Defining Cloud Strategy for UK Public Sector Organisations

Introduction

Cloud computing services have grown exponentially in recent years. In many cases they are the driving force behind industry 4.0, or the fourth industrial revolution, enabling Artificial Intelligence (AI) and Machine Learning (ML), or the Internet of Things (IoT) powering smart homes and smart cities.

High speed networks are enabling secure data sharing over the Internet, resulting in a shift from compute processing in ones own server rooms or data centres to a central processing plant. Here technology can be agile and highly available whilst taking advantage of economies of scale. In much the same way as our ancestors built their own generators to consume electricity; each factory buying and installing components with specialist staff to keep systems running, before eventually moving to utility based consumption of electricity as a service.

Data sharing and data analytics are at the heart of digital transformation. Successful companies are using data with services consumed over the Internet to innovate faster and deliver value; enhancing user experience and increasing revenue.

It is important for organisations adopting cloud computing to define a cloud strategy; this helps ensure coordination and connectivity of existing and new applications, whilst providing a sustainable delivery method for future digital services. A cloud strategy can assist with standardising security and governance alongside reducing shadow IT sprawl and spiralling costs.

The first step is to have a clear understanding of what the organisation as a whole expects to gain from the consumption of cloud technologies. This isn’t limited to the IT teams but is predominantly about business outcomes, for example improved innovation and agility; faster deployment of products or features, application performance and security enhancements for remote workforce, or simply the change in consumption and charging model.

It may be that a compelling event triggered the cloud focus, such as a security breach, site reliability issue, or major system outage. Reducing carbon emissions is part of the wider corporate strategy for many public sector organisations, and replacing old or inefficient data centre and cooling equipment with hyperscalers generating renewable energy can certainly help. Whatever the reasons, they should be captured and worked into your strategy. Doing so will help identify deliverables and migration assessments for brownfield environments.

Public Sector Cloud First

The UK Government first introduced the Government Cloud First policy in 2013 for technology decisions when procuring new or existing services. The definition being that public cloud should be considered in the first instance, primarily aimed at Software as a Service (SaaS) models, unless it can be demonstrated that an alternative offers better value for money.

During the COVID-19 outbreak, the UK saw unprecedented demand for digital services. The National Health Service (NHS) in particular responded quickly; scaling out the 111 Online service to handle 30 million users between 26 February and 11 August, with 6 million people completing the dynamic coronavirus assessment. The peak number of users in a single day was over 950,000; up 95 times from the previous 10,000 daily average. NHS Digital and NHSmail rolled out Microsoft Teams to 1.3 million NHS staff in 4 days, which would go on to host over 13 million meetings and 63 million messages between 23 March and 5 October. Both of these achievements were made possible virtually overnight by the speed and agility of cloud services.

When planning your cloud strategy speak to other people in your community who are using cloud services and review case studies such as How the Welsh Government migrated their technology to the cloud and How Network Rail implemented its hybrid cloud strategy. Your cloud strategy will be individual to your own organisation to solve your unique requirements, but you can absolutely learn from others along the way.

NHS 111 Online was part of the UK digital response to COVID-19

Cloud Guidance for the Public Sector

Following up on the Government Cloud First policy of 2013, the UK Government released further information in 2017 around the use of cloud first, how to choose cloud computing services for your organisation, how to approach legacy technology, and considerations for vendor lock-in. The guidance reiterates the need to consider cloud computing before other options to meet point 5 of the Technology Code of Practice (use cloud first). The Technology Code of Practice can also feed into your cloud strategy:

  • Define user needs
  • Use open source and open standards to ensure interoperability and future compatibility
  • Make sure systems and data are secured appropriately

More recently, in March 2020, the Government Digital Service published Cloud Guidance for the Public Sector. The guidance is set out in easy to consume chunks with links out to further content for each area. Noteworthy sections include:

  • People and Skills: the way technical, security, commercial, and financial teams work will change. New processes and skills will be introduced, and people need to be fully informed throughout the process. It is essential that HR are able to recruit and retain the right skillsets, and upskill people through training and development. Roles and responsibilities should be defined, and extended to service providers and teams as the strategy is executed.
  • Security: the first 2 words in the above guidance paper are key; “Properly implemented”. The overwhelming majority of security breaches in the cloud are due to incorrect configurations. Links are included to the National Cyber Security Centre (NCSC) guidance on cloud security and zero trust principles. Published by the National Cyber Security Centre in November 2020, the Security Benefits of Good Cloud Service whitepaper also provides some great pointers that should be incorporated into any cloud strategy.
  • Data Residency and Offshoring: each data controller organisation is responsible for their own decisions about the use of cloud providers and data offshoring. The government say you should take risk-based decisions whilst considering the Information Commissioner’s Office guidance. Data offshoring is not just the physical location of the data but also who has access to it, and whether any elements of the service are managed outside of the UK.

