|By Elad Yoran||
|May 19, 2013 05:00 PM EDT||
Cloud service providers store data all over the globe, and are constantly moving that data from one datacenter to the next for reasons as wide-ranging as cost considerations and redundancy requirements. Does this mean that the requirements outlined in varying data residency laws and privacy regulations are directly at odds with how cloud computing works?
The question is an especially delicate one when the cloud service provider stores and processes data in a jurisdiction that is perceived to have far less stringent privacy and data protection requirements - or may allow government agencies far broader data subpoena powers. Since the cloud computing model relies on distributed infrastructure to generate cost and flexibility benefits for customers, building a datacenter in each data residency jurisdiction quickly becomes cost-prohibitive. And, applying a set of constraints to the movement of data introduces an additional layer of complexity that further erodes the value proposition of cloud computing for customers.
Just as cloud computing represents a novel way of delivering IT computing and functionality, a new model for maintaining ownership and direct control of data in the cloud is increasingly required. However, this new model requires that the encryption mechanism is maintained externally and independently of the cloud service provider's environment, and that data is encrypted before it is sent to the cloud.
The Issues Surrounding Information Security and Data Protection Laws
Over the past 18 months, concerns about the feasibility of enforcing data residency laws and regulations in the cloud have increasingly come to the forefront. Multiple countries including India, Switzerland, Germany, Australia, South Africa and Canada have enacted laws restricting corporations from storing data outside their physical country borders. Additionally, EU Safe Harbor Principles mandate that companies operating within the European Union are forbidden from sending personally identifiable information (PII) outside the European Economic area, unless it is guaranteed that the data will receive equivalent levels of protection.
This is partly as a result of broader understanding of cloud computing architecture and processes, but also because of the ambiguity of safeguards for the privacy of cloud data. For example, national security concerns have driven the definition of US legislation such as The Foreign Intelligence Surveillance Amendments (FISA) Act and the USA PATRIOT Act, to extend the ability of the federal government and law enforcement agencies to subpoena communications and emails stored in the cloud. The concern is now as much whether data is leaving the jurisdiction as it is what the privacy laws hold where the data lands. Inconsistent approaches to privacy further complicate the picture.
The current response to this challenge is either not to move to the cloud, or require cloud service providers to store data within each jurisdiction. For cloud service providers, this presents a business challenge in delivering a level of flexibility, cost and effective service while altering their delivery and management models to satisfy data residency and privacy requirements. To address the mandates set forth by these laws, a cloud provider would ostensibly have to build datacenters in each jurisdiction, resulting in significant cost and overhead that would reduce the overall gain of cloud storage.
Cloud Encryption and Cloud Data Residency Regulations
The interaction between the evolution of information security and the definition of data protection mandates by legislative bodies or industry groups is a dynamic one. At the heart of the concern is how organizations can continue to maintain ownership and control of data to protect personal information, even when the information resides with a third-party service that relies on a distributed infrastructure in order to deliver resiliency, availability and flexibility to customers.
By way of illustration, compliance requirements and data breach laws have been regularly updated as new information security alternatives have been developed. In the US, more than 40 states currently have breach notification laws mandating that if a company is aware of lost or stolen personally identifiable information, they are required to directly notify the consumer. When these laws were initially enacted (starting with the State of California in 2002), they generally stated that regardless of the circumstances, the company was required to notify the consumer. However, the laws have been gradually amended, and more than 25 states have now enacted an exemption for encrypted personal data. In other words, in instances where lost or stolen data is encrypted, the company is no longer required under law to notify the consumer.
The underlying argument for differentiating between unencrypted data and encrypted data in the context of breach notification is that in the instance where data is encrypted, the attacker has gained access to useless "gibberish" if they do not hold the encryption keys.
However, cloud computing is an evolving paradigm where both the obligations of the data owner and acceptable forms of data protection are still in the process of initial definition. As the technology gains popularity and becomes a well-established method of data storage and processing, the laws pertaining to cloud computing will also continue to evolve in the same way that data breach laws have.
