U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

58–350 PDF 2010

CLOUD COMPUTING: BENEFITS AND RISKS OF

MOVING FEDERAL IT INTO THE CLOUD

JOINT HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,

ORGANIZATION, AND PROCUREMENT

AND THE

COMMITTEE ON OVERSIGHT

AND GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED ELEVENTH CONGRESS

SECOND SESSION

JULY 1, 2010

Serial No. 111–79

Printed for the use of the Committee on Oversight and Government Reform

(

Available via the World Wide Web: http://www.gpoaccess.gov/congress/index.html

http://www.house.gov/reform

(II)

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

EDOLPHUS TOWNS, New York, Chairman

PAUL E. KANJORSKI, Pennsylvania

CAROLYN B. MALONEY, New York

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

JOHN F. TIERNEY, Massachusetts

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

JIM COOPER, Tennessee

GERALD E. CONNOLLY, Virginia

MIKE QUIGLEY, Illinois

MARCY KAPTUR, Ohio

ELEANOR HOLMES NORTON, District of

Columbia

PATRICK J. KENNEDY, Rhode Island

DANNY K. DAVIS, Illinois

CHRIS VAN HOLLEN, Maryland

HENRY CUELLAR, Texas

PAUL W. HODES, New Hampshire

CHRISTOPHER S. MURPHY, Connecticut

PETER WELCH, Vermont

BILL FOSTER, Illinois

JACKIE SPEIER, California

STEVE DRIEHAUS, Ohio

JUDY CHU, California

DARRELL E. ISSA, California

DAN BURTON, Indiana

JOHN L. MICA, Florida

JOHN J. DUNCAN, JR., Tennessee

MICHAEL R. TURNER, Ohio

LYNN A. WESTMORELAND, Georgia

PATRICK T. MCHENRY, North Carolina

BRIAN P. BILBRAY, California

JIM JORDAN, Ohio

JEFF FLAKE, Arizona

JEFF FORTENBERRY, Nebraska

JASON CHAFFETZ, Utah

AARON SCHOCK, Illinois

BLAINE LUETKEMEYER, Missouri

ANH ‘JOSEPH’’ CAO, Louisiana

BILL SHUSTER, Pennsylvania

RON STROMAN, Staff Director

MICHAEL MCCARTHY, Deputy Staff Director

CARLA HULTBERG, Chief Clerk

LARRY BRADY, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, ORGANIZATION, AND PROCUREMENT

DIANE E. WATSON, California, Chairman

PAUL E. KANJORSKI, Pennsylvania

JIM COOPER, Tennessee

GERALD E. CONNOLLY, Virginia

HENRY CUELLAR, Texas

JACKIE SPEIER, California

PAUL W. HODES, New Hampshire

CHRISTOPHER S. MURPHY, Connecticut

MIKE QUIGLEY, Illinois

BRIAN P. BILBRAY, California

AARON SCHOCK, Illinois

JOHN J. DUNCAN, JR., Tennessee

JEFF FLAKE, Arizona

BLAINE LUETKEMEYER, Missouri

BERT HAMMOND, Staff Director

(III)

C O N T E N T S

Page

Hearing held on July 1, 2010 ................................................................................. 1

Statement of:

Charney, Scott, corporate vice president, trustworthy computing, Microsoft Corp.; Daniel Burton, senior vice president, global public policy,

Salesforce.com; Mike Bradshaw, director, Google Federal, Google Inc.;

Nick Combs, chief technology officer, EMC Federal; and Gregory Ganger, professor, electrical and computer engineering, director, Parallel

Data Lab, Carnegie Mellon University ....................................................... 81

Burton, Daniel ........................................................................................... 96

Bradshaw, Mike ......................................................................................... 108

Charney, Scott ........................................................................................... 81

Combs, Nick ............................................................................................... 117

Ganger, Gregory ........................................................................................ 128

Kundra, Vivek, Federal Chief Information Officer, Administrator for eGovernment and Information Technology, Office of Management and

Budget; David McClure, Associate Administrator, Office of Citizen

Services and Innovative Technologies, General Services Administration;

Cita Furlani, Director, Information Technology Laboratory, National

Institute of Standards and Technology; and Gregory Wilshusen, Director, Information Security Issues, Government Accountability Office ....... 10

Furlani, Cita .............................................................................................. 37

Kundra, Vivek ........................................................................................... 10

McClure, David .......................................................................................... 23

Wilshusen, Gregory ................................................................................... 49

Letters, statements, etc., submitted for the record by:

Bradshaw, Mike, director, Google Federal, Google Inc., prepared statement of ........................................................................................................... 110

Burton, Daniel, senior vice president, global public policy, Salesforce.com,

prepared statement of ................................................................................... 98

Charney, Scott, corporate vice president, trustworthy computing, Microsoft Corp., prepared statement of ................................................................ 84

Combs, Nick, chief technology officer, EMC Federal, prepared statement

of ..................................................................................................................... 119

Connolly, Hon. Gerald E., a Representative in Congress from the State

of Virginia, prepared statement of .............................................................. 151

Furlani, Cita, Director, Information Technology Laboratory, National Institute of Standards and Technology, prepared statement of ................... 39

Ganger, Gregory, professor, electrical and computer engineering, director,

Parallel Data Lab, Carnegie Mellon University, prepared statement

of ..................................................................................................................... 130

Issa, Hon. Darrell E., a Representative in Congress from the State of

California, prepared statement of ................................................................ 8

Kundra, Vivek, Federal Chief Information Officer, Administrator for eGovernment and Information Technology, Office of Management and

Budget, prepared statement of .................................................................... 13

McClure, David, Associate Administrator, Office of Citizen Services and

Innovative Technologies, General Services Administration, prepared

statement of ................................................................................................... 26

Towns, Chairman Edolphus, a Representative in Congress from the State

of New York, prepared statement of ........................................................... 3

Watson, Hon. Diane E., a Representative in Congress from the State

of California, prepared statement of ........................................................... 72

Wilshusen, Gregory, Director, Information Security Issues, Government

Accountability Office, prepared statement of ............................................. 51

(1)

CLOUD COMPUTING: BENEFITS AND RISKS

OF MOVING FEDERAL IT INTO THE CLOUD

THURSDAY, JULY 1, 2010

HOUSE OF REPRESENTATIVES, COMMITTEE ON OVERSIGHT

AND GOVERNMENT REFORM, JOINT WITH THE SUB- COMMITTEE ON GOVERNMENT MANAGEMENT, ORGANI- ZATION, AND PROCUREMENT, Washington, DC.

The committee and subcommittee met, pursuant to notice, at 10

a.m., in room 2157, Rayburn House Office Building, Hon. Edolphus

Towns (chairman of the committee) presiding.

Present from the Committee on Oversight and Government Reform: Representatives Towns, Watson, Cummings, Connolly,

Quigley, Cuellar, Murphy, Foster, Chu, Issa, Bilbray, Jordan,

Chaffetz, and Luetkemeyer.

Present from the Subcommittee on Government Management,

Organization, and Procurement: Representatives Watson, Connolly,

Cuellar, Murphy, Quigley, Bilbray, and Luetkemeyer.

Staff present: Krista Boyd, counsel; Linda Good, deputy chief

clerk; Velginy Hernandez, press assistant; Adam Hodge, deputy

press secretary; Carla Hultberg, chief clerk; Marc Johnson and

Ophelia Rivas, assistant clerks; Mike McCarthy, deputy staff director; Amy Miller and Gerri Willis, special assistants; Jenny Rosenberg, director of communications; Leneal Scott, IT specialist; Mark

Stephenson, senior policy advisor; Lawrence Brady, minority staff

director; John Cuaderes, minority deputy staff director; Jennifer

Safavian, minority chief counsel for oversight and investigations;

Adam Fromm, minority chief clerk and Member liaison; Kurt

Bardella, minority press secretary; Benjamin Cole and Seamus

Kraft, minority deputy press secretaries; Justin LoFranco, minority

press assistant and clerk; Christopher Hixon, minority senior counsel; Hudson Hollister, minority counsel; and John Ohly, minority

professional staff member.

Chairman TOWNS. The meeting will come to order.

Thank you for being here.

The purpose of today’s hearing is to examine the benefits and

risks of cloud computing for the Federal Government. At the most

basic level, cloud computing is Web-based computing whereby computing resources are shared and accessible over the Internet on demand. In this way, cloud computing is like most utility services.

Before the electric grid was developed, business owners who

wanted to use machinery also needed to produce enough energy to

run that machinery. That meant investing heavily to build and

maintain a power source. The electric grid revolutionized the counVerDate 11-MAY-2000 15:11 Nov 05, 2010 Jkt 000000 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 U:\DOCS\58350.TXT KATIE PsN: KATIE
2

try by centralizing the resource and allowing businesses to simply

purchase electricity.

Cloud computing promises the same for computing power. Instead of building and maintaining an entire IT system in-house,

businesses can purchase computing power and tap into that resource over the Internet.

Cloud computing is a very real technology that the Federal Government has already begun to embrace. The Federal Cloud Computing Initiative and an online cloud computing storefront were

launched in September 2009.

I have read that the Government-wide implementation of cloud

computing will be a decade-long journey. It is the job of this committee to ensure that journey is well thought out, that the benefits

and risks are fully examined, and that there are comprehensive

plans in place to ensure that we do this the right way, the first

time around.

The shift to cloud computing offers the Federal Government tremendous promise, but it is not without risk. The balance between

risk and reward is an important one and I hope to get a better understanding of that balance today.

It is clear to me that security and privacy are real concerns. Our

natural impulse is to hold the things we value close to us, but cloud

computing requires entrusting data to others. The law’s current

focus on the physical location of data also presents unique privacy

and legal challenges.

A major benefit of cloud computing is the potential for significant

cost savings. It makes sense: cloud computing allows agencies to

pool resources and pay only for the computing power that they actually use.

I look forward to today’s hearing, to a thorough examination of

the Federal Cloud Computing Initiative, and to addressing the

emerging legal and policy issues that Federal cloud computing presents. I want to thank all of our witnesses for appearing here today

and I really look forward to your testimony.

At this time, I would like to yield 5 minutes to the ranking member of the committee, the gentleman from California, Congressman

Issa.

[The prepared statement of Chairman Edolphus Towns follows:]

3

4

5

6

Mr. ISSA. Thank you, Mr. Chairman. I too am looking forward to

this important hearing. I too am expecting that if you and I are

still serving here on the dais in 10 years, we will still be holding

hearings on some portions of this.

I base that on a hearing we had just a week ago, in which we

recognized that half way through a contract that saved the American people, through its government, huge amounts of money if we

implemented new contracts the GSA had negotiated for telecommunications, ones that offered high Internet speeds, better telecommunication, better redundancy, and new features, were not implemented, even though they would save money, because, of course,

bureaucrats move slowly.

So today, as we hear about cost savings, I will not yawn. I will

not pretend to be disinterested. But I will not be a true believer

from the dais that cost savings will drive this move to cloud computing. I will be particularly interested in details as to how companies believe that they can implement guaranteed security in a

cloud environment.

As all of you know, we do not guarantee security; we have

breaches every week, every month, sometimes every day in government. And even here in the Capitol, the Chinese mainland government has repeatedly breached and taken confidential information

from the House. They regularly are able to penetrate our security.

So as we look to the Internet through a Web browser, we need

to do better, not just as good as we are doing here today.

Often said, history does not always repeat itself, but it very often

rhymes. Today, as we start looking at cloud computing, at my age,

I find that it is rhyming rather humorously. When I began my career, we were still using NCR–500’s. We would put as many of

those card reading computers as close as we could to the source,

and they would run the cards back and forth, distributing to us

punching machines so that we could prepare our jobs and then go

to that massive and expensive product and have it run.

By the time I was a young officer, I was running a DEC facility

with PDP–11/45s and DEC–10’s, wonderful computers that could

multitask, that could have multiple clients at one time, that could

load-share and balance, that could distribute priorities of who

needed what and when. But yet it was still sending to the big machine and the machine deciding what we would get when.

As we look at the cloud, there is no question that we can look

at the cloud as thousands, millions of computing devices available

to us to load-share. Or, in the rhyming way, we can look at it as

simply d`ejaˆ vu all over again. In fact, the cloud, in any configuration, is nothing but a return to those DEC–10 machines. You can

have different sizes; you can have dual processors; you can share

multiple across. We once had 14 PDP–11s all deciding, with one

central arbitrator, who got what load when, for what computing in

order to keep us in real time.

All of this has been done before, but not nearly at the scale it

is being done. And, in my case, all of my previous history in the

military was a closed system, an extremely closed system. Today

we are going to talk about an open system, one in which encryption

over a public line is our guarantee, and our only guarantee, that

7

the data flowing back and forth will remain in the hands of those

that it came from and is intended to go back to.

I look forward to hearing how we can, and should, implement

both public and, often, private cloud computing systems; how the

Government can, once and for all, recognize that owning a computer is not as important as owning computer power time, something that, 30 or 40 years ago, everybody understood that owning

time on a computer was what you did, not in fact owning a computer.

But weaning the Federal Government off of the idea that they

have endless arrays of PCs and servers all within a server room

that they can walk to will take time and will take initiative by this

committee. So because this is a Government-wide problem, we believe, the chairman and I, that this is a government oversight solution that must be pushed through day after day, Congress after

Congress.

With that, Mr. Chairman, I yield back the balance of my time

and thank you for this hearing.

[The prepared statement of Hon. Darrell E. Issa follows:]

8

9

10

Chairman TOWNS. I would like to thank the gentleman from

California for his statement.

At this time, we would like to ask you to stand so I can swear

you in.

Raise your right hands.

[Witnesses sworn.]

Chairman TOWNS. You may be seated.

Let the record reflect that all the witnesses answered in the affirmative.

Let me begin with you, Mr. Kundra. As you know, you have 5

minutes and, of course, at the end of 4 minutes the yellow light will

come on, which means caution, and then 1 minute after that the

red light will come on, and every place in the United States of

America that means stop. So, Mr. Kundra, will you start?

STATEMENTS OF VIVEK KUNDRA, FEDERAL CHIEF INFORMATION OFFICER, ADMINISTRATOR FOR E-GOVERNMENT AND

INFORMATION TECHNOLOGY, OFFICE OF MANAGEMENT

AND BUDGET; DAVID McCLURE, ASSOCIATE ADMINISTRATOR, OFFICE OF CITIZEN SERVICES AND INNOVATIVE

TECHNOLOGIES, GENERAL SERVICES ADMINISTRATION;

CITA FURLANI, DIRECTOR, INFORMATION TECHNOLOGY

LABORATORY, NATIONAL INSTITUTE OF STANDARDS AND

TECHNOLOGY; AND GREGORY WILSHUSEN, DIRECTOR, INFORMATION SECURITY ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE

STATEMENT OF VIVEK KUNDRA

Mr. KUNDRA. Good morning, Chairman Towns, Ranking Member

Issa. Thank you for the opportunity to testify today on cloud computing and the Federal Government’s approach toward cloud computing. What I would like to do is draw your attention to the first

slide that you see before you.

