Digital sovereignty guarantees data security in the public cloud

"Digital sovereignty, also known as cyber-sovereignty, is the application of the principles of sovereignty to information and communication technologies", Gwénaëlle continues.

In practice, digital sovereignty rests on three pillars:
1. Firstly, data sovereignty where customers decide who can access their data and who controls the encryption keys. The data is subject to the rules of its home jurisdiction, while the encryption solution prevents the cloud provider from accessing the data.

2. Secondly, operational sovereignty where the customer has transparency and control over the cloud provider's operations, knowing that the data is managed locally by local teams.

3. Last but not least, technological sovereignty which allows the solution to be disconnected from the cloud provider and the internet network.

"Digital sovereignty is important given that the major cloud providers are all from the US and the US Cloud Act of 2018 allows US intelligence services to access any customer's data by court order. Fortunately, Europe has responded with various data protection shields, such as Schrems II or GDPR, thereby demonstrating the real value of European data and allowing European organizations to protect themselves," Gwénaëlle explains.

What's more, the NIS2 (Network and Information Security) directive, which will come into force in Belgium this year, further strengthens the cybersecurity of companies, which are also required to carry out regular audits and report security incidents promptly.

Other regulations and legislation are also being put in place or proposed, notably concerning digital markets and services and artificial intelligence.

"Many companies may perceive the current regulatory framework as being restrictive, wondering how to maintain the pace of innovation while meeting security and compliance imperatives. However, the sovereign cloud allows data to be managed and secured by European entities, which guarantees that data will not leave European soil. Secondly, the sovereign cloud is designed in compliance with European directives and that guarantees data governance. Finally, the sovereign cloud offers a strategic competitive advantage, as it enables us to benefit from all the innovative advantages of the public cloud, including for sensitive data", Gwénaëlle insists.

1. Correctly classifying data sensitivity and the definition of sovereignty requirements according to the type of sovereignty chosen.
2. Selecting the appropriate sovereign cloud solution according to the level of sensitivity, and implementing pilot projects to ensure that the chosen solution delivers the expected results.
3. Making the sovereign cloud operational.

"But only sensitive data requires the use of a sovereign cloud. In fact, non-sensitive data can perfectly well remain in a 'classic' cloud", Gwénaëlle points out.

More specifically, data is stored in Microsoft's confidential cloud, but with strong encryption at all stages of the data journey (including ‘in use’). Data sovereignty is guaranteed through the use of an encryption key management solution, for which we have chosen to work with our partner Thalès, and the attestation solution from our partner Intel. In October 2023, Proximus and LuxConnect launched a joint venture called ‘Clarence’’, which stands for ‘Clarity’ and ‘Transparency’, and will be the first in Europe to market a disconnected sovereign cloud based on the Google Distributed Cloud Hosted (GDCH) offering.

"Our aim is to enable European organizations to continue innovating in accordance with the highest ethical standards in terms of data protection, confidentiality and regulatory compliance", Gwénaëlle adds.

"When talking to our customers, we often see two 'recurring' challenges", Gwénaëlle notes. On the one hand, there is a genuine intent to comply with the principles of digital sovereignty.

It's true that there is a growing awareness of the need to protect European data, but the application of these principles of sovereignty must not prevent innovation. In fact, hyperscalers' solutions for protecting data while innovating, such as Google Distributed Cloud Hosted or Microsoft Cloud for Sovereignty, are still relatively recent and still very unknown in the market. The role now of European ICT !ntegrators, in collaboration with technology providers, is therefore to evangelize on available options to companies wishing to operate responsibly and to reassure."

The second challenge is about classifying data correctly. "Which data is sensitive and which is not? What applications should be hosted in a sovereign cloud? Unfortunately, there is currently no European or national regulatory scheme that can help companies classify data and determine the appropriate sovereignty level. ICT partners take on the role of advisors, helping customers to find answers to these essential questions here too", Gwénaëlle concludes.