Call for Contributions on Cloud Computing
Download 121.34 Kb.
|
- Navigate this page:
- Which of the existing instruments do you think are most suitable for Cloud Computing
- How are you regulating the data transfers carried out in the context of the Cloud Computing service you provide or to which you have subscribed
- Do you think that BCRs for the subcontracting Processor are an interesting solution What type of mechanism would you consider for these BCRs
- Have you already thought about technical solutions that would enable you to better identify and control data flows in the context of Cloud Computing services
- Assessments and proposals on data security
- Access by administrators and encryption
- Data destruction and reversibility
- Standardisation: a potential solution
 
Call for Contributions on Cloud Computing Consultation procedure open from 17 October to 17 November 2011
Name of company: Business sector: Country of primary head office: For Cloud Computing, you are: A service Provider A Client Please forward the questionnaire below - by e-mail to consultationcloud@cnil.fr - via postal mail to: Commission Nationale Informatique et Libertés Service des affaires européennes et internationales 8 Rue Vivienne 75002 Paris, France. Terminology / Abbreviations: In the context of this request for contributions, the term “Provider” designates the companies offering Cloud Computing services, and the term “Client” designates the companies or public administrations who are the clients of Cloud Computing providers. Definition of Cloud Computing
Since the term of Cloud Computing is both recent and encompassing numerous concepts, there is still no consensus on any single specific definition.
We believe that the most appropriate approach to any definition should be based on the features specific to Cloud Computing.
In your opinion, does this set of features enable the proper characterisation of a Cloud Computing service? Should this set of features be complemented?
II. Qualification of stakeholders: towards an assumption of subcontracting? A. Principle Under Article 3 of the French Data Privacy Law of 1978, the Data Controller is defined as “a person, public authority, department or any other organisation who determines the purposes and means of the personal data processing”. The Processor is defined as the subcontractor who processes the personal data on behalf of and according to the instructions of the Data Controller. B. Proposed solution
The Client will always be responsible for the processing as Data Controller. By collecting data and deciding to outsource their processing to a service provider, the Client retains full responsibility for the data processing, since the Client also defines the purposes and means of data processing.
In principle, the Provider acts on behalf of and according to the instructions of the Client acting as Data Controller. Accordingly, it would appear reasonable to establish en assumption that the Service provider acts as Data Processor in the context of the relationship between the Client and the Provider. Such an assumption will be particularly effective whenever the Client uses a private Cloud2 that involves extensive control over the execution of the Cloud Computing service. Conversely, whenever the Client uses a public Cloud3, the respective roles of the Client and the Provider may prove difficult to determine, and will also depend on the type of services subscribed by the Client. In this case, the CNIL proposes that the above assumption be discarded in favour of a set of features that should enable the determination of the margin for manoeuvre available to the Provider to perform the service provision.
By applying this set of features, it will be possible among other to take into account the highly standardised nature of Cloud Computing offers generally resulting in an extensive control of the Provider over the service. The following analysis is submitted by the CNIL for consultation: - The Client is necessarily regarded as the Data Controller. - The Provider is presumed to be a subcontracted Processor, unless the set of features leads to disregarding this assumption, thereby demonstrating that the Provider acts as the de facto Data Controller. In the context of the revision of the EU Directive on data protection, it would be of interest to look at the possible creation of a legal status for the subcontracted Processor, in order to assign a number of specific requirements to said Processor.
In your opinion, does the above analysis reflect the specific features of Cloud Computing? Why?
What is your opinion on a specific legal status for service providers?
Applicable law Since Cloud Computing is based on the use of multiple servers located in various places in the world, there are obvious difficulties to determine the applicable law, since the flexibility and fluidity of data transfers mean that as many laws as there are countries where data processing servers are located, are potentially applicable.
Under Article 5 of the French Data Privacy Law of 6 January 1978 as amended, the French law applies if the Data Controller:
Avenues of investigation While the CNIL is in favour of extending the concept of “processing means”, it nevertheless wishes to mitigate any excessive consequences of an abusively broad interpretation of “processing means” and any potentially systematic application of French law. Question: In your opinion, which criteria would enable the determination of applicable law to Cloud stakeholders?
Regulating framework for data transfers
Under Article 68 of the French Data Privacy Law of 1978, personal data may only be transferred to recipients in countries located outside the EU if that State provides an adequate level of data and privacy protection. Article 69 of the Law expressly specifies the instruments required to regulate such transfers: standard contract clauses, internal corporate regulations (or BCRs), Safe Harbor, or exceptions. Resorting to such instruments implies knowledge of the country(ies) where the data are to be transferred, which is essential to complete the required declaration/authorisation formalities with the CNIL and to inform the data subjects of such transfers to these countries. However, Cloud Computing is most frequently based on a complete lack of any stable location of the data. The Client is therefore rarely in a position to be able to know in real time where the data are located or stored or transferred. In this context, the legal instruments providing a framework to regulate data transfers to non-EU third countries failing to provide any adequate protection, have shown their limits. In addition, there are exceptions to the principle of banned transfers.
