scale Rapidly:
Deliver elastic computing,
allowing Agencies to rapidly
expand or contract IT resources
to support unplanned events or
spikes in usage
Greener
• Energy Efficiency:
Create virtualized
hardware and software
services so Government
uses only what’s needed,
avoiding overbuilding
data center and server
capacity
• Reuse Across
Agencies: Provide
shared, resource pooling,
for greater reuse and
ability to leverage
underutilized IT resources
across Government
Agencies
 Cloud Computing promotes a provider-consumer
relationship over a vendor-user relationship.
Consumer concerns are abstracted from provider
1 Service Based concerns through self service driven interfaces

Services scale on-demand to add or remove resources as

2 Scalable & Elastic needed.

Services share a pool of computing resources to build

3 Shared economies of scale.

Services are tracked with usage metrics to enable

4 Measured Use multiple payment models.

Services are delivered through use of Internet or broad

Internet/Network Based e
5 network access.
Sources: NIST and Gartner

These represent a fundamental shift in computing for most government agencies

3
 Internal cloud Government
based delivery of delivery of email Gmail to the
enterprise email services across general public
services A cloud service agencies or
shared by business governments
or agency Cloud services shared for
partners convenience/relationship/shared
benefit (within a corporate park
or level of government)

Private Public
Entity Owned Assets No Owned Assets
Scope is bounded by Scope is open to
exclusive anyone who can pay
membership defined for service as
by the entity
How do I deliver cloud services delivered by provider
(infrastructure, SaaS, platforms)
Hybrids
to gain as many cloud
More Control Less Control
computing benefits as I can
Lower Value while maintaining a degree of Higher Value
control, whether I choose a
private/government, hybrid or
public cloud?
But there are many clouds to choose from!
 Common Cloud Deployments

• Prototyping/Proof of Concept Looking for…….

• Web Application Serving  Try before you buy

 Unpredictable
workload
• Public-facing Web Sites  Peripheral processing
 Cost avoidance
 Large interactive
• Collaboration customer base
 Avoid Redesign
 Rapid Provisioning
• Development/Testing  Large Economies of
Scale

• SaaS Emerging: eMail, DR, HR,

FM
 Cloud Implementation is Taking Root
Benefits Realized By Agencies To Date
 Cost Reduction
 Faster Deployment of
Systems
 Faster Access to Information
 Increased Productivity
 Scalability
 Improved Vulnerability
Assessment
 Improved Self-Service
Capabilities
Agencies That Have Implemented
 Bureau of Engraving and Printing
 Environmental Protection Agency
 Army
 Air Force
 Veterans Affairs
 General Services Administration
 NASA
 NASA Jet Propulsion Laboratory
 Securities and Exchange Commission
 Social Security Administration
 Department of Treasury
 USDA Forest Service
 Department of Defense DISA
 Federal Labor Relations Board
 Department of the Interior
Agency Name Description
Requirement for 44.3% reduction in staff by 2013 led
to cloud implementation to manage web self-
Air Force service, incident management, customer surveys,
analytics, and knowledge management
Bureau of Used SaaS services to replace BEP’s public-facing
webpage and the eCommerce storefront
Engraving and
Printing
Consolidated emergency notification systems into
GSA one SaaS product, available 24x7
Used cloud solution to complete processing of
NASA Jet 180,000 high-res images from the Cassini spacecraft
Propulsion Lab in 5 hours
Used cloud solution to handle increase in investor
inquiries to the Office of Investor Education of up to
90,000 contacts annually
SEC
Used cloud technology to develop the Online
Answers Knowledge base to manage the millions of
SSA
inquiries SSA receives annually
Moved to a cloud-based system for the Treasury
Vulnerability Assessment System
Treasury
Highlight
• Savings of $4m/year in manpower reductions
• Time for locating customer information reduced from
20 min to 2 min
• Reduced infrastructure costs from $800k to $1,550
• Reduced annual maintenance costs from $77k to
$17k, about 22%
• Increased security and eliminated capital costs
• Processing costs totaled less than $200
• Imagery in the hands of scientists two weeks ahead
of the schedule provided by in-house IT resources
• Reduced investor response time from 30 days to 7
days
• Created a paperless system for handling investor
inquiries
• Reduced timeline for system configuration from
months to minutes
• Nearly 99% of $25m web self-service sessions
handled without agent intervention
• Largest work year savings of any existing eService
• 458% Increase in scanning
• 86% reduction in cost per scan
• 12% increase in vulnerability detection
• Production operation and deployment in 1 day
• Freed 2 Engineer FTE’s
 CIOs Must Plan for Successful Cloud Adoption

• Gain agreement on the drivers • Be realistic in cost

behind adopting a specific cloud estimates and benefits
approach realization
• Resource reduction/cost constraints
• Need for specific cloud characteristic
(elasticity, scalability, usage-based model)
• Cloud creates
• Need for rapid implementation opportunities to
• Infrastructure, software, platform services aggregating some sourcing
or all three
• Don’t focus on the
• Culturally grasp the move to technology, focus on the
services rather than buying desired outcomes driving
physical technology the needs

• Make cloud computing part of an

overall IT investment portfolio
and sourcing strategy (Reduce
capex? Infrastructure? Apps inventory?)