Earlier this week, the Obama administration focused on addressing some of the most persistent and structural issues we have faced

as an administration when it comes to information technology. The

U.S. Government is the largest buyer of IT on the planet. We spend

approximately $80 billion annually on information technology systems.

Yet, as you see on this slide, I want to point to one example. The

Department of Defense spent 12 years and $1 billion on deploying

an integrated human resource system which ended up failing, and

Secretary Gates said, essentially, that what we ended up with was

an acronym that nobody could pronounce. Therefore, earlier this

week, on Monday, we announced aggressive steps in terms of how

we are going to confront some of these issues.

June of last year we deployed an IT Dashboard that shines light

on every aspect of Government operations when it comes to information technology spending with literally the picture of every agency CIR right next to the IT investment that they are responsible

for so the American people could see where they were in terms of

cost, schedule, and whether they are meeting performance targets

or not.

11

What we are doing is approaching this problem in three ways:

No. 1, effective immediately, we are going to be reviewing the most

troubled IT investments across the Federal Government as part of

the fiscal year 2012 budget process and make decisions around

where we need to halt, terminate, or turn around these investments; No. 2, effective immediately, we have halted future task orders on financial systems across the Federal Government for the

CFO Act agencies to make sure that we are not throwing good

money after bad money; and, No. 3, in the next 120 days, we are

focused on making sure that we address some of the structural

issues, understand what is going on, why, for the last 50 years, as

we have tried to address some of these persistent problems, we continue to have spectacular failures in Federal IT.

On slide 2, what I want to draw your attention to is what the

Federal Government has been focused on. Unfortunately, the number of data centers in the U.S. Government has gone from 432 to

over 1,100 in a decade, while in the private sector IBM went from

235 data centers to 12. That is not sustainable in the long-term as

we continue to plow capital in data center after data center.

The next slide shows how other industries have applied these innovations around utility models. As you pointed out, Chairman

Towns, we have seen this happen in the electricity space, where

every home used to have to use candles to light their homes, to

where now they just plug into the grid. Or, with water, every home

used to have to essentially have a well to get water; now what we

see is the ability to turn on and off a tap to consume those resources.

That is one of the reasons we are moving toward the cloud environment. It is not just about cost, it is also about making sure that

we are providing better service so CIOS are focused not on investing on yet another data center, but actually providing better services.

I want to point you to the next slide, which is a tale of two cities.

In the first story, how the Government deployed an IT system versus how a private sector company deployed an IT system. When we

deployed a Cash for Clunkers program, we deployed the traditional

approach to IT, and as demand grew, the system was unstable and

continued to crash over a 30-day period, and we had to literally reengineer the solution, buy new hardware and configure it.

Yet, a company called Animoto faced similar problem but was

using cloud technology. With 250,000 new users enrolled over a 3-

day period, they were able to scale from 50 virtual machines to

over 4,000 virtual machines and supported, at peak times, 20,000

new users an hour.

What I want to point to in the next slide is what the Government

has done so far in terms of making sure that we are focused on

some of the security issues that you have raised; making sure that

we are addressing some of the standards that we need to promulgate as a function of interoperability, data portability, and security;

and procurement. And Dave McClure will talk about the procurement strategy and Cita Furlani will talk about our standards activities. But this work has been underway since April of last year.

I want to leave you with a closing slide that you see on slide 7.

What you see on the left is a cave. This is where most of the FedVerDate 11-MAY-2000 15:11 Nov 05, 2010 Jkt 000000 PO 00000 Frm 00015 Fmt 6633 Sfmt 6633 U:\DOCS\58350.TXT KATIE PsN: KATIE
12

eral Government’s HR records are. What you see on the right is

what the American people expect from their Government. The culture in the Government historically has been there is a form for

that, and the American people have to wait in line, hold on the

phone, or they actually have to come in and submit these complicated forms.

Yet, in the private sector, what we have seen is innovation. And

what we are trying to do is close that gap by making sure that we

are responsibly and safely moving to a cloud environment.

Thank you for the opportunity to testify, and I look forward to

your questions.

[The prepared statement of Mr. Kundra follows:]

13

14

15

16

17

18

19

20

21

22

23

Chairman TOWNS. Thank you very much for your testimony.

Mr. McClure is the Associate Administrator of the General Services Administration’s Office of Citizens Services and Innovative

Technologies. Welcome, Mr. McClure.

STATEMENT OF DAVID McCLURE

Mr. MCCLURE. Thank you, Chairman Towns, Ranking Member

Bilbray, all the other committee members here this morning.

Thanks for having me testify in front of you on what the General

Services Administration is doing to assist in the adoption of cloud

computing.

I think Vivek has done a good job in outlining for you what we

see as some of the tremendous benefits of cloud computing being

adopted in the Federal Government.

At GSA, we also believe that the adoption of safe and secure

cloud computing by the Federal Government represents a huge opportunity for us in terms of getting access to more modern technology and lowering the costs that we are spending on technology;

and various forms of cloud computing are already in place in the

Federal Government today.

Quick example, at GSA we have put the Government’s main primary information portal, USA.gov, into a cloud computing environment last year. We are already reaping the benefits in terms of a

more reliable uptime from the system; we have lowered our overall

computing costs by an estimated $1.7 million; and we actually have

raised the security posture of the system by going to a more reliable security arrangement with our cloud provider. So it does have

tremendous benefits.

As you also know, GSA plays a lead role in the President’s sustainability agenda. We anticipate that cloud computing will be a

major factor in reducing the environmental impact of technology

and also will help achieve some of our national sustainability goals.

Cloud computing can be part of an overall strategy to reduce the

need for these multiple data centers that we have all over the Government and the energy they consume. So we see it helping improve services by lowering the cost and also maintaining a better

environment compared to the redundant and often needlessly redundant brick and mortar data center structures that we have in

place today.

As part of our leadership in the cloud computing environment,

we have stood up a cloud computing program management office,

it is housed in my office at GSA. It provides the technical and administrative leadership for the administration’s cloud computing

initiatives.

We support the design and operation of cloud procurement vehicles; we look at ways in which we can identify enhancing security

requirements, working closely with NIST, as well as with OMB; we

have facilitated the adoption of these requirements in the last few

months; we also sponsor some cloud demonstration projects from a

piloting perspective so that we can demonstrate how this technology can be effective before going full bore; and we are engaged

in data center analysis and strategy planning with OMB as part

of our responsibilities with the PMO as well.

24

I think we also play a huge role in disseminating information

throughout the Government on just what is happening in cloud

computing. We are a knowledge repository for examples, best practices, and things that have really worked for us to date.

So let me just highlight real quickly a few of those areas for you.

I think one of the most significant challenges we face in cloud computing is certainly in the security area. Agencies are concerned

about the risk of housing data offsite, in a cloud, if federally mandated security controls and accountabilities are not in place.

The Federal CIO, our cloud PMO, the CIO Council, which has a

security working group, and NIST have come together to try to

tackle that problem. We have developed a process and corresponding security controls that have been agreed to by multiple agencies.

We are calling this program FedRAMP. It provides a uniform Government-wide risk management approach for enterprise level IT

systems and it will enable agencies to either use or leverage existing security authorizations.

Mr. Chairman, this is a first in the Federal Government, and it

should greatly reduce our security cost; it should enable rapid acquisitions of solutions; it should reduce agency levels of effort; and

it should shift the focus of security to monitoring and protecting

our computing environments.

GSA is working with NIST and the CIO Council to make sure

that this program is put in place and we will be piloting several

things through FedRAMP to get it up to speed with some improvements as we test it out.

The second area is providing newly commercial-provided cloud

services via a Web site called Apps.gov. This is the primary responsibility of GSA. It is modeled on GSA product and service acquisition storefronts; it provides an easy, simple way to find, research,

and procure commercial cloud products and services. And we feel

like that has been a real benefit to Federal agencies both in the

softwares of service area and soon to be in infrastructures of service for cloud computing.

A new class of Internet-based applications have also come onboard called Web 2.0 that focus on delivering information to diverse

communities. Many of these solutions are Web-based and many are

also hosted in the cloud. We at GSA are making sure that we are

providing, as common tools to agencies, social media Web 2.0 tools

that are completely policy compliant with all Federal privacy and

security policies, and it gives them an advantage in terms of doing

this independently on their own. And I think we have already

achieved some significant cost savings by putting some of these in

place Government-wide.

So cloud computing, from our perspective, has the ability to fundamentally reshape how we are approaching Government operations and how we are using computing power for business process

improvement and citizen service delivery support. It can also shift

the focus to the added value use of information, which I think is

what our next decade is truly about; and do this in a very cost-effective way in today’s digitally oriented world.

Chairman TOWNS. Mr. McClure, could you sum up?

25

Mr. MCCLURE. Yes. And, third, I think it frees up some resources

for us to really focus on some of the real information needs of the

Government as well.

So, in general, I think we are supporting the effort the best way

we can with some of our procurement activities and some of our

best practices support, and I think these are adding up to really

advance the computing cause. Thanks.

[The prepared statement of Mr. McClure follows:]

26

27

28

29

30

31

32

33

34

35

36

37

Chairman TOWNS. Thank you very much for your testimony.

Ms. Furlani is Director of the Information Technology Laboratory

at the National Institute of Standards and Technology. Welcome.

STATEMENT OF CITA FURLANI

Ms. FURLANI. Thank you, Chairman Towns and members of the

committee. I appreciate the opportunity to appear before you today

to discuss our role in the deployment of cloud computing technology

in the Federal Government.

Our role is to promote the effective and secure use of the technology within Government by providing technical guidance and

promoting standards. The three cybersecurity objectives, ensuring

the confidentiality, integrity, and availability of information technology systems, are particularly relevant to cloud computing. These

three objectives provide a technical foundation to help address the

associated privacy requirements.

This cloud model that I have listed in my testimony is composed

of five essential characteristics, three service models, and four deployment models, which are laid out fully in the written testimony.

The NIST cloud computing definition is the following: Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources, such as

networks, servers, storage, applications, and services, which can be

rapidly provisioned and released with minimal management effort

or service provider interaction.

This definition has been broadly recognized and helps to clarify

a complex emerging information technology paradigm. However,

there is still much work to be done. We have initiated focused activities to develop Federal cloud computing security guidance, as

well as to facilitate the development of cloud computing standards.

The following are specific NIST efforts which promote the effective

and secure use of cloud computing technology within Government:

NIST held a cloud computing forum and workshop in May to engage stakeholders on ways to best accelerate the Federal Government’s secure adoption of cloud computing. Over 500 stakeholders

attended this event.

We are developing a cloud computing special publication which

will provide insight into the technical benefits, risks, and considerations related to the secure and effective uses of cloud computing,

and provide guidance in the context of cloud computing to provide

interoperability, portability, and security. This publication will also

identify future research areas in cloud computing.

As requested by OMB, NIST serves as the Government lead

working with other Government agencies, industry, academia, and

standards development organizations to leverage appropriate existing standards and to accelerate the development of cloud computing standards where gaps exist. We have initiated the Standards

Acceleration to Jumpstart Adoption of Cloud Computing [SAJACC].

The SAJACC goal is to facilitate the accelerated development of

high-quality standards and to reduce the technical uncertainty during the interim period before many cloud computing standards are

formalized.

NIST, in a technical advisory role, supports the Federal interagency efforts which have been mentioned to the development of a

38

concept for a Federal approach to coordinate and apply consistent

security authorization requirements for cloud computing systems.

The NIST role is to provide guidance for a technical approach and

process which is consistent with NIST security guidance in the context of the Federal Information Security Management Act.

NIST has also initiated a strategic virtualization laboratory effort to research and evaluate the security of virtualization techniques and to mitigate security vulnerabilities in virtualized and

cloud systems. This will inform NIST cloud and virtualization

guidelines.

We have also initiated a Modeling and Analyzing Complex Behaviors in Cloud Computing project. This project seeks to understand and predict behavior in large distributed information systems. In cloud computing, NIST is initiating a study of the applicability of our modeling and analysis techniques to computational

clouds.

As you have just heard, this is a big effort. Thank you for the

opportunity to testify today on NIST’s role in the development and

deployment of cloud computing technology. I would be happy to answer any questions you may have.

[The prepared statement of Ms. Furlani follows:]

39

40

41

42

43

44

45

46

47

48

49

Chairman TOWNS. Thank you very much, Ms. Furlani.

Mr. Wilshusen.

STATEMENT OF GREGORY WILSHUSEN

Mr. WILSHUSEN. Chairman Towns, Ranking Member Issa, Chairwoman Watson, and Ranking Member Bilbray, and other members

of the committee, thank you for the opportunity to participate in

today’s hearing on cloud computing.

At Chairwoman Watson’s request, GAO has been reviewing the

information security implications of cloud computing and Federal

efforts to address them. Today we are releasing our report. My

statement will summarize the contents of that report. But first, if

I may, Mr. Chairman, I would like to recognize two members of my

staff, V.J. DeSouza and Season Dietrick, who were instrumental in

the preparation of that report.

As has been discussed, cloud computing is a form of shared computing where users have access to scalable, on-demand information

technology services and resources. Service providers offer these capabilities using several service and deployment models, including,

for example, a private cloud which is operated solely for an organization and a public cloud, which is available to any paying customer.

Cloud computing has both positive and negative information security implications. Potential security benefits include those related

to broad network access, possible economies of scale, and use of

self-service technologies. Federal agencies frequently cited as potential benefits low cost disaster recovery and data storage, on-demand security controls, consistent application of those controls, and

a reduced need to carry data and removable media.

However, the use of cloud computing can also create numerous

information security risks. Twenty-two of 24 major agencies reported that they were concerned or very concerned about the potential security risk associated with cloud computing. These risks include: ineffective or noncompliance security practices of the service

provider, inability to examine controls of the provider, data leakage

to unauthorized users, and loss of data if cloud service is terminated.

These risks generally relate to the dependence on the security

practices and assurances of the service provider and the sharing of

computing resources. They also may vary depending upon the cloud

deployment model used. For example, private clouds may have a

lower threat exposure than public clouds, but evaluating this risk

requires an examination of the specific controls in place for the

cloud’s implementation.

Federal agencies have begun efforts to address information security issues for cloud computing, but specific guidance is lacking and

often efforts remain complete. Although individual agencies have

identified security measures needed when using cloud computing,

they have not always developed corresponding guidance. In addition, several Government-wide cloud computing initiatives are underway by organizations such as OMB and GSA.

