FOSE sides: DOD deputy CIO Robert Carey

8/2/2019 FOSE sides: DOD deputy CIO Robert Carey

1/46

Innovation to Achievee oJoint Information

Environment

4 April 20124 April 2012

Robert J. CareyRobert J. Carey

Principal Deputy Chief Information OfficerPrincipal Deputy Chief Information OfficerDepartment of DefenseDepartment of Defense


2/46

A enda

DoD FY13 budget

Joint Information Environment Cyber security

Mobility

2


3/46

IT is Central to the DoD Mission

3


4/46

secure access to information from any device, anywhere,

4


5/46

and this is HOW & WHERE we fight

5

5


6/46

POTUS: DoD will be A ileOurmilitarywillbeleaner,buttheworldmustknowtheUnitedStatesisgoingtoarmedforcesthatareagile,flexibleandreadyforthefullrangeofcontingenciesandthreats.

PresidentObama

TheU.S.jointforcewillbesmaller,anditwi e eaner. Butitsgreatstrengt wi ethatitwillbemoreagile,moreflexible,readytodeployquickly,innovative,and

.

forthefuture.SecretaryPanetta

6

DefenseSecurityReview,5Jan12


7/46

DoDs Cyber Footprint How Big?

IT S st em sDoD IT User Base

~1.4 million active duty

~750,000 civilian personnel

~1.1 million National Guard and

>>10,000 operational systems(20% mission critical)

~800 data centers

Reserve

5.5+ million family members andmilitary retirees

146 + countries

~65,000 servers ~7+ million computers and IT

devices

Thousands of networks/enclaves 6,000 + locations 600,000 + buildings and

structures

Thousands of email servers,firewalls, proxy servers, etc.

Mobile devices~ 250, 000 Blackberries~ 5000 iOS Systems (Pilots)Tota l IT Budget

> $37 Billion in FY13

> $20.8 Billion in IT Infrastructure

> $3.4 Billion for Cyber Security

~ 3000 Android Systems (Pilots)

7

Unparalleledsize,scope,diversityandcomplexity


8/46

FY13 IT Presidents Budget EstimatesTotal DoD IT Budget

~$37.0 Billion

Non-Infrastructure(Systems Acquisition)

$16.2 Billion44%

Infrastructure$20.8 Billion

56% Infrastructure Supt

DoD IT Infrastructure Budget

$20.8 Billion

.5%

Battle space Networks$4.4 Billion

21%

Information Management$7.5 Billion

36%

Infrastructure Maintenance$7.8 Billion

37%

Total DoD Budget: ~$525 BIT Budget Remains ~7%

Service Infrastructure Non-Infrastructure Total

Army 5,708.255 4,090.545 9,798.800

Navy 4,749.012 2,730.733 7,479.745

(dollars in millions)

8

AirForce 2,955.047 3,243.993 6,199.040

DISA 4,584.421 886.400 5,470.821

DefWide 2,776.042 5,274.285 8,050.327

Total 20,772.777 16,225.956 36,998.733

o y er u ge :~$3.4 Billion


9/46

FY13 Presidents Budget Estimates669.3 665.9

691.8 689.1

649.6

700.0

800.0(dollars in billions)

456.3

502.7

536.4

604.5

526.0 533.5545.9

555.9 567.3

500.0

600.0

307.1

355.3

433.0

300.0

400.0

100.0

200.0

22.9 24.1 27.3 28.5 31.7 34.1 34.437.0 37.3 37.8 38.7 37.5 37.0 3 6.5 3 6.5 35.4

34.2

0.0

FY01 FY02 FY03 FY04 FY05 FY06 FY07 FY08 FY09 FY10 FY11 FY12 FY13 FY14 FY15 FY16 FY17

DoDTOA ITBudgetFY01 FY02 FY03 FY04 FY05 FY06 FY07 FY08 FY09 FY10 FY11 FY12 FY13 FY14 FY15 FY16 FY17

DoD TOA 307. 1 355. 3 433. 0 456. 3 502. 7 536. 4 604. 5 669. 3 665. 9 691. 8 689. 1 649. 6 526. 0 533. 5 545. 9 555. 9 567. 3

IT Budget 22.9 24.1 27.3 28.5 31.7 34.1 34.4 37.0 37.3 37.8 38.7 37.5 37.0 36.5 36.5 35.4 34.2

IT as a % of TOA 7% 7% 6% 6% 6% 6% 6% 6% 6% 5% 6% 6% 7% 7% 7% 6% 6%

Source:

DoD TOA FY13 Future Year Defense Plan (FYDP)

