6 ms·

I'm wondering how usual is it to host the infrastructure of the national services using foreign cloud provider?

dangsux 2y ago
[dead]
EwanToo 2y ago
It's pretty common, all the biggest clouds are USA or China owned. In the UK government services go through information security classification to determine what level of security is needed, with the most confidential stuff still being self-hosted. I assume most countries operate that way.
- b800h 2y ago
  There was a UK-based cloud provider. Unfortunately it collapsed, leading to a lot of costly replatforming. https://www.civilserviceworld.com/news/article/cabinet-office-counts-cost-of-ukcloud-collapse-175m-so-far https://www.civilserviceworld.com/news/article/cabinet-offic...
  - everfrustrated 2y ago
    Probably couldn't afford their new VMWare bill
BartjeD 2y ago
In the Netherlands, critical infrastructure is required to be hosted in government cloud data centers. An exception is possible if after a risk assessment and the determination that no state secrets may be exposed, a government body decided to use a commercial cloud provider. The private cloud providers list is then filtered by whether or not their country of origin / incorporation, or effective control, has an effective cyber-control program it runs against the Netherlands or against Dutch interests. This arguably includes corporate espionage programs.
- vindex10 2y ago
  https://www.notifications.service.gov.uk/features/who-can-use-notify https://www.notifications.service.gov.uk/features/who-can-us... * central government departments * local authorities * the armed forces * the NHS * the emergency services * GP surgeries * state-funded schools looks quite critical to me
  - BartjeD 2y ago
    Yes, personally I don't think it's a good idea to host these things with the US companies. As a citizen I prefer it's in my own country, unless it's really not critical or interesting information / services. The UK made a different choice.
    - patrakov 2y ago
      Is the gov.uk website infrastructure compliant with their own Cyber Essentials requirements? I very much doubt it, as the anti-malware requirements applicable to cloud providers that are not using Windows or MacOS ([1], section 5, subsection "Requirements", option "Application allow listing" on page numbered 14 in the corner) are not implementable as worded. Using Azure instead of AWS could have helped here. [1] https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-1-January-2023.pdf https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-...
  - djtango 2y ago
    > GOV.UK Notify makes it easy for public sector service teams to send emails, text messages and letters. Doesn't seem that critical to me. Important, but doesn't pass the sniff test of "is this a matter of national security" that would justify self-hosting ultimately slowing down development and making it more expensive and in effect less feature-rich for taxpayers EDIT the API docs suggest this is used for sending formal Notifications en-masse rather than mission-critical comms
  - scaryclam 2y ago
    The kinds of messages that get sent via email or text are usually pretty unimportant. Important things tend to be sent via letter or a phone call. It's not likely to be anything critical.
46Bit 2y ago
It's pretty normal for ordinary government workloads in the UK, or at least it was at GDS. Using niche suppliers who cater to government paranoia is expensive, and they're usually much less mature than hyperscaler platforms. It's also open for debate whether those niche, inflexible suppliers result in a genuinely more hardened target or not.
pjc50 2y ago
You have to understand that buying computers comes out of the capital budget, and is several times more expensive than just leasing them for this year; and that hiring staff runs into severe civil service pay issues. Once "buy some computers and hire staff to manage them" has been ruled out by politics, buying hosting on the open market becomes the remaining reasonable choice, and nobody got fired for choosing AWS.
- vidarh 2y ago
  You can lease or even rent the servers without paying cloud prices, and there's a wide range of companies providing devops services on contract. So really, the main reason is your last clause - AWS is "safe" even though you might as well set cash on fire.
  - pjc50 2y ago
    But then you have to run two competitive tenders, one for the servers and one for the contract devops. How much does that cost and how long does it take? https://www.fgould.com/uk-europe/articles/cutting-the-cost-of-public-sector-procurement/ https://www.fgould.com/uk-europe/articles/cutting-the-cost-o...
    - vidarh 2y ago
      Plenty of companies would happily offer you a package for both.
benrutter 2y ago
Usual: very Good: Not so much Unfortunately, cloud provision isn't very competitive and is very US/China centric. I was at a talk recently around how one of the UKs major infrastructure providers was building their architecturrle, and I was pretty freaked by the level if vendor lock in. Would love to see more governments viewing this as the security risk it is, but I'm not holding my breath.

