Guidance

Moving to modern network solutions

This guidance explains why and how public sector organisations should move to modern network solutions and away from legacy networks with information on standards you need to follow and case studies.

From:
Central Digital and Data Office
Published
15 April 2019
Last updated
23 May 2022 — See all updates

This guidance explains why and how public sector organisations should move to modern network solutions and away from legacy networks with information on standards you need to follow and case studies.

The Government Digital Service (GDS) is helping public-sector organisations to migrate IT infrastructure and digital services to modern network solutions that use the internet and cloud.

Why you should migrate to modern network solutions

You should consider your business objectives together with the needs of all users when migrating from legacy services and buying replacements. When you take full account of the network performance and security needs of your users, you will find that it often makes sense to:

  • use public cloud services

  • reach these public cloud services using an internet connection

This approach is generally more flexible, current, cheaper and quicker to deploy than using bespoke services over dedicated networks. Technology leaders agreed this in 2017 and the approach supports the Cloud First policy.

The benefits of using an internet connection

Using an internet connection helps you to:

  • save money by not using legacy networks like the Public Services Network (PSN)

  • work better across government by using commonly available tools such as instant messaging, voice and video messaging, secure file sharing, and the APIs that support these services

  • provide a better and more secure user experience because cloud vendors continuously fix vulnerabilities and improve their products

  • access a marketplace of cloud security tools, which you can use to help protect your users and their information

  • move to modern solutions and away from legacy technology

  • avoid lock-in to a long-term contract

  • avoid using a fixed network specification that does not support your users’ needs

How to migrate IT environments to the internet and away from legacy networks

Your organisation can reduce the amount it pays for legacy networks like the PSN by migrating in phases.

You should start migrating by:

You may find it useful to learn about how other organisations have migrated away to modern solutions and away from the PSN to the internet.

We also recommend that you:

  • sign up for short-term PSN connectivity contracts, so your agreements do not dictate your exit schedule

  • monitor which PSN services your users need

  • make PSN services accessible to your internet-only users via a gateway

  • reduce the number of users in your organisation with access to the PSN

  • reduce the bandwidth and number of your PSN connections

  • remove PSN users as each service becomes available over the internet

Review your network requirements

When you move away to a modern networking solution and away from a legacy network, you will need to review your network requirements to make sure the internet connectivity you buy meets your users’ needs.

Make sure you have the right amount of bandwidth and resilience. Smaller organisations should make sure they have enough bandwidth to meet user needs when it comes to uploading and downloading content. All organisations should consider bandwidth across different times of day and for different applications.

You should also consider whether losing your connectivity, even for a short period, will cause disruption to your business and impact the general public. If so, you should consider a more resilient connection.

In some circumstances, for example when you have large numbers of users that consume lots of bandwidth your organisation may need a higher quality and more consistent network connection. A solution like a direct private connection may be more cost effective. Several cloud providers offer direct private connections, which offer:

Check what legacy services you’re using

Most local government organisations use services provided by a larger central organisation over a legacy network like the PSN. If you’re a local organisation, you have to wait until that service is available over the internet before you can move away from the PSN. However, there are steps you can take to reduce your reliance on legacy networks.

Contact your IT team to check what PSN services you are using if any. Some government systems like Government Gateway, Vetting service, and Tell Us Once are all available over the internet and you do not need PSN to connect to them.

If you’re consuming services over a legacy network like the PSN, contact the owner of the service to find out:

  • if you can access the service from the internet instead

  • when you will be able to access the service from the internet

  • whether there are any connectivity recommendations or requirements that will improve the user experience

You must also check what data protection and security standards your organisation needs to follow

Move your email services to cloud-based services

You should move email services to a cloud-based provider. You can follow the secure email guidance to learn how to:

  • secure email on any domain, using modern and widely used standards, without tying you to a legacy network

  • protect all domains that do and do not send emails

You must stop using gsi-family domains as they tie you to a legacy network. Replace these domains with a government domain like gov.uk, gov.scot, llyw.cymru or gov.wales. If you try to migrate a gsi-family domain to the internet, some of your emails will not reach their destinations.

The gsi-family domains (gsi.gov.uk, gse.gov.uk, gcsx.gov.uk or gsx.gov.uk) were invented for the Government Secure Intranet (GSI) network. The GSI network no longer exists, so these prefixes are misleading.

After you have migrated from your gsi-family domain, you should use the National Cyber Security Centre’s (NCSC’s) Mail Check service to access your Domain-based Message Authentication, Reporting and Conformance (DMARC), Sender Policy Framework (SPF) and Transport Layer Security (TLS) reports and learn more about your email service’s security.

Review how you use email

You should consider providing a digital service to give other organisations access to information rather than emailing attachments. This means everyone will have a single source of truth, which will improve cross-government collaboration.

This single source of truth will help to manage and control your data effectively and lawfully. Users in other organisations will then always be able to access the most recent version of any data record, rather than referring back to old copies in their mailboxes.

Technical options to move services you provide away from legacy networks

If you provide services over a legacy network such as the PSN, you should review your requirements and develop plans to migrate these services to the internet. This will help make sure your consumers are not forced to buy expensive legacy network connectivity to reach your service. Legacy technology will get more expensive as organisations migrate away from the PSN and suppliers increase their prices to cover their fixed costs.

The ideal migration approach is to offer users the option to connect to your service using either the PSN or the internet. This will help your consumers to switch over to the internet easily without interrupting access to the service.

If you’re a service provider, there are several technical options to move an application from the PSN to the internet or cloud.

Option 1: Use a cloud provider

A cloud provider will supply the infrastructure or platform like IaaS or PaaS, which will let your application to be built in the cloud, and will allow secure wrappers and different authentication levels to be used.

