Keep your feet on the ground: will Russia get a GovCloud?

Back down to earth

No matter how impressive and advanced a service may be, especially a global one, there are many reasons to think carefully before putting your corporate data into it. Here, it is worth noting an interesting feature of our IT market. In our country, the leaders in digital services and the adoption of advanced technologies, such as biometrics and the use of AI in customer service and decision-making, are mainly professional participants in the financial market, particularly banks. An important distinction is that banks are also the most conservative when it comes to information security and, consequently, opening up their infrastructure and being willing to make extensive use of cloud services. Their data is valuable because it is of enormous interest not only to the banks themselves but also to their customers. Would you entrust your savings to a bank if you knew that its accounting system was located in another country and managed by an outside private company?

We must acknowledge that banks' information security teams work to prevent data leaks and ensure that information in production systems is accessible only to authorized employees. They use a wide range of measures to control data leakage: systems that monitor and record the actions of users and customers, regular vulnerability testing of information systems, and the development of security threat models and ways to counter those threats. But what happened with the arrival of cloud computing and services? In most cases, security departments give a firm no when asked whether production information systems can be hosted in the cloud.

To some extent, this is entirely justified. It is not yet clear how to manage such risks, and even the potential threat model is poorly defined. The situation is further complicated by the fact that the shared responsibility model for cloud services changes depending on the specific service and how it is delivered. For example, you can use databases hosted on servers that you configure yourself and then place in the cloud, or you can use services fully managed by the provider. Responsibilities and risks will be allocated differently.

Hybrid infrastructures to the rescue

Hybrid systems, or hybrid clouds, have emerged as one way to balance information security risks. The model is fairly simple: to speed up development, you move outside the corporate perimeter only those systems that contain no real data or are less critical to the core business, while the principal and most important systems remain entirely under the company's control. This approach allows you to benefit from cloud services during development and testing while retaining full control over your own infrastructure and integrating the two closely. However, a number of other problems arise.

Cloud services evolve and change rapidly, so you cannot expect that, once adopted, this approach to building infrastructure will continue to meet business needs for any substantial length of time.

The cloud infrastructures of leading providers have long included development tools (IDEs), automated deployment tools (CI/CD), and serverless technologies that cannot simply be brought inside the corporate perimeter. Doing so requires considerable effort from IT departments and substantial financial investment.

Kubernetes and Docker have solved some of the problems

Applications delivered in Docker containers and infrastructures built on Kubernetes have solved an entire set of problems that IT professionals have faced for years. We can now deliver ready-to-use containers for deployment both in cloud infrastructure and within a company's own perimeter, ensuring a high level of compatibility between software components. This is an excellent solution when starting a new project or implementing new functionality.

Today, the requirements for almost any project include implementing a solution with a microservices architecture and a high degree of flexibility and manageability. This process will lead us toward next-generation infrastructures with features such as automatic recovery from failures, automatic scaling under heavy load, infrastructure as code, and other advantages. Without them, in three to five years your infrastructure may well become outdated and stop meeting business needs.

Neither using hybrid cloud structures nor adding containerization will solve every problem. First, the main advantage of cloud infrastructure is computing capacity on demand. For example, you might acquire tens of thousands of new customers or need to process benefit payments for several hundred thousand people. In a true cloud, this presents no problem: the provider allocates resources at your request or automatically, and you pay only for the time they are actually used. In a hybrid cloud, if your production systems are configured to scale, you must at least have the necessary resources available. In other words, you keep those resources for a rainy day, and when that day is over, you continue to keep them.

Second, a number of large information systems, such as the core banking system, internal analytics systems, regulatory reporting subsystems, and the like, do not lend themselves readily to containerization. These systems have been developed over several decades, so simply rewriting them would take roughly as long. At the same time, they remain fully operational and continue to evolve successfully, so this is not a near-term prospect.

There is always a way forward

What, then, could provide a compromise in this situation? The answer may already have been found: cloud infrastructures under trusted management. In AWS and Alibaba Cloud, these are services hosted in a separate area called GovCloud. This is a restricted part of the cloud infrastructure where special requirements apply to information storage and processing, among other things. Those requirements also apply to the participants connecting to the system. Thus, if a state-owned company wants to use cloud services, it connects to the system and pays for computing resources according to the applicable rates. If a software development company wants to work for that customer, it also connects to the cloud, but must meet a set of criteria. This creates a relatively trusted environment for collaboration and service delivery. It is similar to the PCI DSS standard used in payment infrastructure.

Another incentive to move toward infrastructures under trusted management, at least in the financial sector, could be the interaction between companies and regulators. The Central Bank has long struggled with the lack of transparency into what happens within banks' information systems. Oversight relies on a vast amount of regulatory reporting prepared by the banks themselves, and discrepancies with the actual situation in their accounting systems are possible. Cases of information being "lost," for example when a bank's license is revoked, or manipulated in various ways are also widely known.

A few years ago, there was even discussion of transferring copies of all the data in banks' accounting systems to the Central Bank to prevent this possibility. Later, once it became clear what would be required to bring those systems up and running if necessary, the idea was abandoned. From this, we can conclude that using infrastructure under trusted management could not only help minimize companies' risks but also increase transparency and reduce risks for regulators.

In my view, infrastructures under trusted management, such as GovCloud and a number of other, more closed systems, solve most of the problems currently preventing large state-owned companies and banks from making active use of these new opportunities.

What should you do if such services are not yet available in Russia? Most likely, you should prepare for their arrival. Explore how you could make broader use of cloud services within your infrastructure and learn to manage information security risks under the new paradigm. First, experience shows that most good approaches and ideas eventually reach us and are implemented. Second, you should certainly not try to build similar cloud platforms inside your company. That is an expensive and inefficient undertaking. Third, if you are now developing your vision and strategy for cloud infrastructure, make sure you avoid being tied to a particular service provider.

Doing this on your own is not always easy, so try to find a qualified, independent partner, seek advice, and draw up an action plan. R-Style Softlab can be that partner for you. We have worked in banking automation for more than 25 years and continue to help our customers operate amid rapid, large-scale changes in the IT industry and the banking sector.