IT Budget FY13 IT Presidents Budget Submission (SNaP-IT)9


10/46


11/46

Stove i es to Enter riseFrom: To:Unique Common

LocalProprietary

GlobalOpen

uge

Inaccessible

Modular

Interoperable

CylindersofExcellence

Vulnerable

Standardized

Secure

TheonlywaytotransformistodemandthelevelofSlow

Agile

/Innovative

11

standardizationandcommonalityrequiredtoworktogether


12/46

DoD IT Enterprise Strategy and Roadmap

Ef f ic iency

Reduce duplication inthe DoD IT

Effect iveness

Improve missioneffectiveness and

n ras ruc ure, andeliver significant

efficiencies acrossthe Department

combat powerthroughout the

Department

CyberSecur i ty

Improve the securityof DoD networks andinformation from all

12Consolidateinfrastructuretobetteroperateanddefend


13/46

Audience for the ITESR

OSD MILDEPs

DISA

NSA COCOMs

Industry partners

13


14/46


15/46

ITESR Initiative Areas Network services: services includin hardware,

software and labor) that provide communications

Computing services: services that process, store

Application and data services: common shared

applications, services and processes End-user services: services that enable end users to

access information locally, via the network

IT business rocesses: rocesses used to rocure hardware

software and services needed to operate and maintain theDoD IT infrastructure

15


16/46

DoD IT Modernization~ F Y 1 7~ F Y 1 7F Y 1 2F Y 1 2

Network OptimizationNetwork Optimization

Consolidate Data CentersConsolidate Data Centers

Duplicative

~800

Federated/


17/46

Establish Common IT InfrastructureCreateCloudStrategiesStandardizeandOptimize StandardizeHardwareand

DevelopstandardDoDplatformandgovernance

Consolidatedatacenters Consolidateoperationsand

DevelopDoDstrategyformovingtothecloud

an ate

new

programs,

use

standardplatforms

Transitionongoingprogramstostandardplatforms

management

o

networ

infrastructure

Integrateandcapitalizetestandintegrationcenters

Migrate

services

to

private

or

publicclouds

Conso i ateen userservices(email,collaboration)

17


18/46

Service Consolidation The ITESR will consolidate computing services

into three types of facilities Enterprise Computing Center (ECC)

Com lies with enter rise-level standards and hostsapplications from any DoD component based on service-levelagreements

Area/Regional Processing Center (A/RPC) o co a ora es w s o es gna e s o os

systems with either a primary or back-up instantiation in aparticular location for technical, operational or financialreasons

Installation Processing Center (IPC) An installation may utilize an IPC to host systems with a local

instantiation for technical, operational or financial reasons

18


19/46

Additional Cloud Computing CapacityDataCenters PhysicalServers

um ers um ers

Demand

for

Computing

Capacity Commercial

Opportunities

Time Time

Compute

Demand

Compute

Atsomepoint,demandwillsurpassexistingcapacityofDoDfloorspace

Time

Capacity

modulardata

centers

may

prove

moreadvantageousthaninvesting

19

,

DataCenters Computecapacityincreasingthrough:

increasingCPU

utilization,

virtualization,

Moores

Lawandapplicationreconciliation


20/46

DoD CIO Will Align

StrengthenCybersecurityLeverageCommodityPurchasing

Implementstrategic

sourcing

for

commodity

IT

Integratesecurityandoperationsmanagement

Leverage

automated

tools MandateDoDwideC&Areciprocity

StrengthenGovernancetoImproveEffectivenessofEnterpriseArchitecture

ClingerCohenActComplianceandinteroperability

achievedvia

CIO

participation

in

Milestone

Reviews

Transitionfromdocumentbasedprocesstoone

supportingIT

investment

decisions

20


21/46

The Wa Ahead Afford secure access to information for the warfighter

from any device

Consolidate/standardize elements of networks to moreeffectively defend them and confront threats with agile

Embed policies, procedures, oversight, and culture that

enable info sharing

Leverage extensive and unprecedented capabilitiesafforded by the Information Age

Partner with industry to deliver national security in cyberspace

Wearecreatingaccessfromanydevice,anywhere,anytime21


22/46

Joint Information Enterprise End State

From This: To This:

CoalitionForces

DeployedEnvironmentData

Computing

MissionApplications

EnterpriseInformationEnvironment

ComputingData

Applications

AT21NavyERP DCO

iEHR Enterprise

Email

Defense

Travel

APEX AFATDS

Airman

FundamentalsClose

Combat TM


??

