Introduction
While the past few decades have been marked by the adoption of SaaS, PaaS, and IaaS solutions as part of the IT strategies of organizations worldwide, recent years have revealed many risks associated with these strategies, as I described in my previous blog post. Large enterprises can afford to manage their own data centers and adopt (hybrid) cloud strategies, but for smaller organizations with global operations, this is much more difficult.
Know where your cloud lives
Organizations need to understand the impact that cloud adoption has on their core processes. There is a risk that they will lose control of their own digital environment. To prevent this, Digital Sovereignty must be a priority in their IT strategy. Questions such as: In which country is the (parent) company based? and What technologies do these companies rely on, and could disruptions there impact our business? are questions you need to ask.
No, this doesn’t mean you should steer clear of the “Big 3” cloud providers (AWS, Azure, GCP). Data centers in Europe are still subject to European regulations, and while there are European alternatives, they are often less feature-rich. Still, depending on your needs, European providers such as OVH Cloud, IONOS, or Scaleway can be interesting alternatives. Adopting a multi- or hybrid-cloud strategy can help mitigate the risks highlighted by Digital Sovereignty.
So many clouds
But doesn’t adopting multiple clouds actually make things more complex? Well… you have a point there. Given the skills shortage I mentioned in the introduction, a multicloud strategy doesn’t directly help with that. However, this added complexity can be mitigated by choosing the right architecture, practices, and technologies. There are countless good resources available on multi-cloud architectures, such as documentation, blogs, books, and research.
When implementing a multi-cloud strategy to mitigate risks related to digital sovereignty, it’s important to have a clear understanding of your current workloads. Which cloud providers best suit your needs? What architecture are you currently using, and how can you adapt it to a multi-cloud environment? Understand the types of workloads you’re running, how data needs to be processed (in transit and at rest), what response times are required (in transit and at rest), and verify whether cloud providers can meet these requirements.
Picking one of the big 3 in combination with a European cloud provider such as Scaleway would help mitigate risks related to having your entire workload running at a single cloud provider. It prevents vendor lock-in. For example, N-tier or microservice architectures can typically be mapped on a multi-cloud setup very well, especially when using the correct practices and tools. I am not going to start a lecture about these practices (it will take me several blogs to do that); there are many sources out there related to DevOps, DevSecOps, and Platform Engineering. This can be daunting, understanding your company’s architecture and core business applications, how these can be mapped onto the cloud, and getting the right help to adopt the practices as mentioned earlier correctly requires (different) skills.
A good tool improves the way you geek
I already mentioned something about the IT landscape being large with a growing set of disciplines. In addition to disciplines, there are many tools out there to support these different disciplines. Assuming proper Dev(Sec)Ops/Platform Engineering practices are adopted, there are many tools available that can help. As a side note, there are many European solution providers available; an interesting starting place to take a look would be here. Picking the right tools can help mitigate risks related to both skills and complexity. Typically, I like to suggest open source tools for many of the DevOps practices.
There are countless open-source tools available (and engineers often appreciate it when companies choose to use them). IaC and CaC tools that can handle heterogeneity—such as Pulumi, Terraform/OpenTofu, Ansible, Puppet, or Chef—support a multicloud strategy. For SCM and CI/CD, there are tools like Apache Allura, Gitea, or GitLab (I’m a fan of GitLab, though some features require a license). For containerized workloads—especially with cloud native design patterns—the Cloud Native Computing Foundation (CNCF) offers a good overview. The use cases for these tools are already well explained there.
From my perspective, you want to automate a typical DTAP setup as much as possible with tools that provide as much flexibility as possible (limit/prevent vendor lock-in). Avoid not-invented-here (NIH) tooling and focus on open-source or European tool stacks that help limit some of the risks related to Digital Sovereignty. Finally, consider tools that increase the chance of finding skilled engineers who know how to use those tools. Picking the correct tools for your company’s environment requires knowledge, which requires vision and a good understanding of your company’s environment.
rm -rf /
When adopting the cloud, it has always been important to know where data is located—during transmission, storage, and processing—partly for compliance and security reasons. Many cloud providers offer storage by country or continent, but countries often expect (sensitive) data to be handled in a specific way when you serve customers there. This also applies to business-sensitive data such as research or marketing information.
Let’s start with data at rest. For off-premises backups, encrypting data before storing it in the cloud is a good way to prevent data breaches during transit—using quantum-safe algorithms, of course. An on-premises or cloud HSM can be used for this purpose. Many cloud providers offer integration between your own HSM and their Key Management Services. AWS, for example, describes this process in detail here
This brings us to handling secrets (SSH keys, tokens, certificates, asymmetric key material, passwords, etc.). Secret management is an important topic, especially for managing data in cloud environments. Again, there are many cloud offerings for this; typically, they integrate very well within the Cloud that is offering the service. However, in a multi-cloud setup, this might require a bit more thinking. There are many (open source) solutions available that can help with this, such as HashiCorp Vault (although they did change their license in 2023) or OpenBao. There are additional topics to consider, such as certificate management for securing your data in transit. This could be done via Vault, but there are other open source alternatives, such as OpenXPKI or Dogtag.