Nevertheless, much work remains. For example, OMB has not

yet finished the cloud computing strategy or defined how information security issues will be addressed in the strategy. GSA has

50

begun a procurement for expanding cloud computing services, but

still needs to develop specific plans for establishing a shared information security assessment and authorization process. Furthermore, NIST has not yet issued cloud-specific security guidance.

Both Federal and private sector officials have identified the need

for such guidance.

Accordingly, in the report being released today, GAO recommended that OMB, GSA, and NIST take several actions to address these issues. These agencies generally agreed with our recommendations and indicated that actions were planned or underway to implement them.

To summarize, the use of cloud computing offers promise, but

also carries risk. Until Federal guidance and processes that specifically address information security are developed, agencies may be

hesitant to implement cloud computing programs, and those that

have implemented such programs may not have appropriate security controls in place.

This concludes my statement. I would be happy to answer any

questions.

[The prepared statement of Mr. Wilshusen follows:]

51

52

53

54

55

56

57

58

59

60

61

62

Chairman TOWNS. Thank you very much.

Let me just announce to the Members that there are three votes,

and what I would suggest is that we break now and then come

back 10 minutes after the last vote. The witnesses, of course, need

to stay in the area. Thank you very much. It will at least be half

an hour or more before we get back.

So we will recess.

[Recess.]

Chairman TOWNS. The meeting will reconvene.

Let me again apologize, but we have to vote around here. And

if you don’t vote, they put your name in the newspaper.

Let me begin with, I guess, this question probably to you, Mr.

Kundra and to Mr. McClure. It seems to me that the shift to cloud

computing will move a lot of responsibility that we currently maintain in-house to contractors. What impact will that move have on

the Federal IT work force? Will we lose a lot of jobs as a result of

this?

Mr. KUNDRA. If I can step back for a second and look at the current environment that we are in. For example, based on the FISMA

report of last year, there are over 4,000 systems in the U.S. Government that are maintained by contractors. Just to give you examples of that, with the Navy, their network infrastructure, over

300,000 desktops are maintained and operated by EDS/HP. Our

travel system in the U.S. Government, for example, Northrop

Grumman actually manages that infrastructure.

So I want to be really careful as we talk about cloud computing

in terms of how we treat it versus other IT systems. Like any technology, part of what we are trying to do is make sure that, as we

move toward a cloud, that what Federal employees are doing, they

are armed in training and that we are focusing on work, as I highlighted on my earlier slide in my opening testimony, that serves

the American people. And what I mean by that is making sure that

there is appropriate training, a path to actually fundamentally reengineering the functions of those agencies.

But cloud computing is not something that is going to change the

way, in terms of the procurement side of it, because what we are

already doing is we have already engaged in the last 10, 20, 30

years in a lot of outsource systems, and this is just another area

that we are applying security and standards to.

Mr. MCCLURE. Yes, Mr. Chairman, I think it is a good question

in terms of the work force impact. As you know, a lot of Federal

IT spending is on infrastructure, and as we free up some of the personnel that are actually dedicated to maintenance of legacy systems and infrastructure, you can move them to more high value job

categories and into analytical categories for the information.

I will just draw on my own experience with USA.gov. That was

heavily dependent upon a staff that was engaged in day-to-day operations and maintenance activities, the updates, the patches, and

so forth. By moving it to a cloud environment, we freed up those

people to actually focus more of their time on applications for true

business needs and high-value security functions.

So that is the fundamental shift that could occur here, is that we

are actually enabling an IT work force in the Government to be

more focused and more targeted on high-value needs that we have.

63

Chairman TOWNS. Thank you very much.

Let me say this to you, Mr. Wilshusen. It seems clear to me that

there are certain things that should never be placed in the cloud,

particularly classified or maybe even sensitive information, because

it is simply not worth the risk, I don’t think. Do you agree?

Mr. WILSHUSEN. I would say that there are certain applications

and information in which it would probably perhaps be imprudent

to put in a cloud, but it really depends on what type of cloud is

being used, whether it is a private cloud, perhaps, behind an agency’s firewalls; and specifically what types of controls and the effectiveness of those controls that are placed over the systems operating in that particular cloud.

It is important to remember that the individual systems that are

being used, even in the traditional sense now at many agencies, we

have reported over years that many of them are not that secure in

and of themselves, and it really gets down to assuring that the security controls over the systems that are processing the information are effective and protecting the information, be it classified information, be it unclassified or sensitive information, to a level that

is required.

But I would say that, certainly, what agencies are doing now are

kind of taking a go slow approach in terms of limiting the type of

information that they are putting in the cloud implementations

that they are presently using. Most agencies that we looked at

using this kind of low-impact or low-sensitivity information for

those clouds which may particularly be in a public cloud.

And even in the private clouds they are still using, for the most

part, low-impact information until they work out the issues related

to adequately securing that information. Indeed, one of the risks

that we have identified with our report is the fact that it may be

difficult for agencies to currently assess the security and risk over

the cloud implementations that are available.

Chairman TOWNS. Thank you very much. I see my time has expired.

The gentleman from Utah, Mr. Chaffetz.

Mr. CHAFFETZ. Thank you.

Thank you all for being here. It is very encouraging to see the

presentations; it makes immense sense, particularly Mr. Kundra. I

appreciate that.

How do you get everybody moving in the same direction, though?

I mean, you just know the discussion is going to happen. You are

going to go over to the Bureau of Indian Affairs and they are going

to say, oh, but you don’t understand this and, oh, we have all this

safety and security, and we have to have our own proprietary system. How do you standardize, how do you push them?

Because I think we would probably all sit down and say we need

a unified way to move forward, but the reality is that is why we

end up with the thousands of different legacy systems that we

have. How do you do that? I don’t have a solution to that.

Mr. KUNDRA. Part of the way that we are addressing that challenge is grounded in the budgeting process, so it is part of the fiscal

year 2012 budget process. What agencies are doing is they are actually developing plans to consolidate infrastructure, to consolidate

data centers, and that activity is vital as we think about where

64

does it make sense for us to continue to invest in infrastructure

versus where are there opportunities to move to the cloud in a safe

and secure manner.

Second thing is the program management office that we have

stood up at GSA, where that is a center of gravity with the leadership that is being provided from an execution perspective.

Third is making sure, with the Federal CIO Council, that we create the appropriate economic incentives. And what I mean by that

is consider what it takes right now for any vendor to actually get

certified to sell to the U.S. Government. Well, you have such a high

barrier for entry because you have to get certified. If you are dealing with CDC, NIH, or if you are dealing with the FBI, and then

you have to go deal with GSA. That is very difficult because the

economics or the economies of scale don’t work out.

So, from a security perspective, one of the things we are doing

in cloud computing is we have launched the FedRAMP program,

where we are going to create a certification board made up of members from the Department of Defense, Department of Homeland Security, from GSA, and an agency that actually wants to procure

that technology, so that you go through that certification, but you

don’t just stop there; you move toward a continuous monitoring environment so you are not just generating paperwork reports from

a security perspective.

Mr. CHAFFETZ. But is the idea that if you meet that minimum

standard that would suffice for, say, some of these that truly do

warrant more sophisticated security type applications, that if you

meet that standard, that all the rest of the agencies would fall into

line? Is that the idea?

Mr. KUNDRA. Absolutely. They will be able to then leverage the

work that has been done across the Federal Government. To give

you a simple example, the State Department, over the last 6 years,

has spent $138 million on these paperwork exercises as far as certification and accreditation is concerned, and that is multiplied

across the board with multiple agencies and departments.

What we are trying to do is move away from this environment

of just generating paperwork reports and much more toward continuous monitoring, and that is an area that NIST has been spending a lot of energy in terms of how do we get realtime data on the

security of the systems, rather than just reports.

Mr. CHAFFETZ. Some of the business models that we see out

there that use kind of a version of cloud computing, if you will, are

reliant upon those eyeballs and then selling those eyeballs, in essence, in an advertising manner to be able to say, oh, well, we can

supplement it. It is free as long as you use it, but we are going to

sell some advertising against it.

Is there a standard that you have thought through on how that

would work or not work? Because the sensitivity of who is looking

at that information, selling of advertising, those types of things

may look appetizing to kind of defray the cost, but there are also

some security issues on the companies taking that information and

then, in essence, packaging it up to an advertiser. Have you

thought through how that works or won’t work?

Mr. KUNDRA. If we look at the Recovery Board and its move to

the cloud when it comes to Recovery.gov, they went through those

65

issues, and part of what they did was, as they were negotiating the

contract. And that is why I want to be careful as we think about

the move to the cloud not being something that is brand new, that

has never happened. It is essentially contracting.

As I mentioned, we are moving toward contracting systems,

whether we are dealing with Lockheed Martin, Raytheon, or a

number of other companies. In the same way, Recovery actually

said, you know what, with the cloud vendor, the data must in the

United States and here are a set of prerequisite solutions. And,

frankly, they have to comply with Federal statutes such as FISMA

and security guidance that has come out of OMB and NIST.

Mr. CHAFFETZ. Well, Mr. Chairman, I know my time is short, but

I am fascinated to continue on in having these further discussions,

because my guess is, and it is just a guess, but is that the law is

woefully behind in terms of the velocity and the speed in which

these types of applications change. It is just the nature of the

beast.

We will have to be vigilant on that, but I appreciate the hearing

today. Thanks for your input.

Thank you, Mr. Chairman.

Chairman TOWNS. Thank you very much.

I now yield 5 minutes to the gentlewoman from California.

Ms. CHU. Thank you, Mr. Chair.

I would like to ask the panel concerns about the current electronic privacy laws as we head toward this cloud computing. Specifically, commentators have raised concerns about the Electronic

Communications Privacy Act and that it hasn’t changed in nearly

25 years.

I am also on the Judiciary Committee, and we had a hearing on

the fact that information in the clouds in large part is not protected

by privacy laws; whereas, information in written communication is

protected by the privacy laws. Basically, we have not changed these

laws in these 25 years to accommodate this.

So, looking ahead, what steps should Congress take to ensure

that the privacy of both individual information and Government

records is maintained?

Mr. MCCLURE. I think that is a great question. There are two directives that were issued by the OMB Director last Friday dealing

with this issue of protection of personal identification information

on third-party sites, which are largely where a lot of SAS cloud applications are being used; and those issues were reinforced by the

policy that the protection of personal identifiable information is in

place, that agencies have to take steps to ensure that is occurring.

And if there is personal identification information collected, that it

is specifically explained and posted why it is being collected and

what it is being used for.

So I think what we are doing in the policy area is actually bringing up some of the older policies for inspection and looking at ways

in which we can modernize them in this environment but still offer

security and privacy protections that are fundamental to the data

needs of the Government.

Ms. CHU. And are there specific laws that you think need to be

changed and updated?

66

Mr. MCCLURE. I think that the next step will be to open up and

look at some of the laws. We are trying to look at the directive and

guidance that can come out of the administration, out of the executive branch, because that is normally how agencies implement the

basic fundamentals of the laws themselves. So step one, I think, is

can we get greater velocity and movement in what these changes

need to be, and then I think, longer term, we can open up some

of the statutes.

Ms. CHU. Then next let me ask about security concerns. I believe,

in testimony this morning, Mr. Bradshaw from Google will argue

that the cloud can provide better information security than current

legacy systems and, in particular, that the ability of agencies to

store information in the cloud, instead of on personal computers,

will actually allow for improved security. What do you think about

this argument?

Mr. KUNDRA. Well, I think when it comes to security, we need

to remain ever-vigilant. Whether that is security in our mobile security or whether that is on systems that are Government-owned

and operated or it is in an cloud environment. I don’t think there

is one answer that fits every single imaginable implementation of

these technology solutions.

That is one of the reasons President Obama, after coming into

office, quickly issued a directive to his Homeland Security Council

and National Security Council to do a bottom-up review of

cybersecurity. That is one of the reasons we have focused on investing over $3.6 billion in a comprehensive national cybersecurity initiative and that is one of the other reasons what we have done is

looked at our cyber posture and have said, look, we really need to

move away from these paperwork exercises and to realtime monitoring of how these systems are implemented.

It used to be that you could literally come in and certify a system, and then come back 3 years later, which was the policy that

was actually in place, and figure out whether it was still secure or

not. But we have shifted that by guidance that we issued that

moves us to more of a realtime monitoring approach where DHS,

working with agencies, is going to make sure not only do we have

continuous monitoring, but also investments in red teams that

would actually look at our own systems to figure out if we have

vulnerabilities or not.

The days of just writing a report and hoping things are secure

are over. We are confronting attacks on a real-time basis; therefore,

we must confront them with realtime monitoring on a continuous

basis. And NIST has actually been doing some really good work in

the space from a framework perspective.

Ms. FURLANI. Agreed. The risk management framework defines

ways to assess risk so that the program officials can actually make

those decisions with the facts in front of them.

Ms. CHU. So you are saying basically there would be better oversight, you would be monitoring this. But is there something inherent in the system that would make it more secure? For instance,

would the information be fragmented in various locations?

Mr. KUNDRA. Broadly speaking, when you are able to concentrate

compute power in one place, you are inherently managing one system, rather than managing hundreds and hundreds of systems and

67

trying to get firewalls in place, making sure that you are getting

realtime traps of what is going on in servers and routers and

switches.

So you can make that argument, but in my view there needs to

be a more fundamental shift, which is the cloud is not such a special technology, necessarily, that it is exempt from a security perspective, but it is just another implementation of IT and it is a natural evolution of where we have come from.

Congressman Issa very well articulated sort of the historical evolution of where we have ended up in terms of cloud, but there are

three big things that have happened. No. 1 is bandwidth, the ability to have access to bandwidth in ways that were not available before. No. 2 is processing power; Moore’s Law and the ability to have

processing power in ways that were not available before.

And No. 3 is storage, and the cost of storage has gone down exponentially. Therefore, now you are able to provide services in a centralized fashion that you couldn’t before. But you still have to take

the appropriate security safeguards. That is one of the reasons we

have charged NIST with making sure that we are convening the

right folks and that agencies have to comply with current statutes

and security policy.

Mr. WILSHUSEN. And if I may add, getting to the central question, is it more secure in a cloud versus in agency legacy systems,

as I mentioned before, it really gets down to how security is implemented over those systems. Certainly we have reported in the past

that agency legacy systems have had significant weaknesses in

them.

But there are some very real risks associated with putting information out in the cloud, particularly if they are public clouds. To

the extent that agencies will now have to rely on the security of

the service providers and have mechanisms in place to assure that

those providers are adequately securing the information that they

are given and processing. And just because it goes out to the cloud

does not necessarily make it more secure, but there are some risks

associated with it going out to the cloud.

