The document discusses key topics related to the 2014 London G-Cloud meet-up, including government security classifications set to take effect on April 2, 2014, PSN connectivity retirement, and the future of hybrid clouds and application development. It outlines the classifications of cloud services and their appropriate uses, as well as the implications of retiring GCF connectivity for public sector telecommunications. Additionally, it emphasizes the need for sophisticated solutions and integration of cloud services to enhance citizen engagement and support application developers.

1. Security Radar for 2014
London G-Cloud Meet-up, January 2014
Ivan Harris, Business Manager – Cloud Services
www.eduserv.org.uk

2. Agenda
• Government Security Classifications
• PSN Connectivity
• Hybrid Clouds
• Application Development

3. Government Security Classifications
• Comes into force on 02/04/14
• Classifications: OFFICIAL, SECRET and TOP SECRET
• There is no direct mapping between Security Classifications and BILs
• BIL should still be used as part of the information risk assessment when selecting G-Cloud services
• New G-Cloud service categories:
•
Unassured Clouds: Formerly IL0
•
Assured Public Cloud: Formerly IL2
•
Formally Accredited Public Cloud or Private Cloud: Formerly IL3
• As a rule of thumb:
•
Unassured Clouds: For non-sensitive OFFICIAL information suitable for the public domain
•
Assured Public Cloud: Suitable for general OFFICIAL information that is not particularly sensitive
•
Formally Accredited Public Cloud or Private Cloud: Most OFFICIAL information and aggregated information that‟s not
particularly sensitive in isolation
• Will Assured Public Clouds require PGA? Just ISO 27001 plus additional controls?
Sources:
Government Security Classifications April 2014, Version 1.0, Cabinet Office, October 2013
G-Cloud Information Assurance Requirements and Guidance, HMG, May 2012

4. PSN Connectivity
• GCF connectivity is retired on 31/03/14
• GCF users must have obtained PSN connectivity, achieved compliance and transitioned
by this date
• IL3 accredited PSN bearer networks will start to appear rather than using CAPS
accredited devices over IL2 bearer networks
• 3 new PSN frameworks due with
•
More SMEs (dozens, not hundreds)
•
Three ordering mechanisms (direct award, short competition, full-fat competitions)
•
4-5 year contract length
•
„Public Sector Telecoms‟ framework (which includes cloud services) due to go live in July
• 2014-16 growth in „Wider Public Sector‟ including local government and health services:
•
PSN Spend to mid-2014: Central Government £2.2Bn, Wider Public Sector: £0.8Bn
•
PSN Spend 2014-2016: Central Government £0.6Bn, Wider Public Sector: £1.6Bn
Sources:
Next-generation PSN Frameworks, Cabinet Office, November 2013

5. Hybrid Cloud
• Low hanging fruit of point cloud solutions will soon be harvested
• More sophisticated solutions will be needed to support:
• On premise and off premise
• Legacy systems and cloud services
• Public and private cloud
• Multi-impact level information estates
• Integrating to multi-impact level systems
• Impact level hybrid clouds are needed
• Supports the business benefit prioritized cloud journey and optimises
information estates

6. Application Development
• The „Public Cloud First‟ policy, drives for better citizen experience/engagement
and more sophisticated solutions require digital services, Enterprise Applications
Integration, SaaS and custom web, enterprise mobile applications
• Demand from third-party application developers for IaaS, PaaS, EPaaS and
PSN support on IL2 and IL3 PGA‟d services
• Full software lifecycle support is needed: Spin-up/tear-down of
development, test, staging and production environments
• Needs to align to HMG‟s Agile objectives by supporting continuous integration
and continuous release
• Application developers need help with accrediting their applications on already
PGA‟d services

7. In Summary
• Government Security Classifications
• PSN Connectivity
• Hybrid Clouds
• Application Development

8. “In the midst of chaos,
there is also opportunity”
Sun Tzu
Ivan Harris
Business Manager – Cloud Services
Email: ivan.harris@eduserv.org.uk
Phone: 01225 474311
Twitter: @IvanDavidHarris