GCHQ to Host Classified Material on Amazon Cloud?

[Al Gorithum]

https://www.theguardian.com/uk-news/2021/oct/26/am...

We already know that Priti Patel is a wrong un, but WTAF? Can't see any good coming from this. Can you?

[mwstewart]

AWS itself is certified to store US Department of Defence data, which includes classified data. It's a very secure environment within the boundaries of their service offering and responsibilities. The issues are always with the customer architecture, security, and processes.

In terms of sovereignty, US is an ally so I can't see an issue from a business perspective. The other point relating to sovereignty would be data residency, and AWS has a London region (data centre) which presumably is the location our government would choose.

I think that the Guardian is a little bit uninformed.

[buggalugs]

Doesn't automatically mean that the most sensitive data will be stored there. Also if it's encrypted before being stored then Jeff Bezos isn't getting hold of anything anyway. There might be an issue of availability - shutting off access for whatever reason might come up in the future.

[eharding]

mwstewart said:

The other point relating to sovereignty would be data residency, and AWS has a London region (data centre) which presumably is the location our government would choose.

Might cause a bit of chuntering amongst the usual suspects when they find out GCHQ's AWS assets are deployed in something designated "eu-west-2" though.

[mwstewart]

eharding said:

mwstewart said:

The other point relating to sovereignty would be data residency, and AWS has a London region (data centre) which presumably is the location our government would choose.

Might cause a bit of chuntering amongst the usual suspects when they find out GCHQ's AWS assets are deployed in something designated "eu-west-2" though.

Future headline right there

[rxe]

mwstewart said:

AWS itself is certified to store US Department of Defence data, which includes classified data. It's a very secure environment within the boundaries of their service offering and responsibilities. The issues are always with the customer architecture, security, and processes.

In terms of sovereignty, US is an ally so I can't see an issue from a business perspective. The other point relating to sovereignty would be data residency, and AWS has a London region (data centre) which presumably is the location our government would choose.

I think that the Guardian is a little bit uninformed.

I’d trust AWS infrastructure security over something home rolled any day, both from a basic security perspective and availability. Clearly over the top of whatever data centre you use, you can overlay poor practice, so that bit is irrelevant. I’m working in CNI right now (clearly not on the machine I’m using to type this…..), and trust me, AWS would be safer, cheaper and easier.

[bigandclever]

I suppose they could've used a UK cloud company with similar scale and performance and whatnot, apart from the obvious that there aren't any.

[Byker28i]

mwstewart said:

and AWS has a London region (data centre) which presumably is the location our government would choose.

Yate, Chipping Sodbury, Bristol...probably

[Byker28i]

bigandclever said:

I suppose they could've used a UK cloud company with similar scale and performance and whatnot, apart from the obvious that there aren't any.

There are - crown hosting for one

[arfur]

Byker28i said:

bigandclever said:

I suppose they could've used a UK cloud company with similar scale and performance and whatnot, apart from the obvious that there aren't any.

There are - crown hosting for one

If you are referring to stuff near MK? Been there, done that - useless, utterly useless

[rxe]

Byker28i said:

There are - crown hosting for one

Crown Hosting != AWS. :-)

[arfur]

rxe said:

Byker28i said:

There are - crown hosting for one

Crown Hosting != AWS. :-)

Not in the same league ... still just tin/string in some sites

The only reason some Govt depts use them is that there is no VAT (if not reclaimable). They usually regret it eventually

[h0b0]

arfur said:

rxe said:

Byker28i said:

There are - crown hosting for one

Crown Hosting != AWS. :-)

Not in the same league ... still just tin/string in some sites

The only reason some Govt depts use them is that there is no VAT (if not reclaimable). They usually regret it eventually

Crown hosting is not a cloud vendor. The UK Government use them as a colo and specifically because they are not cloud.

here it is from the horse's mouth

[bigandclever]

Byker28i said:

bigandclever said:

I suppose they could've used a UK cloud company with similar scale and performance and whatnot, apart from the obvious that there aren't any.

There are - crown hosting for one

Yeah ... no

[AngryPartsBloke]

Al Gorithum said:

https://www.theguardian.com/uk-news/2021/oct/26/am...

We already know that Priti Patel is a wrong un, but WTAF? Can't see any good coming from this. Can you?

What is the actually issue or concern you have using AWS?

[h0b0]

h0b0 said:

arfur said:

rxe said:

Byker28i said:

There are - crown hosting for one

Crown Hosting != AWS. :-)

Not in the same league ... still just tin/string in some sites

The only reason some Govt depts use them is that there is no VAT (if not reclaimable). They usually regret it eventually

Crown hosting is not a cloud vendor. The UK Government use them as a colo and specifically because they are not cloud.

here it is from the horse's mouth

I am starting to wonder if I just earned a whoosh parrot.

Full transparency, I am in the cloud industry....

I hear many times people saying "Cloud is someone else's data center". That is a misconception which can be propagated by people using GCP/AWS as a colo. The cloud vendors see people exhibiting this behaviour as a failure and try to assist them in using the advantages of cloud and not just checking a box. This is not due to the cloud vendors being evil, (they may still be evil but not for this reason) it is because anyone using a cloud vendor as a colo is going to complain loudly and not save much money.

[Al Gorithum]

AngryPartsBloke said:

What is the actually issue or concern you have using AWS?

I don't know anything about IT except for being able to turn a PC on and off, so to me it seemed like a very strange thing - especially with Patel being involved.

From the comments of my learned-chums here, it seems I'm wrong. I hope!

[arfur]

Al Gorithum said:

AngryPartsBloke said:

What is the actually issue or concern you have using AWS?

I don't know anything about IT except for being able to turn a PC on and off, so to me it seemed like a very strange thing - especially with Patel being involved.

From the comments of my learned-chums here, it seems I'm wrong. I hope!

AWS are the flavour of the month/year/decade right now in Central Govt - many many old services are being modernised and moved/refactored/redesigned etc over into AWS clouds. As mentioned earlier in the thread AWS are already there in DoD world and even competing (again) with MS for Pentagon stuff.

As I work a lot with AWS I may have a biased view, but I'd trust them way above any Cab Office Govt provided services or localised colo on prem stuff that lurks around C LDN and under the flight path for LHR. A lot of that is moving too ... again to AWS. The previous flavour of the 1/2 decade was UKCloud, but that's now going by the wayside and a lot of exiting is currently in flight.

[Al Gorithum]

arfur said:

Al Gorithum said:

AngryPartsBloke said:

What is the actually issue or concern you have using AWS?

I don't know anything about IT except for being able to turn a PC on and off, so to me it seemed like a very strange thing - especially with Patel being involved.

From the comments of my learned-chums here, it seems I'm wrong. I hope!

AWS are the flavour of the month/year/decade right now in Central Govt - many many old services are being modernised and moved/refactored/redesigned etc over into AWS clouds. As mentioned earlier in the thread AWS are already there in DoD world and even competing (again) with MS for Pentagon stuff.

As I work a lot with AWS I may have a biased view, but I'd trust them way above any Cab Office Govt provided services or localised colo on prem stuff that lurks around C LDN and under the flight path for LHR. A lot of that is moving too ... again to AWS. The previous flavour of the 1/2 decade was UKCloud, but that's now going by the wayside and a lot of exiting is currently in flight.

Thanks Arfur. I appreciate you taking the time to explain

[h0b0]

It is worth saying again that any risk to data will still be held by the developers at GCHQ. AWS etc protect the infra layer but not the application layer. If someone leaves a big hole in their app then there is nothing AWS can do about it.