But there are possibilities where there are certain control elements that can help security over this data, but at the same time

it gets back again to making sure there is verifiable implementation of effective security that is over those systems.

Chairman TOWNS. The gentlewoman’s time has expired.

I now yield 5 minutes to the ranking member of the committee,

the gentleman from California, Congressman Issa.

Mr. ISSA. Thank you, Mr. Chairman.

I am going to pick up right where you left off. I am going to ask

a leading question. Let’s say I am the labs, the Department of Energy labs, and I have five sites. If those sites have a firewall and

access to everybody inside to the Internet, and I take all five sites

and I take all the assets that are inside, behind the firewall, and

I move them to a private cloud, I move them to one, two, or three

sites out on the Internet, and I make a VPN connection with them

and I make all traffic to and from, no independent traffic, so it all

goes there. And then from those locations, through those firewalls

that are maintained, I can also go out and surf the Web.

68

So I am not taking away any result, but I am simply moving everything to where your communication is simply to one or more locations, and then from there they are centrally located. Isn’t it true

I haven’t changed anything at all? Assuming these are exactly the

same assets, just moved, I haven’t changed a thing; they are neither any more nor less secure as a result.

Mr. WILSHUSEN. As long as the same set of security controls are

implemented over the information.

Mr. ISSA. OK. So, as a baseline, I think you could all agree that,

as long as you have an Internet portal, location out of that portal

to some other location, if nothing else changes, makes no difference

at all; it is neither more secure nor less secure.

Mr. WILSHUSEN. As long as your Internet Web portal is securely

configured and secure.

Mr. ISSA. Right. Well, you are only as secure as your firewall to

begin with. So now going over and looking at GSA and Mr. Kundra,

let’s look at it another way. The bureaucracy. Every site, including

the Congress, that is Internet access capable out of our firewalls,

in other words, they are not closed systems, they are open to the

Web, we could take every one of them and we could move them to

Northern Canada so that we wouldn’t have to worry about cooling

year-round.

And as long as we had the bandwidth, we would have changed

nothing, isn’t that right? Now, we are making the assumption. We

are not going to cloud computing, we are just moving our data centers 500 milliseconds of latency time away, but we are moving

them. Anyone disagree that we are changing nothing?

[No response.]

Mr. ISSA. OK. So going back to those old systems of where we

had a 1200 baud connection to some mainframe and we were going

back and forth, the only thing that has really changed from those

old systems in that situation is bandwidth; and bandwidth is no

longer a limiting factor, right?

Mr. KUNDRA. Yes. But, I mean, there are a lot more as far as

cloud is concerned.

Mr. ISSA. OK. Now we want to get to being able to distribute our

load, balance our load among more than one, but maybe hundreds

or thousands of computing so that we get economies that we could

not otherwise get and the ability to have surge without having, as

you said, the Government solution that we had with Cash for

Clunkers, being you have to buy more PCs all the time. We want

to have that in place, right?

So I am going to look at GSA and I am going to say why aren’t you here today saying $80 billion, we would like $1 billion to put

up resources that would be available to new requirements and to

those who wanted to move from where we are to there, where that,

in a sense, you would be saying, look, we are not going to worry

about your budget, we are going to worry about proving that we

can take $1 billion and get what used to be $2 billion, but get it

better, faster, and more reliable.

Why are we not talking about a top-down implementation rather

than the opening statement that, sadly, I heard where we talked

about 500 people going to a big convention and trying to get buyin? Five hundred people trying to get buy-in is what we were here

69

a couple weeks ago talking about when we find that agencies, years

after the GSA provides better, faster, cheaper solutions for Internet

and telephone access, we find that we don’t have them because the

bureaucracy is slow, because they have their systems, because

something as simple as is it safer or less safe? If the GSA took $1 billion and said we are going to contract a

world-class private cloud in which all the vendors have locked

doors and separate everything, but we are going to prove that it

still is better, cheaper, faster, and provides that, and we are going

to make it available to innovative projects or to innovative people

that are already wanting to move from owning to simply having,

why is it that is not what we are here today talking about? Because, otherwise, I fear that it will be 10 years from now, and even

though you will have created the opportunity, the buy-in will be

slow in coming.

Mr. MCCLURE. Well, Congressman, I think we are moving pretty

aggressively in that area. We already, on our Apps.gov store site,

have softwares of service solutions available Government-wide that

provide economies of scale. We just closed yesterday an infrastructure as a service blanket purchase agreement offering that should

be able to leverage cloud-based infrastructure purchasing Government-wide. So those vehicles, I think, we are rapidly putting in

place to allow the economies of scale to actually work.

Mr. ISSA. But each agency is going to have to make those individual decisions, all the things we are hearing that slow the process

down.

Mr. MCCLURE. Exactly, except, remember, what we have been

talking about this morning also is a Government-wide certification

process for the security of these infrastructure offerings, which is

quite different from the way we have operated in the past. So an

agency could get on our BPA, actually choose one of the vendors,

but then each agency would go through its own certification, testing, and control processing.

That is where the process has gotten very inefficient. If we can

successfully stand up a FedRAMP process that allows a consensus

to be built around the testing and controls being accepted by all

parties, or if there is a variation that only the incremental testing

is needed, not reinvention of it, we have moved the ball, I think,

considerably down the path much further than we have previously.

We also have several pilots. I think one of the other things we

have to do—the question earlier was the bureaucracy not accepting

this. So we have pilots underway to show proof of concept in these

cloud arrangements that I think can also move the needle further

down the road by actually showing where these successes are, that

security is in place and that cost-savings are being produced. It is,

show me, I am from Missouri, and I think that is a valid concern.

That is why we are working collaboratively in the E-Gov area to

show some of these pilots and their merits.

Mr. ISSA. Thank you.

Mr. Chairman, I might just note that although GSA doesn’t control it directly, House Administration does, that you and I are part

of a grand experiment where 540 servers in our individual offices

are being moved to 540 virtual ones with no cloud capability, simply relocated. So as I went through that painful example of if you

70

took everything and just moved it somewhere, but didn’t get any

of the benefits of the cloud, you wouldn’t have changed anything,

that is what we are doing in Congress.

Chairman TOWNS. Right.

Mr. ISSA. Thank you, Mr. Chairman.

Chairman TOWNS. You are right.

I yield 5 minutes to the gentlewoman from California, Ms. Watson, who has been very involved in this issue.

Ms. WATSON. Thank you so much, Mr. Chairman. I am so glad

that we are working in conjunction with the full committee because

we have been looking at procurement, and we want to take a deeper look, and I want to continue to restate the purpose for today’s

hearing: to look at the benefits and the risks of the Federal Government’s use of the cloud computing services. So, if you don’t

mind, I will read my statement, my opening statement.

Chairman TOWNS. Without objection, so ordered.

Ms. WATSON. At its basic level, the term ‘‘cloud computing’’ is a

metaphor for Internet-based computing. Some have described it as

a new name for an old concept: the delivery of computing services

from a remote location, similar to the way electricity and other utilities are provided to most customers. A preponderance of technology experts believe that by 2020 most people will access software applications online and share and retrieve information

through the use of remote server networks. This is a dramatic departure from today’s environment where we depend on software

housed on individual computers.

The use of cloud computing by Federal agencies has significant

benefits for collaboration across a broad information infrastructure,

as well as for reducing costs associated with long-term information

technology investments. It holds out the promise of enabling IT assets to remain on the technological cutting edge over their life cycle

at reduced costs.

It is therefore appropriate that President Obama has targeted

the Federal Government’s IT infrastructure as part of his mandate

to cut agency budgets by 5 percent in 2011, particularly when we

consider that the Federal Government spends $76 billion annually

on IT investments and that the majority of those investments are

for software and IT services.

Despite these benefits, we remain concerned with potential or

unknown security risks associated with cloud computing across the

Federal agency community. For example, Federal customers may

become dependent on their cloud computing vendor’s effective implementation of security practices or protocols for ensuring the integrity and reliability of agency data and applications.

The cloud computing model also raises privacy issues, as well as

the level of control over data, due to issues of portability across different platforms or the fact that vendors may not be willing to divulge proprietary information.

Due to these concerns, in July 2009, I requested that the GAO

evaluate the technical and security risks associated with cloud computing across the Federal Government. I am pleased to announce

that GAO is releasing the report at the hearing today, and you

probably have heard some of them in my absence. Mr. Greg

71

Wilshusen, who was just reporting when we recessed, was relaying

some of the findings.

The GAO report notes that while individual agencies have identified security measures needed when using cloud computing, they

have not always developed corresponding guidance, and that OMB

and GSA have yet to complete Government-wide cloud computing

security initiatives. Overall, I believe the report makes the point

that cloud computing has both advantages as well as disadvantages, Mr. Chairman, with respect to cybersecurity and that the administration should move deliberatively and with caution in considering when or when not to use cloud computing platforms.

Concerns involving vendor cybersecurity have not arisen in a

vacuum or in an ad hoc manner. Specifically, we know, through reporting done in the Wall Street Journal and other publications,

that multiple technology and industrial base companies, including

Google, have been compromised by cyberattacks believed to be

sourced from the People’s Republic of China. It has subsequently

been reported that both the Federal Bureau of Investigation and

the National Security Agency have examined these episodes to determine their origins and the extent of damages sustained by all

parties.

Cyberattacks place personal data, intellectual property, and our

national security at grave risk, and require our partners in the

Government contractor community to be ever-vigilant in securing

those systems and infrastructures used to service both Federal

agencies and private citizens alike.

While I understand the aforementioned incidents may not be appropriate for discussion in an open hearing, Mr. Chairman, I believe our vendor panelists need to address the broader issue of how

they plan on meeting Federal information security standards for

protecting those programs and Federal data that may be hosted

through their cloud services.

[The prepared statement of Hon. Diane E. Watson follows:]

72

73

74

75

Ms. WATSON. I really needed to be here full-time to hear what

the panelists have said, but if I might take a few minutes to raise

a question, I would appreciate the time.

Chairman TOWNS. Let me suggest to the gentlelady that what I

will do is recognize Mr. Luetkemeyer and then come back to you.

Ms. WATSON. All right. That is fine. Thank you, Mr. Chairman.

I yield back.

Chairman TOWNS. I recognize Mr. Luetkemeyer from Missouri.

Mr. LUETKEMEYER. Thank you, Mr. Chairman. I was under the

impression that statements like that normally were submitted for

the record, but I guess it is proper to read the entire thing.

Chairman TOWNS. If you have a statement, you can read it.

Mr. LUETKEMEYER. I am sorry?

Chairman TOWNS. If you have a statement, you can read it.

Mr. LUETKEMEYER. I think that these gentleman probably have

more to do than listen to my statement, so I would be glad to submit it for the record. Thank you, sir.

Mr. Wilshusen, I am just kind of curious. What percentage of the

Government’s different duties and agencies do you think would be

appropriate to put the cloud type of computing in place?

Mr. WILSHUSEN. Well, I don’t know if I can really state what percentage of systems should be placed in the cloud; I think it really

depends upon what each agency feels would be best for its interest

to go to a cloud environment. Certainly, in doing that, there are a

number of benefits that come by placing systems and information

out into a cloud. I think some of the other panelists have talked

about those benefits. But they also have to weigh the risk in doing

that. But I really couldn’t hazard a guess as to what percentage of

systems should be placed in a cloud.

Mr. LUETKEMEYER. Who approves the move to go to the cloud

type of computing, is that something that there is a congressional

committee that oversees this or is it just your department or various agencies? Who has the authority to make a decision like this,

to dump everybody’s information to a cloud?

Mr. WILSHUSEN. Oh, I think that would probably be up to the individual agencies, but perhaps Mr. Kundra might be better able to

answer that.

Mr. LUETKEMEYER. OK. Mr. Kundra.

Mr. KUNDRA. It is like any other IT system, it would be the Chief

Information Officer of the agency and the Chief Information Security Officer to make sure that, before moving any system to the

cloud, that, one, they have made sure they have taken into account

all the statutory requirements; two, all the policy guidance around

privacy and security that have existed for many years.

Mr. LUETKEMEYER. I know that there are a couple of agencies

and different groups that already use the cloud type of computing

in our Government. Do you know how many? And are there other

companies, other States, other countries that have gone to this type

of computing that we can look at as models? Just kind of elaborate

on that a little bit.

Mr. KUNDRA. Sure. What I would love to do is share with you

a report we put together where we have highlighted illustrative

case studies, whether that is at a State level, local level, and even

within the Federal Government.

76

But just to give you one example, GSA, as part of the Open Government Directive, when every agency had to engage within 45

days to get input from the American people, what GSA did was it

provided a cloud solution, and they went through the appropriate

security protocols. Instead of every agency having to go out there

and build a proprietary system, they were able to leverage this

cloud solutions and agencies, instead, focused actually on the content of how they were going to interact with the American people,

how they were going to process that input, rather than standing up

yet another set of data centers or servers.

Mr. LUETKEMEYER. In your testimony you indicate that the administration announced three actions this week. The first one was

to take under review troubled IT projects across the Federal Government and identify serious problems. Can you identify some of

the serious problems and how this cloud computing would impact

those? Would that be something that would work with this situation or are they problems that are beyond this type of solution?

Mr. KUNDRA. Well, I think they are larger problems in Federal

IT. So as we look at the fiscal year 2012 budget, the President has

called for a freeze on non-defense natural security spending and

also the 5 percent cut that agencies have to meet, and one of the

ways agencies are going to be able to make sure that they are still

delivering services effectively is through investments and information technology.

Mr. LUETKEMEYER. Well, what are some of the serious problems?

Is the cut you identified a serious problem?

Mr. KUNDRA. No. What we want to make sure is that taxpayer

money is being spent well, so some of these serious problems, the

example I gave——

Mr. LUETKEMEYER. Identify a serious problem for me. I am just

curious as to what the problems were that have been identified.

Mr. KUNDRA. Procurement cycles, for example, that may take 18

months or problems around the Government scoping IT projects

with deliverables that take 2, 3, 4 years. And we have seen best

practices where, at the local, State level, or even the private sector,

where buyers are saying, look, you have to deliver value in 6

months, not 3 years from today.

We have also seen problems in terms of how some of these systems are actually scoped, overly prescribing requirements that will

end up in failure as a result of everything being overly specified.

Mr. LUETKEMEYER. OK, so basically the problems you identified

there were problems of process and procedure versus something to

be solved with the cloud, is that correct?

Mr. KUNDRA. Right. Well, cloud is a technology, by no means a

silver bullet that is going to solve all the IT problems we have. It

is one approach, it is not the answer to everything that is wrong

with Federal IT.

Mr. LUETKEMEYER. All right. Thank you.

Thank you, Mr. Chairman.

Chairman TOWNS. I thank the gentleman from Missouri.

