Inspector General audit finds problems with NASA's cloud computing efforts

(Phys.org) —The Office of the Inspector General, led by Paul Martin, has published the results of an audit of NASA's cloud computing efforts and has found many such efforts lack proper security. The report also notes that many cloud efforts run by the agency were operating without the knowledge of its own Office of the Chief Information Officer.

Over the past several years, the Office of Management and Budget, which controls the purse strings of federal entities, has demanded that governmental agencies, such as NASA, begin transferring some or all of its data processing and storage activities to the cloud. The idea is that doing so will save the government a lot of money. In following the directive, however, it appears that managers at NASA have failed to ensure that cloud operations are undertaken with the knowledge and approval of the agencies top information officer. Worse, it appears that many of the cloud initiatives were undertaken without due consideration given to necessary security precautions that must be put in place when applications and data become accessible across the Internet.

More specifically, the auditors found over a 100 NASA websites—both internal and external—had never been tested for security integrity. Incredibly, many of those same websites were found to have no security controls in place at all.

Government agencies have two main options when moving applications to the cloud—set up facilities on their own or contract out. NASA, like most other federal agencies has chosen the latter. Unfortunately, the auditors found that officials at the agency in many cases failed to include security issues when writing contracts, which of course resulted in them not being put in place.

Overall, the IG's report has found that weaknesses in cloud applications have impeded the agency from reaping the benefits of cloud computing—namely reducing costs. And worse, the approach taken thus far has put NASA data at risk. Out of five contracts reviewed, the auditors found "none came close" to operating with industry standard security precautions.

The auditors recommend that NASA set up an office dedicated to cloud computing and the security issues that must be put in place when such initiatives are undertaken.

© 2013 Phys.org