Worko e

(TDY/Deploy)Home Futuredevices

22

o mus c ange


23/46

Coalition ForcesJoint Information Enterprise End State

Deployed Environment

DataCom utin

MissionApplications

Defensibility/Redundancy/Resiliency Federation/SharedInfrastructure Enter riseServices


DataAT21AT21AT21AT21Navy ERPNavy ERPNavy ERPNavy ERP DCODCODCODCOAPEXAPEXAPEXAPEX AFATDSAFATDSAFATDSAFATDS

IdentityAccessManagement Cost:

????

omput ng

Applications

iEHRiEHRiEHRiEHR Enterpr iseEnterpr ise

EmailEmail

Enterpr iseEnterpr ise

EmailEmail

DefenseDefense

TravelTravel

DefenseDefense

TravelTravel

AirmanAirman

FundamentalsFundamentals

AirmanAirman

FundamentalsFundamentalsCloseClose

Combat TMCombat TM

CloseClose

Combat TMCombat TM


WorkWorkMobileMobile

(TDY/Deploy)(TDY/Deploy)HomeHome

????FuturedevicesFuturedevices

23

Accessatthepointofneed


24/46

Future Securit State

Service/Agency

User

COCOM User ISAF/Coalition

User

DataTaggedandWrapped

IdentityAccess

Management

Federated/EnterpriseNetwork

24


25/46

Our Approach

Build Joint Information Enterprise Architecture ruthlessly enforce during budget process Produce milestones to drive implementation

Optimize information, networks, and hardware A lication normalization standardization and rationalization Data Center Consolidation Security Architecture standardization and optimization

Se arate server com utin from end-user com utin data centric security

Optimize support software

Provide common applications and migrate intostandardized environment

CodifiedintheDoDITEnterpriseStrategyandRoadmap25


26/46

Future DoD IT Environment

Reducedcosts fordatacenters

andapplications

Improvedusersatisfactionand

missionsuccess

Improvedinteroperability for

bettercoordinationand

collaboration

,

capabilitydeliveriesto

Warfighters26

Fasteradoption ofcommercial

ITbreakthroughs

Improvedsecuritytoreduce

cyberthreats


27/46

Realizin the JIE Means Faster deliver of ca abilit to

warfighters Innovative solutions for

warfighters

Improved efficiencies Secure information

capability

Decisionagilitytomeetwarfighterneeds27


28/46

C ber Securit Weareincreasin l vulnerableasnew

technologiesemerge

Threatisindirectandmultifaceted

Advancedpersistentthreat(APT)

CurrentenvironmentisindefensibleC bersecurit vulnerabilities threaten

defensible

Reduceattacksurface

toexploitclassifiedinformationand

endangermissionsuccess

Mobilitypresents

apotential

increase

intheattacksurface

.

28


29/46

Todays Discussion: DoDs Direction

29

Itisuptous tofindopportunities


30/46

Five Pillar C ber Strate Ali nment Treat cyber space as an operational domain

, Train like you fight

Soccernot Football Employ new defense operating concepts

DoD introducin sensors, software and heuristic features to detect and sto maliciouscode and actors

HBSS and movement toward continuous monitoring Act at machine speed vice analyst speed

Partner with public and private sectors Partnership with DHS to support and defend critical information infrastructure DIB Information Sharing program

Build international partnerships

Work with Afghanistan government to rebuild and secure infrastructure Leverage talent and innovation

Information Assurance Scholarship Program , , Teach the Cyber workforce the soccer aspect of this domain

30


31/46

Identity and Access Management

Enter rise A roach to Core IdAM Functions Digital IdentityCredentialingAuthorizationAuthentication Balance secure information sharing and insider threat mitigation

PK Enablement (PKE) of SIPRNet underway Cryptographic logon, system access, data access

automated account provisioning

DMDC DEERS authoritative database forour en y an persona

31


32/46

IdAM High-Level Capability Model

Each capability is achieved through a set of roadmap task areas related to policy, governance, and technical implementation

ear- erm ou come or e o n erpr se ra egy an oa map crea e e core n ras ruc ure o prov e e commonfoundation for these capabilities

32


33/46

Mobility: Innovation

33


34/46

Mobilit DoD CMD StrateVision:Allowthewarfighterthepowerto

connecttotheinformationresourcesthe

need

fromany

device

at an time fromanywhereintheworld

Outcome:The

DoD

Information

Enterprise

willenableuserstoconnect,identify

themselves,accessservices,findandshare

information,andcollaborateasneededfor

themission

at

hand.

