“We want to continue pioneering by embracing the newest and best standard technologies”

What's in store?

"For many years, SIDN has been using a bespoke domain registration system (DRS) developed in house and known as DRS5. It still works very well, but it's now a little behind the times. Consequently, away from the public gaze, our engineers are having to devote quite a lot of time to the management and maintenance of DRS5. We're not alone, though: registries in other countries face similar problems. So we've decided to team up with CIRA, the organisation that runs Canada's .ca internet domain. We going to become co-owners of CIRA's powerful domain registration platform, Fury. Fury is a popular system that the registries in countries such as Ireland and New Zealand already rely on. It makes use of the latest technologies, including RDAP: a protocol that enables the structured lookup of information about domain name registrants. From 2025, all generic top-level domains such as .com will have to support RDAP. We want to make Fury even more accessible, though. So we'll be working with our Canadian colleagues over the next 2 years to migrate the platform to the public cloud. It'll be a joint development effort, with the added benefit that, once Fury's in the cloud, we'll be able to offer 'DRS as a service' to other registries. A lot of interest in the concept has already been expressed within the industry. People like the idea, because domain registration systems aren't available from big suppliers like Microsoft and Oracle. There simply isn't enough demand to make DRS development attractive to players like that. So, in partnership with CIRA, we intend to step into that space."

What's the background to this move?

"We're a relatively small organisation. So we have to constantly ask ourselves, what knowledge should we retain in house, within the team, because of its high added value? And what's the market better at than we are? We've opted to have a domain registration system of our own, but to share the development and maintenance costs with CIRA."

And what is the market better at than SIDN?

"Registries all around the world are coming to the conclusion that there's little added value in operating their own infrastructures. Hardware and energy prices are going up all the time, and it's increasingly difficult to recruit the people you need to operate the kind of infrastructure a registry needs. Also, you're unnecessarily vulnerable as an organisation if the continuity of your operations depend on the expertise of just a handful of individuals. Another significant factor is that internet domains everywhere are no longer growing the way they were. However, the costs are increasing, driven up by things such as the need to invest more in cybersecurity. To some extent, a registry can cover its expanding cost base by increasing prices. But we want to continue pioneering by embracing the newest and best standard technologies. We've therefore been looking around for creative ways to reinforce our core activities, while also making it even easier to bring new services to market. At the moment, our systems are housed in 2 data centres. Managing those systems is very time-consuming. Yet operating our own Linux servers doesn't have any real advantage internationally or in terms of the service we provide to our customers. Over the next 2 years, therefore, we'll be migrating part of our ICT environment, including Fury, to Amazon Web Services (AWS). The process should be complete by early 2026. My personal belief is that the whole sector will move to the cloud in the coming 5 to 8 years. So the strategy we've adopted will put us ahead of the curve."

How will you avoid vendor lock-in?

"Of course, the big question is, why are you moving your essential services to the public cloud, when it's so important to safeguard Europe's digital autonomy? The short answer to that question is that there isn't yet a mature European alternative. As soon as one becomes available, we'll be looking to switch. It's therefore vital that we have an exit strategy. In essence, what that strategy consists of is following 'vendor-agnostic architectural principles' when migrating to the cloud. We'll be using open standards wherever we can, and implementing as few AWS-specific functions as possible. Each step along the way will be evaluated. We're promising to share our knowledge with our stakeholders, even about things that, in hindsight, we think we should have done differently. For example, we're going to compile a manual as we go, documenting all the dos and don'ts of vendor-agnostic cloud engineering that we've identified. SIDN Labs' Director Cristian Hesselman and I will soon be writing a blog, describing our plans in more detail."

What differences will customers notice?

"Migration to the public cloud will allow us to bring in new services more quickly, more easily and more cheaply. Take the popular SIDN BrandGuard service, which enables organisations to protect their domain names against phishing and reputation damage. At the moment, SIDN BrandGuard is tailored to the corporate segment. However, once we've migrated to AWS, it'll be quite straightforward to scale up the service and offer it to the SME market. We're planning to modernise everything, while also optimising the reliability of our established services for the .nl internet domain. That'll mean investing in cybersecurity as well, to counter the increased global threat level created by political unrest."

What will you be doing to boost information security?

We're going to further increase the availability of our anycast platform in order to make our DNS structure even more resistant to cyber-attacks and other external threats. Anycast routing technology lets you fall back on backup capacity immediately whenever the need arises. Tasks are automatically distributed optimally across a network of available servers. The intention is also to offer our anycast platform as a service to other registries, so they too can increase the availability of their domains. The platform is already being used for the .amsterdam domain and for .cw and .aw – the country-code domains of Curaçao and Aruba. In the future, it may be used for other top-level domains as well. Another enhancement we've got planned is raising our information security level. We already comply with ISO 27001:2013, and the aim is to achieve ISO 27001:2022 compliance. Meanwhile, with the longer-term security of our DNS structure in mind, SIDN Labs is researching quantum-secure cryptographic algorithms."

What organisational consequences will the changes have for SIDN?

"We're going to further streamline and standardise all our processes. And we'll be restructuring our ICT organisation accordingly. Within our technical division – known as SIDN Tech since 1 January – we've formed 3 teams reflecting our 3 primary ambition realms: Software Engineering, Cloud Engineering and ICT & Security Operations. We also want to reinforce the link between SIDN Tech and our research department SIDN Labs. That will enable the 2 units to make optimal use of one another's experience, knowledge and contacts."

What difference will SIDN staff notice?

"SIDN Tech's engineers will be given extensive training opportunities, so they can learn about the newest and best technologies. Also, because we'll be working in smaller teams of 10 to 15 people, we'll be able to pay even more attention to each individual's professional development. There's a bit of nervous excitement around the place, with people wondering what the changes might mean for them. But the transition has implications for SIDN as a whole, not just for SIDN Tech. We're expanding as well: we're already talking to applicants for 3 new posts. And we're always keen to hear from talented people who want to deepen their knowledge of the internet's core processes. I myself read Public Administration at university, graduating in 1999. But I was always very interested in the internet: my thesis was about the impact of new internet technologies on the business world. The people at SIDN love the internet and really buy into our main mission of safeguarding the continuity of the Dutch internet domain. And I'm not just talking about the engineers at SIDN Tech and SIDN Labs: everyone in our business, support and communications departments feels the same. It's not by chance that they work here. Since starting at SIDN on 1 September, I've found that everyone I meet is very much aware of the huge importance of the internet for the way organisations operate, and for society as a whole."

What's the timetable?

"Our ambition is to make the Fury platform available in an AWS test environment by the end of 2024. Then, early next year, we'll start testing it with our customers. By the end of 2025, we should have migrated all our systems – except for the DNS systems – from our own data centres to AWS, and shut down our own data centres. In January 2026, we'll switch off DRS5, and we want to go live with Fury. At the same time, we'll start offering DRS as a service to the international market. Over the next 2 years, we'll be reinforcing our core services: DNS and DRS. We're going to make them even more resilient than they already are, while also expanding and improving our services. Migration to the cloud can only help us achieve those goals."