Leading by Example - Government Cloud Services from the UK, Germany and Japan

Cloud for savings, Cloud for quality 27 & 28 February 2013 Brussels, Belgium Leading by Example - Government Cloud Services from the UK, Germany and Japan www.cloudscapeseries.eu info@cloudscapeseries.eu #cloudscapev

Leading by Example - Government Cloud Services from the UK, Germany and Japan UK G-Cloud Vision Denise McDonagh, UK Cabinet Office Government will use multi-tenanted services, shared and managed by several organisations. Shared resources, infrastructure, software and information will be provided to a range of end user devices, e.g. laptops, smart phones etc, as a utility on a pay by use basis, via a network connection in many cases the internet; this will be supported by new delivery and supply models. It will be dynamically scalable, agile, and easy to move in and out of the service. G-Cloud is not a single entity; it is an ongoing and iterative programme of work which will enable the use of a range of cloud services, and changes in the way we procure and operate ICT, throughout the public sector. By adopting cloud computing, the government will be able to more easily exploit and share commodity ICT products and services. This enables the move from high-cost customised ICT applications and solutions to low cost, standard, interchangeable services where quality and cost is driven by the market. It means changing the culture of government to adopt and adapt to the solutions the market provides and not creating unnecessary bespoke approaches. The vision is for government to robustly adopt a public cloud solution first policy, though this will not be possible in every case. Simply buying cloud technology will not, in itself, save the most money. The greatest value will be gained by Government changing the way we buy and operate our ICT. Cloud computing is a way to access and use ICT services in a flexible and agile fashion, buying only the services needed when they are needed we should do it once, do it well and then re-use, re-use, re-use. In achieving this we face challenges in procurement, transition and operational arrangements. In adopting this vision, the government must ensure that the cloud service still provides an acceptable level of security risk mitigation and allows government organisations to demonstrate they are meeting their legal and statutory obligations as far as information is concerned. Cloud computing will be enabled via the creation of a CloudStore. This will take the form of an online portal, and will provide an open marketplace displaying services that will be able to be procured, used, reviewed and reused across the public sector. The goal for the CloudStore will be to:»» Provide an open, visible, commoditised and cost transparent marketplace, that is the first point of call for any public sector ICT requirements Cloudscape V - Position papers 1

Cloudscape V - Position Papers 2 Create a shop window where all the relevant public sector ICT services can be found encouraging innovation, competition and new suppliers Exploit pan-public sector purchasing Enable the IA and security community to have access to information related to the assurance and accreditation status of the service Be a key enabler for collaborative procurement, including: Driving up supplier performance by providing an open feedback mechanism Facilitating re-use of a service to drive efficiency and cost savings. The CloudStore will be the market place in which public sector organisations can purchase trusted services (and in some instances trial services) from a variety of sources. Overall the CloudStore will aim to deliver sophisticated capability, diverse services and will allow users to easily find, review, compare, purchase, commission, decommission and switch services. Government s use of cloud computing technologies for its ICT requirements moves ICT service provision from a costly dedicated development that is often duplicated many times over, to taking the best fit the market has to offer that balances functionality, service levels and cost. This works most effectively where a mature market exists for a given service so that the business can adapt to utilise the commodity solution quickly and easily. The benefits for government Since the emergence of modern ICT solutions, government has defined and purchased custom solutions to meet its needs. In the future, rather than over specifying requirements government will make greater use of commodity solutions that best fit its needs This moves government from attempting to be the architect of bespoke digital solutions to a consumer of widely available and constantly improving mass-market products. Underpinning the government s approach will be the optimisation of our data centre infrastructure, which traditionally has been hugely inefficient. Maximising utilisation will allow rationalisation and consolidation of the data centre estate and lead to significant cost, accommodation and energy savings. For government the benefits will be: Many more common commodity solutions a range of the best industry ICT services and solutions available off the shelf so the government, its agencies and related bodies can use what they need when they need it and not create duplicate services that cannot be shared. Flexibility and Freedom the ability, if required, for departments and organisations to change service provider easily without lengthy procurement and implementation cycles, no lock-ins to long contracts and the freedom to quickly adopt better value and more up to date solutions. Ready and Easy to Use complete solutions that are already assured for security, performance and service management. Ready access to hybrid cloud solutions that allow the cost efficiencies of the public cloud to be used alongside more secure / dedicated private cloud solutions based on a consolidated data centre and service estate; Low cost Services that are paid for on a usage basis, driven by strong competition on price and quality. Transparent costs along with quality and scope-of-service metrics for simpler comparison and control; Competitive Marketplace a range of service providers constantly improving the quality and value of the