34

DoDwillleveragecommercialinnovation


35/46

CMD Pilots/Initiatives Summar

Motorola

Androiddeviceforuse Win7tabletwithinte rated USMCa roveduseof

(NSA

Fishbowl/TIPSpiral)

Fujitsu

Q550

RIM

Playbook

withFishbowl(TIPSpiral)

Conceptdeviceto provides/VoIPuptoTS

smartcardreader PlayBook whileinBlackBerrybridgemode

Modified

iPad1

(SiPad)

Dell Streak5

phone

(AndroidSTIG)

Apple

iPhone/

iPad

(iOS 5ISCG)

Wirelesscapabilities

physicallyremoved fromiPad1tocreateanereaderforclassified

Dellcreated

acustom

Android2.2OStoaddsecuritycapabilitiesforthedevelopmentoftheDell

ApprovediOS 5

ISCG

will

providelimiteduseofiOS 5devices

documents Android2.2approvedISCG

STIGapproved11/8/2011

sensitiveusecase

35


36/46

DoD CMD Requirements

UseCases

Classification Requirements

NonEnterprise

ActivatedCUI(U/FOUO) SECRET TOPSECRET

Publiclyreleasableinformation

128bitAESEncryption

128BitAESSuiteB/Type1

256BitAESSuiteB/Type1

TheDoDCMD FIPS1402L1 FIPS1402L2

TEMPEST

Anti

tamper

FIPS1402L3TEMPEST

Anti

tamper

MobileDevice

Auditing DataatRest/Dataintransitencryption Remotewipe

Strategyconsiders

thetype

of

user

and

theclassificationof

Enterprise

Strongauthentication CMDperipheralcontrol (Camera/GPS/WiFi/etc.)

Transport No DoDNetworks NetworkControl

Broadbandservice QoS

MissionCritical

Low

latency

datawhendeploying

aCMDarchitecture.

Services

Robustcellularroaming/persistentconnectivity

Application

Management

ApprovedCommercialApps

ApplicationControl

ValidatedApps ApplicationAuthorization CentralizedAppStore

Interoperableaccessa eways e un ancy

Cross

domain

support

Executive PriorityAccess Gateway(s) toC2Networks

Ruggedizeddevice Delaytolerantnetworking

Spectrum Interoperability

Inadditiontoenterprisewide

requirements,tactical

supportusersrequireunique

hardware,spectrum,

Support SAASM TRANSEC AntiJam

Phaseofconflict Removaloffixed

infrastructurevulnerability

infrastructure,and

networkingrequirements.

36


37/46

Mobility Risk and Specific

iOS

ThreatstoEnterprise MobileDevicesLossofDevice

Datarecoveredbyunauthorizedparty

Android

iOSw/GOOD

nfidentiality

ass ve a a

CollectionEvesdropping(dataorvoice)

Collectionovertheair

Collectionover

the

network

ActiveData

VulnerableApp

TheftofCredentials

Malware

k STIG Approval / Risk

Androidw/GOODC

o CollectionTracking

Loss/TheftofDevice

Theft/Misuseof

Services

TheftofServices

AbuseofServices

y DatainTransit Ontheflymanipulation

Ri Threshold

WinMobilew/GOODIn

tegri

DataonHostSoftware

Hardware

DataonService Datarecoveredbyunauthorizedparty

Jamming

GPS

MobileCarrierWin7TabletPC

BlackBerry

SMEPED

Availability

DenialofService

MalwareMobileCode

VulnerableApps

VulnerableOS

FloodingRiskMitigatingCapabilities

LossofDataUnintentionalLoss

Malware

37

. o e ev ce anagemen

2.) EncryptedDatainTransit

3.) EncryptedDataatRest

4.) PKI/MutualAuthentication

5.) Auditing/Logging



38/46


CMD ThreatsiOS

ThreatstoEnterprise MobileDevicesLossofDevice

Datarecoveredbyunauthorizedparty

IOS5 offers security improvements

Android

iOSw/GOOD

nfidentiality

ass ve a a

CollectionEvesdropping(dataorvoice)

Collectionovertheair

Collectionover

the

network

ActiveData

VulnerableApp

TheftofCredentials

Malware

xamp e - ty to o over-t e-a r

security updates

k STIG Approval / Risk

Androidw/GOODC

o CollectionTracking

Loss/TheftofDevice

Theft/Misuseof

Services

TheftofServices

AbuseofServices

y Datain

Transit On

the

fly

manipulation

DSAWG conditions for iOS5 approval

1. A lication store to su ort theRi Threshold

WinMobilew/GOODIn

tegri

DataonHostSoftware

Hardware

DataonService Datarecoveredbyunauthorizedparty

Jamming

GPS

MobileCarrierWin7TabletPC

secure provisioning and distribution of

vetted applications to DoD users

BlackBerry

SMEPED

Availability

DenialofService

MalwareMobileCode

VulnerableApps

VulnerableOS

FloodingRiskMitigatingCapabilities

2. Training for DoD general users and

senior officialsLossofData

UnintentionalLoss

Malware

38

. o e ev ce anagemen

2.) EncryptedDatainTransit

3.) EncryptedDataatRest

4.) PKI/MutualAuthentication

5.)

