To understand how vital cloud sovereignty is in the cloud computing environment, let’s look into some of the data breaches that happened in the past.
#1. Epsilon Email Breach
On March 30th, 2011, an unforgettable thing happened where data security had gone terribly wrong at Epsilon, one of the largest providers of email marketing services. Epsilon does email marketing for over 2500 companies, some of which are Fortune 500. The aftermath of what had happened began to be felt in early April. Customers of many Fortune 500 companies started complaining that they were receiving spam and phishing emails on email addresses they had given to the fortune 500 companies. On April 2nd, Epsilon came clean on what had happened. On March 30th, 2011, Epsilon detected an unauthorized entry to their email system. There had been a data breach, and over 40 million customer names and email addresses of the clients of a set of companies Epsilon served were stolen. This data breach alone resulted in damages of about $4 billion. Epsilon’s case is not unique. Countless companies have suffered costly breaches that result in confidential data getting into the wrong hands. Now imagine what would happen if there’s a breach of medical, financial, or military information. That is a scenario that adopters of cloud computing constantly have to think about. A key concern for many organizations, due to the cost and impact of data breaches, is the security and transparency of their cloud providers.
#2. NSA Prism Program Incident
Another key event that spooked organizations using cloud computing was the Prism program incident. In 2013, it was revealed that the United States National Security Agency (NSA), through a program called Prism, had direct access to user data held by leading internet companies such as Microsoft, Yahoo, Google, Facebook, and Apple. Remember, some of these companies are leading cloud solution providers. The Prism incident brought people to the reality that there is no cloud. What people refer to as the cloud are just data centers that are not immune to regulations in the countries where they are located. If an organization is using cloud computing and their vendor’s data center is in a different country, unauthorized entities could access their data due to the laws of the country where their data is stored. As a result, more organizations now care about where their data is stored. To back this, Capgemini, a multinational information technology services and consulting company, published a report in July 2022 showing that 69% of organizations are concerned about exposure to extra-territorial laws in a cloud environment. Additionally, the report titled, the journey to cloud sovereignty showed that 66% of organizations globally and in the public sector consider local/regional data-center offerings of cloud vendors to be a key selection criterion. This is because more organizations care about the possibility of data access by foreign governments due to the location of their cloud vendor’s data centers. All these point to the need for Cloud Sovereignty to tap into a market that cares about its data security, where its data is stored, who has access to it, and varying data privacy laws. In Europe, in particular, companies are keen on cloud sovereignty due to the dominance of American cloud providers. In a worldwide CEO survey conducted by the International Data Corporation, 80% of European organizations consider digital sovereignty their highest priority.
What is Cloud Sovereignty?
Cloud Sovereignty builds upon the idea that a country or region has the right to regulate and oversee data storage, processing, and use within its borders. As a result, cloud sovereignty provides the benefits of cloud computing coupled with compliance with local data privacy and security laws. Additionally, it complies with the region’s cultural and societal values. A sovereign cloud ensures that data and metadata stay within the region or country where they are collected. It also ensures that data is protected from foreign access and that owners fully control it. As noted in the Journey to cloud sovereignty report, cloud sovereignty creates a cloud computing environment owned, deployed, governed, and managed locally or regionally within a single nation or jurisdiction.
How to Achieve Cloud Sovereignty?
For a cloud solution to achieve sovereignty, the following have to be in place:
Compliance with Local Data Privacy Laws
Many countries have laws governing the collection, processing, and use of their citizens’ data. Often these laws differ. For instance, Germany has a privacy act restricting data transfer to third countries even if the company processing the data is not located in Germany. Countries like China and Russia require that data be stored on servers within their countries. In Europe, the General Data Protection Regulation (GDPR) governs data protection and privacy and regulates data transfer outside the European Union. Therefore, the sovereign cloud must comply with data privacy laws in a particular region.
Data Sovereignty
To achieve data sovereignty, there needs to be data localization. To achieve this, data hosted in the cloud is stored and processed in a specific country or region, complying with local data privacy laws. Additionally, access to the data is limited to authorized personnel only, and the data owners have full control of the data stored in the cloud.
Control and Access to Data
A sovereign cloud should allow full regional control of how data gotten from them is stored, processed, and shared. Additionally, control and access to data could mean allowing regions to access data stored in data centers in the location and the ability to audit, inspect and require that data in data centers be stored and processed within their borders. A cloud achieves sovereignty by ensuring compliance with a region’s data privacy laws and regulations, data sovereignty, and providing control and access to data.
Why Cloud Vendors Should Offer Cloud Sovereignty to Their Clients
More organizations and countries are investing in cloud computing, and the industry will keep growing in the coming years. However, with this growth, cloud sovereignty will play a key role in selecting cloud solutions. The following are some of the reasons why cloud vendors should consider offering cloud sovereignty to their clients:
Address Customer Concerns: As cloud computing grows, so does the concern of organizations and countries regarding the security of their data, lack of control over data hosted on the cloud, and exposure to extra-territorial laws, which could mean access to sensitive data by unauthorized entities. All these concerns can be addressed by a cloud provider offering cloud sovereignty. Comply with Regulations: Different countries and regions have developed data privacy laws. Organizations moving their data and services to the cloud will want to comply with their region’s existing data privacy laws. As a result, cloud sovereignty will allow cloud vendors to offer solutions that enable organizations to benefit from cloud computing while still complying with their country’s data privacy. Adapt to Market Needs: According to the Capgemini report, over 66% of organizations globally consider a local or regional data center as a key selection criterion for a cloud solution. Therefore, cloud vendors need to offer cloud sovereignty to appeal to a large percentage of their market. Performance and Latency: By storing data in a cloud environment close to where the data sourced and used will improve performance and reduce latency. This benefits organizations and applications that need fast access to data, such as data analytics. Data Security and Control: Cloud sovereignty allows cloud vendors to better secure the data and privacy of their users by limiting the storage, processing, and sharing of privileged data to the country or region of origin. As a result, organizations are guaranteed full control and ownership of the data. They can avoid unauthorized access to their clients’ data due to varying territorial laws. Reduce Costs: By storing data close to its source and where it is used, cloud vendors can save on costs associated with data transfer. Additionally, by complying with regional regulations, vendors can avoid additional compliance costs from organizations that might want additional compliance measures. Finally, certain locations can offer lower storage and bandwidth costs for a vendor.
Cloud sovereignty is important to governments and organizations. Cloud sovereignty is necessary to comply with regulations in different countries and allow organizations to have full control, ownership, and security of their data.
Final Words
In the coming year, it is expected that cloud sovereignty will take center stage when it comes to selecting cloud vendors. Therefore, it is best that cloud vendors start offering cloud sovereignty to avoid being left behind, losing customers, and being on the wrong side of the law. Next, you can check out the cloud hosting platforms for startups to big organizations.
