Government Agencies Should Be Able to Fully Trust Cloud Services

Dr Thamm, public administration is now entering the cloud in force as well. What are the reasons for this?

Cloud services – or, more simply stated, the device-independent storage and processing of data via the Internet – are in vogue. Private companies have been using them for years, and we have noticed that our customers from the public sector are increasingly demanding the cloud as well. The potential of the cloud is obvious: The solutions promise greater efficiency, as they are quick to implement, easily scalable and often more economical for a company than having its own data centre. The federal, state and local authorities are therefore looking closely at the opportunities and challenges of cloud computing, such as those provided by the German Administrative Cloud Strategy. Against this backdrop, we should soon see a significant leap forward in the public administration use of the cloud.

What is stopping the administration from getting started in the cloud?

In public administration, there is – not without reason – a certain scepticism with regard to data protection and IT security with cloud-based services. In addition, the concept of “digital sovereignty” plays an important role as well. Behind this is the fear that the administration could lose its freedom of choice and control over its own data and applications if it becomes dependent on large hyperscalers which are not from Germany or Europe, but instead mostly from the USA. It is therefore important to avoid unilateral dependencies or to reduce them in order to always have the ability to decide and act independently and autonomously. It is also important to keep an eye on future developments: Political conditions sometimes change rapidly, even in countries regarded as stable partners today.

In light of this, to what do government agencies need to pay particular attention?

By utilising public cloud infrastructures, the public administration naturally relinquishes some direct influence. Therefore, as a general rule, authorities should only use cloud services that they can fully trust because organisational, technical or legal measures ensure this. Likewise, proper licensing practices are needed in order to avoid any nasty surprises in terms of costs and digital sovereignty. However, finding the best solutions in the large and confusing array of offers is anything but easy.

What is the Bundesdruckerei Group’s position on cloud computing?

Thanks to its security and digital expertise, the Bundesdruckerei Group also creates trust in the cloud segment; as a federal technology company, we know which solutions are able to drive digitisation in administration without compromising on data security. In other words: We have the expertise needed to effectively unite legal guidelines and innovation. In addition, we also offer a wide range of solutions, thereby enabling digital sovereignty and full data control.

What solutions does the Bundesdruckerei Group offer?

As a full-service provider, we think about the cloud right from the outset when developing new offerings. This means that our solutions are always prepared for being operated in a cloud. One example of this is the Federal Portal, the central access point to the administrative services of federal, state and local authorities. Or the Federal Foreign Office’s PLAIN platform, where the federal administration uses AI to analyse large volumes of data and to put them at the service of evidence-based administration. We also offer our customers a wide range of possible operating infrastructures: We operate conventional “on-site” applications in our own data centres, work together with German cloud partners for managed or cloudified hosting and use hyperscaler infrastructures. The decisive factor here is what each specific customer requires. On this basis, we work together with our customers to find solutions oriented to their projects and needs.

Do other factors play a role as well?

The digital certificates from D-Trust GmbH, a company of the Bundesdruckerei Group, are what make us a trust anchor. Digital certificates are essential for the use of trustworthy digital infrastructures, as they secure data encryption and ensure clear authentication of communication partners – something that digital certificates can also do for cloud solutions. Identity and Access Management (IAM) for clouds and hyperscalers allows users to identify and authenticate themselves in the cloud. Access rights can be controlled here individually for everyone. Once again, this is based on certificate products from D-Trust. Moreover, certificates are also crucial for client-side encryption: In this case, trust service provider D-Trust encrypts the customer’s data so that the cloud provider and other third parties have no access to the data.

What about customers with particularly high security requirements – can they also use cloud services?

Thanks to our newest subsidiary, Xecuro GmbH in Berlin and Bonn, the Bundesdruckerei Group is able to make it possible for customers who work with classified information to access the cloud as well. To this end, Xecuro operates IT platforms approved for VS in specially constructed, highly secure and geo-redundant data centres in Germany. Thanks to 24/7 shift operation, our services are available to customers around the clock. Our subsidiary genua’s REDCloud research project goes yet another step further. On behalf of the Federal Office for Information Security, it is currently investigating how VS-NfD information can be processed even more securely in public clouds.