Further documentation from the UK Government on Managing Your Spending in the Cloud identifies procurement models and cost optimisation techniques when working with cloud services. It advises that a central cloud operations team, made up of both technical and commercial specialists, is formed to monitor usage, billing, and resource optimisation to reduce costs.

Tools like CloudHealth by VMware help simplify financial management. CloudHealth makes recommendations on cost savings, works across cloud platforms, and crucially provides financial accountability by cost centre. A charging model where internal departments or lines of business pay for what they consume will typically yield reduced consumption and therefore lower costs.

Build management tooling into your cloud framework and aim for consolidated and cloud agnostic tooling. This blog article with Sarah Lucas, Head of Platforms and Infrastructure at William Hill, discusses some best practices for a successful hybrid and multi-cloud management strategy.

Incorporating hybrid and multi-cloud into your strategy can help protect against vendor lock-in, enhance business continuity, and leverage the full benefit of the cloud by deploying applications to their most suited platform or service. Furthermore, having an exit strategy insures against any future price rises, service issues, data breaches, or political changes. The NHS COVID-19 track and trace app for example, was moved between hyperscalers overnight during development. All the more impressive considering it needed to scale securely on a national level, whilst incorporating new features and updates as more virus symptoms and medical guidance was added. This blog article with Joe Baguley, CTO at VMware, outlines the lessons learned developing during a pandemic.

The National Data Strategy

In September 2020 the UK Government published the National Data Strategy. The strategy focuses on making better use of data to improve public services and society as a whole. It does this by identifying the following pillars; data foundations, data skills, data availability, and responsible data. Underpinning the National Data Strategy is a modern infrastructure which should be safe and secure with effective governance, joined-up and interoperable, resilient and highly available. New technology models like cloud, edge, and secure computing enhance our capabilities of providing shared data in a secure manner. The infrastructure on which data relies is defined by the strategy as the following:

The infrastructure on which data relies is the virtualised or physical data infrastructure, systems and services that store, process and transfer data. This includes data centres (that provide the physical space to store data), peering and transit infrastructure (that enable the exchange of data), and cloud computing that provides virtualised computing resources (for example servers, software, databases, data analytics) that are accessed remotely.

Section 4.2.1 of the document notes that “Even the best-quality data cannot be maximised if it is placed on ageing, non-interoperable systems“, and identifies long-running problems of legacy IT as one such technical barrier. The theme of this section is that data, and we can extend this to applications, should be independent of the infrastructure it runs on. Some of the commitments outlined are also relevant to cloud strategy and can be used as part of an internal IT governance framework:

  • Creating a central team of experts ensuring a consistent interpretation and implementation of policies
  • Building a community of good practice
  • Learning and setting best practice and guidance through lighthouse projects

Further demonstrating the importance of data, NHSx launched the Centre for Improving Data Collaboration; a new national resource for data-driven innovation. In a blog announcing the new team Matthew Gould, CEO, NHSx, said “Good quality data is crucial to driving innovation in healthcare. It can unlock new technologies, power the development of AI, accelerate clinical trials and enable better interactions with patients“. NHSx are working on a new UK Data Strategy for Health and Social Care expected late 2020, and have also collaborated with Health Education England on the Digital Readiness Programme to support data as a priority specialism in health and care.

The UK National Data Strategy was published in September 2020

NHS Digital Public Cloud Guidance

In January 2018 NHS Digital, along with the Department of Health and Social Care, NHS England, and NHS Improvement, released guidance for NHS and social care data: off-shoring and the use of public cloud services. This national guidance for health and care organisations can also be applied to the wider public sector dealing with personal information. Andy Callow, CDIO, Kettering General Hospital, also makes a great case for the NHS to embrace the cloud in this Health Tech Newspaper article.

As per the Government Cloud Guidance for the Public Sector; each data controller is responsible for security of their data. The NHS Digital guidance outlines a 4-step process for making risk-based decisions on cloud migrations.

In its review into patient data in the NHS, the Care Quality Commission defines data security as an umbrella for availability, integrity, and confidentiality. With this in mind systems should always be designed with the expectation of failure, across multiple Availability Zones or regions where offshoring policies permit, and with appropriate Disaster Recovery and backup strategies.

