Strengthening Digital Sovereignty Through Multi-Cloud

In the context of digital sovereignty, German government organizations face three main challenges. To discover the first challenge, it is often enough to take the stairs in the office building and go to the basement. Because that's where it is - your own data center. In this data center, various historically grown legacy systems are operated, which still fulfill their tasks but often no longer correspond to the current state of the art regarding development, operation, and innovation. In addition, IT-related processes are usually characterized by the rigid and hierarchical working methods of a German administration. This way of working did not come about by chance but resulted from two other key challenges that those responsible must face.

The next challenge concerns data protection. If data is outsourced to the cloud, it is no longer managed by the company's own operations team, but by external service providers. Many decision-makers, therefore, prefer to take the safer route and store and manage data on their own hard drives in their own data centers. This prioritizes control over potential performance. Knowing exactly which machine the software is running on and who is operating the data center provides almost unparalleled control.

Furthermore, respect for geopolitical dependencies is sometimes very pronounced. Many decision-makers are concerned about dependencies on companies that do not come from Germany or the EU. After all, there is no guarantee that a hyperscaler will still provide its services in ten years. In addition to data protection, opaque value chains also play a role here.

If we look at these three challenges from the perspective of digital sovereignty, it becomes clear that a balance must always be struck between performance and control. An in-house data center offers a certain level of performance and a high degree of control in the short term. However, when we consider the procurement periods during the AI boom and the innovative capacity of administrative processes, it becomes clear that the in-house data center is reaching the limits of its capacity.

The multi-cloud or hybrid strategy is a promising alternative that makes it possible to continue using your own data center and use existing resources efficiently. As part of this strategy, organizations try to use their own data center and cloud services in an integrated and strategic way. In practice, existing in-house data center capacities are supplemented by the modern and innovative offerings of Private, community, or public clouds, such as Microsoft Azure, AWS, Google Cloud, or Delos Cloud.

A service portfolio is created that offers the right level of performance and control for every application. This allows you to decide during the system development process whether you need the high level of control of your own data center or the higher performance of the cloud provider.

The successful implementation of a multi-cloud strategy requires the establishment of comprehensive governance. This governance provides a technology-neutral framework that is applied to the various platforms. Typical components of governance include:

On the basis of good governance, administrations provide their cloud architects with a great toolbox. Your employees will select the necessary tools to implement solutions at the appropriate level of sovereignty.

The following process has been established:

1. Specify risk scenarios>
   At the beginning of system development, the exact sovereignty risks should be identified in order to integrate them as requirements into the development process. A particular focus should be placed on coordinating the control requirements in order to ensure the transparency, efficiency and flexibility of the system.
2. Identify data and applications>
   The business requirements implemented and the data used often specify a minimum level of data protection, IT security and sovereignty. Identifying these helps to find the right platform for the components. These findings are used as a framework for the implementation process.
3. Designing architectures
   The results of the first two steps are taken into account in the design of the target system. Both the available platforms and the services available on them can be used to create an efficient solution. A solution design can focus on one platform or leverage various advantages in an interoperable design.
4. Implementation>
   Thanks to established governance and the use of known software development processes, developers and architects can implement applications independently and efficiently. An essential aspect of this phase is the use of standards both on the platforms and in the workloads, as well as best practices from the industry and the technologies.
5. Testing
   Both the set framework conditions and the defined non-functional requirements for the system can be tested. This helps to certify the sovereignty of a new application before release.

Based on the developed and established governance, targeted solutions can then be developed.

First scenario: Modern web interface and secure data management in a multi-cloud environment

In the first scenario, we have sensitive data that is queried with large load peaks. The aim is to provide users with a modern web interface that is constantly being developed to create a modern user experience. The first step is to focus on the application for data sovereignty. In particular, this involves the data "at rest" - i.e., the persistence level. These are the "gold nuggets" of the application. They are also subject to specific legal requirements that make storage in the public cloud impossible. However, the application displaying the data should be cost-efficiently scalable due to the load peaks. Furthermore, the interface will be specifically rolled out and tested via canary tests. The advantages of the multi-cloud approach are used in the architecture design of the application to develop a target-oriented solution. The high-security features of the on-premise data center are used to store the data. Thanks to governance, the interoperability of the data center with the public cloud has already been defined and implemented. To meet the scalability and testability requirements of the interface, the decision was made to use serverless applications and static websites in the public cloud. The database administrators and software developers can rely on their established processes during implementation and testing.

Second scenario: Optimizing operating costs by using the public cloud

In the second scenario, an application that maps a support process but has many users is to be modernized. The focus of the target architecture is on low operating costs. Savings are to be made at the personnel cost level in particular. The data classification shows that the data is not particularly sensitive and can also be processed in the public cloud. When designing the architecture, the decision is made to focus entirely on the performance of the public cloud during operation. However, to not become completely dependent on the public cloud, the decision is made to organize the application's data backup in the company's own data center. The technicians involved can rely on the established processes in the implementation phase, particularly during platform integration and testing.