After mounting concerns
relating to the security of cloud computing, a new online platform is to enable
users to assess the security features of registered cloud providers. The
Security, Trust & Assurance Registry (STAR) hopes to encourage providers to
improve their data protection security thanks to this increased transparency,
as well as aid organisations using the providers to comply with data protection
laws.
The Working Party drew attention to firm’s lack of
control over customer’s personal data when using cloud services. As cloud
computing uses an internet based network in place of local computing resources,
they stated that there is risk of "loss of governance, insecure or
incomplete data deletion, insufficient audit trails or isolation failures,"
by organisations using these providers. Operated
by not-for-profit body the Cloud Security Alliance (CSA), STAR hopes to limit
such risks to data protection. The CSA’s members include Google, Microsoft and
many other global businesses. They provide education on the uses of cloud
computing to work towards securing all other forms of computing. Through STAR,
cloud providers are able to submit "self assessment reports" which
document their compliance with "best practices" as stated by CSA. This
searchable registry opens the gates for customers to review providers security
practices, so lead hopefully to the improvement of organisations’ their quality
of security. The platform is free for both submission and reviewing of entries.
The CSA said that they were driven to launch STAR as they
believe voluntary self regulation is needed during the early days of cloud
computing, in place of, "heavy handed governmental regulation." They
state they support transparency and competition between cloud providers, with
security as a market differentiator.
In December last year the first cloud providers,
including Microsoft, submitted their reports through STAR. More recently,
Amazon published details of the steps they take to ensure the security of user’s
information, which is stored in ‘Amazon Web Services’. Amazon also stated that their provider, "engages
with external certifying bodies and independent auditors to provide customers
with considerable information regarding the policies, processes, and controls
established and operated by AWS."
However, the information available from cloud providers
or other external certifications is not sufficient to ensure organisations’ own
compliance with UK data protection laws. Organisations storing personal data through
cloud are still responsible for the safety of the data they store. Such
organisations have been told by the EU privacy watchdog, the Article 29 Working
Party, that they must “guarantee” compliance with EU data protection laws.
A spokesperson for the ICO made clear that while the
overseas transfer of personal data is not prohibited by the Data Protection
Act, it is necessary that this information is adequately protected no matter
where, or by who, it is being processed. EU data protection law also requires
that when sending personal data, through cloud, outside of the European
Economic Area (EEA), organisations must ensure that there are sufficient data
protection safeguards in place, prior to processing. As an exception to this,
countries whose data protection has been pre-approved by the European
Commission as being adequate, do not require checking by the organisation
itself.
In order that companies are able to meet their own data
protection requirements relating to cloud services, The Working Party provides
specific guidance. They provide advice on safeguarding contracts between ‘data
controllers’ and cloud providers so as to work towards eliminating the risk of
non-compliance with data protection law. Such contracts are encouraged to include
details of how cloud providers would keep data secure, by what means access to
the private information would be restricted and enable the controller to
monitor the providers’ data protection compliance.
Concerns had been raised relating to the risk of new vectors, created by a public registry,
as targets for exploitation by hackers. The CSA reassured that such risks were
not a matter of concern. The documents submitted by cloud providers are
designed so that security practices can be clearly documented without exposing
sensitive information. This is done through the use of a Consensus Assessments
Initiative Questionnaire (CAIQ).
As for the future, the CSA believe that for the meantime
STAR will continue as a simple registry for providers. However, they expect the
major developments to eventually arise from third party solution providers
extending and automating CSA STAR by integrating their GRC Stack directly into their
products and services. The GRC Stack refers to the CSA’s toolkit for
enterprises, cloud providers, security solution providers and others to
instrument and asses clouds against established best practices, standards and
critical compliance requirements.
© Brian Miller, solicitor, 2012.
Brian can be contacted at Stone King, Solicitors. For further news and information on legal topics of interest, please visit Brian's other blogs:
Comments
Post a Comment