{"id":49475,"date":"2019-07-30T15:17:37","date_gmt":"2019-07-30T05:17:37","guid":{"rendered":"https:\/\/www.aspistrategist.ru\/?p=49475"},"modified":"2019-08-06T10:08:55","modified_gmt":"2019-08-06T00:08:55","slug":"why-australias-national-security-agencies-need-the-cloud","status":"publish","type":"post","link":"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/","title":{"rendered":"Why Australia\u2019s national security agencies need the cloud"},"content":{"rendered":"
<\/figure>\n

There\u2019s been a lot of talk lately about lots of submarines and fighter jets playing a role in Australia\u2019s security. But in all the excitement of contemplating future battles between fleets of submarines and fortuitously small invasion armadas from the People\u2019s Liberation of Army, little thought has been given to an emerging vulnerability in Australia\u2019s national security apparatus brought about by the global change in ICT.<\/p>\n

The world of computing was reinvented about a decade ago with the arrival of cloud computing. Since then, there\u2019s been a shift away from dedicated computing resources (think the home computer that sits on your bench) to on-demand allocation of computing resources by a cloud service provider.<\/p>\n

The advantages are big, although, as with all magical technological advances, there are downsides. Having on-demand computing power allows high processing power and speed to be applied quickly to meet a particular need, and then to be reallocated elsewhere when they\u2019re no longer needed.<\/p>\n

Much more complex functions, like big-data analysis, can be done rapidly and routinely without an enormous investment in standalone supercomputers, and more needs can be met from a given fixed stock of ICT power. Cloud architecture is an essential part of what makes Amazon, Microsoft, Alphabet, IBM, Apple, Facebook, Samsung, Alibaba, Baidu, Huawei, Tencent, Oracle, Cisco and SAP so powerful and able to service millions of customers\u2019 needs simultaneously.<\/p>\n

On top of this, though, another phenomenon of equal importance is that applications\u2014the programs that run on whatever system you have access to\u2014are being increasingly optimised for cloud-based architecture, not for the now-legacy, and increasingly niche, fixed systems used by many governments across the globe.<\/p>\n

Governments and their officials either have been reluctant to give up owning their own servers and data centres or have outsourced them to data centre providers. They tend to look on cloud providers with some trepidation, partly because of concerns about data security \u2018in the cloud\u2019 and partly because of concerns about the overall lack of visibility of how risks are managed across a fairly opaque service model.<\/p>\n

So, here in Australia we\u2019ve seen moves to end contractual arrangements with data centre providers when ownership changes occur, along with a continuing debate over the use of in-house versus contracted-out data centres.<\/p>\n

But the bigger issue\u2014our national security capability\u2014has been a bit of a sleeper here to date, and that needs to change. The situation reminds me of government policy on mobile phones, which was a tale of policy being dragged reluctantly forward by manifest changes in the market. Mobile phones weren\u2019t welcome in much of the national security community, not just in the limited top secret facilities of intelligence agencies and other areas of big agencies.<\/p>\n

Then they were allowed in more broadly because their use became pretty ubiquitous, and the debate moved to what to do about phones with cameras. The security policy world kept it simple. It banned mobiles with cameras. That worked until it became very hard to buy a smartphone without a camera. The policy folded, despite the reluctance of security policy experts. Under controlled conditions, it\u2019s now possible for mobiles to be used in top secret agencies.<\/p>\n

I think we\u2019re at the same point with cloud computing. The overwhelming advantages national security agencies will get from the capabilities provided by a secure cloud infrastructure, compared with traditional computing power allocated to specific agencies and functions within them, are clear. A high-technology fifth-generation military with the intelligence capabilities it will need (as proposed in the 2016 defence white paper) requires cloud infrastructure to work effectively. And Australian agency folk know enough about this from their exposure to US agencies with secure cloud infrastructure to get the point.<\/p>\n

The big companies mentioned earlier develop and implement their cutting-edge technology on cloud infrastructure. They can be providers of this infrastructure because they are developers and users of it themselves.<\/p>\n

Even from a very narrow perspective, not moving the Australian national security community to cloud infrastructure will consign, a few years from now, agencies to commissioning bespoke Australian-only software to run on legacy ICT platforms. Meanwhile, their counterparts in the US\u2014and potentially other Five Eyes partners\u2014will all be able to use applications optimised for cloud architecture systems. It\u2019ll be like getting retired Windows 7<\/a> software engineers to write new versions and keep them running on today\u2019s computers.<\/p>\n

