Blue Clouds and the Red Flags A snapshot of IT regulatory issues and DoD-2008

1. Blue Clouds and the Red FlagsA snapshot of IT regulatory issues and DoD-2008 NDIA Education Seminar, March 2008 Sarasota, Florida

2. Agenda • Blue Clouds • Web 2.0 (IPv6) DoD Standards and Initiatives • Red Flags • Reports of DoD’s cyber security concerns • OMB Desktop Standard-Federal Desktop Core Configuration • OMB Trusted Internet Connection (TIC) Initiative • Counterfeit IT products • Cyber Terrorism Legislation • DoD Considering Ban on Personal Use of Internet (1/28/2008) • DoD blocking MySpace, YouTube and other web sites; cutting soldiers ties to home (5/15/2007) • System & Software Assurance Guidelines-Information Assurance

3. What is the significance of the new internet?What is Web 2.0 and IPv6? • IPv6-Internet Protocol Version 6 • It is a standard • NIST calls it “profiles” • DoD calls it “UCD”-Unified Capabilities Definition • Desktop computing to cloud computing • Blue Cloud announcement • Where are customers in the global commerce and Agencies/DoD heading with this new technology?

4. Conclusions We are entering the third phase of the Internet As profound as the World Wide Web The next 2-3 years will define the Next Generation Internet The Internet revolution is less than 15% completed* Number of users Total bandwidth Total amount of content Number of devices Number of applications The Internet revolution will be as disruptive as the printing press Much faster Totally global More unpredictable Enabling a transformation in e-government *Michael Nelson, Professor Internet Studies, Georgetown University

5. Phase One – Stand Alone Computer App. Data

6. Phase Two – The Web Web sites Data Data Data Data Browser PC App. Data

7. Phase Three – The Cloud Data Data Data App. App. App. Data

8. Phase Three – The Cloud Data Data Data App. App. App. Data

9. Video Everywhere & Social Collaboration • TV shows, YouTube clips, animations, and other video applications already account for more than 60 percent of Internet traffic (CacheLogic) • 80% of all traffic in some countries is video • 98% of all traffic by 2009 (Hui Zhang, CMU) • Amateur video • 100 million downloads/day on YouTube • Star Trek fan videos • Gaming videos • Webcams everywhere • Surveillance video

10. HEADLINE - Collaboration THE HEADLINE High-end video-conferencing (WebEx) THE REAL NEWS The Gaming Revolution + Virtual Worlds Producing GDP equivalent to Belgium's May 1 2006 Business Week cover story Internet isn’t just a medium, it’s a PLACE

11. Early Virtual Worlds Business Applications Collaboration and Events Commerce Education and Training Other Emerging Applications

12. How will the Next Generation Internet be used? Cloud Computing (e.g. “Blue Cloud”) The “network becomes the computer” Pervasive Computing Monitoring and tracking almost anything The Cloud + Pervasive Computing Smart buildings Sensor nets “Invisible computing” or “ubiquitous computing” Ad hoc networking

14. Automobile Design Facilities Management >200K Sensors / Bldg 18% Energy 6.1% CO2 Ubiquitous Connectivity Network Kiosks IPv6 in Japan

15. SO WHAT’S GOVERNMENT’S ROLE? • Early adopter of new technologies (such as Virtual Worlds, Grid) • Promote competition and investment in telecom infrastructure • Enable new access technologies (e.g. WiMax) • Education and training • Foster open standards and open source software • Help create a foundation for a secure Internet • “Future proof” policies

16. US Status and OMB Mandate on IPv6 • OMB requirement to have Agencies have IPv6 Ready networks by June 2008 • Global Status-OECD Paper-International Perspective • NIST Profiles (standards) issued January 2008 • Standards effective 30 months from NIST profile adoption (24 month manufacturing cycle and 6 month lab accreditation) • DISA/JITC standards currently in effect for DoD • NIST and JITC standards vary; testing and certification processes are different • Industry testing and certification costs? • Industry request to OMB to declare the “IPv6 Ready Logo” standard is the de facto standard for US IT manufacturers to meet for civilian agencies until NIST standards are effective • “Product Readiness” and “interoperability” engagement focus • Agency terms and conditions for IPv6 Capability and interoperability requirements? • Procurement professionals need to understand this topic; NIST view that the procurement professionals will support and manage agency network contract requirements?

24. John Grimes February 2008 Memo to Commands • DoD shall reprioritize funds necessary to meet FY 2008 and FY 2009 transition requirements to support respective network and program implementation schedules • MILDEP CIO’s, DISA, and NSA shall provide quarterly updates on IPv6 transition milestones, progress, and required/programmed resources, and spend plans to the DoD CIO Executive Board • Office of the DoD Deputy CIO and the DISA shall develop an “IPv6 capable” definition in coordination with the DoD Components by February 29, 2008

25. DoD IPv6 Warranty Language (DoD, PA&E language, 3/2008) • The contractor warrants that each equipment and software item delivered under this contract shall be able to accurately transmit, receive, process, and function correctly using the Internet Protocol Version 6 (IPv6). Specifically, the contractor warrants that: • 1) each item delivered complies with the current Joint Technical Architecture (JTA) developed IPv6 standards profile; • 2) each item delivered maintains interoperability with IPv4 (specifically, is able to operate on/coexist on a network supporting IPv4 only, IPv6 only, or a hybrid of IPv4 and IPv6) and • 3) each item delivered is supported by the contractor's IPv6 technical support. • Additionally, as IPv6 evolves, the contractor commits to upgrading or providing an appropriate migration path for each item delivered. If the delivery order requires that specific listed products must perform as a system, then the above warranty shall apply to those listed products as a system. The duration of this warranty and the remedies available to the Government for breach of this warranty shall be as defined in, and subject to, the terms and limitations of the contractor's standard commercial warranty or warranties contained in this contract, provided that, notwithstanding any provision (s) to the contrary in such commercial warranty or warranties, the remedies available to the Government under this warranty shall include repair or replacement of any product whose non-compliance is discovered and made known to the contractor in writing within one year after acceptance. Nothing in this warranty shall be construed to limit any rights or remedies the Government may otherwise have under this contract with respect to defects other than IPv6 performance.

26. Security and Integrity of Government Networks • OMB Desktop Standard-Federal Desktop Core Configuration • March 31, 2008; Agency Technical Status report due • OMB Trusted Internet Connection (TIC) Initiative • June 2008; Comprehensive plan of action/milestones-target completion date • Counterfeit IT products • Cyber Terrorism Legislation • DoD Considering Ban on Personal Use of Internet (1/28/2008) • DoD blocking MySpace, YouTube and other web sites; cutting soldiers ties to home (5/15/2007) • Classified Presidential Directive • System & Software Assurance Guidelines-Information Assurance

27. Questions