For example, regulations are also now moving towards excluding encrypted data from data residency legislation. Encryption is recognized in the State of Nevada as a means of securing data outside of geographic boundaries: "A data collector doing business in this State shall not: (a) Transfer any personal information through an electronic, non-voice transmission other than a facsimile to a person outside of the secure system of the data collector unless the data collector uses encryption to ensure the security of electronic transmission; or (b) Move any data storage device containing personal information beyond the logical or physical controls of the data collector or its data storage contractor unless the data collector uses encryption to ensure the security of the information."
While data residency regulations can be narrowly defined, in many jurisdictions laws can be interpreted as not applying to data that has been encrypted before being sent to the cloud. Dr. Thilo Weichert, head of the Independent Center for Privacy Protection for the German state of Schleswig-Holstein, argues in his Cloud Computing & Data Privacy paper that if data is anonymized or sufficiently aliased to the extent that the identity of individuals is indecipherable, then data residency law does not apply. Encryption takes anonymizing and aliasing a step further, where the data is completely indecipherable. Similarly, under the European Union's Data Protection Directive (EU DPD), as long as the data is encrypted, where it resides should not present a legal obstacle.
Likewise, under Canadian privacy law, both federal bodies and commercial organizations domiciled within Canadian borders are responsible for the privacy and protection of personal information in their custody. This requirement applies regardless of where the data resides. While significant concerns have been articulated with regards to the probability of disclosure to law enforcement agencies for data that resides within US datacenters, the requirements pertain directly to the safeguards in place to maintain control.
Ann Cavoukian, Information and Privacy Commissioner for the Province of Ontario, noted in her formal response to a question related to the compliance with the Freedom of Information and Protection of Privacy Act concerning the privacy and security of personal information collected by the Ministry of Natural Resources being stored in the US that: "to the extent that the data owner retains the encryption keys, the location of the encrypted data is a secondary issue."
In other words, if the encrypted data leaves the jurisdiction, but the keys remain under the data owner's direct control, the level of protection can be sufficient in terms of data residency requirements.
However, this model also implies that the data encryption scheme is maintained externally and independently of the cloud service provider's environment, and that data is encrypted before it is sent to the cloud.
Persistent Encryption and Data Residency
The most effective method to address the jurisdictional and residency requirements of data processed by third-party services is via control of encryption keys and the application of persistent encryption. By applying persistent encryption, data that is encrypted at the boundary of the network remains encrypted even when processed and stored within a cloud service provider environment. As a result, persistent encryption ensures that data is never decrypted when in a third-party's environment and the ability to access useable data remains solely with the organization that holds the encryption key.
Therefore, businesses can comply with jurisdictional and residency requirements by virtue of keeping the encryption keys within the jurisdiction regardless of the actual physical location of the data. Laws relating to data residency are now undergoing a historic transition from the old paradigm where it mattered where the data was physically located to the new paradigm where it only matters where the encryption keys are located.
With the application of persistent encryption, control of the keys in combination with encryption across the data lifecycle - in transit, at rest and in use - provide the foundation to satisfy requirements for control and adequate safeguards for the privacy of personal information. Although the encrypted data may leave the physical borders of a specific country, the data is always fully encrypted while outside of the defined jurisdiction. As the keys are retained within a business's legal jurisdiction, the data cannot be accessed or read until it returns to the physical borders in which the organization resides.
Global Pharmaceutical Company Case Study: Cloud Data Ownership and Control Concerns
The following example depicts a privately held multinational pharmaceutical company that engages in research, development, production, and marketing of prescription and over-the-counter medicines and healthcare products. The company has thousands of employees across the globe, as well as multiple subsidiaries and entities.
