Friday, 03 July 2020 10:24

Cloud firm chief says new method for awarding Protected cloud contracts much better

By
Phil Dawson: "Besides being historically outdated by purpose and structure, the former process did not adequately assist with understanding or managing risk within its agency context." Phil Dawson: "Besides being historically outdated by purpose and structure, the former process did not adequately assist with understanding or managing risk within its agency context." Supplied

The head of an Australian cloud company says the new arrangement for awarding contracts for hosting of top-secret government data have advantages over the older one where there was a fixed list of companies certified by the Australian Signals Directorate who could cast their hat in the ring and tout for business.

Phil Dawson, the managing director and co-founder of AUCloud, told iTWire in response to queries that while the ASD was perfectly well qualified to decide on which company met the criteria and which did not, it was not exactly practical for the agency to be involved thus.

"Should they make every risk-based decision on behalf of all government agencies?" he asked. "Of course not, and this is why the basis of the Protective Security Policy Framework and the Information Security Manual is that, ultimately, each agency is responsible for risk and cannot abrogate their responsibility in terms of risk assessment and risk mitigation."

He said as he saw it, the role of the ASD — along with the Attorney-General's Department and the Digital Transformation Agency — was to set the framework while agencies had to execute it with full and far better knowledge of their own requirements and risk profiles.

"However, it is clear that many — too many — agencies were abdicating their responsibilities based on what the ASD had provided as a moment-in-time badge and the inevitable rose-tinted positioning of vendors, without full consideration of their context," Dawson added. "Besides being historically outdated by purpose and structure, the former process did not adequately assist with understanding or managing risk within its agency context."

The jettisoning of the certification process was announced by the ASD in March and thus those who had been given the label Protected held it until the end of June. The decision was taken after a review that began in July 2019.

Dawson, who was the co-founder and chief executive of UKCloud, the fastest growing technology company in the UK between 2012 and 2015 and the leading provider of infrastructure-as-a-service to the British Government, expanded further on these themes, saying that a badge based on a moment-in-time accreditation, as in the UK, was always going to be abused by vendor marketing.

"Witness the behaviour of some global providers who gloss over the catalogue of risk mitigation controls that agencies should be considering when deploying Protected data on their infrastructure," he commented. "It was also going to facilitate inappropriate risk management decision making by individual agencies."

Apart from these factors, Dawson said the old process was outdated and not scalable in terms of both process (unable to support volume and dynamic nature of market) and appropriate risk management by individual agencies.

"This was further exacerbated by a lack of clear distinction between infrastructure-as-a-service and platform-as-a-service, for which there are a small number of providers, and software-as-a-service, where there are thousands," he pointed out. "Also, the process had not and was unlikely to mature to a sustainable model for the reasons outlined – for example, there was limited consideration as to the implications of re-accreditation, failure or even success in relation to risk."

Dawson said the process was also not fit for purpose in terms of the maturity of digital technology – "the changing nature of cloud and movement towards digital and cloud native when compared with the Information Security Manual controls that were almost exclusively about the physical environment (pages on cable colour management) and nothing on automation and secure application development practices".

He said since its inception, the value of "data" had been better understood in respect of there being multiple forms — customer data, customer account data, metadata, monitoring data, analytics data — all presenting a security and privacy risk. Previous definitions and controls ignored this and, consequently, differing approaches were taken to the risk associated with different data types floating around the world.

Finally, he said, the vulnerabilities of extra-territorial jurisdiction positions adopted by certain governments in relation to the "value" of data and their accessibility to it were also now better recognised. As an example, he said this was especially called out during the development of the COVIDSafe app, where the Federal Government passed specific legislation to attempt to negate (unsuccessfully, in his view) this risk.

Regarding recent controversies about the awarding of cloud contracts to American companies like Microsoft and AWS in preference to the local lot, Dawson said there was a difference in the types of contracts which should be noted.

"I recall that I was referring to the difference between the COVIDSafe app decision and the announcement that Defence was proposing to deploy their SAP workloads on Microsoft Azure," he clarified.

"My view of the COVIDSafe app development is that many, many good practices and decisions were made in an environment where 'time' was, for once, a genuine consideration in the overall value placed on the decision.

"In addition, for almost the first time in the public domain, the importance of privacy was considered as the critical part of the design process: a detailed privacy assessment was undertaken and made public alongside specific legislation to overcome the potential risk of extra-territorial jurisdiction. Sadly, not as much attention was paid upfront to the consequences of the hosting decision."

He said with regard to the SAP project, he doubted whether "time" was a serious factor in decision-making. "Consequently, it would seem strange that the underlying infrastructure-as-a-service decision has been made with little or no transparency," he said. "I’m sure that AUCloud, along with a number of sovereign cloud providers, could have worked with our global infrastructure vendors like Cisco and VMware to use their reference architectures for Hana database to provide a competitive alternative.

"Ultimately, competition is enhanced through transparency and, through basic economics, not only drives a better price point, but also access to a wider innovation pool. In the first example, despite the urgency, considerable transparency was applied to many aspects of the development and procurement. I’ll leave you to decide how the second example matches up."