Auditing/Logging 3. DoD Internet proxy service


39/46

How Can You Hel ?

Leverage your bestan r g es

Help us find lasting,innovative solutions

Be art of our success

39

Collaboration:Keytoconqueringthecyberchallenge


40/46

uest ons

Robert J. CareyPrincipal Deputy Chief Information Officer

[email protected]


41/46

Blackberr ictures

41


42/46

Enter rise Resource Plannin S stems

Enterprise Resource Planning systems (ERPs) helpthe DoD achieve audit readiness

ERP design principles Traceabilit of all transactions from source to statement Ability to recreate a transaction Documented, repeatable processes and procedures

Com liance with laws re ulations and standards A control environment sufficient to reduce risk

Additional improvements to Business Enterprise

Orienting BEA around end-to-end processes Improving usability and implementation of BEA

42


43/46

CY12 Token Distribution Profile

3 Feb 10 Feb 29 Feb Mar A r Ma Jun Jul Au Se Oct Nov

FY12

Funded Dec*

Total

CY12

Delivered DeliveredDelivered

Subtotal Delivery

Army 31500 14500 40000 40000 32500 15500 0 0 0 0 0 0 174000 0 174000


Navy 0 0 0 0 5000 10500 22500 22500 22500 22500 22500 22500 150500 22500 173000

AirForce 0 0 0 0 9000 20000 22500 22500 22500 22500 22500 22500 164000 22500 186500


Marine

Corps0 0 0 0 2500 2500 2500 2500 2500 2500 2500 2500 20000 2500 22500

Agencies 0 0 0 0 1000 1500 2500 2500 2500 2500 2500 2500 17500 2500 20000

Total 31500 14500 40000 40000 50000 50000 50000 50000 50000 50000 50000 50000 526000 50000* 576000Delivered DeliveredDelivered

*DecemberdeliverieswillbeprocuredwithFY13Procurementfunds.

After Februar 2012 token deliveries will be made on the last business da of the month.

43

.


44/46

U SIPRNet Token Issuance

Asof23March,59,550tokenshavebeenenrolled/issued

An additional28,544havebeenformatted

Organizations SIPRNetTokensReceivedSIPRNetTokens

Enrolled/Issued

USA 109,105 27,583

USAF 16,500 4,467

USMC 10,887 5,794

USN 15,000 6,211

USCG 800 548

, ,

DLA 3,000 712

DODIG 50 46

DTRA 100 1

JOINTSTAFF 900 356

NGA 500 0

NSA/CYBERCOM 705 19

, ,

Contractor* 6,897

Other* 484

44*IssuingorganizationnotcurrentlyidentifiedintheTokenManagementSystem

(U) SIPRN T k I


45/46

(U) SIPRNet Token Issuance

a s cs170,600 170,600 170,600 170,600

180,000

130,600 130,600 130,600140,000

160,000

80,557 81,302 82,510 85,460

88,094

81,990 84,600 84,600 84,600 84,600 84,600 84,600 84,600

116,100

100,000

120,000

40,499 42,66045,647

48,184 50,27953,820

56,87659,550

47,741 49,26051,928

54,72357,675

63,66269,282

73,852 74,72776,745 ,

60,000

80,000

29,189

31,320 32,185 32,98634,049 35,531

, ,

20,000

40,000

45Asof23March2012

0

12/9/11 12/16/11 12/23/11 12/30/11 1/6/12 1/13/12 1/20/12 1/27/12 2/3/12 2/10/12 2/17/12 2/24/12 3/2/12 3/9/12 3/16/12 3/23/1

TotalIssued TotalFormattedandIssued TotalTokensDelivered

Addi i l Cl d C i A E l


46/46

Additional Cloud Capacity: An Exemplar

~800

rs

taCente

400

AdditionalCloud

CapacityRequired

Between

2014

DDemand

20%

~100

46Time

~20182014 2016

FOSE sides: DOD deputy CIO Robert Carey

Documents

Transcript of FOSE sides: DOD deputy CIO Robert Carey