I now yield to the gentlewoman from California 5 minutes.

Ms. WATSON. Thank you so much, Mr. Chairman.

Cost saving estimates for the Federal Government derived from

the use of cloud computing very greatly, anywhere from 25 percent

77

to above 90 percent in savings. The wide range in cost estimates

is in part due to the fact that cloud computing is still evolving, and

savings are dependent on the type of cloud platform that is deployed.

The required level of security is also an unknown variable. What

other valuables should we take into account in measuring potential

savings from cloud computing and what cost savings estimate can

we reasonably expect? And let’s start with Mr. Kundra and then

go right down the panelists.

Mr. KUNDRA. Sure. So from a savings perspective it is very much

around the problem you are trying to solve. And what I mean by

that is when Recovery.gov moved to the cloud, they saved $750,000

on an annual basis, which is very different than what GSA did

when they moved USA.gov to the cloud; I believe it was $1.7 million is what GSA saved. But in some cases it may end up costing

more because of security requirements that would have to be implemented. So I don’t think there is a single number that is going

to lead to these savings.

Ms. WATSON. It is a range.

Mr. KUNDRA. Well, even within the range that is why you see

such a wide, in terms of degrees of freedom, from 25 to 99 percent,

or whatever the number is. For example, with the Open Government Directive, that was a nominal cost to provide a platform for

every single agency to engage the American people. We didn’t have

to go out there and spend millions of dollars and engage in a multiyear contract. So there is also a lot of cost avoidance as a result

of leveraging these cloud solutions.

And as we look forward, part of what we are doing is we are

making sure we recognize that the power here, when we talk about

cloud computing, is it is also greener from a computing perspective,

because you don’t have to go out there and keep building data center after data center. I mentioned earlier in my testimony how we

have gone from over 400 data centers to over 1,100 in a 10-year

period; whereas, in the private sector we have seen a move toward

consolidation.

So it is greener in terms of making sure that we are leveraging

these assets more effectively, and also provides better customer

service. Those are the other benefits. The example I used around

Cash for Clunkers, where we had challenges around the system not

being able to stay online because demand was so high, versus a private sector company that leveraged a cloud solution that kept up

with demand without any failure.

Ms. WATSON. We don’t want to keep our heads in the clouds. A

pun is the worst form of humor.

Mr. McClure.

Mr. MCCLURE. Yes, I think that is absolutely right, what Vivek

was saying. I think we have to be careful with numbers on averages being thrown around. I think the examples that we have documented in the Federal Government, if you read the report Vivek

was talking about in terms of the dozens of examples of cloud computing, if it has been used for improving software development activities it is one range of cost; if we are actually saving storage cost

because it is more efficient in a cloud environment is another type

of savings; if we have actually saved software development money

78

by taking a common tool that is plug-and-play into an environment.

So I think the cost savings will be dramatically different depending

upon the type of application and type of cloud environment that we

are putting these solutions in.

But I would agree that we shouldn’t focus totally on cost. Speed,

agility, the ability to move quickly into the computing environments are significantly enhanced in these cloud environments, and

those are huge payoffs for service delivery to citizens.

Ms. WATSON. Ms. Furlani.

Ms. FURLANI. I think where NIST contributes to this is the

standardization or the recommendations of consistency in applying

the guidelines and the standards across the agencies so that these

cost savings can be realized. Understanding our risk management

framework, the release we just put out, an 837 updates and permits the leveraging of the certification and accreditation issues that

we have mentioned; the baseline controls that Vivek has referenced, where you can actually continuously monitor security controls are actually deployed appropriately.

So what NIST contributes is this capability of standards and

guidelines to provide consistency so agencies can leverage each other’s capabilities more effectively and make the cost savings real.

Chairman TOWNS. Would the gentlewoman yield?

Ms. WATSON. Yes.

Chairman TOWNS. Do we really know enough to set standards?

Ms. FURLANI. That is what we are working on, to identify where

the standards need to be, and that was the starting point in the

workshop where we had many stakeholders come and help us understand. We have guidelines now for how IT systems should be

deployed, and that was what I was referencing.

But the applicable standards in the cloud computing environment will be dependent on which model of cloud computing you are

actually addressing and which kind you are trying to use for your

own particular program and your own mission requirements. So it

all comes back to the program official understanding the risks that

are being undertaken and having guidance, which we provide, to

assess that risk and make the decisions as to which standards are

available and which can be monitored.

Mr. WILSHUSEN. And although we did not look at the specific cost

savings and issues related to cloud computing in our report, we did

discuss the need for OMB to complete a strategy on its implementation of cloud computing and initiatives across the Government,

and in our report we talked about the information security issues

that need to be addressed in that strategy.

But what also should probably be included in that are performance measures, particularly as they relate to cost savings; the

speed, how much faster is it to obtain the resources that my other

panelists here have been discussing? So certainly the need to develop performance measures, which data can be collected on, and

then one can evaluate just how cost-effective and what cost savings

have been acquired through the use of cloud computing.

Ms. WATSON. Mr. Chairman, I know my time is up, but I just

want to say that our subcommittee will continue to look at this

issue, procurement and is it a cost savings. And what I am hearing

today, we have to customize this particular IT, this cloud kind of

79

IT for the services that you provide. I don’t think one method will

suit all. It is a work in progress, it is evolving, so we are going to

keep tabs on it in the very near future and report back to the full

committee. Thank you so much for the extra time.

Chairman TOWNS. I thank the gentlewoman for her work and

what she is doing in her subcommittee.

I now yield to the gentleman from California.

Mr. ISSA. I am going to continue. I am a big fan of cloud computing, so don’t have anything I say cause you to think that it is anything other than my fear of the bureaucracy that causes me to

sound like we are not going to get there as quick as we would like

to and I want to look at other things.

Mr. Kundra, if we simply did a move and manage, just assume

for a moment that anyone who is eligible to go to the cloud, instead

of going to cloud, we just move and manage, meaning, like Congress, we say we are going to take it out of all your offices, where

everybody had an individual server. You have enough bandwidth or

we will provide you enough bandwidth at a relatively low cost. We

are going to centrally manage. We are going to, where appropriate,

have multiple servers and multiple raids.

We will make those decisions, but we are providing you with an

equivalent amount of processing to whatever you had, but we are

going to relocate it. Literally the way they did it in Congress is

they picked up your server and took it to another place, and then

over time, using VMware or an equivalent, they are going to give

you pieces of more powerful servers.

From a purely speed of chipping away at that $80 billion and

freeing up dollars for innovation and other uses, isn’t that a step

that can be done today without any of the concerns that are being

talked about, about the fitness of some future vendor? In other

words, if you assume that each agency, unless they consent otherwise, doesn’t have sharing between agencies and so on, how would

you envision that as a, if you can’t get what you want, would this

be a step?

Mr. KUNDRA. Sure. And that is actually exactly what we are engaged in. One of the things we have done is we have looked at this

problem around expenditures in information technology, and approximately $20 billion annually is spent on infrastructure. So if

you take the entire $80 billion, break it down to just infrastructure

spend on servers, routers, switches, networks.

Mr. ISSA. Air conditioning, backup generators, UPSes.

Mr. KUNDRA. Exactly. So the first step we are taking is to make

sure that, one, across the entire Federal Government we have detailed plans as far as data center consolidation is concerned.

So that is an effort that is underway, and part of the 2012 budgeting process, what agencies have to do is make sure they come in

to the budget process to say, look, what is your plan? What is your

strategy? For example, Department of Homeland Security has committed to move from approximately 24 data centers down to 2. GSA

has over eight data centers. And I could cite department by department.

Mr. ISSA. And they are supposed to be the example of best of,

right?

80

Mr. KUNDRA. Well, look, we didn’t get here overnight; this is a

multi-decade problem. Over the last 50 years that is how the Government has been growing. In my testimony I talked about how

companies like IBM have consolidated; whereas the Government

continues to grow.

Mr. ISSA. Well, let me ask a question as to that. If that is the

case, we here probably are the most parochial group you are going

to find. We get reelected based on whether or not people believe we

care about them. So it is not uncommon that we would want a data

center in our district, particularly if it created good paying jobs.

Chairman TOWNS. I want two. [Laughter.]

Mr. ISSA. I would second that for the chairman.

Now, it happens that Brooklyn may not always be the best place.

And I know that the electric costs in San Diego are not the lowest.

So what are you, cumulatively or individually, doing to create, if

you will, that best of location, best of price cost for some of these

data systems, and what are you doing to ensure that GSA actually

goes to zero—here me out for a second—zero data centers? Because

there is no reason for you to have a unique data center that is only

GSA.

You can have a unique room in a larger data center that five

other agencies each have a room in. But what would be the costeffectiveness of having your own eight at your own sites. By the

way, you probably would pick sites based on the Congressmen who

have the most influence on you, and I am perhaps one of them,

while Homeland Security might look to Mr. King and so on other

there. What are we doing to ensure that these sitings are both as

consolidated as possible and as efficient as possible?

Mr. KUNDRA. And that is part——

Mr. ISSA. And as least interfered by people like us as possible.

Mr. KUNDRA. Well, one, we look forward to working with the

Congress as we take on this really, really difficult problem——

Mr. ISSA. I think you are getting those two data centers.

Mr. KUNDRA [continuing]. Because you have 1,100, and what was

really interesting was when we went back and looked at the data,

some agencies couldn’t produce that data right away in terms of

where is your data center; how many servers do you have; what is

your rack utilization? And what we are finding, unfortunately, is

that in some agencies server utilization is actually at 7 percent.

And when you think about cloud computing, that is where you

have a lot of wasted capacity, because what ends up happening is

everybody engineers their solution for what they expect the peak

to be. Therefore, they overbuild and it ends up costing a fortune to

maintain those systems.

So by this December——

Mr. ISSA. You mean like the stories that we have seen where

servers are actually retired, never having been powered up, but

they were bought?

Mr. KUNDRA. Right. And that is the type of waste we are taking

head on, and that is why, by this December, agencies across the

Federal Government have been directed by OMB to come up with

road maps and plans on how they are going to consolidate. And

part of what we want to make sure is that we are responsible in

the consolidation, because what you don’t want to do is consolidate

81

to one place where now everybody knows if you go after that one

place, you are going to be able to bring down all of Federal IT.

So we have to figure out how do we, in this environment, where

we have over 1,100—and that number may go up, by the way, because the final plans aren’t due until this December—how do we

make sure that there is enough geodiversity to ensure security, but

at the same time that it is not so crazy that you have data centers

popping up every year all over the country.

Mr. ISSA. Thank you.

Thank you, Mr. Chairman.

Chairman TOWNS. Thank you very much.

Let me thank all the witnesses for your testimony. You have

been very, very helpful and I know the subcommittee will continue

to work on this as well. We want to thank you for your time and,

of course, the suggestions and recommendations. We look forward

to working with you. Thank you very much.

Mr. KUNDRA. Thank you very much.

We would like to call up our second panel.

Mr. Scott Charney is corporate vice president of trustworthy

computing at the Microsoft Corp. Welcome. Mr. Daniel Burton is

senior vice president of global public policy at Salesforce.com; Mr.

Mike Bradshaw is director of Google Federal; Mr. Nick Combs is

chief technology officer of EMC Federal; and Gregory Ganger is

professor of electrical and computer engineering, as well as director

of the Parallel Data Lab at Carnegie Mellon University.

Welcome and thank you all for being here. Let me say to you

that we always swear our witnesses in, so if you would stand and

raise your right hands.

[Witnesses sworn.]

Chairman TOWNS. You may be seated.

Let the record reflect that all the witnesses answered in the affirmative.

Let me start with you, Mr. Charney, and we will just go right

down the line. You know you have 5 minutes. You know how it

works. After the light comes on caution, then red, and all of that,

which will allow us ample time to raise questions. And you can see

that we have a lot of questions. So why don’t we just start with

you, Mr. Charney, and come right down the line?

STATEMENTS OF SCOTT CHARNEY, CORPORATE VICE PRESIDENT, TRUSTWORTHY COMPUTING, MICROSOFT CORP.;

DANIEL BURTON, SENIOR VICE PRESIDENT, GLOBAL PUBLIC

POLICY, SALESFORCE.COM; MIKE BRADSHAW, DIRECTOR,

GOOGLE FEDERAL, GOOGLE INC.; NICK COMBS, CHIEF

TECHNOLOGY OFFICER, EMC FEDERAL; AND GREGORY

GANGER, PROFESSOR, ELECTRICAL AND COMPUTER ENGINEERING, DIRECTOR, PARALLEL DATA LAB, CARNEGIE MELLON UNIVERSITY

STATEMENT OF SCOTT CHARNEY

Mr. CHARNEY. Thank you, Chairman Towns, Ranking Member

Issa, Chairwoman Watson. Thank you for the opportunity to share

Microsoft’s view on the benefits and risks of cloud computing for

the Federal Government.

82

My name is Scott Charney. I am the corporate vice president for

trustworthy computing and environmental sustainability at Microsoft. I also serve as one of the four co-chairs for the Center for Strategic and International Studies Commission on Cybersecurity for

the 44th Presidency. Prior to joining Microsoft, I was Chief of the

Computer Crime and Intellectual Property Section at the U.S. Department of Justice.

In my testimony today, I want to describe how cloud computing

impacts responsibilities for the security, privacy, and reliability of

IT systems, and I want to highlight the importance of Electronic

Communications Privacy Act reform and identity management

issues.

While cloud computing creates new opportunities, it also presents new challenges. More specifically, a Government agency

using a cloud service may shift certain security, privacy, and reliability responsibilities to the cloud provider. To ensure this is done

properly, Government agencies need to clearly identify their security, privacy, and reliability requirements to the cloud provider,

and cloud providers need to be transparent about the steps taken

to meet those requirements.

In Microsoft’s case, we employ a holistic approach in managing

security, privacy, and reliability issues, an approach that is designed to meet or exceed customer requirements. This approach,

which encompasses physical personnel and IT security, has three

parts: first, we have a risk-based information security program that

assesses and prioritizes security and operational threats to the

business; second, we maintain and regularly update a detailed set

of security controls to mitigate risk; third, we use a compliance

framework to ensure that controls are designed appropriately and

are operating effectively.

A key part of this process is the Microsoft Security Development

Lifecycle [SDL], which helps to improve security and privacy protections in our software and our services. The SDL consists of processes and tools designed to reduce the number and severity of

vulnerabilities in software products, manage risk in computing environments, ensure appropriate and agile response when incidents

occur, and help protect people and their personal information by

imposing mandatory engineering practices related to security and

privacy. By building and managing resilient infrastructure with

trustworthy people, we can further ensure a high availability in 24/

7 support in our service level agreements.

