In-House Counsel Day Priorities for 2012

Transcription

1 In-House Counsel Day Priorities for 2012 Cloud Computing the benefits, potential risks and security for the future Presented by Anthony Willis Group Head IP and Technology Thursday 1 March 2012 WIN: What in-house lawyers need Knowledge, support and networking for the in-house lawyer community

2 Cloud computing is on the agenda A recent global CIO survey by Gartner found, for the first time, that virtualisation and cloud computing were the top 2 technology priorities for CIOs Gartner predicts that the cloud computing market will be worth US$150 billion by 2013

3 What is Cloud computing? From delivering basic office applications to individuals or small businesses at one end of the spectrum to major bespoke combined service offerings to large corporates & government agencies at the other All models involve IT services which are: o o o o delivered via the Internet de-centralised IT infrastructure truly elastic/scalable on-demand

4 Service models SaaS o e.g. Google documents, Gmail IaaS o e.g. Data Centre with fully managed service (but scalable ) PaaS o e.g. everything but your applications

5 Why all the buzz? The benefits of the Cloud Substantial upfront and ongoing cost savings: costs reductions due to sharing of infrastructures and payas-you-go model Flexibility: users are not limited by their hardware or IT resources Time to market: adoption of new types of services can be almost immediate

6 Key legal risks Overview Privacy/data ownership and protection o personal information o agency/business sensitive information o confidential information Security issues Meeting regulatory requirements Legacy systems Practical issues These are all familiar issues, but placed in a new context

7 Key risks - Privacy There is a perception that the cloud is inherently less secure than traditional IT models of data stored on hardware located at the premises of the customer or a specific data centre

8 Key risks Privacy (cont) The concerns are: Loss of physical control over data Data is often stored in the most cost effective location(s), which may: o o be offshore; and not have privacy protections comparable to those of Australia Compliance with the Privacy Act 1988 (Cth) and the 11 Information Privacy Principles (IPPs) for government and 10 National Privacy Principles (NPPs) for business in relation to personal information Protection of agency/company data (and program/business sensitive information)

9 Privacy - Holding the data internationally Important to understand the implications NPP 4 (Data Security) reasonable steps to protect PI from misuse, loss, unauthorised access, modification or disclosure NPP 9 (Transborder Data Flows) regulates the transfer by an organisation of PI about an individual to a different entity in an offshore location IPPs may also be relevant: IPP 4 storage and security IPP 11 limits on disclosure The laws of the offshore location where the data is held may also apply to the data

10 Addressing the privacy risks Investigate and understand the mechanisms and protections your supplier will use to protect your information Ensure that your cloud services contract: o contains appropriate obligations on the supplier to safeguard all personal information and relevant indemnities o clearly defines who holds the rights to the data being held in the cloud o places obligations on your supplier to only store your data in nominated countries which you believe have privacy protections comparable with Australian privacy law

11 Privacy - Proving compliance Ensure that your cloud services contract gives you access and audit rights to verify compliance with promised security mechanisms Exercise those rights Ensure your customers are informed of and consent to their data (ie personal information) being processed and/or stored in the cloud

12 Privacy Future Developments Proposed reforms Offshore transfer of personal information o Transferee to remain liable o Guidance to be prepared by Privacy Commissioner

13 Key risks - Security Less control over IT infrastructure Reliance on cloud provider to ensure that the information is kept secure

14 Addressing the security risks Ensure that: o all required security arrangements are reflected in the cloud services contract o you have (and use) access and audit rights to verify compliance Consider use of private or shared cloud (eg G-cloud)

15 Addressing the security risks (cont) Consider alternate forms of cloud computing such as 'private clouds' and 'shared private clouds' (in contrast with the more common 'public cloud - eg G-cloud). Those models may: o o o Deliver many of the benefits of cloud computing Keep IT infrastructure within the customer's physical or virtual control or within a specified geographical boundary Present fewer (or more acceptable) risks than a public cloud model

16 Key risks - Regulatory Certain regulated entities, such as APRA regulated entities and AFS licensees, have additional IT security and operational requirements For example, of relevance to cloud computing is PPG 234 Management of security risk in information and information technology which provides high level guidance for regulated entities as to how they should address the issues of IT security Specific requirements for health records Meeting Archives Act and other record keeping requirements

17 Addressing the regulatory risks PPG234 recommends that disaster recovery arrangements should seek to ensure that an Australian regulated entity maintains control over assets that relate to the Australian operations through: odocumentation identifying the relevant assets osufficient segregation to allow separation of assets if required ocontractual protection to ensure access to assets A regulated entity should ensure that using a particular cloud computing services model will meet its obligations The same sort of approach is probably relevant to government

18 Key risks - Practical Performance obligations and service levels Interoperability Disaster recovery (if not mandated by regulation) Using your existing software in the cloud (licence rights and fees)