As systems and dependencies become cloud based and potentially distributed across multiple providers, more importance than ever is placed on network architecture, latency, and resilience. Software Defined Wide Area Network (SD-WAN) and Secure Access Service Edge (SASE) solutions like VeloCloud by VMware provide secure, high performance connectivity to enterprise and cloud or SaaS based applications.

Where digital services need to be accessed externally using national private networks, like the Health and Social Care Network (HSCN), organisations may consider moving them to Internet facing. This reduces network complexity and duplication whilst making services more accessible and interoperable. According to NHS Digital’s Internet First Policynew services should be made available on the internet, secured appropriately using the best available standards-based approaches“.

Closing Notes

When writing your cloud strategy document, it should be based on the goals and objectives of the organisation. The strategy document does not necessarily need to define the cloud provider or type of hosting, instead it should set out how you meet or solve your business needs or problems, creating outcomes that have a direct impact on the experience of patients, users, or service consumers.

The strategy should be kept simple and high level enough that all areas of the business are able to understand it. Cloud technology moves fast, and guidance shifts with it, your strategy and policies should be reviewed regularly but the overarching strategy should not require wholesale changes that create ambiguity. Eventually, leaders will need to define lower level frameworks that balance visibility, cost, availability and security, with agility, flexibility, choice, and productivity. These frameworks along with the high-level strategy should be well documented and easily accessible.

Featured image by Andy Holmes on Unsplash

Oracle Cloud Infrastructure Demo

This opening post will give an overview and demo of Oracle Cloud Infrastructure (OCI). Oracle Cloud offers fast and scaleable compute and storage resources, combined with enterprise-grade private virtual cloud networks. Oracle Cloud offers a range of flexible operating models including traditional Virtual Machine (VM) instances, container infrastructure, databases on demand, and dedicated hardware through bare metal servers and Bring Your Own Hypervisor (BYOH).

You can sign up for a free trial account with $300 credit here. When you sign up for an Oracle account you are creating a tenant. Resources inside a tenant can be organised and isolated using compartments, separate projects, billing, and access policies are some use case examples.

Oracle Cloud Infrastructure is deployed in regions. Regions are localised geographical areas, each containing at least 3 Availability Domains. An Availability Domain is a fault-independent data centre with power, thermal, and network isolation. A Virtual Cloud Network (VCN) is deployed per region across multiple Availability Domains, thereby allowing us to build high availability and fault tolerance into our cloud design. Virtual Cloud Networks are software defined versions of traditional on-premise networks running in the cloud, containing subnets, route tables, and internet gateways. VCNs can be connected together using VCN Peering, and connected to a private network using Fast Connect or VPN with the use of a Dynamic Routing Gateway (DRG).

Product Page | Getting Started | Documentation | Sizing and Pricing | Architecture

Product Demo

The demo below creates a VCN and VM instances in the second generation of Oracle Cloud for lab purposes. Before deploying your own environment you should review all the above linked documentation and plan your cloud strategy including IP addressing, DNS, authentication, access control, billing, governance, network connectivity and security.

Log into the Oracle Cloud portal here, the home dash board is displayed.

Oracle_Dashboard

You’ll need a subscription to get into the second generation Oracle Cloud Infrastructure portal. Under Compute select Open Service Console.

Oracle_Cloud_Dashboard

The region can be selected from the drop-down location pin icon in the top right corner, in this example the region is set to eu-frankfurt-1. Select Manage Regions to subscribe to new regions if required. Use the top left Menu button to display the various options. The first step in any deployment is to build the VCN, select Networking and Virtual Cloud Networks.

Oracle_Cloud_Dashboard

Make sure you are in the correct compartment in the left hand column and click Create Virtual Cloud Network. Select the compartment and enter a name, in this example I am going to create the Virtual Cloud Network only which will allow me to manually define resources such as the CIDR block, internet gateway, subnets, and routes. The DNS label is auto-populated.

Oracle_VCN_1

The newly created VCN is displayed, all objects are orange during provisioning and green when available.

Oracle_VCN_3

Once the VCN is available click the VCN name to display more options.

Oracle_VCN_4

Use the options in the Resources menu to view and create resources assigned to the VCN. In this example first we’ll create the Internet Gateway.

Oracle_Cloud_IG_1

Next we can create a subnet, in this example I have created a public subnet that I will later attach a VM instance to.