While the cloud is getting ready for the Government, the Government must get ready for the cloud. Agencies continue to struggle

to identify, manage, and account for the security of data and systems. Moving to the cloud does not eliminate an agency’s responsibility for its data. To adapt to the cloud, an agency must clearly

identify and communicate its requirements and expectations to the

cloud provider, who, in turn, must indicate how those requirements

and expectations will be met.

Progress is being made. The Federal Risk and Authorization

Management Program [FedRAMP], is an important initial effort to

create efficiencies and define responsibilities. This program enables

common assessments of cloud service providers, allowing a cloud

provider to certify once and have that certification shared among

83

the agencies. In addition to increased efficiencies, FedRAMP can

ensure better transparency into cloud provider practices.

In addition to managing its own systems, the Government has a

policy role to play. In this regard, it must ensure that privacy protections for citizens keep pace with technological changes. Congress

enacted the Electronic Communications Privacy Act almost 25

years ago. Dramatic technology advancements, including the shift

to cloud computing, require ECPA, as it is known, to be updated

and aligned with reasonable privacy expectations. Additionally, industry and Government must create more robust identities for

Internet use, particularly as we adapt to the cloud.

There are over 1.8 billion Internet users worldwide. The mechanisms used to identify people and devices on the Internet, even

when sensitive data or critical infrastructures are involved, is

weak. And as the Government offers more citizen services online

and individuals store more sensitive information in the cloud, electronic identifications will become increasingly important. The recently released draft National Strategy for Trusted Identities in

Cyberspace represents significant progress in the dialog about how

to create trust in online transactions, but much remains to be done.

In closing, clarity and transparency about Government requirements and cloud provider offerings is critically important. The

more precise and transparent we are, the greater the trust we will

build and the greater the opportunity we create.

Thank you for your important leadership on the issue of cloud

computing, and I look forward to working with you on this important topic.

[The prepared statement of Mr. Charney follows:]

84

85

86

87

88

89

90

91

92

93

94

95

96

Chairman TOWNS. Thank you very much, Mr. Charney.

Mr. Burton.

STATEMENT OF DANIEL BURTON

Mr. BURTON. Thank you, Chairman Towns, Chairwoman Watson,

Ranking Member Issa, members of the committee. Thank you for

holding this hearing and inviting me to share my views.

As the senior vice president for global public policy at

Salesforce.com, I am deeply involved in discussions with Government about cloud computing, and I applaud the efforts of this committee and the subcommittee to shed light on this effort.

Salesforce.com is a leading enterprise cloud computing company

whose applications allow organizations to input, store, process, and

access data about their customers over the Internet. In addition,

we provide a cloud collaboration tool called Chatter and a cloud

technology platform called Force.com. Several U.S. Federal agencies already use Salesforce, including the Army, HHS, NASA, GSA,

the State Department, the Census Bureau, and many others.

In my remarks, I will make reference to the Salesforce enterprise

cloud computing model, not the consumer cloud computing model

popularized by companies like Amazon and eBay.

Descriptions of cloud computing are like the parable of the blind

men and the elephant. One blind man grabbed its trunk and said

it resembled a giant snake; another its legs and said it was a tree;

a third its tusks and said it was an enormous walrus, and so on.

This parable will sound familiar to anyone who follows cloud computing. Some companies state that since it involves third-party

data centers, they are cloud providers; others say that since it uses

subscription payments, they are cloud providers; still others say

that since it is accessed over IT networks, they are cloud providers.

While each of these descriptions is true as far as it goes, by

themselves these discreet services do not constitute cloud computing. Nor can the companies that provide these discreet services be

called cloud computing providers any more than an elephant can

be called a snake, a tree, or a walrus.

True cloud computing consists of a combination of third-party

data centers, subscription payments, Internet access, and something known as multi-tenant architecture, which NIST notes in its

definition.

A good analogy for multi-tenancy is a skyscraper. Just like a skyscraper allows many occupants to run their businesses discreetly in

the same building, multi-tenant cloud computing allows many

users to run their applications discreetly on the same computing

platform. Although users share the underlying infrastructure, they

can only view the data and applications that pertain to them. In

this way, multi-tenant cloud computing is like online banking; it

lets a number of people use their accounts simultaneously, while

keeping their information secure and private.

The great benefit of multi-tenancy is that it can satisfy the needs

of numerous organizations on a single computing stack. Salesforce,

for example, processes the data and applications for its 77,000 customers on just a few thousand serves. A single tenant computing

model, which is sometimes referred to as a private cloud, could reVerDate 11-MAY-2000 15:11 Nov 05, 2010 Jkt 000000 PO 00000 Frm 00100 Fmt 6633 Sfmt 6633 U:\DOCS\58350.TXT KATIE PsN: KATIE
97

quire several hundred thousand servers to manage a customer base

this size.

For Government, multi-tenant cloud computing offers cost savings, flexibility, fast deployment, and lower risk of project failure.

Traditional Government IT systems require up-front investments

in hardware and software, and can take years to implement. As a

result, they are often out of date and over-budget by the time they

are deployed. Multi-tenant cloud computing eliminates large upfront costs and lets Government agencies start with a few users

and scale rapidly so there is much less chance of waste and failure.

I understand that cost data ownership, security, and interoperability are of particular interest to this committee. Most studies

conclude that cloud computing offers important cost savings. A recent Brookings study concluding that the cost savings for Government average between 25 and 50 percent. Salesforce cast studies

support this conclusion.

As for ownership of data, Salesforce claims no rights to the information its customers submit to our cloud services. We use and

process this information only as our customers instruct us to or to

fulfill contractual and legal obligations. If a customer decides it no

longer wants to use our cloud services, we make their information

available to them in a format that allows them to move it elsewhere.

The Salesforce security management system is based on internationally accepted security standards like ISO27001. Perhaps the

most compelling evidence of our security is the fact that over

77,000 organizations around the world, including very large institutions in highly regulated sectors like financial services, health care,

and government, trust their information on cloud applications to

Salesforce.

When it comes to interoperability, the proof is in performance.

Over 50 percent of the transactions we process are handled automatically. In other words, about 150 million times per day our computers seamlessly operate with outside computers without human

involvement.

I appreciate the committee’s efforts to advance the Government’s

ability to take advantage of this important technology and look forward to your questions.

[The prepared statement of Mr. Burton follows:]

98

99

100

101

102

103

104

105

106

107

108

Chairman TOWNS. Thank you very much, Mr. Burton.

Let me just say to the committee members that we have three

votes, and we will hear from Mr. Bradshaw and then I will recess

the committee, and we will return 10 minutes after the last vote.

Mr. Bradshaw.

STATEMENT OF MIKE BRADSHAW

Mr. BRADSHAW. Thank you, Mr. Chairman, Chairwoman Watson,

Ranking Member Issa, and members of the committee. I lead the

Google team that provides cloud computing services to the Federal

Government, and I am pleased to be here.

Federal IT is at a crossroads. Down one path, the adoption of

cloud computing, we see more competition and innovation; down

another path, which keeps IT tethered to the traditional desktop

computing model, we have more of the status quo, meaning fewer

choices and less competition. If there is one thing I want to leave

you with today, it is this: the cloud is secure, the cloud saves taxpayer money, and the cloud can make Government more efficient.

We believe Federal IT procurement policy should encourage competition and choice.

As you have heard today, there are three basic types of IT infrastructure: cloud, there is legacy, and a hybrid model that tethers

the cloud to legacy systems.

Google offers cloud solutions that are used by 2 million businesses. A growing number of State and local governments, from

Los Angeles to Orlando, use the cloud, as do Federal agencies, including the Departments of Defense, Energy, and Interior, as well

as NASA, the SEC, and the GSA.

I would like to focus on three benefits from Federal adoption of

the cloud: one, enhanced security; two, savings for taxpayers; and,

three, more competition and innovation.

First, the cloud offers security advantages over legacy and tether

cloud alternatives. Under legacy computing models, we store critical data on our computers and servers either at work or at home.

This is the equivalent of keeping cash under our mattress. Storing

data securely in a multi-tenant cloud is like keeping cash in a

bank. Cloud providers are security professionals, and they can offer

better security than customers do on their own.

There have been several examples where Government laptops

and hard drives were lost or stolen, compromising the sensitive

personal information of hundreds of thousands of individuals. In

fact, GAO confirmed in 2009 that recent data losses occurring at

Federal agencies have been the result of physical thefts or improper safeguarding of systems.

An important security benefit of full cloud model is that you can

control security updates much more consistently and easily. Research shows most organizations take between 25 to 60 days to deploy security patches, and some CIOS admit it can take up to 6

months. In the cloud, everyone gets security updates as soon as

they are available, not weeks or months later. Attacks come frequently, and cloud computing allows us to react quickly.

Hackers do not care about the labels assigned to cloud computing, whether the cloud is public or private or otherwise. Hackers

will exploit security vulnerabilities where they find them. That is

109

why security must be judged based on an examination of specific

security controls in place by a given cloud computing implementation.

At Google, we protect data by shredding and splitting it across

numerous servers and data centers, making an attack much harder

because no user’s data resides on a single disk or server. The data

is replicated and spread across different locations. So if a hurricane

or an earthquake strikes one place, the application keeps running

elsewhere. This is important for backup and disaster recovery. It

was a key consideration for the city of Los Angeles because of their

location in an earthquake zone. Backup and recovery solutions are

built into Google’s cloud architecture, and it comes at no extra cost.

Second, the cloud can save taxpayer dollars. This April, Brookings found that the Government agencies that switched to some

form of cloud computing saw up to 50 percent savings. Last year,

Forrester calculated that Google’s cloud-based email service was

one-third the cost of legacy email. To put that in context, the Federal Government spends $76 billion per year on IT, with $20 billion

of that devoted to hardware, software, and file servers.

Other cost savings come from improving productivity, enabling

more Federal employees to telework, and reducing energy consumption.

Third, introducing more choices into the Federal marketplace

will intensify competition, which in turn will drive innovation up

and prices down. The Federal Government is embracing cloud computing, and we support the administration’s effort to drive the

adoption of the cloud, including FedRAMP. We strongly support the

effort to accelerate the process.

Naturally, legacy providers would benefit if they didn’t have to

compete with the cloud, so it is not surprising that some may try

to slow this transition by fomenting fear of cloud security. This

overlooks the security problems we have seen in legacy IT systems

and it fails to recognize how these problems can be solved by the

cloud.

Ms. WATSON [presiding]. We are out of time now, so we are going

to recess and we will reconvene 10 minutes after the last vote.

Thank you so much.

Mr. BRADSHAW. Thank you.

[The prepared statement of Mr. Bradshaw follows:]

110

111

112

113

114

115

116

117

[Recess.]

Chairman TOWNS [presiding]. Mr. Combs.

STATEMENT OF NICK COMBS

Mr. COMBS. Chairman Towns, Ranking Member Issa, thank you

for the opportunity to address this important session.

Prior to my current role as CTO of EMC Federal, I served more

than 25 years in Federal Government, primarily in the Army,

DOD, and the intelligence community, so I echo the remarks of Mr.

Issa about concerns with security.

During my career in Government and public sector, I have personally experienced many of the IT challenges facing Federal agencies today. Cloud computing is the buzz word of the day in IT, but

the characteristics the cloud brings are what is important for Federal organizations. IT environments must be flexible, on-demand,

efficient, and resilient.

Organizations must change, and the IT infrastructures that support them must be able to keep pace. At no other time has it been

more important to change our IT landscape, as organizations are

experiencing unprecedented levels of information growth and are

under constant pressure to deal with the costs associated with

maintaining our legacy IT environments.

Many Federal organizations have already begun to build the

bridge to the cloud by adopting some form of virtualization. In fact,

virtualization has become the foundation of the cloud and, in my

view, is a great enabler of cloud services across the various deployment models.

Cloud computing is virtualization taken to its most logical extreme, creating the ultimate in flexibility and efficiency, and revolutionizing the way we compute, network, store, and manage information. Cloud computing has the potential to make the biggest impact in IT since the development of the microprocessor, but it is not

going to happen overnight. This will be a journey, but we will realize benefits at many points along the way. In the end, we will be

able to provide organizations with much greater flexibility to ensure we can meet the demanding needs of our Federal Government.

Many challenges and questions are yet to be fully answered, including acquisition, availability, performance, scalability, solution

maturity, vendor lock-in, and, of top concern, security. I have addressed many of these in my written statements; however, due to

time constraints, I will focus on security. We have an opportunity

to get it right with cloud computing by engineering security into

the solution, not bolting it on, as has been in the past.

Admittedly, with cloud computing sophisticated automation, provisioning and virtualization technologies, there is significant security implications. These risks require that we look at security in a

whole new way. While perimeter and point security products will

still be used by organizations, companies such as EMC and

VMware are embedding security controls and security management

in the virtual layer, creating an environment in the virtual world

that is safer than the physical world today. Industry must continue

to develop and deliver technology components that support centralized, consistent management of security across the technology

stack.

118

The level of transparency that cloud computing vendors provide

is critical when utilizing private sector partners. While there is a

lot of talk about service level agreements helping to satisfy Federal

security needs, SLAs alone are inadequate. The Government must

take a trust, but verify approach and cloud vendors should be required to provide the tools and capabilities to allow customers visibility into those clouds to ensure the SLAs are being met.

Fundamentally, security must be risk-based and driven by a

flexible policy that is aligned to the business or mission need. The

need for common framework to ensure that security policies are

consistently applied across the infrastructure is critical to successful risk management. That is one of the principle reasons that

EMC supports updating the Federal Information Security and

Management Act [FISMA], important legislation that will update

the law to enable more operational risk management.

Technologies exist today to deliver private cloud environments

inside Federal organizations to dramatically improve IT efficiency

and still provide the security required to protect sensitive information within the Government enterprise. Multi-tenant federated

clouds can be deployed where similar security requirements exist.

However, placing information on a public cloud today should be

limited to public facing information only, and then only if the providers can prove the level of auditing and protection procedures are

implemented to deal with breaches of sensitive information.

Ultimately, cloud computing offers great potential for reducing

cost and increasing efficiency and transparency throughout the

Federal Government, and Federal departments and agencies

should be encouraged to embrace that potential.

I again thank the committee for allowing EMC and me to contribute to this important effort. I look forward to taking your questions.

[The prepared statement of Mr. Combs follows:]

119

120

121

122

123

124

125

126

127

128

Chairman TOWNS. Thank you very much for your testimony, Mr.

Combs.

Mr. Ganger.

STATEMENT OF GREGORY GANGER

Mr. GANGER. Thank you for this opportunity to testify along with

the others. I am a professor of electrical and computer engineering

at Carnegie Mellon University, where I am also the director of a

research center focused on issues like cloud computing, and have

been for over a decade. I hope that my independent voice from an

elite educational institution can help with clarifying the issues

being explored today.

