Defense officials speaking on July 28 at the Digital Government Institute’s 930GOV Conference in Washington, D.C., said agencies should use the shared responsibility model to guide cloud modernization decisions, including the selection of cloud service models.
The shared responsibility model is a cloud framework that divides security, operational, and compliance responsibilities between cloud providers and customers.
Gordon Deng, Gravity Platform portfolio lead at the Air Force Research Laboratory, said many agencies began cloud migrations without first understanding how responsibilities shift across different cloud service models.
“Four or five years ago, we were told by a lot of different organizations, ‘Hey, we need to move to the cloud.’ But what is it? What’s inside the cloud? What does it look like?” Deng said.
Agencies must understand the components that make up cloud environments, including compute, storage, networking, identity, security tooling, and compliance services, before they can determine responsibility for configuration, monitoring, and authorization, Deng noted.
He illustrated the concept with a shared responsibility diagram that maps which cloud components are managed by the provider and which remain under the customer’s control. The amount of infrastructure that agencies manage changes depending on the service model they choose, he noted.
The shared responsibility model presented by Deng and Raley during DGI’s 930GOV conference on July 28 in Washington, D.C.
“The blue boxes are what you, as an organization, or what you, as your team, want to manage… As you move along to the right, there’s less management. Because as you move further along to the right, there’s less responsibility. But when you move back to the left, there’s more responsibility,” Deng said.
Deng said selecting a cloud service model is also a workforce decision because agencies that retain more control over infrastructure must also maintain personnel to manage cybersecurity, cloud operations, and architecture.
Dave Raley, chief digital services officer for the U.S. Marine Corps Operation Stormbreaker, said agencies cannot eliminate the operational and security work required to support applications regardless of the service model they choose.”These activities need to happen in order to have the appropriate place for an application to run, whether or not you, as the mission owner or your agency, actually pays for this stuff and manages all those resources … or you outsource those things, they have to happen,” Raley said.
Raley identified identity and access management, network configuration and monitoring, vulnerability management and patching, logging, telemetry, incident response, compliance documentation, and evidence collection as responsibilities that exist across on-premises environments, infrastructure as a service, platform as a service, and managed platforms.
He said the distinction is whether the agency performs those functions, or the cloud provider performs them under the shared responsibility model.
Officials also addressed concerns that greater use of managed services could reduce agencies’ visibility into compliance activities.
Raley said it’s possible to shift infrastructure management responsibilities to a provider without losing visibility into security and compliance activities.
“We intend to abstract away from the mission owner, the vendor, the engineers the underlying complexity of managing the infrastructure and the compliance side, to provide that as a service, as opposed to it being hidden, we’re abstracting that away from them. We can share how we’re doing it. We can show what’s happening. We can give them telemetry if they need it,” Raley said.