On 23 February 2023, the Minister of Defence François Bausch presented the draft law on the Cyber Defence Cloud (LCDC) to the Committee on Internal Security and Defence of the Chamber of Deputies and to the press.
The draft law authorises the Directorate of Defence to finance the acquisition, operation, maintenance, exploitation and management of the system and of the related components and services of the LCDC. The total budget for the project, amounting to a maximum of 250,360,323 euros, will be spread over a period of twelve years, from 2024 to 2035.
The Luxembourg Cyber Defence Cloud
Cloud Computing provides computing resources and services on-demand through a network of remote servers. The computing resources are managed by a service provider, so that the user does not have to manage these computing resources himself and can focus on the services that he wants to host in the cloud.
The LCDC will be hosted in secure data centres in Luxembourg, with a level of protection that meets the highest international standards, providing highly secure and available computing and storage capacity. This means that de LCDC can store both unclassified and classified information in multiple cloud environments for each classification level. The LCDC will be a private cloud environment, which means that it will only be accessible on a private network and not via the Internet.
The idea is to create multi-tenancy environments for the different users of the LCDC, allowing beneficiaries to use the same cloud infrastructure to store and process their data, while ensuring that no other beneficiary can access their information.
The LCDC will provide a platform that is compatible and interoperable with different technology solutions from different providers. This approach, known as "multi-cloud", aims to reduce dependency on a single supplier.
"The LCDC will play a key role in the implementation of Luxembourg's future cyber projects, contributing to our strategic goal of building one of the most cyber-secure defences. By making this future state-of-the-art capability available to reliable partners, Luxembourg will make a significant contribution to the common collective defence effort at EU and NATO level," said François Bausch.
The benefits of such a cloud computing infrastructure include:
- Reduced costs and environmental footprint: Cloud computing eliminates the need to invest in redundant hardware and software and saves energy consumption.
- Scalability: it is possible to adapt the allocated capacity to the current needs of the users.
- Reliability: Cloud computing simplifies data backup, disaster recovery and business continuity.
- Productivity: the management and maintenance of the IT infrastructure will be part of the services provided by the LCDC, thus freeing the users' IT teams from IT infrastructure maintenance.
- Security: the LCDC will be installed in highly secure data centres accredited to host classified data.
In addition, the Luxembourg Defence "Cyber Range", a training environment used for the continuous training of cyber experts introduced in 2021, will be hosted on the new LCDC.
Role of the NATO Support and Procurement Agency
Given the scope of the project and the complexity of the IT infrastructure as well as its management, the LCDC will be operated for the benefit of the Luxembourg Defence with the support of the NATO Support and Procurement Agency (NSPA) for managing the contracts with the various external contractors required for the implementation and operation of cloud environments. The NSPA had also been mandated upstream by the Directorate of Defence to carry out the proof of concept and to determine the budget required to implement this project.
In addition, a dedicated part of the LCDC will be set up for the needs of the NSPA. Indeed, the NSPA already operates a private cloud environment for its own needs, the latter being co-financed by Luxembourg. This private cloud environment will be migrated to the LCDC.
Background
In February 2021, the Directorate of Defence published the Luxembourg Cyber Defence Strategy. This document sets the framework for the development of Luxembourg's defence in the field of cyber defence.
The long-term objective of this strategy is for Luxembourg to have one of the most cyber-secure defences in NATO and the EU and to develop expertise and capabilities that can also be offered to allies and partners.
Luxembourg hosts one of the most advanced and secure data centre fleets in Europe, with the highest performance and lowest latency connections to all major European internet platforms.
"Today, highly secure, available and scalable IT resources are essential to cope with the extensive digital transformation in the defence of NATO and EU member states," concluded François Bausch, adding: With the LCDC, Luxembourg will have a capacity that it can make available to its national and international allies and partners to respond to these challenges, the importance of which will continue to grow.
Press release by the Directorate of Defence