A cloud provider will have a large number of built-in mechanisms to assist with security, which is key for making applications available over the internet.

Example: Defra moved its Latest Earnings Networked Nationally Overnight (LENNON) application using a cloud provider

You will have to develop a new graphical user interface for the PSN application while it is still on the PSN, and move the back end to a cloud provider in the background.

Once the app backend is moved to the cloud, the web front end can be also hosted in the cloud, and the clients would be redirected to the new location via DNS updates. Security for the application can be tightened by using SSL systems and WAFs.

Option 2: Use an internet facing servers

There are 3 options available to make a service available over the internet using internet facing servers.

2.1. Use a cloud provider

You can use a cloud provider and use their technology to present web front ends for your applications. Using this method allows you to have built-in analytics, monitoring, performance tracking, granular security capabilities.

2.2. Use a Demilitarized zone (DMZ) arrangement

This will serve only the web front end of your application. A classic DMZ scenario may fit some current PSN applications, although the administrative overhead is increased, as the application stays in house, but a DMZ must be created and maintained, and secured.

2.3. Use a Reverse proxy system

Hackney Council introduced a reverse proxy to present a previously ‘internal only’ service externally and to ensure secure connections between users and the internal service

The same method can be used in order to publish a previously PSN application using reverse proxy.

Using Hackney’s method, the PSN application would be removed from the PSN network and placed on the regular internal network, with a reverse proxy placed on the perimeter in order to allow users on the internet to access the application, along with an identity management system to secure the accounts.

Option 3: Use APIs

You can use APIs to make your application available over the internet instead of PSN. This is done by exposing hooks which other organisations can use to connect to your application.

There are some government APIs which let you to reuse content, which may be useful in publishing web based versions of PSN content.

There are more complex API possibilities, which will require developers to write the API and to create a method of using the API, such as a web client which the organisations that wish to use your application will need. There are several factors to consider, latency being one of them, as well as SLIs. You should check guidance on setting API service levels.

APIs are advantageous as they expose less information to the internet, with the only entry point being the API itself and perhaps on a particular port.

Follow guidance on designing government APIs.

Option 4: Use a third party provider

Using a third party provider offers flexibility if you publish multiple applications to the PSN. IT also allows you to create a secure bridge between the PSN and any cloud provider.

The third party provider will give you a central gateway which interconnects securely and safely with your internal network, the PSN and any cloud network. This allows a fluid migration path, without affecting existing users of that application.

If you need a new cloud environment, it would take seconds to spin up rather than procuring a whole new environment for every application. All of the interconnects would be there, as well as layer 4 routing, WAFs and SOC data with the capability of monitoring all traffic passing through it.

This type of arrangement might be very helpful when there is one organisation with a requirement to migrate multiple PSN applications, and in a way that can be staged rather than taking a “big bang” approach. The PSN connection for the provider/publisher would no longer be required as the gateway itself would create that bridge.

Because of the ability to bridge across multiple networks in a highly secure manner, it would be possible to migrate pieces of the application at a time (such as a database backend).

Read more about keeping services secure.

Data protection and security standards to follow

Your organisation is expected to meet its legal, regulatory and policy obligations as required by:

The Cabinet Office requires all departments, which includes organisations, agencies, arm’s length bodies, and contractors, to follow the Minimum Cyber Security Standard. This should help you meet your legal and regulatory obligations.

The Government Digital Service (GDS) recommends all public sector bodies follow the Minimum Cyber Security Standard, unless they are required by a specific authority to follow a different standard. For example, follow the Data Security and Protection Toolkit for the NHS.

Your organisation may follow other security standards such as:

If your organisation uses any of these standards you should also make sure that you align with the Minimum Cyber Security Standard.

Meet the Minimum Cyber Security Standard even if you’re PSN compliant

The Minimum Cyber Security Standard requires you to focus on your sensitive information and your key operational services. PSN compliance covers only the IT environment that is connected to the PSN and what you need to do to protect the shared PSN network.

Key operational services are services that your organisation is responsible for delivering to citizens or other organisations. These may include:

  • services like revenues, benefits, identity and passport services

  • services for other government organisations like vetting and law enforcement

The scope of your existing PSN compliance certificate may not cover all these services.

The Minimum Cyber Security Standard groups its controls into 5 areas:

  • identify

  • protect

  • detect

  • respond

  • recover

Keep services secure on the internet

If you’re a public sector organisation or a commercial partner you should follow this guidance when:

  • building an internet-facing service to replace a legacy service on a dedicated network such as the PSN

  • migrating a legacy service from a dedicated network such as the PSN

Standards to use if you’re building a service

If you’re designing and building a new service to use over the internet that replaces one on a dedicated network, you need to follow the Technology Code of Practice. This will help you to make sure the technology you buy or build meets users needs, is scalable, shareable, maintainable, vendor-independent and secure. You should pay particular attention to:

National Cyber Security Centre (NCSC) offers more detailed security and policy guidance that you should follow. If you are:

Standards to use if you’re migrating a service

If you’re migrating a service to the internet from a dedicated network, you should follow:

Check your service is secure when live

Once you have built or migrated a service to the internet use:

PSN migration case studies

To help your organisation migrate away from the PSN you can learn from other organisations who have already migrated. GDS will add more case studies to this list as migrations across government progress.

The benefits of moving to modern solutions and away from the PSN

There are many ways to migrate from the PSN. You can read about how:

Updates to this page

Published 15 April 2019
Last updated 23 May 2022 + show all updates

  1. Adding case study - The Pensions Regulator moves email and web portal to the cloud

  2. We've updated the guidance to clarify when to use the Minimum Cyber Security Standard, which will continuously evolve.

  3. Added a case study about how Hackney Council has moved to a cloud-first approach

  4. First published.

Sign up for emails or print this page

Contents

Related content