Evolving Security Standards a Challenge for Cloud Computing, Expert Says | News | ChannelWorld.in

Evolving Security Standards a Challenge for Cloud Computing, Expert Says

Added on Nov 09, 2012 by Ellen Mesmmer

Any enterprise looking to use cloud computing services will also be digging into what laws and regulations might hold in terms of security and privacy of data stored in the cloud. At the Cloud Security Alliance Congress in Orlando this week, discussion centered on two important regulatory frameworks now being put in place in Europe and the U.S.

Are lawyers getting in the way of cloud-based security?

The European Union, with its more than two dozen countries, has had a patchwork of data-privacy laws that each country created to adhere to the general directive set by the EU many years ago. But now there's a slow but steady march toward approving a single data-privacy regulation scheme for EU members.

These proposed rules published by the EU earlier this year may not become law until 2016 or later as they involve approval by the European Parliament, said Margaret Eisenhauer, an Atlanta-based attorney with expertise in data-privacy law.

Europe, especially countries such as Germany, already takes a stricter approach to data protection than the U.S., with databases holding individual's personal information having to be registered with government authorities, and rules on where exactly data can be transmitted. "European law is based on the protection of privacy as a fundamental human right," Eisenhauer said.

The benefit of the proposed EU regulation is that EU countries will, in theory, present a uniform approach instead of a patchwork of rules. The so-called "Article 29 Working Party Opinion" of proposed law specially addresses use of cloud computing, and it presents cloud providers and users with a long list of security-control requirements.

In addition, cloud providers must offer "transparency" about their operations — something some are reluctant to do today, Eisenhauer said.

The proposed regulations also allude to how cloud-based computing contracts should be established. Among many requirements, "you have to state where the data will be processed," Eisenhauer said, plus where it will be accessed from. Customers have the right to "visit their data," she said, which means providers must be able to show the customer the physical and logical storage of it.

Some ideas could become the norm for Europe, such as the concept of the "right to be forgotten," which recognizes that individuals have a right not to be tracked across the Internet, which is often done through cookies today. This "privacy by default" concept means that Web browsers, for example, will likely be required to ship turned on by default to their newer "do not track" capabilities to be used in Europe. In Europe, "there are real concerns about behavioral targeting," said Eisenhauer.

Some European legal concepts suggest that even use of deep-packet inspection — often a core technology used in security products today to watch for signs of malicious activities on the network — could be frowned on under European law, and companies will need to be mindful of how deep-packet inspection is deployed, said Eisenhauer. Even today, use of security and information event management (SIEM) monitoring of employee network usage is something that does not easily conform to European ideas of data privacy.

The proposed EU data-privacy rules require reporting data breaches to the governments and their data-privacy authorities there as well as to the individuals impacted by it very quickly. The regulation also points to possible fines for failing to comply with the proposed regulations, fines that start with 2% of the company's annual worldwide revenue.

However, Eisenhauer adds that Europe's data-privacy regulators in government encourage direct communication about any issues that come up with cloud-service providers and their customers and are far more eager to resolve problems, not mete out punishments.

Many companies, including HP, which is a member of the CSA, are tracking these kinds of regulatory requirements from all across the world that impact the cloud.

"You will have to answer to auditors and regulatory regimes," said Andrzej Kawalec, HP's global technology officer at HP Enterprise Security Solutions. This means that there can't be "monolithic data centers" all subscribing to one mode of operation, but ones tailored to meet compliance in Europe, Asia and North America.

In Switzerland, for example, which is not part of the EU, "the Swiss think the data should remain in Switzerland," he said. But "everyone is getting a lot more stringent" on security and data protection, Kawalec said. Some ideas, such as Europe's notion that even the user's IP address represents a piece of personally identifiable information, are not necessarily the norm in the U.S.

In the U.S., there is also a significant regulatory change afoot related to cloud computing and security and it is arising out of the federal government's so-called FedRAMP program unveiled earlier this year.

FedRAMP is intended to get cloud-service providers (CSP) that serve government agencies accredited for specific security practices over the next two years. Although no CSP is yet certified, according to Chris Simpson, CEO at consultancy Bright Moon Security, who spoke on the topic at the CSA Congress this week, the goal is to get CSPs on board by assuring through third-party assessments that their cloud environments conform to specific security guidelines.

