DoD eyeing commercial cloud options for secret data

Amber Corrin, 

December 11, 2015 

Source Link

The Defense Department's cold feelings toward moving any of its classified data to a commercial cloud provider might be warming up as the department evaluates options for commercial cloud companies to handle and store secret information.

As DoD moves more of its data to the cloud, most of that data is unclassified, less-sensitive data categorized at lower "impact levels," which is how DoD rates its data sensitivity. Impact levels 1 through 5 involve increasingly sensitive and tightly controlled unclassified data, but impact level 6 is classified secret data that so far only is approved for storage on internal DoD systems, such as the Defense Information Systems Agency's milCloud.

But that could change, according to Rob Vietmeyer, associate director for cloud computing and agile development in the enterprise services and integration directorate at the DoD CIO's office.

"Level 6 for commercial providers is in planning phase," Vietmeyer said after his remarks at an AFCEA Northern Virginia chapter event in Vienna, Virginia, Dec. 11. "We're working closely with [the intelligence community] because they have a need for secret-level cloud as well, so there are negotiations right now for how we might bring a level 6 provider into the SIPRNet environment. So that's in the discussion and planning phase."

One option to do that, and other sensitive data operations, involves bringing commercial providers in to operate within DoD facilities, he said.

"What we're looking at doing is opening up our floor space and then enabling commercial providers to come in and offer their services from within inside the DoD perimeter," Vietmeyer said. "It may be our floor space or [in some cases] it may just be within our network in their own facilities. But we are looking at dedicated implementation for these cloud services that we can then offer to the DoD community for our high-impact, mission-critical systems, level 5 and even level 6. In the classified environment we're not going to be connected to the Internet or other commercial infrastructures; we're going to run that from fully private, dedicated Defense Department infrastructures."

Vietmeyer noted that officials in his office are looking at a similar type of agreement under way between the Navy and IBM at the Allegany Ballistics Laboratory in Rocket City, West Virginia.

"We have been reviewing that, working with IBM and the Navy to approve that for Ievel 5 use. That's one of the upcoming provisional authorizations that you should be seeing in the next few months; we're in the final stages of getting that approved," he said. "So that's operating on Navy property, and we're looking at how we extend that model to other providers and other data centers. We're primarily working with the Army and DISA to open up some of the Army data centers and DISA data centers to bring commercial providers into that environment."