4/30/2014. Avoiding no to cloud computing. What is the Cloud Data as a Driver Regulations Avoiding No. Cloud Computing

Transcription

1 Avoiding no to cloud computing A Primer for Compliance Professionals Janet Himmelreich, CCEP, CCEP-I Head, Client Compliance Services Centre of Excellence BT Global Services Al Silipigni SVP, CHIEF PRIVACY OFFICER --- HSBC North America & US Bank NY Regional Meeting Society of Corporate Compliance and Ethics May 16, 2014 Cloud Computing What is the Cloud Data as a Driver Regulations Avoiding No 3 1

2 The magic of the cloud in computing Cloud computing encompasses any subscription-based or pay-per-use service that, in real time over the Internet, extends IT's existing capabilities. Rather than depending solely on hardware owned and operated by you with inherent limitations of money and space, the Cloud is a service that can be purchased based on how much power, space and time you need when you need it The Cloud does things that can t be done in a traditional data center in that whether it is your own infrastructure or some type of shared infrastructure, the user has access to data storage, processing and sharing that is provided virtually and therefore is unlimited in it s power and ability to scale up or down as needed by an authorized user on a self-serve basis Private Cloud: an organization builds its own cloud infrastructure. Community Cloud: several organizations with shared interests build their own cloud infrastructure. Public Cloud: cloud infrastructure is provided for use by the general public. Hybrid Cloud: the organization uses some combination of the above to meet its cloud computing needs. So what is the Cloud as a technology? A typical cloud model itself is a three-tiered structure based on (1) infrastructure-as-a-service (IaaS); (2) platform-as-a-service (PaaS); and (3) software-as-a-service (SaaS). Infrastructure and software are particularly important for corporate counsel to master. Provisioning infrastructure from a third-party cloud vendor allows corporations to take advantage of processing, storage, networks, and other fundamental computing resources on which its computers can run software, including platforms, Operating Systems, and applications. As the National Institute of Standard and Technology definition of the cloud makes clear, [t]he consumer does not manage or control the underlying infrastructure, but has control over what to deploy on it. An example of IaaS is Amazon s Elastic Compute Cloud (EC2). Data Security And The Imperative of Private Clouds Ken Kerschberg, Forbes Contributor Sept 9, 2011 Why businesses are embracing Cloud 2

3 Software as a service (SaaS) Users are provided access to application software and databases. Cloud providers manage the infrastructure and platforms that run the applications. SaaS is sometimes referred to as "on-demand software" and is usually priced on a pay-per-use basis. SaaS providers generally price applications using a subscription fee. Platform as a service (PaaS) Cloud providers deliver a computing platform including operating system, programming language execution environment, database, and web server. Application developers can develop and run their software solutions on a cloud platform without the cost and complexity of buying and managing the underlying hardware and software layers. Infrastructure as a service (IaaS) Most basic cloud-service model - offer computers physical or (more often) virtual machines and other resources. Can support large numbers of virtual machines and the ability to scale services up and down according to customers' varying requirements. Cloud Service Models 7 Drastically reduced capital expenditures for hardware. IDC* predicts that cloud computing will reduce the cost of owning IT infrastructure by 54 percent. Decreased costs of computing power and the ability to scale or decrease service at almost no marginal cost beyond that of the on-demand services, platforms or infrastructures themselves. Few (if any) upgrade purchases. Decreased maintenance and reduced IT support costs as a result of not having to maintain staff to keep infrastructure and software running locally. *IDC = International Data Corporation as quoted by Ken Kerschberg, Forbes Contributor Sept. 9, 2011 Why your IT Dept. loves the cloud Click to build / click to buy Convenience, business agility Assured service 99.95% service SLA Sustainable Use 30% less energy Public cloud attributes Private cloud attributes OPEX model No capital investment required Flexible Align dynamically to business needs Services include virtual servers, virtual infrastructure, flexible networks and storage shared across multiples locations with security separation maintained Inherently resilient ISO certified Lower total cost of ownership Driving savings of up to 40% An approach to the Cloud design 3

4 What a Compliance Professional needs to know Data ultimately resides on hardware somewhere Hallmark of Cloud is that the data is fragmented and stored in the most expeditious available place based on the algorithms that take the fragments to the next available place This is the biggest argument against the cloud the controller does not know where the data actually resides Legal considerations Cross border transfers Who owns the data in the case of a request in a legal case depends on where the data resides Availability zones may be restricted Global access and local control by architecture Encrypted data (by policy) may be moved anywhere the controller so desires BT solution maintains the data in an Availability Zone that is defined by geographic location and defined storage and capacity so that the data location can be pinpointed to a specific data centre though not the specific piece of hardware Even using the Cloud the data is somewhere Data According to Merriam Webster dictionary Data is Facts or information used usually to calculate, analyze or plan something information produced or stored by a computer Documents Critical Sensitive Personally identifiable Intellectual property Electronic Regulated Data 4

