Bipartisan cloud study recommends speeding federal adoption, or remain vulnerable on cyber

The CSIS commission recommended a rethinking of existing procedures to quicken federal agencies’ pace.

Slow adoption of cloud technologies poses a cybersecurity hazard for federal agencies, which will require an overhaul of contracting, regulatory and budgeting procedures to fix, a bipartisan think tank report that will be released Thursday concludes.

Led by veterans of both the first Trump administration and Biden administration as well as lawmakers from both parties, the Center for Strategic and International Studies report arrives as the transition to the second Trump administration begins next week. CyberScoop is the first to report on it. 

“Despite the widespread use of cloud services in the private sector, federal agencies remain significantly behind in the modernization of their information technology (IT) infrastructure, which has created problems for citizen service delivery and cybersecurity,” the report states.

A 2011 Obama administration strategy on moving agencies toward the cloud envisioned shifting a quarter of all federal IT spending to the cloud. As of now, federal IT spending is at more than $130 billion and only $17 billion of that is spending on cloud technologies, the report notes.

The commission has a host of recommendations for improving that. Among them is the Office of Management and Budget coming up with a plan to remove old IT systems that are expensive to maintain, and “the 2025 transition provides an opportunity to finally do this.” Policymakers have long struggled to ditch their reliance on legacy systems, with ongoing efforts including a dedicated Technology Modernization Fund.

Federal agencies need to move away from relying on thousands of data centers and eliminating them in a way similar to how the Defense Department recommends closing military bases, and instead consolidate services for smaller agencies, the report suggests.

Cloud contracts should include minimum cybersecurity standards, according to the report. “Security requirements must be mandatory for federal contracts in the same way that seat belts and airbags are mandatory for cars and planes,” it reads. 

Failure to move to the cloud undermines the use of other technologies, the report states. “Cloud computing is essential to AI and other advanced software tools, as it provides the massive processing power and data storage required for training complex models and handling large datasets,” it says.

The co-chairs of the commission were Karen Evans, managing director of the Cyber Readiness Institute who served in top cyber and IT-related positions under Trump and George W. Bush, and Robert Knake, principal at the Orkestrel cyber firm who held top cyber posts under Biden and Barack Obama. The ex officio co-chairs were Connecticut Rep. Jim Himes, top Democrat on the House Intelligence Committee, and West Virginia Sen. Shelley Moore Capito, the chair of the appropriations subcommittee on homeland security.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure