MINSAV_-_CLOUD_TENANTS_Briefing.pdf

Air Force MINSAV Industry Day

Cloud Features P . L e n O r l a n d o I I I

A F H w A L e a d T & A M a n d M I N S E C

A F R L / R Y D T

DISTRIBUTION A. Approved for public release: distribution unlimited.

Introduction

• Cloud 101

• Collaboration

• Traceability and Provenance

• Data Management

• Dynamics

• Storefronts

• Cloud Portability

• DoD Participation

Cloud 101

DISTRIBUTION A. Approved for public release: distribution unlimited.

Fab

Package

BoardTest

System

Field

Obsolete

Destruction Specs

DoD

Academia Small Business

Design

Partners

ME Lifecycle

Data Exchanges

DiB Commercial

Legacy – Today – Tomorrow From Cradle to Grave

Secure Cloud

Ecosystem Aggregated Hardware

Physical Security – Common Compute – Storage Database – Network – Configurable SW Security

Hi gh

A va ila bi lit y

Hypervisor

Guest OSGuest

OSGuest OS Attachable data

SW Applications

Attachable data

Attachable data

Collaboration

DISTRIBUTION A. Approved for public release: distribution unlimited.

• Traditionally DoD communities are isolated silos of deep knowledge

• Geographically and organizationally isolated

• Beneficial when problems can be solved within a site

• Today, problems are challenging enough that multidisciplinary skills are necessary to provide solutions

• Technology pace is rapid and dynamic

• Cloud as an enabler:

• Integrate geographically desperate communities to solve problems interactively

• Leverage economies of scale utilizing reproducible cloud methods

• Granularity of controlled access: user, project, community, organization, periods of time

• Persistent information capture

• Multi-org consistency

• Secure infrastructure

DoD

DiB Small Business

Academia

Non- Traditional

Commercial

FFRDC

Traceability and Provenance

DISTRIBUTION A. Approved for public release: distribution unlimited.

• The objective is to provide mechanisms to determine who created what, who did what and when was it done.

• How is traceability and provenance achieved?

• Cloud Technology i.e AWS CloudTrail/CloudWatch

• Blockchain (Capture every click, data sources, etc.)

• Or is it a mix? Or new technology?

• How will you authenticate?

• 2 factor authentication i.e google authenticate

• Specific hardware requirements

• What data is captured and granularity?

Data Management

DISTRIBUTION A. Approved for public release: distribution unlimited.

• How is data managed and monitored while in-motion or at-rest?

• Data Exchanges: commercial-defense-university

• Data Generated: IP repository

• Data Ingested: 3rd Party IP, Commercial IP and

Software

• Data Validation

• Data Archived: Persistent long-term data storage (i.e.

AWS Glacier)

• Data Resurrection: Bring data back into the system for analysis

• Data Protection: Encryption

• Data Access: Levels of access User, Group, Org, etc.

• U.S. citizen vs. greencard vs. non-U.S.

Intra-Cloud Data Exchanges

Inter-Cloud Data Exchanges

Off Cloud Data Exchanges

Dynamics

DISTRIBUTION A. Approved for public release: distribution unlimited.

• Cloud environment is constantly changing with new hardware, security threats, software, vulnerabilities, and users.

• Scalable system

• Automated deployment

• Cloud independence

• Transferrable

• Persistent Data availability for 10’s of years

• Uptime

• System needs to be operational 24/7

• Red-Blue Deployment

• Scheduled outages when needed

Virtual Store Fronts

DISTRIBUTION A. Approved for public release: distribution unlimited.

• Private cloud enclaves operated by 3rd party technology providers who determine what information is shared, who it is shared with, and when it is shared

• Leverage common distribution mechanisms within the cloud

• Centralized Terms and Conditions (T&C’s) and Non-disclosure agreements (NDA’s)

• Key enabled access

• Different levels of access based on need

• Solutions can be made available to all

• Configuration control

FOUNDRY

BOARD

TEST

Virtual Microelectronics Community

Data Repo

SW

Repo

Cloud Portability

DISTRIBUTION A. Approved for public release: distribution unlimited.

• Ability to encapsulate the entire cloud environment used to design a microelectronics system and transfer to another cloud or to a standalone environment

• Provides a path for cloud independence

• Orchestration of independent cloud environments to achieve best capability to achieve mission objectives

• Mechanism to achieve maximum uptime and availability

Public Cloud

DoD Participation

• DoD is an active participant within the cloud environment

• Pathway to accreditation

• FEDRAMP approved

• Authorization to operate

• Authorization to use

• Risk Management Framework

• Requires additional processes and reports

• Operating System STIG compliance

• Routine Static and Dynamic Scans

• Penetration Testing

Summary

DISTRIBUTION A. Approved for public release: distribution unlimited.

Utilize best cloud services possible to achieve microelectronics mission

- Leverage commercial existing capability

- Enable collaboration within the ecosystem and partnerships external to the ecosystem

- Maintain high levels of assurance, traceability and provenance, and security

- Automated, dynamic, and extendable to cover the full lifecycle

Questions?