add additional security statement

[trevorbryant]

add additional security statement

[pburkholder]

👍

[pburkholder]

Well, you tried....

[carlsonloggie]

Peter, I was fascinated to receive a flood of emails saying that the OMB and CIO aren’t interested in industry advice. However, I never received a response to issue #4 <#4> . I understand the importance of cloud computing. When it first became available, I used CVS and saw great potential. I currently use Microsoft O365 both at home and at work. However, moving to the cloud creates other problems. Cloud computing solves some problems (government data centers with different equipment and security standards) while introducing others. 1. Help desk staff have no experience with cloud computing. Tier 1 support is basically useless for a time, but there is not enough Tier 2 & 3 support to go around. When CVS first came online, no one knew how to support it, and no one could say where the tech support was. It was a nightmare, and some of the problems were never resolved. Some users never got an account either because it wasn’t required or because they couldn’t get their accounts up and running. 2. It can be difficult to get the cloud software loaded onto individual computers, as local IT is generally not prepared for the job. (I am a licensed user of O365 at the office, but IT won’t allow the rich client to be installed on my computer as no one has told them it is authorized or instructed them as to the proper procedure.) 3. Existing staff have no experience with cloud computing. Training helps, but it does not compensate for the lack of experience. Hiring contractors is not a solution if the management staff and executive leadership don’t have the skills and expertise to properly guide them. 4. Existing software should be rewritten to take advantage of cloud computing. This rarely happens, leading to sub-optimal software and higher than expected costs. 5. Existing data should be cleansed, with a single authoritative source for each piece of data. A data virtualization layer can help, but who is going to do that, especially in a government context with technically incompetent people in leadership positions? And especially because proper data virtualization reduces the amount of control exercised by middle management and executive leadership? 6. Lift and shift moves the current problems to someone else’s computers, with the expectation that the cloud will somehow solve them. Hope is not a plan. 7. Cloud providers offer different computing services, leading to vendor lock-in. It is difficult to move optimized programs from one provider to another, but it is even more difficult to move zettabytes of data. 8. Containerization improves cloud provider portability but tends to cost about 20% more. It’s an unintended consequence. Kris Carlson, MIS, CISSP 9434 1st View St Norfolk, VA 23503 From: Peter Burkholder ***@***.***> Sent: Friday, July 19, 2024 6:06 PM To: ombegov/cloud.cio.gov ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [ombegov/cloud.cio.gov] add additional security statement (#9) Well, you tried.... — Reply to this email directly, view it on GitHub <#9 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAQDRMLQKZAC7HKTALMEBLDZNGET5AVCNFSM6AAAAABLFJWKICVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENBQGMZTCMBUGI> . You are receiving this because you are subscribed to this thread. <https://github.com/notifications/beacon/AAQDRMOHLAMM4XZPUFXBFWTZNGET5A5CNFSM6AAAAABLFJWKICWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTUFRC6SE.gif> Message ID: ***@***.*** ***@***.***> >

[pburkholder]

Hi Kris, My comments weren't on behalf of OMB or CISA. I was going through all my old open PRs in GitHub and realized I had about 8 comments/PRs still open from 2018 and that I might was well close them. Anyhow, I don't have any stance one way or the other wrt to your observations. But thanks for trying to help illuminate these issues for policy makers. All the best, Peter

…

On Sat, Jul 20, 2024 at 12:17 PM carlsonloggie ***@***.***> wrote: Peter, I was fascinated to receive a flood of emails saying that the OMB and CIO aren’t interested in industry advice. However, I never received a response to issue #4 <#4> . I understand the importance of cloud computing. When it first became available, I used CVS and saw great potential. I currently use Microsoft O365 both at home and at work. However, moving to the cloud creates other problems. Cloud computing solves some problems (government data centers with different equipment and security standards) while introducing others. 1. Help desk staff have no experience with cloud computing. Tier 1 support is basically useless for a time, but there is not enough Tier 2 & 3 support to go around. When CVS first came online, no one knew how to support it, and no one could say where the tech support was. It was a nightmare, and some of the problems were never resolved. Some users never got an account either because it wasn’t required or because they couldn’t get their accounts up and running. 2. It can be difficult to get the cloud software loaded onto individual computers, as local IT is generally not prepared for the job. (I am a licensed user of O365 at the office, but IT won’t allow the rich client to be installed on my computer as no one has told them it is authorized or instructed them as to the proper procedure.) 3. Existing staff have no experience with cloud computing. Training helps, but it does not compensate for the lack of experience. Hiring contractors is not a solution if the management staff and executive leadership don’t have the skills and expertise to properly guide them. 4. Existing software should be rewritten to take advantage of cloud computing. This rarely happens, leading to sub-optimal software and higher than expected costs. 5. Existing data should be cleansed, with a single authoritative source for each piece of data. A data virtualization layer can help, but who is going to do that, especially in a government context with technically incompetent people in leadership positions? And especially because proper data virtualization reduces the amount of control exercised by middle management and executive leadership? 6. Lift and shift moves the current problems to someone else’s computers, with the expectation that the cloud will somehow solve them. Hope is not a plan. 7. Cloud providers offer different computing services, leading to vendor lock-in. It is difficult to move optimized programs from one provider to another, but it is even more difficult to move zettabytes of data. 8. Containerization improves cloud provider portability but tends to cost about 20% more. It’s an unintended consequence. Kris Carlson, MIS, CISSP 9434 1st View St Norfolk, VA 23503 From: Peter Burkholder ***@***.***> Sent: Friday, July 19, 2024 6:06 PM To: ombegov/cloud.cio.gov ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [ombegov/cloud.cio.gov] add additional security statement (#9) Well, you tried.... — Reply to this email directly, view it on GitHub < #9 (comment)> , or unsubscribe < https://github.com/notifications/unsubscribe-auth/AAQDRMLQKZAC7HKTALMEBLDZNGET5AVCNFSM6AAAAABLFJWKICVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENBQGMZTCMBUGI> . You are receiving this because you are subscribed to this thread. < https://github.com/notifications/beacon/AAQDRMOHLAMM4XZPUFXBFWTZNGET5A5CNFSM6AAAAABLFJWKICWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTUFRC6SE.gif> Message ID: ***@***.*** ***@***.***> > — Reply to this email directly, view it on GitHub <#9 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJHWCURE7JFT3QZRUWHZGTZNKEPPAVCNFSM6AAAAABLFJWKICVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENBRGE4TMNBUGA> . You are receiving this because you commented.Message ID: <ombegov/cloud. ***@***.***>