solutions they offer, from small SME organisations providing niche products to large scale hosting and computer server capacity. The benefits for suppliers The development of the marketplace must be beneficial to small, medium and emerging suppliers as well as government if it is to thrive and improve the range and quality of services available. The move from custom to commodity solutions for suppliers means:»» Open Marketplace always available for government customers, current service usage, cost and performance is transparent along with upcoming opportunities. Contract performance and comparative performance indicators are published. As government customers are not locked-in to long-term service contracts, suppliers are free to offer new, better quality and value solutions to government clients at any time»» Simple and Fair Procurement simplified commodity purchasing, through the use of systems, such as dynamic purchasing systems currently used for other utilities, removes the need for long, expensive procurement processes. This creates a level playing field for suppliers, both major and emerging providers, especially SMEs will be able to offer solutions that can be easily and quickly adopted by government»» Freedom to Innovate service suppliers are free to innovate, to offer new solutions and improvements to services at any time, rather than being held to deliver often out-dated and inappropriate custom specifications and requirements set through the procurement process. Cloudscape V - Position papers 3

goberlin A service marketplace for businesses and citizens Klaus-Peter Eckert, Fraunhofer FOKUS Focus Area & User Targets Cloudscape V - Position Papers 4 The main goal of the goberlin project is provisioning a service marketplace that combines commercial services and public governmental services to state-of-the-art applications. Around circumstances such as birth, marriage, children or move services from both worlds are orchestrated and offered to citizens in a personalised mode as SaaS. Citizens have the advantage to get an all-inclusive, one-stop-shopping service for administrative issues. Administrations have the advantage that a lot of applications and processes can be done or prepared online and the work for the government employees can be reduced. Commercial service providers get a commercial environment to offer their services and application developers get a technical platform as a service to develop and provide their orchestrated apps. The architecture of the marketplace is a loosely coupled combination of functional and security related aspects such as access control, privacy, multi-tenancy etc. It can be applied to other cloud services running in similar cloud infrastructures, operated by public data centres. Relevance to the EC Cloud Computing Strategy goberlin is part of the Trusted Cloud projects sponsored by the German Ministry of Economics and Technology. These projects are clustered in four groups: basics, industry, heath, and public sector. Implementing a trusted marketplace implies the consideration of aspect such as data preservation in and between long running user transactions, data disclosure considering legal rules, data transfer from user profiles to commercial and governmental services, traceability of service invocations. Identity management plays an important role because citizens must be able to identify and authenticate themselves via classical user name password mechanisms and utilizing the German identity card respectively the eat (electronic residence title). Service and application providers must be able to identify themselves as corporate body respectively their employees as natural but authorised persons. The orchestration and invocation of externally hosted technical (Web) services in apps requires the guarantee of interoperability considering syntactic, semantic and legal aspects. The uniform deployment of externally developed apps in a PaaS style requires the consideration of deployment related cloud standards. The examination of the applications developed by external stakeholders and operated on the trusted marketplace requires the development and implementation of associated certification policies. Relevant standards for interoperability and portability A service market place operated in a cloud infrastructure has to consider several use cases and standards. The architecture of the goberlin marketplace and several other Trusted Cloud projects has been aligned with the NIST reference architecture and will be compared with the upcoming ISO-approaches. For the

