Implications for Cloud Computing & Data Privacy

Transcription

1 Implications for Cloud Computing & Data Privacy Diane Mueller Cloud Evangelist, ActiveState

2 Founded million developers, 97% of Fortune 1000 Development, management, distribution & cloud deployment for dynamic languages Cloud Solution: Stackato Private PaaS Some of Our Customers

3 Drivers for Cloud Computing US Patriot Act & Data Privacy Implications for Cloud Computing

4

5 Savings of physical IT costs Faster Deployment Times Higher Levels of Application Availability Reliability & Fault Tolerance Access Anywhere Capacity scales as needs change Improved Time to Market

6 Maintain privacy & confidentiality Preserve intellectual property rights Potential for intervention by foreign governments Manage operational & commercial risks Comply with industry & jurisdictional regulatory requirements

7 Information is no longer in your direct custody or control. handed over to a third party to manage resident in a different jurisdiction or multiple jurisdictions Mass-market cloud services are subject to take it or leave it service agreements Information and data may not be portable you can t take it with you

8 Signed into law in October 2001 Extended in May 2011 grants privileges to access private data in case of suspected terrorist threats significantly increased the surveillance and investigative powers of law enforcement agencies in the United States

9

10

11

12 New powers of surveillance and search/seizure extend to records of anyone (including Foreign Nationals) in the US. Extends to records in the custody of US companies in Foreign Countries Foreign-based subsidiaries of US companies Foreign-based companies with presence in US

13 Cloud Computing is premised on the concept of infrastructure pooling regardless of geographic location. Users may not have visibility in relation to the ultimate location of data. Data may not in fact be pooled in one place could be spread across a cloud service provider's network.

14 Data that is housed or passes through the United States is vulnerable to interception by authorities applies to: Everyone living and visiting the country, including any foreign national who spends time on U.S. soil as part of a visa arrangement. Companies based in the U.S., whether they are headquartered there or not

15 BBC Worldwide HQ in London also has studios and offices in the U.S making these U.S.-based offices vulnerable to the Act.

16 National Security Letters can involve a gag order prevents the organization from ever disclosing receipt of a letter requiring the handover of records. Vendors cannot provide a guarantee that their customers would be informed This contravenes the EU Data Protection Directive which requires organisations to inform users when personal information is disclosed.

17 Regulators may restrict the international transfer of certain kinds of data, even require certain kinds of data to be kept separate and not be intermixed with other data. Examples: Australia Canada EU HIPA

18 MSFT could not guarantee the sovereignty of European customers data in its data centers If the US Patriot Act was invoked, MSFT would be compelled to hand data over to US authorities and would keep the data transfer secret This contravenes the new EU Data Protection Directive which requires organizations to inform users when personal information is disclosed Extremely difficult for US HQ companies to refuse to comply with the Patriot s Act in deference to the EU Directive

19 CEO, Reinhard Clemens "The Americans say that no matter what happens I'll release the data to the government if I'm forced to do so, from anywhere in the world, certain German companies don't want others to access their systems. That's why we're well-positioned if we can say we're a European provider in a European legal sphere and no American can get to them."

20 Remains responsible for protecting and safeguarding information Needs to make informed choices Take be a risk-based approach What is the sensitivity of the information? What is the risk to the data? What role does the jurisdiction play in that risk? If the risk is high and the safeguards cannot be assured, then don t use the service provider

21

22 Own the infrastructure Run your own cloud in your data center Host your own services Minimize the number of layers between you and the NSL Minimizes US Patriot Act effect

23 Keep all your data within your own firewalls Avoids the Gag Issue If the US Gov t wants information they have to ask you, not some cloud provider Keep all your data within secure containers Multi-tenancy Security by Isolation Ensure Privacy within your organization Encrypt your data when you transmit it beyond your firewalls Control & Manage your own resources

24

25 Greater oversight & control Maintaining security of data Greater control over computational resources Exclusive to an organization Managed either by the organization or a third party Hosted in the organization s data center or outside

26 Applications (SaaS) Application Middleware/Platform (PaaS) Infrastructure (IaaS)

27 IaaS Layer: Gives you an Elastic Playground Pooled Resourcing Shared Operating System Shared Services Security by Unix User Separation

28 PaaS Layer: gives your applications individual Playgrounds Everyone gets their own Operating system No Shared Services Security by Isolation Secure Multi-tenancy

29 Applications need more than just infrastructure! Applications Need Secure Environments Applications need middleware components: languages, modules, databases, web servers Apps don t deploy themselves A PaaS automatically configures and deploys the middleware, so your SaaS apps practically deploy themselves

30

31 Maintain accountability and ensure security Keep your & your clients data private & secure Ensure that you are notified requests for information based US Patriot Act Still get all the benefits of cloud (elasticity, pooling resources within your organization, with faster time-to-market) on a private cloud Make migration and deployment with private cloud easier with a private PaaS

32 Hybrid Clouds Private Clouds Public Clouds Your App

33

34 (#stackato) Blog: #stackato IRC channel on Freenode