These include practices for incident response in the cloud, forensics in a highly dynamic environment, threat detection and analysis in a multi-tenant environment, and continuous monitoring for remediation, among other things. One FedRAMP idea is that service providers must be prepared to report security incidents of many types to the U.S. CERT and the government agency that might be impacted. The agency would also be reporting to US CERT as well, said Simpson.

If CSPs can't meet the FEDRAMP guidelines, they won't be able to provide services to government agencies, said Simpson. Once certified in FedRAMP though, they'll have a path to contracting for all federal agencies. But if a security incident or data breach occurs that is seen as negligence, that might be cause "to pull that authorization," Simpson concluded.

Ellen Messmer is senior editor at Network World, an IDG publication and website, where she covers news and technology trends related to information security. Twitter: MessmerE. E-mail: emessmer@nww.com.

Editor's Pick
Customer service: The proof is in the numbers

Customer service: The proof is in the numbers

Customer satisfaction increases when you find your greatest weaknesses and then hone in with a laser focus to address them.

5 principles for great vendor relationships

5 principles for great vendor relationships

Unhappy with your vendor? Challenge them to commit to a strategic relationship. And don’t hesitate to move on if they don’t.

Services is a Multi-Pronged Strategy: Jayanth Gojer, Vitage Systems

Services is a Multi-Pronged Strategy: Jayanth Gojer, Vitage Systems

Services is the goldmine for us, asserts Jayanth Gojer, COO of Bangalore’s Vitage Systems.

We Help Customers Effectively Integrate the SMAC Stack: Pankaj Ratra, Path Infotech

We Help Customers Effectively Integrate the SMAC Stack: Pankaj Ratra, Path Infotech

Customers need applications to effectively adopt and integrate the SMAC stack and we help them achieve the objective, says Pankaj Ratra, Director-Sales & Marketing, Path Infotech

How Ujjivan is Using a Mobile App to Uplift the Underprivileged

How Ujjivan is Using a Mobile App to Uplift the Underprivileged

Enough is said about Digital India. But it’s actually happening here and now. Ujjivan Financial Services, a microfinance company, is leveraging a mobile app to make sure that its underprivileged customers get loans real quick in order to grow their businesses.

Latest Videos
Cloud Computing is Not Hype, But Real: Channel Partners

Cloud Computing is Not Hype, But Real: Channel Partners

Cloud Computing has come out of the hype cycle and is now the defining point for enterprise IT, channel partners observe, about the potential for cloud, cloud services and the financing models around cloud computing. 

Services is a Multi-Pronged Strategy: Jayanth Gojer, Vitage Systems

Services is a Multi-Pronged Strategy: Jayanth Gojer, Vitage Systems

Services is the goldmine for us, asserts Jayanth Gojer, COO of Bangalore’s Vitage Systems.

We Help Customers Effectively Integrate the SMAC Stack: Pankaj Ratra, Path Infotech

We Help Customers Effectively Integrate the SMAC Stack: Pankaj Ratra, Path Infotech

Customers need applications to effectively adopt and integrate the SMAC stack and we help them achieve the objective, says Pankaj Ratra, Director-Sales & Marketing, Path Infotech

How Ujjivan is Using a Mobile App to Uplift the Underprivileged

How Ujjivan is Using a Mobile App to Uplift the Underprivileged

Enough is said about Digital India. But it’s actually happening here and now. Ujjivan Financial Services, a microfinance company, is leveraging a mobile app to make sure that its underprivileged customers get loans real quick in order to grow their businesses.

How Mobility Has Helped Our Business Grow: Channel Partners

How Mobility Has Helped Our Business Grow: Channel Partners

Indian channel partners share how mobility has been instrumental in growing the business of their customers and how that, in turn, has taken partners' business to another level.

ChannelWorld Research
Why Channels Have Changed Their Go-to-Market Strategy in Six Months

Why Channels Have Changed Their Go-to-Market Strategy in Six Months

According to our SOTM Mid-Year Survey, a majority of Indian channels said their top go-to-market strategy was to offer services in a recurring revenue model—not introducing new technologies, like SMAC, which was their top GTM strategy six months ago.

SOTM Mid-Year Survey 2015: Your Roadmap for the Next 6 Months

SOTM Mid-Year Survey 2015: Your Roadmap for the Next 6 Months

According to the survey, the next six months of the year are going to be eventful. Here are the challenges, emerging technologies and trends that will shape the rest of the year for you.

