Welcome!

Related Topics: @CloudExpo, Microservices Expo, Containers Expo Blog, Cloud Security, @BigDataExpo, SDN Journal

@CloudExpo: Article

Cloud Computing and Data Residency Laws

Irreconcilable differences?

Cloud service providers store data all over the globe, and are constantly moving that data from one datacenter to the next for reasons as wide-ranging as cost considerations and redundancy requirements. Does this mean that the requirements outlined in varying data residency laws and privacy regulations are directly at odds with how cloud computing works?

The question is an especially delicate one when the cloud service provider stores and processes data in a jurisdiction that is perceived to have far less stringent privacy and data protection requirements - or may allow government agencies far broader data subpoena powers. Since the cloud computing model relies on distributed infrastructure to generate cost and flexibility benefits for customers, building a datacenter in each data residency jurisdiction quickly becomes cost-prohibitive. And, applying a set of constraints to the movement of data introduces an additional layer of complexity that further erodes the value proposition of cloud computing for customers.

Just as cloud computing represents a novel way of delivering IT computing and functionality, a new model for maintaining ownership and direct control of data in the cloud is increasingly required. However, this new model requires that the encryption mechanism is maintained externally and independently of the cloud service provider's environment, and that data is encrypted before it is sent to the cloud.

The Issues Surrounding Information Security and Data Protection Laws
Over the past 18 months, concerns about the feasibility of enforcing data residency laws and regulations in the cloud have increasingly come to the forefront. Multiple countries including India, Switzerland, Germany, Australia, South Africa and Canada have enacted laws restricting corporations from storing data outside their physical country borders. Additionally, EU Safe Harbor Principles mandate that companies operating within the European Union are forbidden from sending personally identifiable information (PII) outside the European Economic area, unless it is guaranteed that the data will receive equivalent levels of protection.

This is partly as a result of broader understanding of cloud computing architecture and processes, but also because of the ambiguity of safeguards for the privacy of cloud data. For example, national security concerns have driven the definition of US legislation such as The Foreign Intelligence Surveillance Amendments (FISA) Act and the USA PATRIOT Act, to extend the ability of the federal government and law enforcement agencies to subpoena communications and emails stored in the cloud. The concern is now as much whether data is leaving the jurisdiction as it is what the privacy laws hold where the data lands. Inconsistent approaches to privacy further complicate the picture.

The current response to this challenge is either not to move to the cloud, or require cloud service providers to store data within each jurisdiction. For cloud service providers, this presents a business challenge in delivering a level of flexibility, cost and effective service while altering their delivery and management models to satisfy data residency and privacy requirements. To address the mandates set forth by these laws, a cloud provider would ostensibly have to build datacenters in each jurisdiction, resulting in significant cost and overhead that would reduce the overall gain of cloud storage.

Cloud Encryption and Cloud Data Residency Regulations
The interaction between the evolution of information security and the definition of data protection mandates by legislative bodies or industry groups is a dynamic one. At the heart of the concern is how organizations can continue to maintain ownership and control of data to protect personal information, even when the information resides with a third-party service that relies on a distributed infrastructure in order to deliver resiliency, availability and flexibility to customers.

By way of illustration, compliance requirements and data breach laws have been regularly updated as new information security alternatives have been developed. In the US, more than 40 states currently have breach notification laws mandating that if a company is aware of lost or stolen personally identifiable information, they are required to directly notify the consumer. When these laws were initially enacted (starting with the State of California in 2002), they generally stated that regardless of the circumstances, the company was required to notify the consumer. However, the laws have been gradually amended, and more than 25 states have now enacted an exemption for encrypted personal data. In other words, in instances where lost or stolen data is encrypted, the company is no longer required under law to notify the consumer.

The underlying argument for differentiating between unencrypted data and encrypted data in the context of breach notification is that in the instance where data is encrypted, the attacker has gained access to useless "gibberish" if they do not hold the encryption keys.