You have heard from a number of folks already today, and obviously, from the questions, investigated the issues yourselves as

well; and I will attempt to avoid being needlessly redundant. But

I will underscore a few important points and raise a few new ones.

As we have heard and as you have read, cloud computing is a

buzz word for using others’ computers together with yet others in

order to achieve efficiency, instead of doing everything yourself. It

is a natural evolution as a part of a service-based economy. In fact,

as Mr. Issa noted, it is a bit of a return to the past in some ways.

I won’t get into the details of it now, but there is actually a good

reason why it has gone back and forth a little bit as engineering

technology and economies of scale have changed.

One aspect of the definition of cloud computing that I want to

make sure doesn’t get lost is the differentiation between a private

cloud and a public cloud, which has to do with who shares the

cloud. A private cloud is something that an organization does itself

and might be shared amongst the sub-organizations of that organization. So in the Federal Government imagine all the agencies

sharing a cloud. As contrasted with a public cloud that might be

offered to many organizations to share, as is usually thought of

when one hears the term cloud computing because of the Internet

analogy of everybody being able to access the Internet.

But the private cloud is something that we don’t want to lose

sight of because it is going to play a part of the approach that gets

taken with the breadth of Federal IT functions. In fact, this is another thing that was brought up earlier, this notion of moving to

a centralized management site. That is one step toward a private

cloud approach.

And there are some private cloud initiatives that are going on in

the Government right now. For example, the NBC of the Directorate of the Interior has some cloud computing functions and there

is also an activity called Nebula that NASA is doing for scientific

activities.

The benefits of cloud computing, when done well, can be huge.

We have heard a number of examples. I liked the example, in particular, of IBM going from 235 data centers to 12. In my written

testimony I talk about several others, including HP going from 85

data centers to 6 over the course of the last 4 years and reporting

from that 60 percent reductions in their data center costs across

the board, while at the same time increasing the amount of computing and storage that they are doing. So the savings are real and

they are large.

129

As with most things, your mileage may vary, and this was

brought up multiple of you already, and just how much you save

is going to depend, for example, on how efficient the function that

you are moving was already. And the efficiency of existing implementations of functions varies widely, so naturally the savings you

are going to get is going to vary as well.

But one big benefit that I haven’t heard talked about as much

that you don’t want to lose sight of as well is the speed of deploying

a new application. In the traditional model, where you have to procure, buy, deploy, set up a set of computers before you can even

start to develop the application that you are trying to deliver, and

that process may take many months, 18 months was the example

that Mr. Kundra used, comparing that to the notion of renting

some computing utility and getting started right away is a sea

change in terms of how quickly you can move in a new direction.

There are risks. It is natural to address them with questions,

which is why I started with the benefits. Security is a very natural

one. It is very important, in talking about security, to not start

from the mentality that doing it yourself means that it will be done

perfectly. There are too many examples where that is not the case,

and, in fact, having a collection of security experts try to do the job

for a larger collection of people, rather than having each of those

people do it themselves, makes a lot of sense.

You get more ability to move forward quickly when you have the

experts doing it for people rather than everybody doing it themselves. It doesn’t mean that everything is going to want to migrate

to a central place, but it is going to mean that a lot of things are

going to make sense to that kind of centralization.

Lock-in fears mean that standardization is going to be critical.

Resistance to change is going to mean that change management

and new training is going to be critical, as well as centralized

knowledge sharing portals and information sharing. And IT culture

changes are going to mean that the IT staff are going to have to

be retrained to new roles as well. They are not going to go away;

you are still going to need expert IT staff to manage the interaction

between any given agency, for example, and the cloud computing

provider, but their roles are going to change, they are going to

move closer to the applications folks.

But the potential is great; it needs to be embraced. I am thrilled

to see that is happening, and thank you for letting me be here and

I am happy to answer any questions that you have.

[The prepared statement of Mr. Ganger follows:]

130

131

132

133

134

135

136

137

138

139

140

Chairman TOWNS. Thank you very much.

Let me thank all of you for your testimony.

I guess I just want to ask all of you this question, and you can

sort of answer it as briefly as you possibly can. What do you see

as the greatest benefit and the greatest risk to the Federal Government in terms of cloud computing? If you just go right down the

line and sort of be as brief as possible.

Mr. CHARNEY. I see a couple of huge benefits. One, of course, we

have talked about, which is cost savings. But the other huge benefit, I think, is that the aggregation of data will allow, in appropriate circumstances, much deeper analysis of data. When you

think about how we are going to do health care in the future, for

example, the ability to analyze a lot of data and see trends and

other things could be hugely valuable to the Government.

In terms of risk, it really does come back to the things we have

talked about: security, privacy, and reliability. We are going to be

dependent on this cloud, and if you can’t access this cloud, or if

cyber criminals go after the cloud because the aggregation of data

presents a rich target, or people don’t have faith that the data in

the cloud is both protected and not improvidently used by the cloud

provider, we will lack trust.

Mr. BURTON. Yes, I think the benefits of cloud computing are

enormous, and that is why it is really taking off in the private sector; and to look at those benefits: cost advantages, speed advantages, scale advantages, ease of use advantages, customization advantages, and, not to be overlooked, tremendous innovation advantages, because once people are on a cloud platform, you can easily

develop new applications, you can deploy them instantly, you can

share them with other agencies.

If you look at risk, usually at the top of the risk list is what this

committee has focused on, and that is concerns about security and

privacy.

Mr. BRADSHAW. I think there are great advantages to cloud computing. Innovation, innovation of features and functionality, but,

more important, innovations around security, our ability to react

much more quickly now to security threats. There are great cost

savings as well for the taxpayer.

As far as risk, I do think we, right now, are in the risk of trying

to label cloud computing a certain way so that we don’t understand

the security issues in it. We label it and dismiss it based on labels

versus really what the security requirements are for the environment.

Mr. COMBS. Thank you, Mr. Chairman. I agree with all the comments that have previously been stated, but the greatest benefit,

I think, is speed to delivery of capabilities, like Mr. Ganger brought

up. Today, it takes far too long to implement new capabilities in

organizations. With cloud computing we can rapidly implement capabilities and, therefore, keep up with the changing needs of the

Government.

As far as the greatest risk, I have to go back to my intelligence

community days, that is the loss of the information. In the intelligence community, in the Department of Defense realms, that loss

of information can mean the loss of lives. In the commercial world,

141

that loss of information can be the loss of intellectual property and

lots of money.

So those are the greatest benefits and the greatest risks as I see

them. Thank you.

Mr. GANGER. I would say that the greatest benefit, as most have

noted, is efficiency, efficiency both in terms of cost and in terms of

the ability to roll out a new application, a new e-Government approach in each of the individual applications that one wants to get

started, both of those forms of efficiency.

In terms of the greatest risk, I guess I am going to depart from

a lot of people here and say that I would worry that the greatest

risk is entrenchment and the difficulty that one has in making a

transition from a comfort level that one has with the way they do

things currently to something very different.

And given how widespread the IT functions of the Federal Government are already, we heard about 1,100 data centers, getting all

those people around the idea of looking at cloud computing and seriously considering not doing it all themselves, it is a tough sell to

do that with people, to get them to really seriously consider doing

that. The security aspect is one of the concerns that will get raised,

and there are legitimate security concerns, but the technical security concerns, to me, seem smaller than the entrenchment concerns

that will be rallied around, for example, the security word.

Chairman TOWNS. Thank you very much.

I now yield 5 minutes to the ranking member from California.

Mr. ISSA. Thank you, Mr. Chairman.

Mr. Ganger, I am going to followup with you as the honest

broker. Eleven hundred data centers. In your opinion, is there any

reason that this committee shouldn’t drive the bureaucracy toward,

let’s say, 200 data centers and force people who have 8, like GSA,

to have 8 that are co-located within those 200 centers? And

wouldn’t that represent billions of dollars in savings and a consolidation toward a private cloud—which is the second question, since

you are writing—which is aren’t we big enough at $80 billion worth

of total IT services, tens of billions of dollars worth of specific software support and $20 billion worth of infrastructure support, aren’t

we big enough to own our own cloud?

I don’t want to quote, but I will, the Rolling Stones, 1967, when

they said ‘‘Get off of my cloud,’’ but why would we get onto somebody else’s cloud to begin with? Why wouldn’t we say we are big

enough to go alone or to be co-located with other locations, but

have complete segregation so that security is designed in from the

door on?

Mr. GANGER. OK, so I will try to take them in the order that you

gave them.

Mr. ISSA. No, no, take them in the order best for you.

Mr. GANGER. OK. So do you drive data center reductions? I don’t

have a lot of insight into what the 1,100 are doing. It would shock

me to hear that an analysis of the 1,100 doesn’t lead to being able

to do 200, for example.

Mr. ISSA. Earlier testimony, it took a long time to find out how

many they had and where they were in some cases.

Mr. GANGER. Which means, by the way, that it is going to take

longer to do the consolidation than one might hope, right, because

142

there is going to have to be a lot of learning about what functions

those different data centers are doing in order to make a consolidation actually work.

Mr. ISSA. But just shared bandwidth efficiency, facilities advantages, all of that would be in the hundreds of millions of dollars,

enough to pay for the consolidation in a short period of time.

Mr. GANGER. Yes, absolutely, I agree. Huge advantages to be had

there. And I would be really surprised to learn that type of consolidation couldn’t be done and that those advantages couldn’t be realized. The corporate world has done it and we have seen two examples of very large corporations that have gone from two and three

digit numbers of data centers to single and 12 was the second example numbers of data centers.

In terms of is the Government big enough to do a private cloud,

there is no question the Government is big enough to do a private

cloud. The question that you would have to ask yourself isn’t

whether you are big enough to do it, it is whether you have the expertise to do it for all of the different types of cloud technologies

that you might need to do it for.

Mr. ISSA. OK. I am going to move to the cloud folks for a moment.

Mr. Burton, you offer a public cloud solution that is already purchased by agencies of the Government, and they buy a product as

a COTS product, basically. So that can proliferate with vendors offering them, and the only problem, of course, is certifying that the

data they put on to your cloud is in fact safe, secure, and so on,

right? Would you say that there are things like Mr. Combs might

mention, the NSA or the CIA, that never really should be customers of yours, at least not with the same computer and the same

location that are dealing in the clandestine world?

Mr. BURTON. Yes, I think without a doubt not only in the Federal

Government, in the private sector there are certain data sets that

are so secret, so sensitive that they will never go on to a multi-tenant cloud structure.

Mr. ISSA. There is a company in Atlanta called Coca-Cola. I suspect that is at least one formula you will never host.

Mr. Charney, in light of that, won’t there always be some private

computing facility-based, like some of our labs activities, where

even the hard drives have to be removed between uses? So, in a

sense, isn’t this committee looking at the migration of public, private, and legacy, with an inevitability that one size doesn’t fit all?

Mr. CHARNEY. I agree with that completely. I mean, there will

be cases where organizations, Government agencies want to run an

on-premises system and control it very tightly, like some of the intelligence communities. There will be places where the Government

is a community of interest and can share a cloud, and there may

be places for public information that a public cloud service is not

a big concern because it is information you want to share anyway.

The key is customer choice and mapping the cloud model to the

risk model.

Mr. ISSA. Mr. Bradshaw, I understand that you are a super

salesman, among other things. You would like to sell as much of

your product as you can, I am sure. But wouldn’t you also agree

that there is a segment that could be moved sooner, rather than

143

later, to public cloud, a segment that needs to have that transition,

and then a segment that will never, in the foreseeable future, make

that transition?

Mr. BRADSHAW. I absolutely agree with that. We have aimed our

initial offering at the sensitive, but unclassified, level to meet that

or exceed it. But we do agree there are some things that we would

not recommend you move to the public cloud.

Mr. ISSA. And I will close with one thing on behalf of the chairman and myself, both. Isn’t one of the challenges to a truly transparent cloud, when it is pointed toward the public, that portion of

cloud computing, the fact that all of our various Government agencies have failed to have standards that are interoperable and easily

searchable so that you can know that a name or a particular cell

in a data base will in fact correspond not just, but including Web

sites?

Mr. BRADSHAW. I do believe it is very difficult to put standards

in place that meet the requirements of all the individual agencies

and individual bureaus within the agencies, and take advantage of

information technology at the same time. That is a big challenge.

But I do think we can use the current regulations that are in place,

get a great understanding of how things compare, and then all of

us, we have security experts in our company, let’s take advantage

of those and work with you to continuously update these through

continuous monitoring and things like that.

Mr. ISSA. Thank you.

Anyone else before the chairman reclaims my time?

[No response.]

Mr. ISSA. Thank you all.

Chairman TOWNS. Thank you very much.

I now yield 5 minutes to the gentlewoman from California.

Ms. WATSON. Thank you.

As I mentioned in my opening statement, in light of the recently

reported cyberattacks involving China and other nation states, I

would like to hear some specifics from each one of our vendors

about how we would protect our particular systems, and I would

like specifics on how your companies plan to demonstrate compliance with the requirements on a regular basis. And I would just

like you to go down the line.

And then I am going to ask, since we are not going to have time

within this session to hold additional hearings in our subcommittee, how you would provide this information and would you give us

kind of a summary in writing to our committee? And then we will

submit that to your committee.

So just tell us in your own words about what you, as an individual vendor, would do to protect the security.

Mr. CHARNEY. I think there are really two parts to the question.

First, in terms of how we protect security, the real key is having

a documented information security program that looks at the assets you want to protect, what the threats to those assets are, and

then you build and test a set of controls to protect those assets.

But the China question is a little bit difficult in the sense that

one of the changes we have seen over the last 20 years is a major

change in the threat model. When I was at the Justice Department

prosecuting cyber crimes in 1991 and 1992, at the beginning of my

144

career there, a lot of the hackers were young students exploring

networks.

Now we have what we call the advanced persistent threat; we

see more and more nation state activity on the Internet, we see

more organized crime activity on the Internet, we see a black market for vulnerabilities. A regular documented information security

program that might be adequate for most commercial purposes

may not be completely adequate for an advanced persistent threat.

This is why, for example, as I said earlier, I don’t think the intelligence community should be parking its information on even public or shared tenant clouds. The advanced persistent threat is going

to require a much more careful analysis and different cybersecurity

strategies. I have, in fact, written a paper on this very point and

would be happy to share it with the committee.

Mr. BURTON. Thank you for that question, Chairwoman Watson.

Security is something that our smallest customers take very, very

seriously; whether you are a corner pizza store maintaining your

customer data or a multinational bank or health care company or

an agency of the Federal Government.

Ms. WATSON. Let me be more specific. How do we have assurance

that our Federal information within our systems can be protected?

And I know this is not the place where you can give direct answers.

Mr. BURTON. I will respond to that.