Dawson has a whole list of credentials, apart from starting and running the two companies mentioned earlier. He has also been a board member of TechUK, a member of the UK Information Economy Council and co-author of the UK Data Capability Strategy before moving to Australia for one of his biggest professional challenges to date; launching AUCloud to deliver sovereign cloud services to support Australian Government and Critical National Industries.

"Replicating previous activities hasn't been easy. However, with a deep-seated belief that if you deliver price-competitive services on an 'apples-for-apples' basis and reduce the risks to data for your customers, through enhanced security and automation, success will then follow," he averred.

"In doing so [one is] creating jobs, paying taxes and supporting worthy charitable causes, but this time Australian jobs, Australian, taxes and Australian charities.

"I'm currently a member of the AIIA's Federal/ACT Council and have played an active role in both ASD's Cloud Security Forum and a PM&C's Digital Task Force. I am passionate about the role and contribution that SMEs/Scale-ups can make within the digital economy in delivering innovation, social value, sovereign resilience and above all better products and services than large, unwieldy multinational corporations whose self-interest is headquartered elsewhere in the world."

Asked about a recent report that said multinational companies were dominating the Australian hyperscale cloud market, Dawson again clarified that the market itself was not hyperscale, merely the companies that were global in their operating models.

"The reason global operating models are predominating is for three reasons," he said. "Economies of scale on the supply side: build it big and reduce the unit costs; economies of scale on the demand side: aggregate customer volatility, improve asset utilisation and reduce the unit costs; and automation: use technology to manage technology to improve quality, enhance agility, increase security and reduce the unit costs."

But he said foreign solutions — what he called Made in California/Shanghai models — had an inherent weakness when localisation — security, privacy, service — considerations came into play.

"To date, relatively few workloads have moved to cloud compared with sub-optimal on-premise solutions. However, as they do, more cloud consumers will become uncomfortably familiar not only with the privacy and security implications of their global provider choices, but also with the painful realisation of switching costs. Governments will also realise that tax, jobs and sovereignty are risks that they cannot ignore or outsource.

"In addition to this, development of local competition requires a more transparent marketplace so that buyer decisions can be understood and scrutinised, innovations can come to the fore and investors can double down on the successful models."

He commented that following the lead of the NSW Government, the Federal Government was starting to move towards a more transparent marketplace for cloud services and - "hopefully" - with more understanding and awareness, government agencies and Australian enterprises would see the value in buying from some of the many sovereign IaaS, PaaS and SaaS providers. In doing so they would be enhancing sovereign resilience.

During an initial email exchange, Dawson pointed to two government procurements and said they highlighted the impact of how agencies specified their functional needs to the market and influenced — or distorted, depending on one's perspective — the potential supplier-based and related competition/innovation.

He was more than willing to elaborate on that, saying the first example — a procurement for the Department of Agriculture, Water and Environment — provided a detailed, functional description of their need.

"It was very comprehensive and involved a new mission critical biosecurity application that interfaces through APIs with many other high-security applications across other government agencies," Dawson said.

"I liken this to buying a car and deciding that you need one with four wheels, petrol engine, manual transmission, five doors and some safety features - all good so far for competition – but then mandating that the engine has to be provided by Company M. In a stroke, you have limited competition and innovation. Prepare to pay more and get less."

With regard to the second procurement notice — from the Department of Health — Dawson said this was for a similar mission-critical application for reporting notifiable diseases. "Probably less complex and not as scalable, but nevertheless similar in nature. The spec for this was equally good but left the engine open to all manufacturers," was his comment.

He said his intuition was that the first one would receive fewer bids with higher costs, less innovation and longer lead times than the second, which would also be more encouraging of new entrants to the Federal Government market.

"The remedy is keeping bid lists transparent, open to anyone who has cleared the basic hurdles of the cloud marketplace, and avoiding restrictive specification that pander to your legacy switching costs," he said. "Continuing the status quo will not bring about a transformative, service-oriented, technically-enabled society."


Subscribe to Newsletter here

NEW OFFER - ITWIRE LAUNCHES PROMOTIONAL NEWS & CONTENT

Recently iTWire remodelled and relaunched how we approach "Sponsored Content" and this is now referred to as "Promotional News and Content”.

This repositioning of our promotional stories has come about due to customer focus groups and their feedback from PR firms, bloggers and advertising firms.

Your Promotional story will be prominently displayed on the Home Page.

We will also provide you with a second post that will be displayed on every page on the right hand side for at least 6 weeks and also it will appear for 4 weeks in the newsletter every day that goes to 75,000 readers twice daily.

POST YOUR NEWS ON ITWIRE NOW!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

These days our customers Advertising & Marketing campaigns are mainly focussed on Webinars.

If you wish to promote a Webinar we recommend at least a 2 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://www.itwire.com/itwire-update.html and Promotional News & Editorial.

For covid-19 assistance we have extended terms, a Webinar Business Booster Pack and other supportive programs.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!

BACK TO HOME PAGE
Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

BACK TO HOME PAGE

ZOOM WEBINARS & ONLINE EVENTS

GUEST ARTICLES

VENDOR NEWS

Guest Opinion

Guest Interviews

Guest Reviews

Guest Research & Case Studies

Channel News

Comments