We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byAmira Valley
Modified over 2 years ago
1© Copyright 2010 EMC Corporation. All rights reserved. Privacy, Assessments, and Cloud Wayne Pauley EMC Corporation UMass Lowell November 3, 2010
2© Copyright 2010 EMC Corporation. All rights reserved. The Focus Area Cloud Computing –Economic Drivers for the Enterprise –Top Concerns: Security & Privacy Privacy & Security –Relatively New Area of Research –Challenges Exacerbated Shared Resource Model Highly Automated Self-Service Loss of Control –Regulatory vs. Self-Regulated? –Lifecycle Needed Starts with Assessment Adds to Privacy Knowledge Image from: https://www.expresscertifications.com/ISC2/
3© Copyright 2010 EMC Corporation. All rights reserved. The Justification In the context of the enterprise – Smith (2004) stated that private information relates to information that companies value as intellectual property, information about their customers, and their employees. Smith (2004) also stated that the enterprise is driven to improve privacy protections based on an external force such as changes in regulations or a breach. Cloud computing is an emerging technology that holds promise to replace traditional client-server architectures by providing new economic incentives for the enterprise (Foster, Zhao, Raicu, and Lu, 2008). Yee (2009) defined a requirement that the privacy standard for one provider must be maintained when information flows and information is stored potentially by another provider. Clarke (2009) suggests that privacy is a strategic variable to the enterprise and that Privacy Impact Assessments (PIA) adoption is an element of cogent management. Yee (2009) defined the providers obligation to build in provisions that gives users control over the providers collection, retention, and distribution about he user.
4© Copyright 2010 EMC Corporation. All rights reserved. Research in Progress Position Paper –Risk Assessment as a Service (March,2010) –Co-authored with Dr. Burton Kaliski Empirical Studies –Cloud Service Provider Transparency (May, 2010) –Privacy Risk Assessment Methodologies in the Cloud (Nov./Dec., 2010)
5© Copyright 2010 EMC Corporation. All rights reserved. Risk Assessment: Definition Quantitative and/or qualitative valuation of risk in a specific context against a given threat with a probability of occurrence Includes system characterization, threat assessment, vulnerability analysis, impact analysis, and risk determination Many well-established standards for assessing security; some for privacy as well
6© Copyright 2010 EMC Corporation. All rights reserved. Risk Assessment in the Cloud: Challenges Cloud Characteristic (per NIST) Challenge On-Demand Self- Service Human interaction is replaced with automated controls – which now must be trained to pass security audits Broad Network Access Endpoints can be any type, location, not just a pre-approved set Resource Pooling Dynamic allocation, virtualization mean that resources are not known in advance Multi-tenancy brings threats in house Location independence introduces significant diversity in applicable laws
7© Copyright 2010 EMC Corporation. All rights reserved. Risk Assessment in the Cloud: Challenges Cloud Characteristic (per NIST) Challenge Rapid Elasticity Cloud bursting engages multiple levels of sub-providers, who must also be assessed Measured Service Metering information has more detail about multiple tenants – a higher-value target Economics of the cloud also complicate assessments: cloud infrastructures will be constantly changing due to market growth, M&A – risk assessments will rapidly become stale cost competition may discourage investment in risk assessments while increasing risk-taking
8© Copyright 2010 EMC Corporation. All rights reserved. Proposal: Risk Assessment as a Service Approach: an automated risk score (e.g. like credit score) –for a given tenant or application – or for general use –pre-assessment and on-demand Modes: provider self-assessment, third-party audit, consumer assessment (non-privileged) –internal and external agents involved Policy-based IT management translates assessment of underlying dynamic resources into overall score
9© Copyright 2010 EMC Corporation. All rights reserved. A Possible Architecture