Ms. WATSON. Good.

Mr. BURTON. Each of our customers can come in and do security

reviews with Salesforce, and they do not go on to our platform until

they are satisfied with our security. We comply with major international security standards, ISO27001, SAT Type 2 Systrust. All of

those are available. We feel that without trust no one is going to

use Salesforce.

So we have site. Anyone can look at it, this committee can look

at it, Trust.Salesforce.com, and if you look at that site you can see

what the performances of our system every single day. I looked at

it this morning. We processed 315 million transactions yesterday,

each one in about 300 milliseconds on that site. You can see the

types of security attacks we are facing; you can see all of our credentials.

If you want to lock down your security, it provides you who to

talk to, how to get at that. So we feel that not only security standards, but transparency is critical to the whole cloud model, and

that is why we have this trust site that is available for anyone to

look at.

And I think just the one question, to come back really, I think,

to a comment Mr. Issa raised, is, yes, there, are some data sets

that are so sensitive, so secret that they should be kept outside of

a cloud environment.

But I think if you look at the vast majority of the data that the

U.S. Federal Government processes and stores, it falls into a lower

level of security, and I think that is perfectly adequate for a strong

vendor with good security to manage on a multi-tenant platform in

a cloud.

Mr. BRADSHAW. Thank you. Google has made a commitment at

the executive level of the corporation to meet Federal security requirements. We have completed and submitted to the Government

145

our FISMA certification package and we are waiting to hear. We

do meet the security and privacy requirements that are laid out in

the Federal statute under FISMA and we make those findings

available upon request.

I think what we also do, we are so focused on security. We all

know this is a growing threat for everybody. We look at two areas,

one is reducing the threat environment. So we are very focused on

bringing down things that had been exploited in the past, trying

to limit that, limit the doors that have made these threats possible;

and then looking at moving some appropriate data to an environment where we can take our security professionals and we can take

just multiple layers of security and protect that data for you.

Ms. WATSON. You are so out there, that is why I mentioned

Google, because I say to myself would you Google that, please,

quickly. We know the problems that all of you are facing, so I just

want to get some ideas how you are addressing them.

Mr. Combs.

Mr. COMBS. Thank you, ma’am. Today’s security architectures

are nothing more than a broken safety net of point security solution products. We have to move from point security products to an

information-centric approach to managing our data. It is all about

two things: it is about identities.

Those systems and processes that either need to have access or

be restricted access to our resources, and the information. That information must be either available or restricted however an organization’s policies defines. That gets into your second part, which is

Government risk and compliance.

What we are doing at EMC is we have acquired technologies and

we are further developing them to allow portlets for organizations

to look inside our cloud offerings and to ensure that we are providing the Government the risk and compliance capabilities that

matches their requirements.

Ms. WATSON. What I am going to advise my staff to do is send

letters to all of you, and you can respond to the questions that we

have in your letters. So you will get something and we will try to

do it as soon as possible.

Thank you so very much, and thank you, Mr. Chairman, for the

time.

Chairman TOWNS. Thank you very much.

I now yield to the gentleman from Utah, Mr. Chaffetz.

Mr. CHAFFETZ. I like the enthusiasm, Mr. Chairman. I appreciate

that.

Thank you all for being here, I appreciate it. Full disclosure: I

think I have been a consumer of all of your products and services,

with the exception of the parallel data lab. I can’t think of something, although you probably have something I have consumed

along the way, all with great success. You are obviously market

leaders and we appreciate your perspective here, and we won’t do

it justice in the 5-minutes, so if there is additional information you

want to share with us, please know that we would love to have you

followup on that.

Mr. Bradshaw, starting with you if I could, in your written testimony you say, ‘‘The most important component of feeling comfortable with one’s data in the cloud is trusting a cloud services

146

provider and the practices and policies they have in place.’’ Ronald

Reagan famously said once, trust but verify.

How does that work in a government-type model? Because the

second part of my questions is how does Google, which is so unique

in all the world, how does your business model fit with government

types of services, where you have relied a lot on getting a lot of eyeballs and then converting those into advertising dollars? How does

that work in a business model with the Federal Government or

State government?

But going back to this, OK, it is great to say, hey, trust us, that

is the most important thing, but how do we gain a comfort level

that information is secure?

Mr. BRADSHAW. I agree with you on that. First of all, I am in a

group called Enterprise, which is a separate group from the consumer group you are very familiar with. We actually look at the

consumer products and determine how we can change them so they

fit into a government or into a commercial environment. So the

products are slightly different and they are modified for that reason.

As far as trust, we understand this is the biggest thing for you

on security and privacy, so we try to be as transparent as possible.

I think sometimes we make sure we put something out in a blog

as soon as we find it so that you will understand what kind of

problem we have. I think the benefit of that to you, and to me as

well, is that the technology allows us to very quickly react to some

of these attacks that we have seen, look at the situation, and then

correct it, and immediately make that fix available to a lot of people. So, again, this is where the innovation just really plays to this

increasing threat model we are all seeing.

Mr. CHAFFETZ. And that is where I think one of the interesting

questions going forward, is how do those cloud-oriented companies,

and in their business model, how do they make that work. We will

have to explore that further.

The GAO, in their report, reported that 23 out of 24 agencies

identified multi-tenancy as a potential information security risk.

Do you find that? Is that baseless or is that something you would

concur with?

Mr. BRADSHAW. I don’t concur with this. I think we have many

examples where we have multi-tenant application solutions that we

use and we are very comfortable with, such as an ATM, you know,

a banking system where multiple people are in the same system.

We are very comfortable with that. I think the Government has

several examples where they have solutions they have been using

for years where they are multi-tenant.

So I think you can gain so many benefits from this environment,

again, because we are putting the data in one location and we are

putting multiple layers around it.

Mr. CHAFFETZ. Mr. Charney, how would you address that, the

GAO concern?

Mr. CHARNEY. I think multi-tenancy can be fine, but I think it

also raises different threat models, and the ATM analogy is not

quite right; and the reason for that is I can go up to an ATM machine and put in my card and take out money, and it may be true

that my account is stored with other accounts, but the ATM is not

147

a platform on which I can load software. There has been some research done where academics have basically hosted in the cloud applications designed to attack the rest of the cloud, and with multitenancy in that environment, virtualization becomes key to separating the data.

So it doesn’t mean multi-tenancy is dangerous; what it means is

it presents a different threat model and you need to make sure you

are mitigating those threats.

Mr. CHAFFETZ. So what are those technologies that ought to be

highlighted in terms of differentiating?

Mr. CHARNEY. I think there are a few things. The key thing, of

course, is that you have secured development of the virtualization

technology; that the people who are developing that technology are

trained in security and that they use good development practices

and security to make sure that the containers that are built

through virtualization are in fact robust.

Mr. CHAFFETZ. Do we possibly have enough personnel in order to

achieve that? I mean, it is hard enough to hire as it is in some of

these specialized fields.

Mr. CHARNEY. Many years ago, when Microsoft adopted the Security Development Lifecycle, we took the view that, basically, keeping it to ourselves for competitive advantage was the wrong approach. We decided that what we needed to do was share our best

practices.

And what we did was we published books on threat modeling,

unsecured code development, and on the Security Development

Lifecycle itself; and we published some of the tools we use in Visual

Studio, which is our product for developers, and we have also made

tools publicly available, like our threat modeling tool. We believe

that there are not enough well-trained security experts on the planet today, and it is something the Government can help address as

well.

Mr. CHAFFETZ. Mr. Chairman, thank you.

I can spend hours with each of you, but thank you for your time,

and appreciate any followup. Thank you.

Ms. WATSON [presiding]. I would like now to yield 5 minutes to

our distinguished member, Mr. Bilbray.

Mr. BILBRAY. Thank you, Madam Chair.

I want to followup on my colleague’s comments about this exposure, I guess it was 23 out of 24. That really kind of makes us focus

on the task at hand when we have that kind of exposure, and I

again would like to followup by asking why you think we have

these risks but, more importantly, what can we do to address these

risks and try to avoid impact by them? Basically, how do we armor

the system and protect the system?

Mr. CHARNEY. I think in part there is a lot of concern because

the technology is new and evolving. Therefore, we are not familiar

with the risks and, undoubtedly, what will sometimes occur is we

will learn new things along the way. I think there is a natural and

healthy tendency to say I need to protect my data, and I may put

it in this new environment that has these new threat models that

I don’t fully understand.

The way to address that is through transparency; that is, that

the cloud providers need to be transparent about how they run

148

their operations and manage their information security program,

and governments need to be clear about what their requirements

are so that both parties to the transaction get greater comfort level

with both what they are trying to protect, what they think is needed to protect it, and whether those controls are in place.

Mr. BILBRAY. Before we go on, let me just say, Madam Chair, it

is kind of just reminding me of when I got here in 1995 and the

leadership was changing after 40 years, that there were a lot of

members of the previous majority that actually were terrified at

the concept of having Internet between offices and among offices

because they were worried about security. Literally, that was the

fear at that time.

Of course, at the same time we were still delivering buckets of

ice, 95 years after the invention of refrigeration, but that fear was

there even among Members of Congress as late as 1995, and I am

sure it has been much more recent than that.

Mr. Burton, you had a comment.

Mr. BURTON. Yes. I would very much like to comment on that

question. Multi-tenant cloud computing is a mature technology.

Salesforce has been doing this since its founding 10 years ago, and

you have major banks, major health care companies running mission-critical applications on this platform today. Gardner says 25

percent of all new software sales are going to be softwares of service cloud computing next year.

So I think while there are issues to consider, it is a mistake to

say this is new, this is unproven, this is untested, don’t go there.

This has been tried and proven successfully in the marketplace.

I think the key question about multi-tenancy, the key question

about security is know your vendor. Does the cloud provider let you

do deep security reviews? Does it have international security standards? Does it have transparency and trust so that you can go in

and see what is going on? And I think as government agencies

start exploring this, they will find that, in fact, there are some

cloud providers that provide that today. There are lots of others

who don’t. There are lots of issues.

We are going to be discussing this for some time, but I don’t

want this committee to leave with the impression that somehow

multi-tenant cloud computing is not tested, it is new, it is not to

be trusted, because I think the marketplace has already ruled on

that and the marketplace is moving in a major way toward this

new platform.

Mr. BRADSHAW. I also would like to point out I think something

like FISMA provides a great way of evaluating the current systems

we have against this new technology right now, so we can take a

look at what we are facing with the current environment and put

it right next to what we get, what benefits we get from it. FISMA

has independent audits in there, we have that third-party audit, so

it gives you a great way of looking and comparing this system to

what is available to you right now.

Mr. COMBS. Why do we have these risks? There is no doubt that

our adversaries can penetrate our networks and gain access to the

resources that we have.

Chairwoman Watson, you brought the Chinese up in your opening statement. It is absolutely proven time and time again that we

149

cannot stop our adversaries from getting into systems that are

available on the open Internet.

This is why I say that moving information into the public cloud

should be limited to the information that is public-facing information. The internal information, the engineering, the intellectual

property, the sensitive information that exists in our Government

needs to be protected behind appropriate security measures to prevent us from getting into big trouble.

Ms. WATSON. Thank you.

Mr. Issa, you will have the last comment and question, and then

after that we will be adjourning; we have two votes or three votes,

as I understand, at 2.

Mr. ISSA. And I will be brief.

Mr. Combs, in a compartmented world, the term compartmented

exists for a reason. Would you briefly, in light of a multi-tenant environment, if, hypothetically, all of Government was all in the cloud

and, because of government-to-government requirements, interlaced, what would happen to the historic compartmenting that we

rely on in the intelligence world today?

Mr. COMBS. Mr. Issa, there are ways to bring cloud computing

into those environments. The consolidated data centers that are

going on within the Directorate of National Intelligence today,

these are similar security requirements across the intelligence community.

We can develop and deploy private cloud environments in a

multi-tenant environment that will allow the security controls to be

protected in that environment. Across NASA, NASA is going

through a 110 data center consolidation right now. Much of their

engineering processes today are similar, yet they have 110 separate

data centers.

Mr. ISSA. I think you have answered the question. I want to be

brief for the Chairlady.

Mr. Bradshaw, responsible disclosure, when companies discover

flaws in each other’s software, does your company have a stated

policy for how that is to be done?

Mr. BRADSHAW. We do make security and privacy statements. We

definitely try to be as transparent as we possibly can.

Mr. ISSA. No, that wasn’t the question, sir. All of the software

companies that interact get access to various portions of each other’s source code and interface with it for purposes of porting software, going back and forth through data bases and so forth.

Does Google have a responsible disclosure policy as to discoveries

of opportunistic or whatever security failures? How do you inform

Sun or somebody else that you found something that would be a

vulnerability to the outside world if it were discovered? You have

teams of software producers, as does Microsoft, as does Salesforce.

What is your stated policy or do you have a stated policy if a software engineer discovers a vulnerability in somebody else’s software?

Mr. BRADSHAW. I can’t personally state the policy, but I will be

glad to get that back to you.

Mr. ISSA. If you would respond to that for the record. Actually,

if all of your companies would. It is an area of deep concern to me,

mostly because I understand the Chinese are out there trying to

150

penetrate us. I find it interesting that sometimes the penetrations

end up in blogs and they really come from software engineers employed by competitors.

And as long as we are buying from all of the companies, the one

thing we don’t want is a vulnerability created at our expense in a

competitive environment. So if each of you would respond to the extent it is appropriate to your company.

Ms. WATSON. Let me ask that each of you will respond in writing. We have all framed the question, if that is all right with you.

Mr. ISSA. That would be great.

Ms. WATSON. Because that is a vote.

Mr. ISSA. OK, and I have one closing one only for the record, and

it is for Google. The Presidential Records Act requires that we capture all emails of the President and their entire Office of the President. Could you respond for the record of how you are capturing

Gemails that are being used in and around the White House by

White House personnel?

Mr. BRADSHAW. I am in a group, again, that sells a product to

the Federal Government, but it is not the Gmail system, the personal Gmail system. In our group, in our organization, we have a

tool that allows you to do e-discovery as well as archiving for our

mail product.

Mr. ISSA. And I was talking about specific examples of what is

going on relative to use of the public Gmail. So if you could respond

for the record. Thank you.

Ms. WATSON. All right, thank you so much for your questions,

Mr. Issa.

I want to thank the witnesses for your testimony, the time that

you have spent here. We are sorry for the interruptions, but this

is the Congress and we do have to go to vote.

Thank you, audience, for hanging in here with us. The meeting

is now adjourned and we will put our comments and questions in

writing to you. Thank you.

[Whereupon, at 2:07 p.m., the committee and subcommittee was

adjourned.]

[The prepared statement of Hon. Gerald E. Connolly and additional information submitted for the hearing record follow:]

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

Æ