The company's IT procurement and deployment approach follows a decentralized model in which each entity subsidiary hosts its own servers and datacenters. There are three functional organizational pillars maintained within its technology and IT services division: Technology Planning; Enterprise Architecture and Data Services; and Production Services. The divisions are staffed by IT engineers with managed services providing support for thousands of clients across a multitude of sites. Existing infrastructure includes hardware, software, services, and virtualization from multiple top vendors including Microsoft, VCE, Dell, Oracle, EMC and VMware.
The pharmaceutical company had adopted several cloud-based services for applications that do not process or store critical or regulated business information, such as Web conferencing, spam filtering, compliance training and tracking, and travel and expense management, but was seeking to expand its cloud computing usage to business critical applications by moving low value servers to cloud providers, as well as moving commodity applications such as email to the cloud.
Concerns about the loss of control and ownership of corporate data, however, stood in the way of realizing the increased efficiencies and operational benefits possible through broader adoption of cloud-based services. These concerns were related to:
- Compliance with international data residency requirements that preclude data leaving a jurisdiction in the clear
- Compliance with regulations governing the security, privacy and confidentiality of healthcare data
- Safeguards to limit exposure of its intellectual property when it is stored and processed in the cloud
- Lack of visibility into service provider responses to information subpoenas that can result in a breach of confidentiality or loss of data
Addressing Residency and Unauthorized Disclosure
While the cloud service provider could attest to the security of the environment based on a framework like the Cloud Security Alliance's Cloud Control Matrix, the global pharmaceutical company required an independent mechanism to protect its intellectual property while resident in the cloud. A common challenge to cloud migration within the pharmaceutical/healthcare industry is confidentiality and sensitivity to a service provider's compliance with government subpoenas as pharmaceutical and healthcare companies maintain sensitive information related to research, clinical study results, and personal medical history. Therefore, it is critical that sensitive information remain under the company's control, without any forfeiture of attorney-client privilege.
In a typical scenario, if a company stores sensitive data in the cloud, and the cloud service provider is faced with a subpoena or other request from the government, they must comply and disclose the company's data to the federal government body. The provider may notify the company after the fact, or in cases of blind subpoenas, not at all.
The pharmaceutical company decided to use persistent encryption technology to specifically address the migration of their email infrastructure to the cloud. Deployed as an on-premise gateway, this enabled the company to successfully address the jurisdictional and residency requirements of email data hosted in the cloud, as the company maintains control of the encryption keys - and business data is encrypted when it passes through the gateway's proxy at the boundary of the network and remains encrypted even when processed by and stored within a cloud service provider environment.
The persistent encryption technology ensures that data is never decrypted when in a third-party's environment and the ability to access useable data remains solely with the organization that holds the encryption key. Therefore, the company is able to comply with jurisdictional and residency requirements by virtue of keeping the encryption keys within the jurisdiction regardless of the actual physical location of the data, as well as ensuring complete ownership and control of that data if faced with a subpoena.
|veronica321 05/22/13 11:13:00 AM EDT|
Great article and rightly said, security is still the biggest concern when moving to the cloud , I came across this interesting piece on cloud computing and cloud security in particular that readers might find interesting 'Cloud risks Striking a balance between savings and security' it talks a great deal about securing the cloud and data residency laws that might interest readers
WebRTC is bringing significant change to the communications landscape that will bridge the worlds of web and telephony, making the Internet the new standard for communications. Cloud9 took the road less traveled and used WebRTC to create a downloadable enterprise-grade communications platform that is changing the communication dynamic in the financial sector. In his session at @ThingsExpo, Leo Papadopoulos, CTO of Cloud9, discussed the importance of WebRTC and how it enables companies to focus o...
Jan. 20, 2017 08:45 PM EST Reads: 4,356
"We're bringing out a new application monitoring system to the DevOps space. It manages large enterprise applications that are distributed throughout a node in many enterprises and we manage them as one collective," explained Kevin Barnes, President of eCube Systems, in this SYS-CON.tv interview at DevOps at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Jan. 20, 2017 06:30 PM EST Reads: 5,451
The Internet of Things can drive efficiency for airlines and airports. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Sudip Majumder, senior director of development at Oracle, discussed the technical details of the connected airline baggage and related social media solutions. These IoT applications will enhance travelers' journey experience and drive efficiency for the airlines and the airports.