However, cloud computing is an evolving paradigm where both the obligations of the data owner and acceptable forms of data protection are still in the process of initial definition. As the technology gains popularity and becomes a well-established method of data storage and processing, the laws pertaining to cloud computing will also continue to evolve in the same way that data breach laws have.

For example, regulations are also now moving towards excluding encrypted data from data residency legislation. Encryption is recognized in the State of Nevada as a means of securing data outside of geographic boundaries: "A data collector doing business in this State shall not: (a) Transfer any personal information through an electronic, non-voice transmission other than a facsimile to a person outside of the secure system of the data collector unless the data collector uses encryption to ensure the security of electronic transmission; or (b) Move any data storage device containing personal information beyond the logical or physical controls of the data collector or its data storage contractor unless the data collector uses encryption to ensure the security of the information."[1]

While data residency regulations can be narrowly defined, in many jurisdictions laws can be interpreted as not applying to data that has been encrypted before being sent to the cloud. Dr. Thilo Weichert, head of the Independent Center for Privacy Protection for the German state of Schleswig-Holstein, argues in his Cloud Computing & Data Privacy paper that if data is anonymized or sufficiently aliased to the extent that the identity of individuals is indecipherable, then data residency law does not apply. Encryption takes anonymizing and aliasing a step further, where the data is completely indecipherable. Similarly, under the European Union's Data Protection Directive[2] (EU DPD), as long as the data is encrypted, where it resides should not present a legal obstacle.

Likewise, under Canadian privacy law, both federal bodies and commercial organizations domiciled within Canadian borders are responsible for the privacy and protection of personal information in their custody. This requirement applies regardless of where the data resides. While significant concerns have been articulated with regards to the probability of disclosure to law enforcement agencies for data that resides within US datacenters, the requirements pertain directly to the safeguards in place to maintain control.

Ann Cavoukian, Information and Privacy Commissioner for the Province of Ontario, noted in her formal response to a question related to the compliance with the Freedom of Information and Protection of Privacy Act concerning the privacy and security of personal information collected by the Ministry of Natural Resources being stored in the US that: "to the extent that the data owner retains the encryption keys, the location of the encrypted data is a secondary issue."

In other words, if the encrypted data leaves the jurisdiction, but the keys remain under the data owner's direct control, the level of protection can be sufficient in terms of data residency requirements.

However, this model also implies that the data encryption scheme is maintained externally and independently of the cloud service provider's environment, and that data is encrypted before it is sent to the cloud.

Persistent Encryption and Data Residency
The most effective method to address the jurisdictional and residency requirements of data processed by third-party services is via control of encryption keys and the application of persistent encryption. By applying persistent encryption, data that is encrypted at the boundary of the network remains encrypted even when processed and stored within a cloud service provider environment. As a result, persistent encryption ensures that data is never decrypted when in a third-party's environment and the ability to access useable data remains solely with the organization that holds the encryption key.

Therefore, businesses can comply with jurisdictional and residency requirements by virtue of keeping the encryption keys within the jurisdiction regardless of the actual physical location of the data. Laws relating to data residency are now undergoing a historic transition from the old paradigm where it mattered where the data was physically located to the new paradigm where it only matters where the encryption keys are located.

With the application of persistent encryption, control of the keys in combination with encryption across the data lifecycle - in transit, at rest and in use - provide the foundation to satisfy requirements for control and adequate safeguards for the privacy of personal information. Although the encrypted data may leave the physical borders of a specific country, the data is always fully encrypted while outside of the defined jurisdiction. As the keys are retained within a business's legal jurisdiction, the data cannot be accessed or read until it returns to the physical borders in which the organization resides.

Global Pharmaceutical Company Case Study: Cloud Data Ownership and Control Concerns
The following example depicts a privately held multinational pharmaceutical company that engages in research, development, production, and marketing of prescription and over-the-counter medicines and healthcare products. The company has thousands of employees across the globe, as well as multiple subsidiaries and entities.