Oracle_Cloud_Subnet_1Oracle_Cloud_Subnet_2

We also need to add a route table or new routes into the default route table.

Oracle_Cloud_Route

The final step to allow connectivity in and out of our new subnet(s) is to define ingress and egress rules using security lists. Again you can either add rules to the default section or split out environments into additional security lists.

Oracle_Cloud_Security_1

Define the source and destination types and port ranges to allow access. In this example we are allowing in port 22 to test SSH connectivity for a VM instance.

Oracle_Cloud_Security_2

Now that we have a fully functioning software defined network we can deploy a VM instance. From the left hand Menu drop-down select Compute, Instances. Use the Create Instance wizard to deploy a virtual machine or bare metal machine.

Oracle_Cloud_Instance

In this example I have deployed a virtual machine using the Oracle Linux 7.5 image and VM.Standard2.1 shape (1 OCPU, 15 GB RAM). The machine is deployed to Availability Domain 1 in the Frankfurt region and has been assigned the public subnet in the VCN we created earlier. I used PUTTYgen to generate public and private key pairs for SSH access.

Oracle_Cloud_Instance_2

Once deployed the instance turns green.

Oracle_Cloud_Instance_3

Click the instance name to view further details or terminate, when removing you have the option to keep or delete the attached boot volume.

Oracle_Cloud_Instance_4

Additional block volumes can be added to instances. Block volumes can be created under Block Storage, Block Volumes.

Oracle_Cloud_Block_2

For object based storage we can create buckets under Object Storage, Object Storage.

Oracle_Cloud_Bucket_1

Buckets can be used to store objects with public or private visibility, pre-auth requests can also be added for short term access.

Oracle_Cloud_Bucket_2

Oracle_Cloud_Bucket_3

VMware Cloud on AWS Deployment Demo

This opening post will give an overview and demo of VMware Cloud on AWS. VMware Cloud on AWS provides on-demand, scaleable cloud environments based on existing vSphere Software-Defined Data Centre (SDDC) products. VMware and AWS have worked together to optimise running vSphere, vSAN and NSX, directly on dedicated, elastic, bare-metal AWS infrastructure without the need for nested virtualization. A SDDC cloud can be deployed in a few hours and then capacity scaled up and down within minutes; either manually or automatically using elastic DRS.

Key Benefits

There are a number of benefits and use cases for extending on-premise data centres to the cloud with VMware Cloud on AWS:

  • VMware maintains software updates, emergency software patches, and auto-remediation of hardware failures
  • Increasing capacity in the cloud is generally quicker, easier, and sometimes more cost effective than increasing physical capacity in the data centre
  • Scale capacity to protect services when met with temporary or unplanned demand
  • Improve business continuity by using the cloud for Disaster Recovery (DR) with Site Recovery
  • Consistent operating environments allows for simplified cloud migrations with minimal re-training for system administrators
  • Transfer your existing operating system and third party licensing to the cloud and make use of existing support contracts with VMware
  • Expand into additional geographical locations without needing to provision new data centres

Key Details

Update 18/01/2019 – see also VMware Cloud on AWS Deployment Planning. As with all cloud services functionality and limitations are constantly changing, I have updated some of this content but make sure you review the links below for the most up to date information.

VMware FAQ | AWS FAQRoadmap | AWS Pricing

The following links contain enough reading to plan your VMware Cloud on AWS implementation and cloud migration strategy, the points below should also be enough to get you started.

Product Documentation | Technical Overview | VMware Product Page | AWS Product Page | | Case Study | Try first @ VMware Cloud on AWS – Getting Started Hands-on Lab

  • At the time of writing up to 2 SDDC’s can be deployed per organisation (soft limit), each SDDC supporting up to 20 vSphere clusters and each cluster up to 16 physical nodes.
  • The standard i3 bare metal instance currently offers 2 sockets, 36 cores, 512 GiB RAM, 10.7 TB vSAN storage, a 16-node cluster provides 32 sockets, 576 cores, 8192 GiB RAM, 171.2 TB.
  • New R5 bare metal instances are deployed with 2.5 GHz Intel Platinum 8000 series (Skylake-SP) processors; 2 sockets, 48 cores, 768 GiB RAM and AWS Elastic Block Storage (EBS) backed capacity scaling up to 105 TB for 3-node resources and 560 TB for 16-node resources. For up to date configuration maximums see Configuration Maximums for VMware Cloud on AWS.
  • Each ESXi host is connected to an Amazon Virtual Private Cloud (VPC) through Elastic Networking Interfaces (ENI’s), which supports throughput up to 25 Gbps
  • Hybrid Cloud Extension allows stretched subnets between on-premise and cloud data centres for live migration of virtual machines
  • Hybrid Linked Mode allows administrators to connect vCenter Server running in VMware Cloud on AWS to an on-premises vCenter server to view both cloud and on-premises resources from a single interface
  • VMware Cloud on AWS complies with ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2, SOC 3, HIPAA, and GDPR, find the full list of compliance certification here
  • VMware Cloud on AWS is managed from a web-based console or RESTful API
  • At the time of writing VMware Cloud on AWS is available in the AWS Europe (Frankfurt and London), AWS US East (N. Virginia) and AWS US West (Oregon) Regions
  • Basic pricing before discount can be calculated here