8
 Commercially- Managed Public Cloud Services

(4.1) Acquisition (4.2) Activation

- Create purchase - Activate leased assets

orders, lease agreements
- Load content
- Perform competition or

Solution: Decisional sole source

- Negotiate Service Level
Agreements
- Establish operations
- Establish performance
monitoring

Maps
- Begin billing / payment
- Negotiate performance
process
measurement methods

Solution Scoping and Definition

(2.1) Cloud Service Government- Managed Cloud Services.
(2.3) Cloud Service Government Line of Business
Definition (2.2) Business Case
Requirements
- Scope the types of (5.1) Define
- Define the business - Identify cloud service (5.2) Activation
services to be obtained Agreements
rationale for creating or detailed requirements for
from the cloud
moving to cloud services the types defined in2.2 (3.0) - Define Service Level - Activate leased assets
Start - E.g. Storage, Bare
- E.g. Security, Records Decision Agreement (SLA) or Operations
Operating System - Define cost - Load content
Retention, Continuity of Memorandum of
Platforms, Development expectations for cloud Point
Operations, Expected Understanding (MOU) - Establish operations
Environments, services
Performance, Support - Define cost recovery - Establish performance
Computational - Define expected pros Levels, Scale model monitoring
Resources, Web and cons of cloud
Platforms, Office implementation - Prototyping and pilots - Begin payment process
Applications, Back Office
Applications

New Internally- Built Private Cloud Services

Supporting Information
(6.1) Service (6.2) Service
Engeering Implementation
- Full engineering life- - SW license and HW
Enterprise Program Security cycle acquisition as required
Architecture CONOPs Policies - Design Data Center(s) - Implement and test cloud
services
- e.g. Assess locations,
power consumption, - CRM: Support cloud
workforce, transportation consumer Programs and
PMs in cloud service use
- Design cloud
Infrastructure, security

No Cloud
Use
Source: Mitre
Office of Citizen Services and Innovative Technologies 10
 Independent Risk Assessments for Cloud Solutions

Federal Agencies Duplicative risk

… management efforts

Incompatible
requirements

Acquisition slowed by
lengthy compliance
processes
…
Outsourced Systems Potential for inconsistent
application of Federal
security requirements
 Government-wide Risk Management of Shared Systems
Risk management cost
Federal Agencies savings and increased
… effectiveness
Risk Management
- Authorization Interagency vetted
- Continuous approach
FedRAMP Monitoring
- Federal Security
Requirements Rapid acquisition
through consolidated
risk management

Consistent
… application of Federal
Outsourced Systems security requirements

FedRAMP: Federal Risk and Authorization Management Program

 Infrastructure as a Service BPA

• Cloud Storage Services in these 3 categories awarded

to 12 vendors on 10/20/2010

• Virtual machines Security A&A being completed by GSA

Expect these to be offered on apps.gov

• Web Hosting in 3rd Q and 4th Q 2011

• Customers can compare pricing of identical services across

vendors
• Vendor costs for compleeing the A&A built into pricing mode
• Strong SLAs
• FISMA Moderate Risk security level

Office of Citizen Services and Innovative Technologies 3/9/2011 13

 Cloud Email as a Service

• Inter-agency SaaS Email Working Group established

in June 2010. SaaS email offers huge
cost savings:
• Developing an RFQ for a government-wide BPA of
SaaS email solutions. Federal agencies could
save approximately 44%
over existing premise-
• RFI completed based solutions.
13 respondents
RFI responses will be leveraged to create RFQ The U.S. taxpayer will save
requirements. $1M annually for every
7,500 users who transition
• GSA completed security authorization of Google to cloud-based email
services.
Apps which may be leveraged by other agencies. Source: Forrester

• USAID leveraged Google Apps security

authorization package to greatly reduce timeline
for system implementation
14

14
 GeoCloud Community Platform

Large pool of agency

applications identified App 2 Platform
for cloud migration App 1 Revenue
Stream
More
Apps …
Need
Platform Savings
Platforms
Cost
Platform Faster effective
Reduced
building deploy- develop-
mainten-
time & ment ment /
Federal Platform Reference … effort
ance costs
Implementations test

Platforms
Amplify GeoCloud Community Platform
IaaS
Savings Infrastructure as A Service Savings
Hardware Savings Operations Savings Scalability Savings
http://www.gsa.gov/portal/category/25729