4 ms·

While I don’t know the specifics of JEDI, it seems problematic that military data is being stored in a civilian center at all, and one that’s likely to be inter

While I don’t know the specifics of JEDI, it seems problematic that military data is being stored in a civilian center at all, and one that’s likely to be internet connected. Every day practically we see a new breach, and there’s two things in common: a weak point in software, and the internet. Will JEDI be completely air gapped?

ocdtrekkie 5y ago
The expectations placed on military compliant service is pretty significant, in that it's generally going to be dedicated boxes and networks and significant controls to prevent any easy movement between enterprise or consumer users and government. (Most government cloud customers are already on a pretty separated area from everything else.) But presumably Internet connectivity is the entire point of why they'd want a cloud contract: The government already has servers in buildings. It sounds like they particularly want the global reach of a cloud service, probably for activities intentionally intended to be on the Internet. I mean, bear in mind, if you're a state-level actor that engages in cyberattacks, you need to be on the Internet to do them... Not saying that's the purpose of the JEDI contract, just that... there's plenty of scenarios where the military wants Internet-connected things.
- shadowgovt 5y ago
  In taking a contract like this, I (as a company owner) would be more concerned with the thought that I just added my datacenter to someone's priority target list. On the other hand, let's be honest... In strategy for a modern war, Microsoft and Amazon's major datacenters are already on someone's priority target list.
  - ocdtrekkie 5y ago
    Yeah, the thing is too, global actors have already learned that attacking corporate entities is a really good way to screw with our public sector too. And it's a lot easier to wreak havoc by attacking major municipalities than trying to inject code onto an F-35, and arguably, the former is capable of doing more damage than the latter.
    - azinman2 5y ago
      You can do both. And I doubt it’s about trying to modify the f-35 design (tho maybe), but more likely simply exfiltrate all the data, possibly with some ability to “rm *” on demand.
  - jedberg 5y ago
    There is a reason Amazon and Microsoft keep the locations of their datacenters secret. They are unlabeled buildings. If you drove by it you'd have no idea what it was.
    - shadowgovt 5y ago
      That secrecy really only works for the 90-99% of people they want to keep out who would be showing up at their door for "lookey-loo" purposes. Every nation-state actor knows where every datacenter is of every major digital player, because they've already implanted spies in those companies and the location maps of those datacenters are not internally secret. It'd be very hard to make them internally secret, since those DCs communicate with the rest of the network and must be controlled in realtime by site reliability engineers.
      - ocdtrekkie 5y ago
        Pretty much. If you have a datacenter in your local vicinity, it's also not hard to find it: It's the building with far more air conditioning equipment than seems reasonable for a building it's size, with security cameras every two and a half feet.
        nceqs3 5y ago
        Wikileaks also leaked the locations of all the AWS buildings a couple years ago.
streetcat1 5y ago
Per my understanding there would be data centers dedicated to the army.
croes 5y ago
You want to air gap the cloud solution?
- patch_cable 5y ago
  It has been done before: https://aws.amazon.com/blogs/publicsector/announcing-the-new-aws-secret-region/ https://aws.amazon.com/blogs/publicsector/announcing-the-new...
  - azinman2 5y ago
    Once upon a time, telecommunication networks were built point-to-point or otherwise non-publicly switched. I believe the telephone network, for example, is still this way, which includes more than just telephones but also ISDN lines and likely other technologies/use cases as well. There's no reason you couldn't have military facilities on their own network connected to servers in their own cloud, as this AWS instance has shown.
mabbo 5y ago
https://aws.amazon.com/blogs/publicsector/announcing-the-new-aws-secret-region/ https://aws.amazon.com/blogs/publicsector/announcing-the-new... > The AWS Top Secret Region was launched three years ago as the first air-gapped commercial cloud and customers across the U.S. Intelligence Community have made it a resounding success. AWS has provided air-gapped regions to the US Government for 6+ years, according to that blog post.
natural219 5y ago
Don't know why this is getting downvoted; it's an interesting question, if a simple top-level one. I'm not sure myself why the DoD can't just build its own "cloud" with a $10 billion dollar budget, instead of putting the security of our military apparatus in the hands of some private company.
- rswail 5y ago
  The same reason it doesn't build it's own "plane" or "ship" or "submarine" or "satellite" or "gun" or "bullet". The DoD's job is defense, so it's about fighting wars, not about building infrastructure and supplies. The security of the military apparatus will stay in the DoD. The implementation and operation of the security infrastructure will be delivered by government contract.