If that isn\u2019t convincing enough, potential adversaries\u2019 militaries, intelligence agencies and national security communities will have capability advantages over their Australian counterparts simply because they either already have or will have adopted cloud infrastructure.<\/p>\n

I\u2019m not sure, though, that the Australian government\u2019s secure cloud strategy<\/a> can be usefully applied in Australia\u2019s national security agencies.<\/p>\n

It encourages each agency to make its own decisions in accordance with its own \u2018vision and strategy for cloud adoption\u2019. That approach is unlikely to maximise federal purchasing power or drive agency cooperation in an area in which a critical mass of investment is likely to be important.<\/p>\n

It also says agencies should \u2018consider public cloud first and in preference to any other cloud deployment model\u2019 and simply adds that \u2018agencies should ensure the public cloud service has the appropriate security\u2019. That means existing government security frameworks and policies designed for the non-cloud IT world are just imported to this entirely new business model.<\/p>\n

Leaving those issues aside, four big obstacles are likely to be in the way of Australia\u2019s national security community moving to cloud infrastructure. The first will be money. A move like this isn\u2019t in the budget plans of any agency or group of agencies\u2014and Treasurer Josh Frydenberg just said<\/a> he\u2019s already kicked in to raise the defence budget and is in no mood to add more.<\/p>\n

The second is agency independence. Cloud infrastructure for the national security agencies will be best done as a joint initiative that at least includes the national intelligence community and the defence organisation.<\/p>\n

That\u2019s a massive organisational and cultural shift to greater collaboration and interdependency, beyond the wildest thoughts of the authors of the 2017 intelligence review<\/a>. Agency or portfolio control and ownership of functions is a bureaucratic battleground littered with skewered careers and reputations. And some nasty battles are still underway with the formation of the Office of National Intelligence and, more particularly, Home Affairs.<\/p>\n

Third is the lack of knowledge and skills in this technology area\u2014part of the broader STEM skills deficit Australia faces. National security agencies have some flexibility in employing specialist skills. They\u2019ll need to use all of that to build and retain the knowledge needed to operate securely and to maximum effect on cloud infrastructure if they are to be more than passive customers of global providers.<\/p>\n

The last major obstacle is likely to be trust and risk. The number of cloud providers that could work with the Australian national security community is fairly limited. It would certainly include the global providers at the big end of town like Microsoft, Amazon, IBM, Alphabet and even Northrop Grumman. But medium-sized data centre operators (for example, NEXTDC and Canberra Data Centres) and local cloud providers already serving government like Vault, partnering with bigger global cloud providers and with companies like Leidos, might also see this as a viable business proposition given a reliable big Australian customer.<\/p>\n

If the government were to use its larger purchasing power across the national security community and other big agencies, and think strategically about what could be done with its US ally, the options would be broader, and probably both more resilient and more financially viable.<\/p>\n

Regardless of who the provider or providers might be, validating the security of a cloud solution, and gaining a sufficient understanding of its vulnerabilities, will be large and difficult pieces of work. Simple issues like the resilience of cloud infrastructure if it\u2019s dependent on a small number of international undersea cables will need to be assessed.<\/p>\n

Overall, though, the issue of cloud infrastructure for the Australian national security community needs to be elevated way above the realm of individual agency IT departments and break the confines of debates over in-house or contracted data centres and current security rules.<\/p>\n

A move now to secure cloud infrastructure is needed if Australia\u2019s national security agencies are to remain at first-world capability.<\/p>\n","protected":false},"excerpt":{"rendered":"