customer/provider relationships and SLAs between citizens, service providers and application providers with the operator of the market place NIST and DMTF concepts have been considered. The description of cloud services considers the German/W3C USDL-developments and the deployment process considers the TOSCA specification that is improved in another Trusted Cloud project. Members of the goberlin team contribute to the work of the coordinating initiative of the Trusted Cloud projects and participate in standardisation activities such as ISO SC38, NIST, ETSI, partially in cooperation with other European projects like OCEAN. Relevance to SIENA Roadmap Calls for Action Beneath technical aspects the goberlin project develops business models and evaluates German regulation for the operation of a service market combining commercial and governmental services. Especially considering security related aspects German laws seem to be quite restrictive concerning identity and access management and the distribution of data from a public cloud marketplace to commercial services. The development of solutions considering data transfer and interoperability on a local or even national level can be regarded as a first step for the identification of European solutions. One result of goberlin will be the development of a cloud strategy for the Berlin data centre that is going to operate the goberlin marketplace. These results may influence future procurement strategies for cloud services in the German public sector. The Trusted Cloud competence centre has created an overview of Cloud related standards that seem to be relevant for the Trusted Cloud projects. This inventory will be updated with respect to the requirements and experiences of the fourteen projects. Cloudscape V - Position papers 5

The Resiliency, Dependability and Survivability of Cloud Computing Ben Katsumi, Information-technology Promotion Agency, Japan Cloudscape V - Position Papers 6 In 2011, parts of Japan were devastated following the Great East Japan Earthquake and the resulting tsunami. Hundreds of thousands of people lost their relatives, housing, daily lives, and jobs. The tsunami also took away social infrastructures as well as IT facilities. The emergency relief effort was swift and massive as response teams and volunteers joined up to help the victims. People lost their homes and were evacuated to city halls, gymnasiums, community houses, and even to temples/shrines/churches. There was a lack of food, water, medicine and sanitation, as well as fuel and blankets. Aid came from all over Japan with materials piling up in warehouses and gymnasiums. However, relief teams were immediately faced with the problem of not knowing where the real demand was from and exactly what items were needed as they up to date information from victim camps was not available. This meant that effective and timely delivery of much-needed relief was impossible. What was missing was information and the IT to convey, aggregate, disseminate and match information regarding needs and supply. As PCs and printers were also lost in the tsunami, replacements were also provided as part of the relief effort. In addition, communication lines were down including servers which had been destroyed. To solve this issue, cloud services were provided free for to city staff and volunteer teams. Cloud-based communication media also supported people s peer to peer communication allowing people find out if their family, relatives, friends and colleagues were safe. Cloud also helped governments address a lack of capacity. Many local governments had used poor servers and narrow bandwidth to disseminate administrative information to citizens. The aftermath of the disaster saw demand increase to a spike peak hundreds of times higher as people clambered to get information on radiation levels. Servers crashed as people found out where the latest updates were online. As a response, CSP offered free hosting and mirroring to local and central governments. Free use of cloud was also offered to companies who suffered from lack of IT. The disaster proved the cloud s ability, efficiency and advantages in emergency response on a national basis. Cloud is also used in every component of society and economy today. It supports people, companies, critical infrastructure and governments. If cloud stops the whole of society is affected. If this is due a natural disaster, then the whole of society and the economy can be thrown into chaos and catastrophe. We therefore need to seriously identify the potential damage that can be caused if the cloud went down. There is no king s way to solve this problem. We need to make data centers robust and disaster ready. Then we should think of moving cloud from one data centre to another. Virtualization technology makes this easier compared to traditional real machine-based computing. There is also a lot of work going on to develop standards to realize migration between clouds. To make cloud migration feasible technological issues must be addressed as well as business and legal aspects, including SLA, security, consumer contract, providerprovider contract, compliance and international alignment.

Cloudscape V Sponsors and Research Partners