Big Data, Mobility Top Partners’ Wish List: SOTM Mid-Year Survey 2015

Big Data, Mobility Top Partners’ Wish List: SOTM Mid-Year Survey 2015

According to the ChannelWorld's State of the Mart Mid-Year Survey (SOTM) 2015, big data is the way to go for the enterprise channels for the second half of this year, with 34 percent partners planning to invest in it.

Private Cloud Still Remains a ‘Safe Bet’ for Partners: SOTM Survey 2015

Private Cloud Still Remains a ‘Safe Bet’ for Partners: SOTM Survey 2015

According to the STOM 2015 survey, channel partners who are into cloud computing feel that 42 percent of their business will be generated by private cloud.

Partners Pin Hope on Government, Expects IT Spend to Grow: SOTM Mid-Year Survey 2015

Partners Pin Hope on Government, Expects IT Spend to Grow: SOTM Mid-Year Survey 2015

According to the ChannelWorld's State of the Mart Mid-Year survey (SOTM) 2015, 30 percent of the channel partners believe that IT spend in the government sector is likely to increase in next six months.

No More Baby Steps, Partners Ready to ‘Risk’ Gambling with Disruptive Tech: SOTM Survey 2015

No More Baby Steps, Partners Ready to ‘Risk’ Gambling with Disruptive Tech: SOTM Survey 2015

According to ChannelWorld’s State of the Mart Survey (SOTM) 2015, 43 percent of channel partners say their business will have a ‘high risk appetite’ in the second half of this year.

Channels’ 3 Great Expectations from Tech OEMs

Channels’ 3 Great Expectations from Tech OEMs

Introduced as an individual category under ‘Expectations from tech OEMs’ list in SOTM Mid –Year Survey, ‘transparent deal registration’ emerged as the biggest concern for channel companies in India.

SLIDESHOWS
What Quarterly Earnings Reveal About Top IT Companies

What Quarterly Earnings Reveal About Top IT Companies

As top companies reported their quarterly earnings, we find out what strategy worked best for them and the causes of concern in the future.

10 Things You Need to Know About Bi-Modal IT

10 Things You Need to Know About Bi-Modal IT

No longer just another buzzword, bi-modal IT is soon becoming a necessary organizational setup in most companies, especially the ones which find it difficult to go completely digital. Read on to know what CIO.com (http://bit.ly/1Rz1Jti) wants you to know about this system.

Five Hybrid Cloud Benefits Your Customers Can’t Ignore

Five Hybrid Cloud Benefits Your Customers Can’t Ignore

According to IDC, the global cloud market, including private, public and hybrid clouds, will hit $118 billion in 2015 and crest at $200 billion by 2018. If that isn’t enough for you to convince customers to take the hybrid cloud route, here are five more from across the web.

Horrible Bosses: Five Bosses You’d Love to Kill

Horrible Bosses: Five Bosses You’d Love to Kill

It takes all kinds to make the world go round. But it takes only one to bring yours to a standstill: Your boss. Here are five types of bosses you wouldn’t miss—when they’re gone (under mysterious circumstances).

India's Leading VADs
Why Channels Want to Partner With Inflow Technologies

Why Channels Want to Partner With Inflow Technologies

Inflow Technologies’ tie up with 39 vendor companies, an extensive tech portfolio, and a services play, are great value propositions for enterprise channels, says its President and CEO, Byju Pillai.

iValue Creates Real Value for Channels in India

iValue Creates Real Value for Channels in India

Focused on niche vendor alliances around data, network and app management backed by a robust channel ecosystem marked iValue's success in 2014. What clicked for the seven-year-old VAD?

RAH Infotech Shows Channels the Way Ahead

RAH Infotech Shows Channels the Way Ahead

Mutual trust and long lasting bond with vendor companies and channel partners helps VADs to evolve and succeed in today’s aggressively competitive market. Leveraging competent channel partners and forge niche vendor alliances marks RAH Infotech’s success in 2014.

How Satcom Infotech is Adapting to New Security Landscape

How Satcom Infotech is Adapting to New Security Landscape

As a leading value added distributor, Satcom Infotech is emerging as an end-to-end security player, helping both customers and partners grow.

