How the Recovery Board gathered its multiple clouds

The agency's cloud hub helps control, monitor and audit systems, even among multiple cloud providers.

The Recovery Accountability and Transparency Board has deployed a cloud hub that lets the organization securely integrate and manage a variety of cloud services from multiple providers.

Launched in October, the cloud hub allows the RATB to use multiple cloud providers in conjunction with its own internal private cloud infrastructure, according to agency CIO Shawn Kingsberry. The cloud hub provides a technology stack that includes a firewall between the agency’s enterprise operations and the cloud service provider, a router for virtual private network services, and computing services that include integrated security and service management, Kingsberry said.

Best known for the Recovery.gov website, RATB is a non-partisan government agency created by the American Recovery and Reinvestment Act of 2009 to provide transparency of Recovery Act-related funds and to detect and prevent fraud, waste and mismanagement.

The move of Recovery.gov, the stimulus tracking website, to Amazon’s Elastic Compute Cloud infrastructure-as-a-service platform was the agency’s first step toward a multiple cloud strategy, Kingsberry said.  RATB has since moved e-mail and office automation systems to Microsoft’s Office 365 Government Community Cloud.

FederalReporting.gov,  the data collection system for federal agencies and recipients of stimulus funds to fulfill reporting obligations, is hosted in CGI’s secure federal cloud. 

FederalAccountability.gov,  the portal for agencies and inspectors general to perform risk assessments of individuals and organizations that have applied for or received funds, is hosted in RATB’s private analytics cloud at the agency’s headquarters in Washington, D.C.  Plans are underway to move big data analytics using Hadoop to a private cloud.

RATB synthesized all of the best practices that industry and agencies have derived to deal with the challenges of cloud deployment into RATB’s cloud hub architecture, Kingsberry said.  Those best practices focus on issues such as compliance, data flow and protection, security and visibility of information.

Now, “we are our own cloud broker,” he said. 

A critical component of the hub is the ability to control, monitor and audit access to systems and information within a hybrid cloud infrastructure.  As a result, RATB has deployed Xceedium’s Xsuite software, which provides a single point of policy management for controlling privileged access to information and applications.

“Xceedium is actually in our cloud hub stack, handling access control between all of our systems,” Kingsberry explained.  The software provides auditing and the ability to control access because users go through one central point to access systems, including those in the cloud. “In essence, I can go through one interface to manage Amazon and Microsoft 365,” he said.

Xsuite also gives RATB the ability to enforce separation of duties and record sessions of all administrators accessing its internal server stack as well as its managed service offering to other federal agencies. The software will protect servers running on the agency’s internal private cloud, based on VMware virtualization technology, and infrastructure running on Amazon Elastic Compute Cloud and the company’s Simple Storage Service.

Xsuite software can run on a physical appliance residing in a data center or across that facility, or as a virtualized appliance within a cloud provider’s infrastructure, such as Amazon, said Ken Ammon, Xceedium’s chief strategy officer.

Additionally, RATB managers will be able to deploy Personal Identity Verification (PIV) cards for system administrators working with Recovery.gov, providing multi-factor authentication before they are granted access to critical systems and cloud management consoles. RATB will implement PIV cards for administrative access to servers wherever they reside, without having to change how the agency manages passwords and other credentials on its systems.

There are other security features that RATB’s cloud hub architecture provides, Kingsberry said.  Because RATB has implemented Microsoft Active Directory Federation Services 2.0, the agency is able to lock down the devices that sync with its network.  “We can say only RATB-issued devices can connect and sync with us,” he said.

“But the cool thing about that is, our architecture can support bring–your-own-device,” Kingsberry added.  If RATB can get the unique information from each user’s mobile device, then managers can say, “Only connect with this device,” and access will be permitted for smart phones by model, serial number and telephone number.

“We thought about a lot of that as we architected our cloud hub,” he said. It wasn’t easy, but Kingsberry  credited his colleagues at RATB with making it work.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.