Jan. 20, 2017 05:45 PM EST Reads: 2,089
All organizations that did not originate this moment have a pre-existing culture as well as legacy technology and processes that can be more or less amenable to DevOps implementation. That organizational culture is influenced by the personalities and management styles of Executive Management, the wider culture in which the organization is situated, and the personalities of key team members at all levels of the organization. This culture and entrenched interests usually throw a wrench in the work...
Jan. 20, 2017 05:30 PM EST Reads: 1,474
In his General Session at DevOps Summit, Asaf Yigal, Co-Founder & VP of Product at Logz.io, will explore the value of Kibana 4 for log analysis and will give a real live, hands-on tutorial on how to set up Kibana 4 and get the most out of Apache log files. He will examine three use cases: IT operations, business intelligence, and security and compliance. This is a hands-on session that will require participants to bring their own laptops, and we will provide the rest.
Jan. 20, 2017 05:15 PM EST Reads: 4,951
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
Jan. 20, 2017 05:15 PM EST Reads: 3,805
@DevOpsSummit at Cloud taking place June 6-8, 2017, at Javits Center, New York City, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long developm...
Jan. 20, 2017 05:15 PM EST Reads: 3,534
A look across the tech landscape at the disruptive technologies that are increasing in prominence and speculate as to which will be most impactful for communications – namely, AI and Cloud Computing. In his session at 20th Cloud Expo, Curtis Peterson, VP of Operations at RingCentral, will highlight the current challenges of these transformative technologies and share strategies for preparing your organization for these changes. This “view from the top” will outline the latest trends and developm...
Jan. 20, 2017 04:45 PM EST Reads: 1,078
"LinearHub provides smart video conferencing, which is the Roundee service, and we archive all the video conferences and we also provide the transcript," stated Sunghyuk Kim, CEO of LinearHub, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Jan. 20, 2017 03:00 PM EST Reads: 1,649
When you focus on a journey from up-close, you look at your own technical and cultural history and how you changed it for the benefit of the customer. This was our starting point: too many integration issues, 13 SWP days and very long cycles. It was evident that in this fast-paced industry we could no longer afford this reality. We needed something that would take us beyond reducing the development lifecycles, CI and Agile methodologies. We made a fundamental difference, even changed our culture...
Jan. 20, 2017 02:30 PM EST Reads: 1,127
Things are changing so quickly in IoT that it would take a wizard to predict which ecosystem will gain the most traction. In order for IoT to reach its potential, smart devices must be able to work together. Today, there are a slew of interoperability standards being promoted by big names to make this happen: HomeKit, Brillo and Alljoyn. In his session at @ThingsExpo, Adam Justice, vice president and general manager of Grid Connect, will review what happens when smart devices don’t work togethe...
Jan. 20, 2017 02:15 PM EST Reads: 620
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal ...
Jan. 20, 2017 01:30 PM EST Reads: 5,238
@DevOpsSummit taking place June 6-8, 2017 at Javits Center, New York City, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. @DevOpsSummit at Cloud Expo New York Call for Papers is now open.
Jan. 20, 2017 01:30 PM EST Reads: 3,597
"There's a growing demand from users for things to be faster. When you think about all the transactions or interactions users will have with your product and everything that is between those transactions and interactions - what drives us at Catchpoint Systems is the idea to measure that and to analyze it," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York Ci...
Jan. 20, 2017 01:30 PM EST Reads: 5,732
SYS-CON Events announced today that Dataloop.IO, an innovator in cloud IT-monitoring whose products help organizations save time and money, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Dataloop.IO is an emerging software company on the cutting edge of major IT-infrastructure trends including cloud computing and microservices. The company, founded in the UK but now based in San Fran...
Jan. 20, 2017 01:00 PM EST Reads: 2,578