The Infrastructure On-Demand private cloud, which debuted in 2010, became the model for Energy’s YOURCloud, a self-service portal for infrastructure-as-a-service offerings across multiple cloud service providers — on premise, corporately provided, and through public clouds such as the Amazon Elastic Compute Cloud.

Today, many agencies are going to have some sort of on-premise infrastructure offering – based on the maturity of the agency and the sensitivity of data the agency is trusted to protect – as a predecessor to moving to a hybrid cloud environment, said Anil Karmel, president of C2 Labs, a cloud security and services company.

A hybrid cloud, which lets agencies run portions of their workloads on premise in private clouds and some workloads in commercial public clouds, is going to be the natural reality for many agencies going forward, said Karmel, a former deputy chief technology officer with the National Nuclear Security Administration, and the solutions architect who drove the implementation of the LANL Infrastructure On-Demand cloud. He later used lessons learned from that experience to help build DOE’s YOURcloud.

“Virtualization is the foundation for moving to any infrastructure as a service offering,” Karmel said. Virtualization allows a single physical server to run multiple guest operating systems as a way of making more efficient use of the hardware, which frees data center space and achieves greater IT operational and energy efficiencies.

Between 2006 and 2008, LANL created a virtual environment in which officials decommissioned 100 physical servers and deployed 300 virtual machines on 13 physical host servers. Through virtualization, LANL achieved $1.4 million in cost savings and another $1.4 million in cost avoidance. To achieve virtualization’s benefits, agency’s need capacity planning tools to measure resource utilization of systems at their data centers. Administrators can determine how much energy their facilities use and how much energy they would save if they implemented virtualization technology. LANL used Novell Recon to gather metrics on its systems and get a fix on the resultant virtualization platform.

From 30 days to 30 minutes

Nine years later, the vast majority of agencies have already taken that first step of virtualizing workloads and receiving the return on investment of virtualizing those workloads. “But I don’t think many agencies have taken that workload and operationalized it into a fully, automated cloud offering,” Karmel said. That is the next step in the journey that will allow these agencies to move into the hybrid cloud.

The need for agility, flexibility and transparency drove LANL’s move toward an IaaS solution. Researchers wanted to quickly run workloads without waiting for the IT department to go through the provision process to get that workload up and running. “By implementing Infrastructure On-Demand back in 2010, we were able to take the average provisioning time from 30 days to 30 minutes,” Karmel said.

Being able to run multiple workloads and letting researchers only pay for what they used for the time period in which they used it, gave the LANL officials flexibility in how to use mission dollars most effectively.Additionally,by moving to an IaaS private cloud, they were able to quantify the cost of their IT investments from an infrastructure standpoint and gain a better understanding of the number of virtual machines that were running across multiple virtual infrastructures.

ROI on the virtual environment was achieved in less than a year after implementation. The move to the automated IaaS environment took another year and half — between 2009 and 2010 — because Karmel’s team had to invent capabilities that didn’t exist at the time.

“There were no automation tools at the time to upgrade or make a cloud into a fully automated service. So everything we had to create, we had to create from scratch because there was nothing we could buy.” For example, LANL officials used Microsoft SharePoint Server to develop a portal that would access a virtualization back end, such as VMware. SharePoint’s workflow capabilities were used to automate the creation, deployment and management of an infrastructure-as-a-service model.

Automation tools cut migration times

Now, in 2015, there are many automation tools available on the market that allow organizations to install, configure and automate their existing virtualization offering. “There is no need to build your own cloud service portal or cloud broker, you can buy one from a vendor of your choice,” Karmel explained.

Additionally, IaaS offerings have expanded over the years. The cloud service providers offer a lot more than virtual machines as a service now, said Coby Holloway, vice president and director of SAIC’s Cloud Computing and Business Transformation Services.

“They are now offering firewalls, load balancers, dynamic IP addressing, a variety of different modes of security access, automation tools and additional [application programming interface] access into the environment that didn’t exist years ago.” Holloway said. Automation is one of the areas where agencies can get the quickest return on investment because it reduces the amount of work required to do common tasks in the data center, he noted.

