NASA Continues To Be Baffled By The Cloud
NASA OIG: NASA’s Progress in Adopting Cloud-Computing Technologies
“The OIG review found that weaknesses in NASA’s IT governance and risk management practices have impeded the Agency from fully realizing the benefits of cloud computing and potentially put NASA systems and data stored in the cloud at risk. For example, several NASA Centers moved Agency systems and data into public clouds without the knowledge or consent of the Agency’s Office of the Chief Information Officer (OCIO). Moreover, on five occasions NASA acquired cloud-computing services using contracts that failed to fully address the business and IT security risks unique to the cloud environment. Finally, one of the two moderate-impact systems NASA moved to a public cloud operated for 2 years without authorization, a security or contingency plan, or a test of the system’s security controls. This occurred because the OCIO lacked proper oversight authority, was slow to establish a contract that mitigated risks unique to cloud computing, and did not implement measures to ensure cloud providers met Agency IT security requirements.”
Previous IT Stories
Good.
Moving to the cloud would be a STUPID decision by NASA. If NASA IT departments are in fact impeding NASA’s move to the computational cloud, that means that they are doing their jobs correctly, and the OIG should be congratulating them.
“Cloud” seems to be little more than a marketing buzzword these days. Near as I can tell, it is used to generally refer to any form of remote hosting and/or storage service. I do think some of these services have a proper place and can enhance productivity, but certainly not across the board.
I question the very first sentence of the IG’s report, the assertion that “NASA spends about $1.5 billion annually on its portfolio of information technology (IT) assets.” The figures were derived from a politically motivated call for (mis)information almost a decade ago, during the preceding administrations push for “enterprise architecture,” another name for handing one or two big integration contracts to the administration’s political friends.
At our location, at least, they inflated the figure by including 100% of the FTE’s for contractors involved in mission or instrument operations as “IT” – after all, you don’t get to $1.5B through hardware these days; it has to be on burdened salaries and overhead. In the cases with which I was familiar, they were high by a factor of four.
That said, I can believe that there are some NASA IT activities that are appropriate for cloud deployment, as long as security and availability concerns are addressed. Sam and Fred’s Excellent Cloud is not the same as Amazon’s various offerings. NIST defines several types of clouds, and it looks as though what NASA needs, for its cloud-approrpiate applications, is a “hybrid”cloud: some public cloud services, some cloud architecture hosted at one or more NASA Centers.