ocdtrekkie 5y ago

The expectations placed on military compliant service is pretty significant, in that it's generally going to be dedicated boxes and networks and significant controls to prevent any easy movement between enterprise or consumer users and government. (Most government cloud customers are already on a pretty separated area from everything else.) But presumably Internet connectivity is the entire point of why they'd want a cloud contract: The government already has servers in buildings. It sounds like they particularly want the global reach of a cloud service, probably for activities intentionally intended to be on the Internet. I mean, bear in mind, if you're a state-level actor that engages in cyberattacks, you need to be on the Internet to do them... Not saying that's the purpose of the JEDI contract, just that... there's plenty of scenarios where the military wants Internet-connected things.

shadowgovt 5y ago
In taking a contract like this, I (as a company owner) would be more concerned with the thought that I just added my datacenter to someone's priority target list. On the other hand, let's be honest... In strategy for a modern war, Microsoft and Amazon's major datacenters are already on someone's priority target list.
- ocdtrekkie 5y ago
  Yeah, the thing is too, global actors have already learned that attacking corporate entities is a really good way to screw with our public sector too. And it's a lot easier to wreak havoc by attacking major municipalities than trying to inject code onto an F-35, and arguably, the former is capable of doing more damage than the latter.
  - azinman2 5y ago
    You can do both. And I doubt it’s about trying to modify the f-35 design (tho maybe), but more likely simply exfiltrate all the data, possibly with some ability to “rm *” on demand.
- jedberg 5y ago
  There is a reason Amazon and Microsoft keep the locations of their datacenters secret. They are unlabeled buildings. If you drove by it you'd have no idea what it was.
  - shadowgovt 5y ago
    That secrecy really only works for the 90-99% of people they want to keep out who would be showing up at their door for "lookey-loo" purposes. Every nation-state actor knows where every datacenter is of every major digital player, because they've already implanted spies in those companies and the location maps of those datacenters are not internally secret. It'd be very hard to make them internally secret, since those DCs communicate with the rest of the network and must be controlled in realtime by site reliability engineers.
    - ocdtrekkie 5y ago
      Pretty much. If you have a datacenter in your local vicinity, it's also not hard to find it: It's the building with far more air conditioning equipment than seems reasonable for a building it's size, with security cameras every two and a half feet.
      - nceqs3 5y ago
        Wikileaks also leaked the locations of all the AWS buildings a couple years ago.

streetcat1 5y ago

Per my understanding there would be data centers dedicated to the army.

croes 5y ago

You want to air gap the cloud solution?

patch_cable 5y ago
It has been done before: https://aws.amazon.com/blogs/publicsector/announcing-the-new-aws-secret-region/ https://aws.amazon.com/blogs/publicsector/announcing-the-new...
- azinman2 5y ago
  Once upon a time, telecommunication networks were built point-to-point or otherwise non-publicly switched. I believe the telephone network, for example, is still this way, which includes more than just telephones but also ISDN lines and likely other technologies/use cases as well. There's no reason you couldn't have military facilities on their own network connected to servers in their own cloud, as this AWS instance has shown.

mabbo 5y ago

https://aws.amazon.com/blogs/publicsector/announcing-the-new-aws-secret-region/ https://aws.amazon.com/blogs/publicsector/announcing-the-new... > The AWS Top Secret Region was launched three years ago as the first air-gapped commercial cloud and customers across the U.S. Intelligence Community have made it a resounding success. AWS has provided air-gapped regions to the US Government for 6+ years, according to that blog post.

natural219 5y ago

Don't know why this is getting downvoted; it's an interesting question, if a simple top-level one. I'm not sure myself why the DoD can't just build its own "cloud" with a $10 billion dollar budget, instead of putting the security of our military apparatus in the hands of some private company.

rswail 5y ago
The same reason it doesn't build it's own "plane" or "ship" or "submarine" or "satellite" or "gun" or "bullet". The DoD's job is defense, so it's about fighting wars, not about building infrastructure and supplies. The security of the military apparatus will stay in the DoD. The implementation and operation of the security infrastructure will be delivered by government contract.