VMware_AWS

Product Demo

The demo below creates a SDDC in the cloud for lab purposes. Before deploying your own environment you should review all the above linked documentation and do your own research to plan your cloud strategy as well as the following:

  • Identify or create an AWS account and ensure that all technical personnel have access to the account
  • Identify a VPC and subnet by cross-linking the AWS account to the SDDC
  • Allocate IP ranges for the SDDC, and determine a DNS strategy
  • Identify the authentication model for the SDDC
  • Plan connectivity to the SDDC
  • Develop a network security policy for the SDDC

Browse to the VMware Cloud Services portal (https://console.cloud.vmware.com) and login using your VMware ID. At the time of writing to access VMware Cloud on AWS you need to be invited or you can register for a 30 day single host trial here.

VMware_Cloud

Select VMware Cloud on AWS. If you have not used the service before you will be prompted to create a new organisation. Enter a name for your new organisation and accept the terms of service, click Continue.

AWS_1

Add a credit card to be billed if you use the service.

aws_2.png

After you have created the organisation and added payment information you will be sent to the VMware Cloud on AWS dashboard. The first step is to create our SDDC in the cloud, click Create SDDC.

Billing: annual subscriptions are listed under the Subscriptions tab, you can see other billing information from the drop-down menu next to your organisation name: select Organisation Settings, View Organisation. From here you have services, identity and access management, billing and subscriptions, and support options.

AWS_3

Select a region and deployment model for the SDDC, enter a name and the number of hosts if you are not using the single host deployment. Click Next.

AWS_4

Follow the instructions to connect an AWS account and assign the relevant capabilities.

AWS_5

Once the connection is successfully established click Next.

AWS_7

Select the VPC and subnet to use then click Next.

AWS_8

Specify a private subnet range for the management subnet or leave blank to use default addressing. As mentioned above ensure you have planned accordingly and are not using any ranges that will conflict with other networks you may connect in the future. Click Deploy SDDC.

AWS_9

The SDDC will now be deployed, it takes around 2 hours to provision the ESXi hosts and all management components.

AWS_10

Once the deployment is complete the dashboard will show the new SDDC and assigned resources. Click View Details (you can toggle the web portal theme using the Dark/Light options in the top right hand corner).

AWS_14

From either the SDDC Summary tab or back on the SDDC dashboard you can seamlessly add additional hosts or clusters at any time.

AWS_15

If needed the chat bubble in the bottom right hand corner of the screen will take you through to support.

AWS_Support

The Network tab shows the network topology and is where you can configure firewall rules, NAT rules, VPN, Direct Connect, etc.

AWS_12

To access the vCenter Server through the vSphere client the port needs opening, a VPN can also be used. Under Management Gateway select Firewall Rules, click Add Rule. Configure the rule to allow access to the vCenter on port 443 and click Save.

AWS_11

Click Open vCenter from either the Summary or Network tab, if access is in place you are given the cloudadmin@vmc.local credentials to open vCenter. Active Directory can also be configured as an identity source later on.

Once you are logged into the vSphere client you will see the familiar vSphere layout.

vCenter_AWS

It is also possible to see your on-premise vCenter Server(s) in the same pane of glass using Hybrid Linked Mode, click here for more information.

Back in the VMware Cloud on AWS portal the Add Ons tab features Site Recovery and Hybrid Cloud Extension for protecting and migrating workloads to your SDDC in the cloud.

AWS_16

You can delete a SDDC from the Actions drop-down menu in either the SDDC Summary tab or the SDDC dashboard. Once a SDDC is deleted all workloads, data, and interfaces are destroyed and any public IP addresses released.

AWS_17