5 As Directors continue to be highly mobile, globally dispersed and engaged on multiple boards, their companies need to make sure they have both systems and processes in place to assist and protect them and their communications. They print the materials you send and carry them with them to make notes etc..., setting up the risk of documents being lost, stolen or misplaced: 2012 Survey 50% of respondents indicated Board communications are still managed on paper via courier delivery or by commercial 60% reported that Board members retain Board materials on their private mobile devices Over 2/3 of Board members reported printing materials to read while in transit; only 1/3 of respondents were confident that Board Members followed the document destruction policies of your company particularly around sensitive Board materials That almost 100% of the respondents to the Governance Survey reported their Board members had reported a lost mobile device in the last year. Do you know. If your organization provides Board books and what they contain? Whether your Board members use their own private cell phones, Ipads, addresses for Board communications? (BYOD) How your materials get to your Board members? Who wants Data - your Board Enormity of sources of data and increasing ability to capture it has led to Big Data / Enhance Analytics and the discipline of Data Analytics. The bigger the data sources and desire to extract the next nugget the more it drives the need for Cloud Computing Frequent Uses for Data Improve efficiency sensors, cameras, Point of Sale terminals, GPS, etc. all used to analyze and apply to operations Derive the next area of demand to respond in new products and services Lens to discover new markets or opportunities (current products and services as well as new) Language through which a company speaks to itself Helps companies broaden their understanding of what they need to do to succeed in other than their current business data informs strategy Thus, protecting data = protecting profits and intellectual property Attracts investment Spawned a new role Chief Data Officer Regulatory environment is struggling to keep up with the demand Who wants Data - Marketing So that s where the regulations come from! 5

6 In general, Data Protection laws protect an individual s personal information from outside access ISO Privacy Data Protection Standards privacy is an integral part of data protection Data Protection Act of 1998 UK law that delineates 8 Data Protection Principles that implemented the EU Data Protection Directive 1995 Data Privacy Principles rely on Data Protection Directive 95/46/EC regulates the processing of personal data and the free movement of that data through the European Union Each country within the EU must adopt it s own regulations to implement the Directive Key definitions are consistent: Sensitive Personal Information racial/ethnic origin; political opinions; religious convictions; union membership; health; sex life Controller whoever has control over how the data is handled and who is acting on their behalf Processor whoever manages the data on behalf of a Controller according to the directions of the Controller with appropriate security measures to prevent unauthorized access and assures data is not held longer than required Data can be transferred to other countries only if local legislation permits The basic principle is that data should not be transferred where Data Protection is inadequate or nonexistent Individuals have the right to see all the information that is obtained and transferred EEA European Economic Area EU countries + Iceland, Lichstein and Norway Regulatory Basis - EU No comprehensive Data Protection Guidelines Sector basis Combination of legislation, regulation, self-regulation Signatory to OECD (Organization for Economic Cooperation and Development) Guidelines from 1981 Safe harbor 2000 US Dept of Commerce in consultation with European Commission after EU Data Protection was passed Mechanism for US company s to be offering adequate protection Transactions requiring the transfer of personal data from the EU to non EU states Example regulations: HIPAA Security 1996 COPPA - Children s Online Privacy Protection Act 1998 FACTA - Fair Audit and Accurate Credit Transaction Act 2003 Guidelines: Payment Card Industry (PCI) Data Security Standard; adopted by the industry in 2006 Regulatory Basis - US 6

7 Brazil- constitutional right to privacy is part of the civil rights guaranteed Australia Federal, State and Sector-specific Privacy regulations in place Canada Federal Personal Information Protection and Electronic Documents Act and individual provinces have provincial laws in place India June 2011 new privacy rules adopted includes obtaining written consent from data subjects before certain activities are undertaken Mexico July 2010 new privacy regulations were adopted including establishing fines and prison penalties for serious violations Republic of China (Taiwan) 1995 law enacted for Computer Processed Personal information Russia Since 2005 also series of laws to protect personal data that is processed by means of automation equipment Regulatory Basis - Other The real world of Boards and CEOs and data The perils of saying no New reality -- Data is part of business strategy who has it and what can we do it are key business imperatives for all companies today. Data assists in defining new products, opportunities and markets. Data about competitors, risks and threats are core pieces of information that are used to analyze and plan. Data is what finance teams thrive on in order to figure out revenue optimization methods (and profit and tax options etc.. etc..) Compliance Officers are part of the business management of the organization and need to understand what data is being used and for what in order to assure proper monitoring, risk assessment, collaboration with Internal and External audit, requirements for vendors, training. Privacy Officer is responsible for the elements of the information systems and compliance programs which analyze the data, define how it can be used and where it can be stored or processed. Every Organization needs to define Roles and Responsibilities for themselves while the title may change, reporting lines may move these are activities someone must be responsible for Isn't this the Privacy Officer s Job? Yes and 7

8 1. Assure you are part of the planning and evaluation team.ask your IT Head to brief you on the Cloud do you use it? For what? If not are you planning to? 2. Ensure you have a current and relevant Data Protection policy that is trained on regularly. 3. Institute a secure Board web portal for members that does not allow downloads unless the data is encrypted educate them as to the risk of paper documents left in a taxi that front page nightmare stuff they worry about! 4. Cloud is about capture, storage, processing and moving data all BAU requirements remain. No exceptions for Cloud. 5. Know where your data is Cloud providers load balance globally you may contract with provider in India, data is US customers, and servers in HK. Avoiding No now Janet Himmelreich, CCEP, CCEP-I Head, Client Compliance Services Centre of Excellence BT Global Services janet.k.himmelreich@bt.com Al Silipigni SVP, CHIEF PRIVACY OFFICER -- HSBC North America & US Bank Al.R.Silipigni@US.HSBC.COM Contact us 8