The company's IT procurement and deployment approach follows a decentralized model in which each entity subsidiary hosts its own servers and datacenters. There are three functional organizational pillars maintained within its technology and IT services division: Technology Planning; Enterprise Architecture and Data Services; and Production Services. The divisions are staffed by IT engineers with managed services providing support for thousands of clients across a multitude of sites. Existing infrastructure includes hardware, software, services, and virtualization from multiple top vendors including Microsoft, VCE, Dell, Oracle, EMC and VMware.

The pharmaceutical company had adopted several cloud-based services for applications that do not process or store critical or regulated business information, such as Web conferencing, spam filtering, compliance training and tracking, and travel and expense management, but was seeking to expand its cloud computing usage to business critical applications by moving low value servers to cloud providers, as well as moving commodity applications such as email to the cloud.

Concerns about the loss of control and ownership of corporate data, however, stood in the way of realizing the increased efficiencies and operational benefits possible through broader adoption of cloud-based services. These concerns were related to:

  • Compliance with international data residency requirements that preclude data leaving a jurisdiction in the clear
  • Compliance with regulations governing the security, privacy and confidentiality of healthcare data
  • Safeguards to limit exposure of its intellectual property when it is stored and processed in the cloud
  • Lack of visibility into service provider responses to information subpoenas that can result in a breach of confidentiality or loss of data

Addressing Residency and Unauthorized Disclosure
While the cloud service provider could attest to the security of the environment based on a framework like the Cloud Security Alliance's Cloud Control Matrix, the global pharmaceutical company required an independent mechanism to protect its intellectual property while resident in the cloud. A common challenge to cloud migration within the pharmaceutical/healthcare industry is confidentiality and sensitivity to a service provider's compliance with government subpoenas as pharmaceutical and healthcare companies maintain sensitive information related to research, clinical study results, and personal medical history. Therefore, it is critical that sensitive information remain under the company's control, without any forfeiture of attorney-client privilege.

In a typical scenario, if a company stores sensitive data in the cloud, and the cloud service provider is faced with a subpoena or other request from the government, they must comply and disclose the company's data to the federal government body. The provider may notify the company after the fact, or in cases of blind subpoenas, not at all.

The Solution
The pharmaceutical company decided to use persistent encryption technology to specifically address the migration of their email infrastructure to the cloud. Deployed as an on-premise gateway, this enabled the company to successfully address the jurisdictional and residency requirements of email data hosted in the cloud, as the company maintains control of the encryption keys - and business data is encrypted when it passes through the gateway's proxy at the boundary of the network and remains encrypted even when processed by and stored within a cloud service provider environment.

The persistent encryption technology ensures that data is never decrypted when in a third-party's environment and the ability to access useable data remains solely with the organization that holds the encryption key. Therefore, the company is able to comply with jurisdictional and residency requirements by virtue of keeping the encryption keys within the jurisdiction regardless of the actual physical location of the data, as well as ensuring complete ownership and control of that data if faced with a subpoena.

References

http://www.paulmudgett.com/resources/Nevada_Data_Security_Law.pdf

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML

More Stories By Elad Yoran

Elad Yoran is the CEO of Vaultive, Inc. He is a recognized expert on information security market and technology trends. Yoran has 20 years of experience in the cyber security industry as an executive, consultant, investor, investment banker and several-time successful entrepreneur. He is also a member of a number of technology, security and community Boards, including FBI Information Technology Advisory Council (ITAC); Department of Homeland Security Advisory Board for Command, Control and Interoperability for Advanced Data Analysis (CCICADA); and Cloud Security Alliance New York Metro Chapter.

