Securing the Cloud

Building Effective Frameworks to Safeguard
Public Sector Cloud Environments

Adrienne Moor
Lead, The Government Cloud Programme,
Department of Internal Affairs

Government keynote highlights from Adrienne Moor, the Lead of the Government Cloud Programme from Department of Internal Affairs – in which she discusses about where to from here.

The use of cloud in the
public sector

Cloud technologies across the world continue to create great benefits, but even within the public sector in New Zealand, there is great disparity when it comes to the adoption of such technologies. Adrienne Moor , the Lead for the Government Cloud Programme at the Department of Internal Affairs , says that “it is necessary for the public service to be able to move with the wave of digital interaction,” and cloud is part of that. Their overall objective therefore is to “support the public service to accelerate the use and benefits of cloud capabilities.” However, it needs to be a “human cantered approach that allows New Zealanders to interact with the government in the ways they want, when they want and how they want.”

A cloud first strategy was initially introduced into the public service in 2012, “so we’ve had digital enablement for some time now.” But technologies change rapidly so “the government published its Strategy for a Digital Public Service in 2019,” which is designed to “achieve a modern, digital public service that works for all New Zealanders.” Though that alone is not enough. Sitting alongside that is the “Strategy for a Digital Aotearoa, which is about a digital direction and aspirations for our entire nation.” Cloud adoption is therefore “a pretty important pillar of both strategies,” and to achieve that, the Strategy for a Digital Aotearoa in particular has three main themes:

• Trust – There needs to be trust “in our brand locally and globally, but also trust in the government and in the public service.”
• Digital inclusion – “As we progress our digital journey, it is important that we don’t leave anybody behind.”
• Growth – “As we recover from COVID-19, we need to use technologies in ways that support us to thrive in our digital economy aspirations.”

The evolution of cloud
adoption

When the cloud first strategy was introduced, it was simply about migrating to the public cloud and using the cloud for everything. But over time, “the world has changed and the policy needs to change with it.” So now it is about a “multi-cloud and hybrid-cloud approach.”

“The continued investment in New Zealand by global cloud providers is delivering strong and positive support for New Zealand’s digital maturity. At the same time, agencies have varying needs, so the need and the flexibility of the cloud solutions need to be able to reflect and enable what is required in their different contexts for their different customers and with their different risk profiles.”

Apart from that, there is a shift in the way cloud is being adopted. Failure is an accepted part of learning in the private sector, but the risk appetite for getting things wrong in the public sector “is low, at best.” Yet, the cloud adoption journey is always “complex and there are many things that can go wrong.” The goal of the government’s cloud program therefore is to “support agencies to successfully adopt secure cloud capabilities,” irrespective of where they are on the journey. After all, there are some government departments or agencies that are “very mature, very strongly cloud enabled and reaping the many benefits of the cloud, whilst there are other agencies that are struggling to get to the cloud starting line.”

Since the government’s goal is to “accelerate the use and benefits of the cloud,” there are actually eight areas of focus to enable that, known as ‘workstreams’ , which were developed to “focus on critical issues that public service departments have identified as being common for all.”

The streams are:

• Leadership – “Supporting Ministers, chief executives and senior officials to understand what the cloud capabilities are, and to advocate on the importance of them for New Zealand’s wider digital journey.”
• Access – “Working with providers to invest in establishing their capabilities in New Zealand, and to ensure that they meet the public and private sector needs. This will allow us to engage, interact and thrive digitally, and to reduce the concerns that folks have about cloud adoption.”
• Accelerate – “Supporting the public service to securely adopt cloud capabilities. As such, we set up the cloud capabilities network which is a one-stop-shop that can support agencies with guidance and reference materials and communities of practice so they can properly plan and execute their cloud adoption journeys.”
• Policy – “To ensure that our policy decisions are fit for our current state. There are proposals that will go to Cabinet early in the new year around resetting government’s cloud first policy.”
• Kaupapa Maori – “Working with our treaty partners to deliver value and benefit for Maori. We are also working to dispell some of the myths and the legends around what cloud adoption is and what it does and doesn’t mean from a Maori point of view.”
• Security – “Ensuring that New Zealand specific security settings are built in so that they support safe and secure cloud adoption.”
• Innovation – “Producing innovative capabilities and opportunities with nationally impactful solutions to complex and narrow problems.”2D8561
• PMO – “All of this is underpinned by a program management office that supports us to progress the program in a structured way.”