There\u2019s been a lot of talk lately about lots of submarines and fighter jets playing a role in Australia\u2019s security. But in all the excitement of contemplating future battles between fleets of submarines and fortuitously …<\/p>\n","protected":false},"author":766,"featured_media":49478,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[343,483,301],"class_list":["post-49475","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-australian-intelligence-community","tag-cloud-computing","tag-national-security-2"],"acf":[],"yoast_head":"\nWhy Australia\u2019s national security agencies need the cloud | The Strategist<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why Australia\u2019s national security agencies need the cloud | The Strategist\" \/>\n<meta property=\"og:description\" content=\"There\u2019s been a lot of talk lately about lots of submarines and fighter jets playing a role in Australia\u2019s security. But in all the excitement of contemplating future battles between fleets of submarines and fortuitously ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/\" \/>\n<meta property=\"og:site_name\" content=\"The Strategist\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ASPI.org\" \/>\n<meta property=\"article:published_time\" content=\"2019-07-30T05:17:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-08-06T00:08:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/07\/5569724272_34e45f38e0_z.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"427\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Michael Shoebridge\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:site\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Michael Shoebridge\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\",\"url\":\"https:\/\/www.aspistrategist.ru\/\",\"name\":\"The Strategist\",\"description\":\"ASPI's analysis and commentary site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.aspistrategist.ru\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-AU\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/#primaryimage\",\"url\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/07\/5569724272_34e45f38e0_z.jpg\",\"contentUrl\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/07\/5569724272_34e45f38e0_z.jpg\",\"width\":640,\"height\":427},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/\",\"url\":\"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/\",\"name\":\"Why Australia\u2019s national security agencies need the cloud | The Strategist\",\"isPartOf\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/#primaryimage\"},\"datePublished\":\"2019-07-30T05:17:37+00:00\",\"dateModified\":\"2019-08-06T00:08:55+00:00\",\"author\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/b7802124e14835ff19b5c244e962849f\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/#breadcrumb\"},\"inLanguage\":\"en-AU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.aspistrategist.ru\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why Australia\u2019s national security agencies need the cloud\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/b7802124e14835ff19b5c244e962849f\",\"name\":\"Michael Shoebridge\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/9ad669e65739d5a3f4bbc0e839d8a6b8?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/9ad669e65739d5a3f4bbc0e839d8a6b8?s=96&d=mm&r=g\",\"caption\":\"Michael Shoebridge\"},\"url\":\"https:\/\/www.aspistrategist.ru\/author\/michael-shoebridge\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why Australia\u2019s national security agencies need the cloud | The Strategist","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/","og_locale":"en_US","og_type":"article","og_title":"Why Australia\u2019s national security agencies need the cloud | The Strategist","og_description":"There\u2019s been a lot of talk lately about lots of submarines and fighter jets playing a role in Australia\u2019s security. But in all the excitement of contemplating future battles between fleets of submarines and fortuitously ...","og_url":"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/","og_site_name":"The Strategist","article_publisher":"https:\/\/www.facebook.com\/ASPI.org","article_published_time":"2019-07-30T05:17:37+00:00","article_modified_time":"2019-08-06T00:08:55+00:00","og_image":[{"width":640,"height":427,"url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/07\/5569724272_34e45f38e0_z.jpg","type":"image\/jpeg"}],"author":"Michael Shoebridge","twitter_card":"summary_large_image","twitter_creator":"@ASPI_org","twitter_site":"@ASPI_org","twitter_misc":{"Written by":"Michael Shoebridge","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/www.aspistrategist.ru\/#website","url":"https:\/\/www.aspistrategist.ru\/","name":"The Strategist","description":"ASPI's analysis and commentary site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.aspistrategist.ru\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-AU"},{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/#primaryimage","url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/07\/5569724272_34e45f38e0_z.jpg","contentUrl":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/07\/5569724272_34e45f38e0_z.jpg","width":640,"height":427},{"@type":"WebPage","@id":"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/","url":"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/","name":"Why Australia\u2019s national security agencies need the cloud | The Strategist","isPartOf":{"@id":"https:\/\/www.aspistrategist.ru\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/#primaryimage"},"datePublished":"2019-07-30T05:17:37+00:00","dateModified":"2019-08-06T00:08:55+00:00","author":{"@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/b7802124e14835ff19b5c244e962849f"},"breadcrumb":{"@id":"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/#breadcrumb"},"inLanguage":"en-AU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.aspistrategist.ru\/why-australias-national-security-agencies-need-the-cloud\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.aspistrategist.ru\/"},{"@type":"ListItem","position":2,"name":"Why Australia\u2019s national security agencies need the cloud"}]},{"@type":"Person","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/b7802124e14835ff19b5c244e962849f","name":"Michael Shoebridge","image":{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/9ad669e65739d5a3f4bbc0e839d8a6b8?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9ad669e65739d5a3f4bbc0e839d8a6b8?s=96&d=mm&r=g","caption":"Michael Shoebridge"},"url":"https:\/\/www.aspistrategist.ru\/author\/michael-shoebridge\/"}]}},"_links":{"self":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/49475"}],"collection":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/users\/766"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/comments?post=49475"}],"version-history":[{"count":4,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/49475\/revisions"}],"predecessor-version":[{"id":49589,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/49475\/revisions\/49589"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media\/49478"}],"wp:attachment":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media?parent=49475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/categories?post=49475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/tags?post=49475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}