This content is sponsored by Flexera.
What federal agencies can learn about cloud from industry, early adopters
It鈥檚 been ten years since the Cloud First policy directed federal agencies to start exploring and implementing cloud technologies, and it鈥檚 clear now that cloud is here to stay. But only the early adopters among agencies have made any significant progress in their cloud migrations; many federal IT leaders say they are still in the early stages of adopting cloud for uses like data analytics and business processes. But as those early pioneers give way to a great migration into the cloud, from federal agencies and industry that can ease an agency鈥檚 transition and adoption.
The first thing any agency can do is understand the extent of its IT infrastructure, by getting an enterprise view of services, applications, where they reside, and how they interact. That means going all the way down to individual app servers, databases, load balancers, middleware and web servers. Once an agency has that view, it can begin to assess the technical demands and cost of migrating a service.
The Office of Inspector General for the largest quasi-government civilian agency recently did just that. It found it needed to upgrade its networks in order to lay the foundation for moving out of data centers, migrating its infrastructure to the cloud, and using those capabilities to begin implementing data analytics and artificial intelligence.
Next, agencies need to determine what to move to the cloud, and when. Impact to mission needs to be taken into account here, as well as security, procurement and workforce considerations. Some applications may need to continue running on premises. Upfront and operational costs, as well as data sensitivity and governance requirements need to be taken into account as well.
For example, the Department of Veterans Affairs recently achieved the kind of visibility into its systems that have allowed it to begin prioritizing the transition of its systems and applications into the cloud. One official estimated the department has saved 10% on data storage costs since determining what needs to stay on premises, and what can go into the cloud. It鈥檚 now to prioritize those migrations and develop more accurate cost projections as well.
But the work doesn鈥檛 end after agencies lay the foundation for moving into cloud. Although transitioning to the cloud is where agencies will see some of the biggest costs, it鈥檚 easy to get into trouble post-migration if they aren鈥檛 prepared for the 鈥減ay-by-the-drink鈥� pricing model.
Time-consuming pre-approvals won鈥檛 work when costs rise every time a developer deploys a new workload. Agencies have to be proactive in their governance once they鈥檝e moved into the cloud. And the federal government is starting to get the picture. The General Services Administration鈥檚 IT Category office is a best practices guide for purchasing cloud computing on a consumption basis using GSA Schedules.
Agencies also need to plan ahead for software licensing challenges. There are often differences between running software on premises and in the cloud, and most vendors present financial obstacles or prohibitions from running their software on competitors鈥� clouds. And with most experts agreeing that multi-cloud is the way forward, . While most agencies currently use multiple cloud platforms, 75% report that managing multiple clouds will be a top challenge over the next five years, and nearly half of federal IT executives agree their agency is not yet taking the right steps to prepare for their multi-cloud future.
And updated security and governance controls will become necessary as well. Mitigating risks requires real-time visibility into every asset on the network. Some early adopters have already found significant success with continuous diagnostics and mitigation. For example, the has leveraged data analytics tools to build out a cybersecurity dashboard that provides an around-the-clock look at every agency device that鈥檚 connected to its network, all the way down to mobile devices.
鈥淲hether it鈥檚 what threats might be against SBA 鈥� being able to see our entire inventory, who鈥檚 on our network, what they鈥檙e doing, how they鈥檙e using our networks, and having visibility into that environment 鈥� that鈥檚 something we did not have before,鈥� said Maria Roat, former CIO of SBA.
Automation is key to maintaining that kind of comprehensive view into an agency鈥檚 systems as it moves more fully into the cloud. U.S. Citizenship and Immigration Services recently redesigned its security operations center with that in mind.
鈥淚f you are cloud heavy like USCIS is 鈥� we are 80%-90% cloud at this point 鈥� your SOC better reflect that. That means if your infrastructure is code, then your security is code too. Your SOC floor better have development teams on it. If you don鈥檛, you鈥檝e already lost the battle and probably the war,鈥� said Shane Barney, the chief Information Security Officer at USCIS. 鈥淲e鈥檝e had several instances in cloud and every single time, it鈥檚 the development teams that rode the show on it. They helped us resolve it; they helped us fix it; they helped us determine it and they helped us develop mitigation solutions going forward.鈥�
These are just a few examples of the best practices coming out of early adopters among federal agencies and industry. Download Flexera鈥檚 new cloud whitepaper to learn more.
