Information Technology:
This Year’s Hot Issue - Cloud Computing
National Institution of Standards and
Technology (NIST) Working Definition
National Institution of Standards and Technology (NIST) defined Cloud computing as a model forenabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with
minimal management effort or service provider interaction.
There currently are three basic service models, delivered through public, private or hybrid delivery models.Public Cloud Service Models
Software as a Service (SaaS)
• Use provider’s application over the Internet
Platform as a Service (PaaS)
• Deploy enterprise-created applications in a cloud
Infrastructure as a Service (IaaS)
• Rent processing, storage, network capacity, and other fundamental computing resources
The Cloud is Wonderful, but…
How can I maintain control of my data in the cloud?
What if I want to change cloud vendors? How can I verify my data is “destroyed” when terminating a service provider?
What happens if my service provider goes out of business?
How can I comply with security best practices, internal governance and compliance rules in the cloud?
How can I guarantee only I have access to my data?
Information is no longer in your direct custody or
control… data is handed over to a third party to manage
Cloud Providers often use third party providers
themselves, creating further distance to data use and potential storage
Information may be resident in another jurisdiction or multiple jurisdictions
Multiple third parties have access to physical devices and processing environment, even if virtually
segregated:
□ Cloud providers sometimes implement security assuming that those outside of their cloud are evil, and those inside are good… but what if those inside are also evil?
Protection of personal information should consider the impact of the cloud
on each phase
Is data commingled with information from
other organizations that use the same vendor?
What third parties can access my information?
□ In some jurisdictions, governments may have the right and
ability to search through data without necessarily notifying the data owner.
Does the cloud provider itself has any right to
see and access customer data?
□ Some vendors today track user activity for a range of
purposes, from sending targeted advertising to improving services.
How long is personal information retained in
the cloud?
Which retention policy governs the data?
Who enforces the retention policy in the cloud,
and how are exceptions to this policy (such as
litigation holds) managed?
Does the customer own the data, or the
vendor?
How does the cloud provider destroy data at the
end of the retention period?
Cloud storage providers often replicate the data
across multiple systems and sites:
□ How do you assure the vendor didn’t retain additional
copies?
□ Did the vendor really destroy the data, or just make it
inaccessible to the organization?
□ Is the vendor keeping the information longer than necessary
so that it can mine the data for its own use?
How do organizations ensure that their PII is
destroyed by the vendor at the right point?
Trade Secrets
Privileged Information
Access by Governmental Entities
Export Control Issues
Approaching Privacy in the Cloud
Sensitive Data
Define the Workload
(isolate a function)
Classify the Relevant Data Assess the Associated Risks Determine Legal and Regulatory Requirements Define Appropriate Establish Contractual Obligations
The original custodian is responsible for protecting and safeguarding the personal information
The original custodian must make informed choices about data handling, including what
services and providers to use for its processing
Should be a risk-based approach
□ What is the sensitivity of the information?
□ What is the risk to the data?
□ What role does the jurisdiction play in that risk?
If the risk is high and the safeguards cannot be assured, then don’t use the service provider
Threshold Questions/Issues
Where and how will users access the cloud?
How secure is the cloud provider?
□ Does it have incident response, notification and remediation processes?
□ Are its servers in a secure facility?
□ Does it conduct ongoing 3rd party assessments (e.g., SAS 70 Type II Audits) and make these available to customers?
□ Does the provider segregate job duties, limit access to systems, limit access to customers’ data?
□ Does it use strong authentication and robust password policies?
1. Can I see your data center? Ask the vendor to show you their environment and explain their security controls.
2. How do I move my apps to the cloud? Understand the processes and procedures, which may introduce additional security risks.
3. How are my apps and data protected from other users on the same cloud servers? Understand how vendors handle multiple tenants on the same cloud servers how segregation of data and applications is achieved.
4. Can I speak with some of your customers?
Customer references will give you the opportunity to
5. Can I move an existing app from my servers to your cloud without massive reconfiguration? The cloud
vendor's infrastructure is likely different.
6. How do I get my data back? In the event you need to move applications and data back into your data center (or to another cloud vendor), know where is data stored and how you will get it back.
7. How do you address government regulations? It is critical to know how your cloud vendor is handling your data so you can assure regulatory compliance.
8. What will I really pay? Cloud vendors sometimes
leave details out of their cost estimates (e.g., cost of data transfer and set up).
• Avoid take-it-or-leave-it agreements with standard, non-negotiable terms.
• To ensure that your organization’s data is not
inadvertently mingled with that of any other company (especially a competitor), ascertain the provider’s data segregation procedures:
• Ensure that no one other than your organization has access to the data, even in a multi-tenant shared-hosting environment
• Determine how frequently the provider monitors its environment to confirm that data is properly
segregated?
• Cloud provider should have good disaster recovery and business continuity plans
Has cloud provider implemented a security incident response plan (including forensic investigations and remediation procedures)?
How will provider deal with electronic discovery requests?
Will provider sign EU model contract clauses or become Safe Harbor certified if needed?
Does provider have good physical security measures in its data centers (video cameras, key card entry, security
personnel, etc.)?
Does provider conduct background checks on IT administrators who will have access to the cloud?
Does provider have current certifications, as applicable? (e.g., PCI DSS, ISO 27001/02, SAS 70)