The Federal Risk Authorization and Management Program (FedRAMP) also brings standardization in the area of security accreditation and certification that didn’t exist a few years ago, giving agencies the assurance that cloud providers adhere to a baseline set of security requirements,

When it was launched, LANL’s Infrastructure On-Demand consisted of a Web portal; Microsoft SharePoint software for workflow and communications; VMware VCloud Director, a Web-based user interface that consumed cloud resources and VMware vShield for managing policies.

“It really was an evolution starting with Los Alamos, with virtualization and then implementing cloud. Then scaling that offering into a secure, hybrid community cloud for the [Energy] department, said Karmel, which from a design and application point of view can be applied to multiple agencies.

“We see a lot in the area of hybrid cloud – specifically around agencies that have certain assets that they want to continue to own and manage, they just don’t want to own the building that those assets live in,” said Lee Tamassia, director of business development for government markets at QTS. “We certainly see demand for that.”

Bonus Report: A new cloud approach

Tamassia said QTS also sees solicitations from agencies looking for wholesale cloud services, particularly with smaller or low-impact applications that can be easily migrated to a third-party infrastructure.

“It depends on how much you’re consolidating,” said Sue Palermo, senior vice president for emerging programs and services at CCSi. “You’d have to do an analysis to determine the best way to move that … If you’re moving like-for-like, then it’s probably easier to go in with all your infrastructure and write off the cost of the equipment you have.”

Agencies should look at colocation or wholesale IaaS on a case-by-case basis, Matt Sexton, CCSi chief information security officer, agreed, taking into account costs, availability of the data and the speed at which it needs to be accessed.

Others see full-scale hosting as the pure form of IaaS.

“I don’t think of colocation as Infrastructure-as-a-Service,” said Mark Ryland, chief solutions architect for AWS Public Sector. “You might be paying some service fee to rent space to put your servers in but if you still own all the servers and you’re still doing everything in a manual way, that’s not Infrastructure-as-a-Service.”

Ryland cited moves by the Navy and NASA to host their public websites using cloud infrastructure and an interesting case study in which the SEC found the answer to a difficult analytics problem in the cloud.

Spinning up quickly in the cloud

In 2012, when the Securities and Exchange Commission needed more computing power to run their MIDAS program – a real-time database that allows analysts to see time-stamped snapshots of market transactions – employing third-party infrastructure was a necessary component of getting it off the ground.

Combining data from markets and exchanges across the country (and the globe) created more than a terabyte of data per day, far more than could be stored and properly analyzed on SEC’s existing servers at the time.

“In our response to the RFP we included two options on how this could be deployed from an IT perspective,” said Mike Beller, CEO of Tradeworx, which ultimately won the contract to manage the system. “One was cloud based and the other was in the SEC’s datacenter.”

Tradeworx preferred the cloud option but didn’t know whether the SEC was ready to house its data and analysis in a third-party environment.

“The SEC very early on in our interactions said we want to do this in the cloud,” Beller said. “We were very gratified by that because we felt it was going to be the best way to go. We were just glad to see the SEC was very forward-thinking about how these problems could be solved and willing to be pioneers” in the federal sphere.

SEC got its first look at the MIDAS system four months later and it was up and running within six months.

The speed to adopt and efficacy of the final product were a direct result of SEC’s strong desire to implement what was, at the time, an innovative shift in government IT.

“‘Where there’s a will there’s a way’ is a big aspect of it,” Beller said, both in the implementation and moving through the federal acquisition process. “SEC was highly motivated. We put extra staff on the project to address getting things done quickly. We were able to partner effectively with Amazon Web Services, who put extra staff on getting things done quickly.”

The other major factor was the ability to use existing third-party infrastructure to move quickly.

“We didn’t have to buy computers, move them into datacenters, rack and stack them, bring them up, transfer data onto them,” Beller explained. “We just spun resources up in the cloud, following the appropriate security procedures. But we didn’t have to do physical infrastructure work at all to make this happen.”

“That’s a great example where the SEC didn’t even ask for cloud [initially] but the solution was so compelling,” Ryland said.

The cultural and managerial challenges of the cloud are most pronounced when it comes to Infrastructure-as-a-Service, particularly in regard to giving up control, shifts in responsibilities and the nuances of incremental procurements.

When compared to other cloud services — like Platform-as-a-Service, Software-as-a-Service or Email-as-a-Service — federal agencies aren’t generally as knowledgeable about IaaS, according to Lee Tamassia, director of business development for government markets at QTS.

