ML21277A115
| ML21277A115 | |
| Person / Time | |
|---|---|
| Issue date: | 08/18/2021 |
| From: | Pushpa Jayapal, Steven Schrader Governance & Enterprise Management Services Division |
| To: | NRC/RES/DSA |
| Dennis M | |
| References | |
| Download: ML21277A115 (7) | |
Text
NRC CLOUD INFRASTRUCTURE PUSHPA JAYAPAL AND STEVE SCHRADER
CLOUD STRATEGY The Agencys objectives are:
Improve security, cost effectiveness, efficiency, agility, and scalability in delivering IT services; Align with the OMBs Cloud Smart policy and the Federal Cloud Computing Strategy; Accomplish appropriate system and application migrations to cloud services as part of compliance with Federal DCOI mandates; Establish consistent cloud solution planning and migration practices; and Reduce risks to IT delivery, availability, and performance through a more distributed and consistent infrastructure and platform environment.
To maximize cloud services benefits, the NRC will use the following strategies:
Leverage Software-as-a-Service (SaaS) first to support a low-code deployment approach and optimize functional requirements to take full advantages of SaaS benefits.
Leverage Platform-as-a-Service (PaaS) to drive technology standardization for modernized systems and applications that require customization.
Plan to acquire and support standardized PaaS platforms.
Increase application refactoring activities to rearchitect applications from monolithic and tightly integrated applications to loosely-coupled, cloud-based microservices focused on activities and workflows.
Adopt Infrastructure-as-a-Service (IaaS) only by exception.
MAJOR COMPONENTS Azure Commercial (IaaS and PaaS)
AWS, NRC RES-Managed Other SaaS
AZURE INFRASTRUCTURE ExpressRoute connected stub network No direct Internet AccessAll access through the NRC TIC connection 2-Gbps Connection through Equinix Equinix will be the TIC 3.0 connection for NRC Supports Cloud EDTE, Production, and DMZ zones Currently supporting several systems using the following PaaS (not exhaustive):
Azure Web Apps Azure SQL Database Azure Functions Azure Bot and QnA Maker Azure Search Azure Cognitive Speech Service
CLOUD SECURITY When possible, all cloud systems use Private IP Space In Azure, SaaS and PaaS Services use PrivateLink to provide for Private IP usage In Azure and AWS IaaS, no public IP addresses are assigned to VMs Cloud Access Security Broker (CASB)
Provides policy enforcement regardless of what sort of device is attempting to access cloud services Azure Defender Currently monitors Azure SaaS and PaaS Configurations Can be configured to remediate identified issues Standard Network Security approaches, e.g. Splunk, Firewalls, IDS, AV
CURRENT AND FUTURE PROJECTS Application Migration Efforts - EIE, ILDC, NITA, Data Warehouse, ADAMS, TTC ColdFusion, RPS, ALM, Azure VDI New Capabilities - ActiveNav PaaS Implementations - Containers, Azure Security Center, Site Recovery, Mobile Apps, Logic Apps 3WFN Data Center Consolidation Evaluating and Scheduling all NRC FISMA Systems Cloud Migrations Goal is to migrate all systems which can be migrated to the cloud by Dec 2026
THANK YOU JAYAPAL, PUSHPA PUSHPARANI.JAYAPAL@NRC.GOV STEVE SCHRADER STEVEN.SCHRADER@NRC.GOV