Secure and Reliable Cloud Computing

The SEI is working to help the DoD, as well as other organizations and government agencies, modernize their systems with cloud technology. To do so, we identify the threats and vulnerabilities involved in migrating to the cloud, and we develop practices to help organizations make the transition to the cloud as secure as possible.

Ensuring your organization's security in the cloud involves managing a wide range of issues, from technical details to commercial, financial, legal, and compliance risks. Organizations must establish meaningful service level agreements (SLAs) with their CSP, and they must monitor the CSP's security performance. Doing so is often difficult because CSPs are sometimes not completely transparent. Our work with cloud computing has resulted in process- and data-driven approaches that help organizations work through these significant challenges through attention to both architecture and processes and establish more transparency between themselves and their CSPs.

Cloud computing is evolving quickly in both technology and governance. The DoD's mission of active cyber defense is driving an emphasis on continuous monitoring to allow for continuous authorization. Third-party tools complicate these activities. The DoD has issued new guidance that provides direction to those supporting cloud-based systems. This guidance reflects the increased concern for cybersecurity risk in cloud computing, including guidance on how computing systems should be acquired, tested, and supported. The SEI has studied the challenges that cloud computing brings to the DoD along with the capabilities that it enables. To meet these challenges, the SEI developed a roadmap for operational test and evaluation to support DoD adoption of cloud-based systems.