19 Addressing the practical risks Usual best practice IT contract principles apply: contract should describe the supplier s performance obligations and set out mechanism to ensure performance and to deal with non-performance - observe SMART principles Note exclusions of liability eg due to internet unavailability

20 Addressing the practical risks (cont) Confirm interoperability: will your retained IT and communications infrastructure be appropriate to connect to the supplier s cloud? Contractual disaster recovery and business continuity processes and infrastructure: ohelp ensure service continuity and protect against data loss otraditional forms of disaster recovery are not always possible or appropriate - ask supplier to explain their processes and infrastructure oensure your contract places appropriate obligations on the supplier Software licence rights and fees for use in the cloud

21 Where to from here? Before you jump into the Cloud Do your homework! Take time to investigate and understand: The types (eg personal / sensitive / confidential / health records) and sensitivity of the data to be put into the cloud Your obligations (eg contractual, privacy, regulatory, confidentiality) with respect to the data Do the terms of your existing software licences permit moving your software into the cloud? Are there any consequences for the licence fees?

22 Where to from here? Before you jump into the Cloud (cont) Where is your supplier s infrastructure and data centre based and where (i.e. in which country) will your data be stored? Will your data be subject to potential access by foreign governments (under laws such as the US Patriot Act)? What security protections will the supplier use to protect your data? Reputation/track record of your supplier how reliable are they?

23 Australian Government Publications Australian Government Data Centre Strategy DoFD, 3/10 Cloud Computing Strategic Direction Paper - Opportunities and applicability for use by the Australian Government V1.0 - DoFD, 4/11 AGIMO Circular - Cloud Computing Policy and Cloud Computing Strategic Direction -DoFD, 4/11 Cloud Computing Security Considerations - Defence, ISCSOC, 12/4/11 A Checklist for Records Management and the Cloud - NAA, 2011 Better Practice Guide: Negotiating the cloud - legal issues in cloud computing agreements - DoFD, 2/12 Better Practice Guide: Financial Considerations for Government Use of Cloud Computing - DoFD, 2/12 Better Practice Guide: Privacy and Cloud Computing for Australian Government Agencies - DoFD, 2/12

24 Checklist for Records Management and the Cloud Lists the requirements of the Archives Act for 'records' which might be stored in the cloud, and includes a checklist to ensure that Records should be: authentic, accurate and trusted complete and unaltered secure from unauthorised access, alteration and deletion findable and readable related to other relevant records

25 Better Practice Guide: Negotiating the cloud - legal issues in cloud computing agreements Key legal issues identified (a checklist at the end) are: compliance with rules (e.g. CPGs, particularly MPPs) protection of information (e.g. privacy, security, auditing) liability performance management (e.g. service levels) ending the arrangement (e.g. termination scenarios) dispute resolution risk of harmful code (e.g. viruses) change of control of the cloud (and third-party access) transborder data transfer unilateral variation of the terms by the provider

26 The G-Cloud What is it? UK cross government initiative to adopt cloud computing to procure, manage and deliver public sector ICT. Government Cloud is not a single, government owned, entity; it is an on-going and iterative program of work which will enable the use of a range of Cloud services, and changes in the way we procure and operate ICT, throughout the public sector. (Cabinet Office Cloud Strategy document) CloudStore online portal / open marketplace for UK agencies to procure, use, review and reuse the 'off-the-shelf' ICT services on a 'pay-as-you-go' basis The CloudStore was built by UK SMB Solidsoft and is hosted in the cloud, running on Microsoft Azure.

27 G-cloud services Services available via the CloudStore include: word processing system hosting enterprise resource planning electronic records management customer relationship management office productivity applications

28 G-cloud - Objectives Bring a broader range of ICT suppliers to the UK government market, particularly SMEs, by simplifying and reducing procurement costs Increase flexibility in procurement contracts by reducing the length of procurement and implementation cycles and contracts Achieve large, cross government economies of scale Deliver ICT systems that are flexible and responsive to demand to support UK government policies and strategies Use new technologies to deliver faster business benefits and reduce cost Meet environmental and sustainability targets Achieve cost savings as a result of: rationalising and consolidating government data centres; moving from high-cost, customised ICT solutions to low cost, standard, interchangeable services where quality and cost is market driven; and price transparency.

29 G-cloud current status Went live on 19 Feb 2012 with 257 suppliers, 50% SMEs. Suppliers include: Large: Capgemini, EMC, Google, Fujitsu, HP, Microsoft, PWC, SAP, Sage, IBM, BT, Virgin Media Open source: RedHat, OpenText, Rackspace, Huddle Absent: Oracle To be reopened to new suppliers in the next few weeks CloudStore currently a beta site. Buyers cannot purchase services directly and are directed to a 'personal shopper' to guide them through the G-Cloud procurement process 6 March 2012, Maritime and Coastguard Agency the first customer - purchased Agile software to help run its Future Coastguard Program MCA said it was 'simple and fast' and done in less than 24 hours

30 Questions?