(i) From a legal standpoint The increasingly multiple locations of data storage make it difficult to enforce any legal instrument that would guarantee adequate protection levels. The CNIL therefore proposes that 1) service providers should incorporate standard contractual clauses into the service provision contracts, and 2) the feasibility of Binding Corporate Rules (BCRs) for subcontracted Processors should be investigated. Such BCR for processors would enable the Provider’s client to entrust their personal data to this subcontracted Processor while being assured that the data transferred within the Provider’s business scope would receive an adequate protection level. (ii) From a technical standpoint Regulatory control over data transfers could also depend on the technical solutions used. For instance, some Providers mention the use of “metadata”4 to define or describe another data item, regardless of its media (print or electronic), or homomorphic encryption solutions5. Resorting to encryption would also be regarded as a satisfactory solution to guarantee the transfer of data to predetermined countries only. In such cases, the Client could then truly endorse its role as Data Controller by defining the data recipient countries, even before the service is performed. In practice:
Data security The issues of security and confidentiality of data outsourced to the Cloud, as covered under Article 34 of the French “Informatique et libertés” Law, are generally one of the top concerns for users6. In the case of an organisation subscribing to a Cloud Computing service, the management of data security is largely delegated to the service Provider, from whom it is often difficult to obtain guarantees on the actual security level. In application of Article 35 of the French law, the subcontracted Processor “shall offer adequate guarantees to ensure the implementation of the security and confidentiality measures mentioned in Article 34”7, while the Data Controller has the “obligation to supervise the observance of such measures [of security and confidentiality]”7. In addition, the same Article provides that “The contract between the Processor and the Data Controller shall specify the obligations incumbent upon the Processor as regards the protection of the security and confidentiality of the data and provide that the Processor may act only upon the instruction of the Data Controller”. It is therefore necessary for these security requirements to be materialised in a contract. In particular, it is essential that the roles and responsibilities of the parties be clearly defined in advance, in order to ensure efficient processing of any incident that might lead to a loss or disclosure of personal data. Question What are your views on the contractual relations between the Client and the Provider regarding security measures and compliance with Articles 34 and 35 of the French Data Privacy Law (“Informatique et libertés”)?
Risks specific to Cloud Computing A risk assessment8 is recommended prior to drafting any data security policy, in particular for large-size IT systems. This recommendation was previously formulated by ENISA9 in its report published in November 2009 entitled “Cloud Computing: benefits, risks and recommendations for information security”10 and by ANSSI in its more general report on “Outsourcing of IT systems – Risk management” published on 19 March 201011. This risk assessment should in particular factor in the nature of the organisation using the Cloud Computing service and the type of data processed in the Cloud. The CNIL therefore believes that a risk analysis approach to assess the impact of switching over to Cloud Computing, should be adopted by all Data Controllers wishing to use Cloud Computing for some of their personal data processing operations. Question: What are your views on the recommendation to conduct a risk assessment before switching over to Cloud Computing?
Assessments and proposals on data security
When using Cloud Computing services, the CNIL recommends that some aspects of data security should be looked at carefully:
For Providers offering services to private companies or public administrations, the following could be added:
Questions: What are your views on this analysis? In your opinion, which security measures should the CNIL highlight to draw the attention of Data Controllers?
In the absence of any encryption at the data storage level, which is very frequently the case, the IT administrators15 of the Provider have full access to the data of their Clients16. One way to secure at least partial protection against such risks is to ensure that the Provider’s administrators have a confidentiality clause in their employment contract or have signed a specific non-disclosure agreement. In addition, it is recommended to record the traceability of the administrators’ actions in logs that are not accessible to them. However, for the Data Controller Client, encryption of the data stored in the Cloud constitutes the only way to prevent the Provider’s IT administrators17 from accessing the data entrusted to them. Question What are your views about encryption in the Cloud?
Once the service provision expires (account closed, contract termination, etc.), it is important for the Client to ensure that the data previously entrusted to the Provider will no longer be accessible to the Provider. Depending on the sensitivity of the data, the followed measures may be required:
In addition, the issue of data reversibility should also be taken into account by the Client prior to subscribing to a Cloud Computing service. The Client may wish to retain the data entrusted to the Provider, and in such case, the Provider should plan to return the data in a standardised format that will enable the Client to reuse these data with another service provider or using a conventional software program. Question: What are your views about the return of data and reversibility?