10© Copyright 2010 EMC Corporation. All rights reserved. Transparency Challenges Self-Serviceness –Lowest Cost at the Expense of Customer Service –Portal tells part of the story Manual Methods –Time Consuming –Much of the data not publically available –No scoring system
11© Copyright 2010 EMC Corporation. All rights reserved. Transparency Results Self-Service Method Basic Scorecard Four Areas –Security –Privacy –Audit –Service Level Findings –Manual method time consuming –Results varied based on public information & centralization of information –Insufficient information via self-service method
12© Copyright 2010 EMC Corporation. All rights reserved. Privacy Assessments Privacy Impact Assessments –Questionnaire based pre- assessment –ISO/IEC 22307:2008 –DHS/DOJ PIA Template –Shared Assessments Assessment NameAuthoritySecurity or PrivacyPre or Post Assessment ISO/IEC 27002:2005StandardSecurityPost ISO/IEC 22307:2008StandardPrivacyPre OCTAVE AllegroStandardSecurityPost DHS/DOJ PIABest PracticePrivacyPre Share Assessments Privacy Assessment Best PracticePrivacyPost Security Assessments Subset of questionnaire ISO/IEC 27002:2005 CMU OCTAVE Allegro
13© Copyright 2010 EMC Corporation. All rights reserved. Cloud Privacy Assessment Six Privacy Dimensions Evaluated –Notice, Access and Consent (FIPS) –Permissions, Regulations & Data Flows, Management & Organization Five Cloud Characteristics Scored –On-demand & Self-Service –Broad Network Access –Resource Pooling –Rapid Elasticity –Measured Service Four Phased Approach –External via Self-service –As a Customer via Self-service –As a Customer using customer service chat/ –Survey CSP Security/Privacy Office Three Cloud Providers –Must be IaaS Providers –Offer includes Self-Service
14© Copyright 2010 EMC Corporation. All rights reserved. RAA Theoretical Reference Application Architecture –Application, Web server, & Database –Database has regulated data in it Employee, Customer, and Corporate data Regulated as PII, HIPAA, SOX, & PCI data Size of RAA is Important –Ideally enough data to cross hard-drive boundaries –Enough VMs to reside on multiple servers –Shared across multiple data-centers North American based Providers –Not studying trans-border issues outside US –Scope creep due to expanded regulatory requirements
15© Copyright 2010 EMC Corporation. All rights reserved. Topics for Further Research Automated measurement and analysis for risk assessment –What sensors are needed? What language to use? e.g., CloudAudit defines a dictionary based on common standards Automated adjustment based on the assessment Trust assurances for measurements –Who guards the guards? Effectiveness of automated assessment vs. traditional approaches Defining what is Privacy Knowledge in the enterprise Practical Privacy Assessment & Privacy Scoring methodologies
16© Copyright 2010 EMC Corporation. All rights reserved. References Clarke, R. (2009). Privacy impact assessment: Its Origins and development. Computer Law & Security Review, 25, Foster, I., Zhao, Y., Raicu, I. & Lu, S. (2008). Cloud computing and grid computing 360-degree compared. Proceedings of the IEEE Grid Computing Environments, Kaliski, B. S. Jr., Pauley, W. (2010). Toward risk assessment as a service in cloud environments. Proceedings of the 2nd USENIX conference on Hot topics in cloud computing, Pauley, W. (2010). Cloud provider transparency – an empirical evaluation. IEEE Security and Privacy, Smith, H. J. (1994). Managing privacy: Information technology and corporate America. Chapel Hill, NC: University of North Carolina Press. Smith, H. J., Milberg, S. J., & Burke, S. J. (1996). Information privacy: Measuring individuals concerns about organizational practices. MIS Quarterly, 20(2), Tsoumas, B., Dritsas, S., & Gritzalis, D. (2005). An ontology-based approach to information systems security management. In V. Gorodetsky, I. Kotenko, and V. Skormin (Eds.), Lecture Notes in Computer Science, (Vol. 3685, pp ). Berlin, Germany: Springer. Yee, G. (2009). Estimating the privacy protection capability of a web service provider. International Journal of Web Services Research, 6(2),
17© Copyright 2010 EMC Corporation. All rights reserved. Contact Information Burt Kaliski Director, EMC Innovation Network Founding Scientist, RSA Laboratories community.emc.com/people/kalisb community.emc.com/people/kalisb Wayne Pauley Advisory Technical Consultant
18© Copyright 2010 EMC Corporation. All rights reserved.
