This offering forms part of secunet cloud, the brand under which secunet bundles its cloud products. The infrastructure is hosted in secunet’s certified, high-security data centres in Germany. Whilst secunet handles the operation, updates and lifecycle management of the infrastructure – including the IT security components – the client retains full control and administrative rights over their own cloud instance at all times, thanks to a clear separation of roles. This allows a significant proportion of the client’s own classified data IT workload to be flexibly outsourced.
Until now, the SINA Cloud solution has been available exclusively for operation within a client’s own data centre. With this new service model, secunet is expanding its offering to include an option that significantly reduces the burden on clients when operating their classified data infrastructure and greatly simplifies the process of obtaining approval for classified information.
“Operating a classified-capable cloud ties up staff and resources that public authorities urgently need elsewhere. At the same time, IT systems for classified data must be continuously adapted to new technical and regulatory requirements. With SINA Cloud as a Service, we take on these tasks. The fact that a German federal authority has already opted for our service right from the start demonstrates just how great the need is. Our clients benefit from decades of experience in handling classified information and our expertise in cloud operations. This allows them to concentrate on their core tasks,” says Andreas Rückriegel, VP Cloud Services at secunet.
Securely hosted and classified information-compliant
SINA Cloud as a Service meets the requirements of Section 51 of the German Classified Information Directive (VSA) for external cloud infrastructures up to the ‘VS-NfD’ classification level, thereby enabling the legally compliant use of external cloud resources. secunet is currently the only provider of such a solution. The service is certified to ISO 27001 on the basis of IT-Grundschutz (IT baseline protection) and is GDPR-compliant. High-security cryptography based on proven SINA technology protects the data. secunet operates and monitors the infrastructure twenty-four hours a day and provides updates as well as ongoing compliance with regulatory requirements.
The division of responsibilities is clearly defined: secunet is responsible for the underlying infrastructure – from the physical data centres, through the cloud platform and the SINA security layer, to secure access. Clients retain full control and administration of their instance, as well as responsibility for their applications and end devices. Access to the cloud occurs via authorised SINA-secured end devices. This completely eliminates the need for clients to set up and operate their own data centre, which can be costly. Furthermore, resources can be scaled flexibly as workloads increase.
Faster approval for classified information
As IT security is already integrated into the product, the process leading to approval for classified information is significantly shortened for clients. secunet’s cloud experts support clients with their experience throughout the planning, testing and implementation phases. Public authorities can implement projects in the classified information environment more quickly and with less effort on their part. Typical use cases include collaboration and office applications – such as Nextcloud – which public authorities wish to use in a VS-NfD context, as well as the migration of specialist processes to the cloud.
Security-by-design based on open source
SINA Cloud combines a security layer comprising components that have been authorised for use by the German Federal Office for Information Security (BSI) with an orchestration layer based on established open-source technologies such as OpenStack and Kubernetes. Lifecycle management is handled by Yaook, whilst monitoring is carried out using tools such as Prometheus and Grafana. The architecture structurally separates security functions from cloud operations. This allows the scope of functionality to be continuously expanded and adapted to new requirements without affecting security functions or jeopardising the components’ authorisations for use. This represents a significant advantage over cloud platforms that have been retrofitted with security hardening. Thanks to cryptographic tenant separation, the platform processes data and applications from multiple clients in isolation on a shared, classified information compliant infrastructure. This enhances resource efficiency compared to dedicated, standalone solutions.
A portfolio for all security classifications
With secunet cloud, secunet offers secure and sovereign cloud solutions – from the public cloud to the classified cloud – all from a single source. For public authorities with their own classified information infrastructure, SINA Cloud remains available as an on-premises solution. Provided the client’s data centre has a suitably designed dedicated infrastructure, it is possible to implement the solution for processing classified information up to the German ‘GEHEIM’ (‘SECRET’) classification level. SINA Cloud can provide approved tenant separation there. Clients retain full control over data, zones and stages.
With its various operating models and classification limits, secunet cloud comprehensively meets the requirements of public sector clients for sovereign digitisation.