All of the above-discussed issues could be partially addressed by bolstering the transparency from Cloud Computing providers about their security policies. It would be possible to boost the trust of clients and data protection authorities by adopting measures designed to certify the data centres, taking into account personal data protection without inducing any additional risks20. However, there are currently no existing security standards adapted to Cloud Computing that would fully factor in the issue of personal data protection. The CNIL recommends that security standards incorporating the issue of personal data protection in the Cloud be defined and promoted by the industry in order to strengthen transparency for the clients. Questions:
1 A free application/software is covered by a license that allows anyone (without any compensation) to use, study, modify, duplicate and distribute said application/software program. A number of free operating systems also exist, such as LINUX. 2 In a private Cloud, IT resources (infrastructure, applications, etc.) are available to and operated solely for a single organisation. The resources may be owned, managed and administered by the organisation itself, or by a third party. In all cases, the organisation generally has control over the related infrastructure and location of the data. Whenever the infrastructure is shared by several organisations supporting a specific community with shared concerns, the term of “Community Cloud” is used. 3 In a public Cloud, IT resources are operated by third parties and the tasks assigned by a large number of clients co-exist on the same servers, storage systems or other infrastructure component. The end user generally has no way to know which other users are present on the server, network or hard disk where the tasks are performed. 4 Method enabling a linkage of information specific to the data, and the determination of the geographic scope over which the data may be transferred. 5 Method of encryption enabling the Provider to aggregate messages even though they are encrypted and without possibility of reading their contents. 6 In a survey conducted by IDC Enterprise Panel (USA) in response to the question “Rate challenges/issues ascribed to the ‘Cloud’/on-demand model”, data security was rated at the top of concerns, with 74.6% respondents (source: NIST presentation on Cloud Computing and Security, available at: http://csrc.nist.gov/groups/SNS/Cloud-computing/Cloud-computing-v26.ppt). 7 Article 35 of the French “Informatique et libertés” Law. 8 The risk assessment method most frequently used in France was developed by the Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI, formerly DCSSI), called “EBIOS” (see more on http://www.ssi.gouv.fr/site_article45.html). 9 European Network and Information Security Agency 10 This report identifies 35 risks specific to Cloud Computing. ENISA specifies the assessment to be conducted prior to the use of Cloud Computing by public administrations in a second report published in January 2011 entitled “Security & Resilience in the Governmental Clouds”, where ENISA provides an analytical guide for public administrations and generally recommends the use of private Clouds for which the risk/benefit ratio seems to be positive. 11 In particular, risks linked to location and pooled hosting. 12 Firewall used to filter incoming and outgoing connections. In this case, the firewall would take the form of a software program, or failing that, a functionality supplied by the operating system of the terminal. 13 E.g. by using https format (HyperText Transfer Protocol Secure) to secure browsing. 14 In the case of an IaaS type offer, it will be important to activate the logs in the OS (security, system, application), and in the hardware infrastructure contributing to the network security (firewall, IDS). If SaaS type services are also provided, then a log of events must be kept (account creation, exports, read/write access) in the database and/or the related software application. In addition, access to the logs must be write-protected and limited to a minimum number of persons. Although generally managed by the Cloud Computing service provider, the logs should be accessible to the client (possibly on request). 15 Network/operating system, data base and application 16 Which may represent a very large volume of data, i.e. thousands of ADP clients, or millions of Google clients. 17 And therefore the Cloud Computing company itself. 18 Data deleted with the delete function of the OS can be easily retrieved, even after emptying the bin or reformatting the system. Many software programs exist on the market (some of which free, such a Recuva), providing the possibility of retrieving data after deletion or reformatting. This is why secured deletion software has been developed, based on rewriting of random bits over deleted data. 19 Buyback of the media is sometimes possible but generally billed at a high cost. 20 Conversely, if each client had the ability of conducting audits of the data centre, such ongoing audits would induce new risks on the data security of the centre. Cloud Computing Directory: sites -> default -> files files -> Answer True False 2 points Question 2 files -> Northern England’s set-jetting locations files -> Nstructions for Acquiring Excess Equipment online, through the 1033 Program files -> Occupational health and safety files -> The Black Panther Party’s Ten Point Program files -> International programs roel profile files -> Fermi Questions a guide for Teachers, Students, and Event Supervisors Lloyd Abrams, Ph. D. DuPont Company, cr&D/ccas experimental Station Wilmington, de 19880 files -> Personal Information Name: Maha Al-Ammari Nationality: Saudi Relationship Status Download 121.34 Kb. Share with your friends:
|