Collaborative knowledge management A construction case study
Measuring innovation TRAINING WORKSHOP ON SCIENCE, TECHNOLOGY AND INNOVATION INDICATORS Cairo, Egypt September 2009.
Tunis, Tunisia, June 2012 Privacy in Cloud Computing Vijay Mauree, Programme Coordinator, TSB, ITU ITU Workshop on Cloud Computing.
Implementing Business Driven Information Management Practices From Policy to Metadata.
Measuring Innovation in Developing Countries SEMINAR – WORKSHOP ON SCIENCE, TECHNOLOGY AND INNOVATION INDICATORS Gaborone, Botswana.
Notes accompany this presentation. Please select Notes Page view. These materials can be reproduced only with written approval from Gartner. Such approvals.
Workshop: Governance, Risk, Compliance (GRC) & Identity Management , 09:00-12:30, Track: Workshop I Dr. Horst Walther, Kuppinger Cole + Partner.
Measuring innovation SUB-REGIONAL HANDS-ON TRAINING ON SCIENCE, TECHNOLOGY AND INNOVATION INDICATORS Damascus, Syria September.
Clouds: What’s new is old is new… Joseph Alhadeff, VP Global Public Policy; CPO, Oracle.
Manchester Computing Cross Council ICT Conference For e-Science & GRID May 2004 End to End Services to support an e-Science Community Professor M.
1 TECHNOLOGY. 2 Productivity A university President has observed that education is one of the few areas that has not improved productivity in decades.
Examining the Regulatory Landscape Al Berman DRI International NEDRIX Annual Conference October 20, 2009.
Cloud Security Assessment. 2 CoE IT Leadership.- Progress report Introduction »Cloud computing is an approach in which infrastructure and software resources.
John Clark COO, PCI Security and Compliance CCIA Fall Meeting – 7 th October 2011.
1 Chapter 13 Information Technology Economics. 2 Learning Objectives Identify the major aspects of the economics of information technology. Explain the.
© John Beveridge CobiT Update NSAA IT Conference Richmond, VA John W. Beveridge September 27, 2007.
Performance Management Overview Mike Salisbury BPRA Product Manager SunGard Higher Education Pennsylvania Banner Users Group.
Forum on Next Generation Network Standardization Colombo, Sri Lanka, 7-10 April 2009 Forum on Next Generation Network Standardization Colombo, Sri Lanka,
1 This is a little story about four people named Everybody, Somebody, Anybody, and Nobody. There was an important job to be done and Everybody was sure.
Cloud Governance. 2 CoE IT Leadership – Cloud Governance Atos Sphere Advisory Services SAP Regressio n Testing (SaaS) Product Lifecycle Mgmt.(PL M) on.
Work programme 2009 – Info Day European Commission – DG Enterprise & Industry E-M. Engdahl Information Day 16th September 2009 Brussels Kristien Van Goey.
An Overview of Cloud Computing Presented by: Nicholas Kottyan CEO, DataChambers, LLC November 18, ARMA Presentation November 18, 2009.
Abstract Cloud Computing is being projected by several major IT companies such as IBM, Google, Yahoo, Amazon and others as fifth utility where clients.
MDM Strategies for the Global 10,000 Atul Patel Director MDM SAP Asia Pacific & Japan
GLOBAL INNOVATION MANAGEMENT AND VIRTUAL R&D TEAMS.
Intelligent Risk Management & Compliance Cost Reduction Creating a sustainable risk and compliance organization while reducing inefficiency and improving.
Canadas Innovation Strategy: The Innovation Engagement Process and Follow-on Actions Prepared by Lois Stevenson The Innovation Secretariat Policy Sector,
© 2016 SlidePlayer.com Inc. All rights reserved.