Wait... there are consequences!
With the introduction of NIS2 in Europe in 2023, inadequate cybersecurity could have serious consequences. In the Netherlands, implementation (the Dutch Cybersecurity Act) has been delayed, but noncompliance can result in fines or penalties. As mentioned earlier: take cybersecurity seriously in software development and infrastructure management. There must be processes and tools in place to support this. Governments provide resources for this purpose, such as guidelines, the basic cyber resilience scan, and best practices.
There are several important aspects to consider, some of which have already been mentioned, such as data security, and some are mentioned in the links of the previous paragraphs. In terms of prevention, the implementation of benchmarks/guides provided by organisations such as the Center for Internet Security (CIS) or the DoD is typically good practice for hardening your infrastructure. Benchmarks and guides such as CIS or Security Technical Implementation Guides (STIGs) for operating systems, network equipment, web servers, cloud, and much more are provided by these organizations. There are many tools available that allow (automated) scanning to verify that the expected configuration is in place. For CIS or STIG, this can be done with tools such as OpenVAS, OpenSCAP, or Nessus.
In addition to infrastructure scans, this includes linting, code reviews, SAST, and pre-production auditing. IDEs often support linters, and through VCS integrations, SAST and auditing tools can be incorporated into the build pipeline. Cloud providers also offer auditing tools such as AWS Audit Manager or Microsoft Defender for Cloud. No matter what environment you have, centralized logging and auditing are essential requirements, and you should always store audit logs in an immutable format.
Clouds typically provide auditing tools that allow scanning of resources in the cloud, think of AWS Audit Manager or Microsoft Defender for Cloud. These tools can provide integration of benchmarks from CIS or STIG. Always set up some kind of centralized logging and auditing regardless of the type of environment, albeit on-premises, hybrid, single, or multi-cloud. And always store audit logs in an immutable location. So far, I have hinted at a couple of practices, but there are many more, such as IAM, cyber incident management and awareness training, all mentioned as part of the NIS2 regulations. From my perspective, these items are typically overlooked, poorly adopted, and poorly implemented. This can create significant risks to your company, but also but also to the digital sovereignty of your nation and Europe. With the introduction of NIS2, in addition to the security risks for your company, there can also be legal consequences for not properly addressing cybersecurity.
The council of three (or maybe four, but we need ‘n / 2 + 1’ for majority)
How can we simplify this? I’ve discussed multi-cloud, architectures, tools, data processing, and cybersecurity—it seems like you need a jack-of-all-trades. But there’s no such thing. That’s why a few key roles are necessary.
A person who can properly translate the company’s mission and vision into an IT strategy for the company, typically a CTO. The person responsible for this role should have some technical knowledge and a general understanding of technologies and domains within the IT landscape. More important is the understanding of the domain(s) the company is operating in and how IT solutions can help in that domain. The person who determines the IT strategy is the one who can be the driving or limiting force for your company.
Second: a solutions architect who translates strategic goals into an appropriate architecture. If you understand how business services map to software and infrastructure, you’ll make better choices—whether on-premises or in the (multi- or hybrid) cloud.
Together, these roles determine what expertise is needed—whether internal or external. For example, a cloud engineer can determine which cloud strategy is appropriate and which tools and practices are needed. This also helps in making choices between SaaS, PaaS, and IaaS, and between closed-source and open-source solutions.
Finally, there will always be an initial investment to update, upgrade, or migrate a company’s environment. But when done correctly, the number of hours to maintain a properly set-up environment will be significantly less than the initial investment of creating the environment. Especially when the people with the right skills were involved in the beginning, that do consider the scalability of the environment, the extensibility of the environment based on possible future needs, and security, you know that thing called vision.
Summary of all the above
Data, technologies, competence/knowledge, (cyber) security all require thought when considering Digital Sovereignty. In this blog, I attempted to highlight some technologies, architectures, and practices to consider when addressing these aspects. Some of my colleagues, when reading this blog, will tell me about the many topics I did not address, or could have a blog of their own. They would be correct, and they probably should (maybe they can help with this (insert evil laugh)). My goal was to address some of the nuances to consider when defining your company’s IT strategy, when putting on Digital Sovereignty ‘glasses’.
It’s not easy, but it’s necessary to work safely and comply with regulations. At SUE, we’ve developed Multistax, a tool that addresses many of these challenges. We also have consultants who can help with architecture, onboarding, and the transition to multi-cloud. Feel free to contact us to schedule a conversation!
To learn how SUE secures cloud environments, visit the Cloud Security page. The Cloud Security Guide explains how to set up and maintain a secure cloud environment.