“They’re certainly as aware of it but perhaps not as knowledgeable about how to leverage it,” he said.

Infrastructure — housing servers and guaranteeing uptime — is “expensive and it takes a lot of upfront capital to buy the necessary hardware and all the software and the associated infrastructure to stand up systems,” Tamassia said. “And behind that you have to hire people to run and manage it … Whereas as you go to the cloud you’re essentially taking that large upfront expense and transitioning it to more of an incremental, operational expense, so it’s much easier on the budget.”

While IaaS is usually more cost effective, “Change always involves some challenges,” Mark Ryland, chief solutions architect for AWS Public Sector, said.

And when it comes to infrastructure, those roadblocks are rarely an IT issue.

Cultural shift

“The challenges we have aren’t technology,” said Bud Michels, senior director for cloud solutions at General Dynamics IT. “The major challenges are the ability for the business owners to let go and let their data be somewhere else.”

For many federal agencies, getting past the idea of giving over ownership of their IT systems is a major culture shift.

“There is still — and understandably so, particularly in federal — a mindset behind being able to touch and manage the actual underlying infrastructure,” Tamassia said.

Risk managers, in particular, often “have adverse reactions to just giving up control of their data to any cloud provider,” Michels said. “Their job is to protect information. They don’t want to be in front of congress — and you can’t blame them.”

To quell those fears, “Companies have to form a trusting relationship and make sure [agencies] understand we have processes in place to protect their information,” he said.

Those relationships should be solidified during contract negotiations, according to Matt Sexton, chief information security officer at CCSi.

“You are relinquishing quite a lot of control if you’re using their hardware, their solutions. But the workaround there is to work with the CSPs upfront … so you can monitor what’s going on, so you know that everything from the hypervisor down is secure,” he said.

While the feeling of ownership is an important factor, it really boils down to security concerns.

“Talk to anybody in the cloud market and they’ll say the No. 1 hesitation people have about the cloud is security,” Tamassia said.

He credited the FedRAMP program for creating a framework that gives agencies confidence that data held by cloud providers will be secure. However, he believes that concern should be “flipped on its head.”

“Cloud systems are run by service providers where this is all they do every day,” Tamassia said. “Their attention is 100 percent on security,” whereas IT managers are often focused on the next project, not maintaining infrastructure. “Going to a cloud provider can actually provide a better sense of security, rather than a do-it-yourself approach.”

Changes to workflow

As agencies move away from managing their own infrastructure, staffing needs will change and organizational structures might be altered.

However, CCSi Senior VP for Emerging Programs and Services Sue Palermo cautioned against simply getting rid of the IT department.

“The people that were taking care of the infrastructure, you don’t need them to do that, however you may need to maintain some of those skills and expertise,” she said. “You want somebody who really understands that, who can talk with the cloud service provider about what they’re providing for you and how they meet performance metrics.”

As agencies employ more service-based systems, the roles within the IT department will change and likely require some measure of retraining.

“We have customers where the backup guy used to do a physical job and now he sits at a computer and does the same basic work — more efficiently because of leveraging the tools — but skills training was part of the transition,” Ryland said.

Budgeting for as-a-service

The security officers and IT managers won’t be the only ones adapting to change in the as-a-service environment. Contracting and acquisition managers will have to adjust to a new style of procurement, as well.

“One of the nice things about cloud is that it’s very, very scalable,” Tamassia said. “If you need more compute power or more storage … you can generally go into a provisioning portal and spin up additional resources in the cloud.”

While this is the major strength of IaaS, it also creates a unique challenge to budgeting.

Agencies have to consider “How does that fit within a federal budgeting process where you have ‘x’ amount of dollars to spend every year? How do you ensure that you don’t blow the budget?” Tamassia said.

In IT, “People are used to doing capital-based procurements,” Ryland said. “There might be people in the procurement shop that say, ‘I don’t know how to buy something by the drink; I don’t know how to deal with variable costing.’ In that same agency there might be procurement people who do that all the time — when they buy professional services, when they buy power, when they buy telecom — but that’s not the IT peoples’ strength.”

Ryland suggested offering specific training to those procurement officials in order to get the full cost benefits of IaaS.