The Defense Department’s aggressive strides in opening the Pentagon doors to commercial cloud services leaves many questions to be answered, including the technicalities inherent to large-scale IT operations. One big question: What happens when there’s a breach?
So far, when it’s a commercial entity housing DoD data, it’s not necessarily immediately clear which entities are responsible for what. That’s something Pentagon officials are working to establish as they negotiate the path toward the DoD commercial cloud.
“I think it’s a serious discussion we have to have…privacy and what happens when you lose the data. Because let’s be real – it’s not about if. At some point, somebody’s going to lose some of our data,” Terry Halvorsen, acting DoD CIO, said at an event held Feb. 12 in Washington by thee Cloud Computing Caucus Advisory Group. “We’ve got to have that conversation up front so when it happens, we all agree how it’s going to work and what are the rules. If you lose DoD data, I get to do forensics on it, and [commercial cloud providers] aren’t going to like the forensics I do.”
That’s because beyond just the actions that must follow a data breach or loss, there are further implications: privacy concerns, or worries about exposure of proprietary capabilities or intellectual property, Halvorsen noted.
DoD currently is running a small handful of pilot programs to test out the use of commercial cloud for sensitive military data. Right now, those cases are small enough to closely control, he said, but once those capabilities are expanded to the broader department, it’s a different scenario – especially when a breach becomes public.
“How do we work for that so we’re both prepared for [a breach] and we have a plan to operate…so there are no surprises?” Halvorsen said. “Everybody’s going to have to know what they’re responsible for. Everybody has to know what the process is going to be and what levels of reaction you’re going to get.”
It’s an ongoing conversation that’s unfolding between government and industry, and one that’s critical to continue, Halvorsen said.
“We’re taking our standards as they are today, how we in DoD respond to a loss, and we’re working through that with our current pilot partners,” Halvorsen said. “We’re explaining to them this is what we have to do; now, what’s the equivalent of that in the commercial sector? If that equivalency doesn’t meet our [requirements], then what’s the plus we have to add there?”