Comments (1) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
veronica321 05/22/13 11:13:00 AM EDT

Great article and rightly said, security is still the biggest concern when moving to the cloud , I came across this interesting piece on cloud computing and cloud security in particular that readers might find interesting 'Cloud risks Striking a balance between savings and security' it talks a great deal about securing the cloud and data residency laws that might interest readers 

Latest Stories
DevOps is being widely accepted (if not fully adopted) as essential in enterprise IT. But as Enterprise DevOps gains maturity, expands scope, and increases velocity, the need for data-driven decisions across teams becomes more acute. DevOps teams in any modern business must wrangle the ‘digital exhaust’ from the delivery toolchain, "pervasive" and "cognitive" computing, APIs and services, mobile devices and applications, the Internet of Things, and now even blockchain. In this power panel at @...
More and more brands have jumped on the IoT bandwagon. We have an excess of wearables – activity trackers, smartwatches, smart glasses and sneakers, and more that track seemingly endless datapoints. However, most consumers have no idea what “IoT” means. Creating more wearables that track data shouldn't be the aim of brands; delivering meaningful, tangible relevance to their users should be. We're in a period in which the IoT pendulum is still swinging. Initially, it swung toward "smart for smar...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
@DevOpsSummit at Cloud taking place June 6-8, 2017, at Javits Center, New York City, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long developm...
Kubernetes is a new and revolutionary open-sourced system for managing containers across multiple hosts in a cluster. Ansible is a simple IT automation tool for just about any requirement for reproducible environments. In his session at @DevOpsSummit at 18th Cloud Expo, Patrick Galbraith, a principal engineer at HPE, discussed how to build a fully functional Kubernetes cluster on a number of virtual machines or bare-metal hosts. Also included will be a brief demonstration of running a Galera MyS...
"We build IoT infrastructure products - when you have to integrate different devices, different systems and cloud you have to build an application to do that but we eliminate the need to build an application. Our products can integrate any device, any system, any cloud regardless of protocol," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
"We are an all-flash array storage provider but our focus has been on VM-aware storage specifically for virtualized applications," stated Dhiraj Sehgal of Tintri in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Internet of @ThingsExpo has announced today that Chris Matthieu has been named tech chair of Internet of @ThingsExpo 2017 New York The 7th Internet of @ThingsExpo will take place on June 6-8, 2017, at the Javits Center in New York City, New York. Chris Matthieu is the co-founder and CTO of Octoblu, a revolutionary real-time IoT platform recently acquired by Citrix. Octoblu connects things, systems, people and clouds to a global mesh network allowing users to automate and control design flo...
In addition to all the benefits, IoT is also bringing new kind of customer experience challenges - cars that unlock themselves, thermostats turning houses into saunas and baby video monitors broadcasting over the internet. This list can only increase because while IoT services should be intuitive and simple to use, the delivery ecosystem is a myriad of potential problems as IoT explodes complexity. So finding a performance issue is like finding the proverbial needle in the haystack.
Between 2005 and 2020, data volumes will grow by a factor of 300 – enough data to stack CDs from the earth to the moon 162 times. This has come to be known as the ‘big data’ phenomenon. Unfortunately, traditional approaches to handling, storing and analyzing data aren’t adequate at this scale: they’re too costly, slow and physically cumbersome to keep up. Fortunately, in response a new breed of technology has emerged that is cheaper, faster and more scalable. Yet, in meeting these new needs they...
Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at 20th Cloud Expo, Ed Featherston, director/senior enterprise architect at Collaborative Consulting, will discuss the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
When it comes to cloud computing, the ability to turn massive amounts of compute cores on and off on demand sounds attractive to IT staff, who need to manage peaks and valleys in user activity. With cloud bursting, the majority of the data can stay on premises while tapping into compute from public cloud providers, reducing risk and minimizing need to move large files. In his session at 18th Cloud Expo, Scott Jeschonek, Director of Product Management at Avere Systems, discussed the IT and busin...
According to Forrester Research, every business will become either a digital predator or digital prey by 2020. To avoid demise, organizations must rapidly create new sources of value in their end-to-end customer experiences. True digital predators also must break down information and process silos and extend digital transformation initiatives to empower employees with the digital resources needed to win, serve, and retain customers.
The WebRTC Summit New York, to be held June 6-8, 2017, at the Javits Center in New York City, NY, announces that its Call for Papers is now open. Topics include all aspects of improving IT delivery by eliminating waste through automated business models leveraging cloud technologies. WebRTC Summit is co-located with 20th International Cloud Expo and @ThingsExpo. WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web co...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...