Reach out to Eivind if you want to discuss sovereign cloud, digital sovereignty and security.
Full description of the talk: The European "sovereign cloud" market has matured fast: hyperscaler sovereign regions, EU/US joint ventures, pure-European providers on OpenStack, and a load of frameworks to define sovereignty (SecNumCloud, EUCS, BSI C3A, the CADA). But the labels hide enormous variation in what survives an actual event where sovereignty is tested.
Based on experience from building a national sovereign cloud in the Nordics, we will explore the more hidden dependencies that can still challenge sovereignty. The assumption is that picking a European provider, or a hyperscaler's "sovereign" region, gets you there. The reality is that you still might not be sovereign and subject to significant risks. The cloud workload hosted in Europe is only the visible tip of the "sovereignty" iceberg.
Underneath the water sit a dozen dependencies that can quietly stay non-sovereign. Your IdP, your DNS registrar, your certificate authority, your edge protection (DDoS/WAF/CDN), your key management, your GitOps host, and the SaaS your security stack phones home to and get updates from are all part of the totality that is needed for sovereignty.
Attendees leave with a practical checklist on dependencies, and learn how we solved this challenge.