A certification for Christmas: after more than three years of effort, Google and Thales couldn’t dream of a better gift under the tree. Their joint venture, S3NS, officially became this Friday the first company to be SecNumCloud certified for an offering combining infrastructure, platform and containerized computing. Enough to guarantee, in particular, the immunity of hosted data from non-European extraterritorial laws, with the American Cloud Act in the lead.
The S3NS offer, called Premi3ns, corresponds concretely to a cloud offer which is intended to be similar in scale to that offered by Google Cloud Platform (GCP). But if it runs well thanks to American technologies, S3NS is in reality a subsidiary owned almost entirely by the French Thales. “Google has good capital, but well below the 24% threshold required by certificationexplains Cyprien Falque, general director of S3NS. The five directors come from Thales: Google has neither voting rights nor veto rights. »
« Le marché du cloud est dominé par Amazon, Microsoft et Google » : alerte sur la dépendance française aux géants américains
Behind this offer, one objective: to allow companies with sensitive data to migrate to the cloud, a technology that accelerates innovations such as artificial intelligence, without fearing for the security of their data. Concretely, if GCP provides the source code behind the cloud, it is audited before being made available to S3NS customers via data centers owned by the company – enough to operate in a hermetic manner vis-à-vis the American giant. “No one at Google has control over the system, whether it’s the infrastructure or the softwareadds Cyprien Falque. Google becomes a simple technology supplier, like so many in tech! »
If the objective is to ultimately provide a catalog of services equivalent to that of GCP, it will however be necessary to count on a cost of 15% to 20% higher, but also on later availability of Google Cloud innovations. “For simple updates, there will be a delay of around a week between GCP and S3NSwarns Anthony Cirot, vice-president of Europe and Middle East South at Google Cloud. For new products or new services, on the other hand, it will be necessary to verify that they meet the SecNumCloud criteria, which will involve a longer delay. »
This announcement allows Google Cloud to strike a major blow against Microsoft Azure, whose technology will be the basis of Bleu, a joint venture between Orange and Capgemini, but clearly behind in the race for certification. As for the third thief of the giants in the field, Amazon, it has chosen a less demanding path with its European sovereign cloud (ESC), which aims to be a “photocopy” of AWS on a European scale but with total autonomy in relation to the company’s global infrastructures.
“This cloud is not connected to any other cloud outside Europe, and is operated by European citizens, residents of the EU and who only have access to the ESC when they are on European territoryunderlines Stephan Hadinger, technical director of AWS France. Not to mention that it has, like the rest of our data centers, Nitro technology, which creates a physical barrier between our customers’ data and AWS: if authorities asked us for access to the data, we would tell them that we are unable to access it. »
« Décadente », « ingérable » : la Maison Blanche de Trump théorise la mise sous tutelle de l’Europe et l’affaiblissement de l’UE
“In the case of Amazon, the cloud remains operated by the subsidiary of an American group, therefore required to respond to American justice”contests Cyprien Falque. An interpretation confirmed not without embarrassment by Ruba Borno, one of the vice-presidents of AWS, questioned at the beginning of November to find out how AWS would respond to a request from the American government for access to ESC data: “I don’t think AWS can say no. »
Furthermore, if S3NS plans to develop in Europe, it will not extend beyond in order to preserve data security: a necessity, when we know that the establishment of the French OVHcloud in Canada recently led Canadian justice to require the company to provide data located in France or the United Kingdom.
The fact remains that the irruption of the American giants into the French game is not to everyone’s taste. This is particularly the case of Hexatrust, a professional association bringing together French and European players in cybersecurity and trusted cloud: in The Tribune at the beginning of November, she asked “put an end to it « sovereign-washing » » and to define sovereignty based on “data sovereignty, operations and technological sovereignty”.
“S3NS and Bleu do not meet the pillar of technological sovereignty. If the Chinese Alibaba were certified following the same logic, this would raise questions”grumbled David Chassan, director of strategy for the French cloud Outscale, also certified for the infrastructure part. Who, however, sees behind these two projects the proof of a ” interest “ for SecNumCloud certification, set up by ANSSI but more demanding than EUCS certification which is emerging at European level.
IA, quantique… Pourquoi la France peine à protéger ses champions de la tech
Enough to create a complementary market to that of the classic cloud, as the thirty or so companies already customers of the S3NS offer can attest, including EDF, MGEN and Matmut. “The objective is to address data perimeters that were not on the cloud todaysummarizes Cyprien Falque. For certain customers with sensitive activities, this could be 50% to 60% of their data; for others, only 5% to 10%. »
A scope that cannot yet be addressed by French cloud players, who are exclusively certified on the infrastructure part, and not on the platform part. “We would like to have European Azures, but this is not currently the caseregretted Joffrey Célestin-Urbain, president of Campus Cyber, at the end of the summer. These hybrid offers [S3NS et Bleu] come to meet a need for sovereignty greater than what exists today on the market: this represents progress. » Progress that Joffrey Célestin-Urbain hopes for “transient” before the emergence of 100% French or European offers.