[dead]

It's pretty common, all the biggest clouds are USA or China owned. In the UK government services go through information security classification to determine what level of security is needed, with the most confidential stuff still being self-hosted. I assume most countries operate that way.

b800h 2y ago
There was a UK-based cloud provider. Unfortunately it collapsed, leading to a lot of costly replatforming. https://www.civilserviceworld.com/news/article/cabinet-office-counts-cost-of-ukcloud-collapse-175m-so-far https://www.civilserviceworld.com/news/article/cabinet-offic...
- everfrustrated 2y ago
  Probably couldn't afford their new VMWare bill

BartjeD 2y ago

In the Netherlands, critical infrastructure is required to be hosted in government cloud data centers. An exception is possible if after a risk assessment and the determination that no state secrets may be exposed, a government body decided to use a commercial cloud provider. The private cloud providers list is then filtered by whether or not their country of origin / incorporation, or effective control, has an effective cyber-control program it runs against the Netherlands or against Dutch interests. This arguably includes corporate espionage programs.

vindex10 2y ago
https://www.notifications.service.gov.uk/features/who-can-use-notify https://www.notifications.service.gov.uk/features/who-can-us... * central government departments * local authorities * the armed forces * the NHS * the emergency services * GP surgeries * state-funded schools looks quite critical to me
- BartjeD 2y ago
  Yes, personally I don't think it's a good idea to host these things with the US companies. As a citizen I prefer it's in my own country, unless it's really not critical or interesting information / services. The UK made a different choice.
  - patrakov 2y ago
    Is the gov.uk website infrastructure compliant with their own Cyber Essentials requirements? I very much doubt it, as the anti-malware requirements applicable to cloud providers that are not using Windows or MacOS ([1], section 5, subsection "Requirements", option "Application allow listing" on page numbered 14 in the corner) are not implementable as worded. Using Azure instead of AWS could have helped here. [1] https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-1-January-2023.pdf https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-...
- djtango 2y ago
  > GOV.UK Notify makes it easy for public sector service teams to send emails, text messages and letters. Doesn't seem that critical to me. Important, but doesn't pass the sniff test of "is this a matter of national security" that would justify self-hosting ultimately slowing down development and making it more expensive and in effect less feature-rich for taxpayers EDIT the API docs suggest this is used for sending formal Notifications en-masse rather than mission-critical comms
- scaryclam 2y ago
  The kinds of messages that get sent via email or text are usually pretty unimportant. Important things tend to be sent via letter or a phone call. It's not likely to be anything critical.

46Bit 2y ago

It's pretty normal for ordinary government workloads in the UK, or at least it was at GDS. Using niche suppliers who cater to government paranoia is expensive, and they're usually much less mature than hyperscaler platforms. It's also open for debate whether those niche, inflexible suppliers result in a genuinely more hardened target or not.

pjc50 2y ago

You have to understand that buying computers comes out of the capital budget, and is several times more expensive than just leasing them for this year; and that hiring staff runs into severe civil service pay issues. Once "buy some computers and hire staff to manage them" has been ruled out by politics, buying hosting on the open market becomes the remaining reasonable choice, and nobody got fired for choosing AWS.

vidarh 2y ago
You can lease or even rent the servers without paying cloud prices, and there's a wide range of companies providing devops services on contract. So really, the main reason is your last clause - AWS is "safe" even though you might as well set cash on fire.
- pjc50 2y ago
  But then you have to run two competitive tenders, one for the servers and one for the contract devops. How much does that cost and how long does it take? https://www.fgould.com/uk-europe/articles/cutting-the-cost-of-public-sector-procurement/ https://www.fgould.com/uk-europe/articles/cutting-the-cost-o...
  - vidarh 2y ago
    Plenty of companies would happily offer you a package for both.

benrutter 2y ago

Usual: very Good: Not so much Unfortunately, cloud provision isn't very competitive and is very US/China centric. I was at a talk recently around how one of the UKs major infrastructure providers was building their architecturrle, and I was pretty freaked by the level if vendor lock in. Would love to see more governments viewing this as the security risk it is, but I'm not holding my breath.