How ComGuard Shields Channel Partners

How ComGuard Shields Channel Partners

As emerging technologies introduce new threats to the enterprise landscape, they are making channel partners anxious. But VADs like ComGuard are putting their worries to rest. Here's how.

Tech Chat
Collaborating To Outcome Based World: Priyadarshi Mohapatra, Avaya

Collaborating To Outcome Based World: Priyadarshi Mohapatra, Avaya

Priyadarshi Mohapatra, Managing Director, India and SAARC, Avaya, on how IT is transitioning from a keep-the-lights-on role to one that enables customers to deliver results.

The Dawn of the Digital Age: Akhilesh Tuteja, KPMG

The Dawn of the Digital Age: Akhilesh Tuteja, KPMG

The development of digital infrastructure will be a key growth driver for technology and solution providers. 

Paradigm Shift from End-Users to User-First : Parag Arora,Citrix

Paradigm Shift from End-Users to User-First : Parag Arora,Citrix

Parag Arora, Area Vice President and India Head, India Sub-continent, Citrix, says new technologies will force organizations to take a user-first approach in 2015.

Mobile and Cloud Are Gamechangers of the Future: Karan Bajwa, Microsoft

Mobile and Cloud Are Gamechangers of the Future: Karan Bajwa, Microsoft

Karan Bajwa, Managing Director, Microsoft India, says, in  2015, organizations will adopt a mobile-first and cloud-first strategy to get ahead of competition.

A Network for the Internet of Everything : Dinesh Malkani,Cisco

A Network for the Internet of Everything : Dinesh Malkani,Cisco

Dinesh Malkani, President, India and SAARC, Cisco, talks about IoT and the significant technology transitions in the networking world.

Moving to the Third Platform: Jaideep Mehta, IDC

Moving to the Third Platform: Jaideep Mehta, IDC

Cloud and mobility are the two technologies that will fuel the rapid adoption of the third platform in India.

Envisaging a Holistic Security Strategy For 2015: Sanjay Rohatgi,Symantec

Envisaging a Holistic Security Strategy For 2015: Sanjay Rohatgi,Symantec

Sanjay Rohatgi, President–Sales, Symantec India, says the company has a set of holistic solutions in place to secure organizations from security threats. 

Beating the Bad Guys: Sivarama Krishnan, PwC

Beating the Bad Guys: Sivarama Krishnan, PwC

Organizations will need to turn inwards to establish robust information security strategies.

Building Capabilities for a Digital Tomorrow: Alok Ohrie,Dell

Building Capabilities for a Digital Tomorrow: Alok Ohrie,Dell

Alok Ohrie, President and Managing Director, Dell India, on the company’s investments to build end-to-end solutions and delivery capabilities for a digital world.

FAST TRACK
Kamtron Systems

Kamtron Systems

Transitioning towards a service-oriented company will boost our growth, believes Kavita Singhal, director, Kamtron Systems.

TIM Infratech

TIM Infratech

Delivering ‘best of breed’ technologies to enterprises is key to success, says Monish Chhabria, MD, TIM Infratech

Mudra Electronics

Mudra Electronics

A vendor-agnostic strategy helped us sustain business, says Bharat Shetty, CMD, Mudra Electronics.

Systematix Technologies

Systematix Technologies

Our USP is a customer-friendly approach backed by services, says Akhilesh Khandelwal, Director, Systematix Technologies.

CorporateServe Solutions

CorporateServe Solutions

Our ability to turnaround complex ERP projects in record time is what gets us customer referral, says Vinay Vohra, Founder & CEO, CorporateServe Solutions.

KernelSphere Technologies

KernelSphere Technologies

We are emerging as an end-to-end systems integrator, says Vinod Kumar, MD, KernelSphere Technologies.

Uniware Systems

Uniware Systems

We constantly validate emerging technologies for first-mover advantage, says Vergis K.R., CEO, Uniware Systems.

Astek Networking & Solutions

Astek Networking & Solutions

An innovative approach helps us stay successful, says Ashish Agarwal, CEO, Astek Networking & Solutions.

CSM Technologies

CSM Technologies

Our approach is backed by innovation and simplicity, says Priyadarshi Nanu Pany, CEO, CSM Technologies.

SOCIAL MEDIA @ CW India
SIGNUP FOR OUR NEWSLETTER

Signup for our newsletter and get regular updates.