It’s amazing to see how one individual can bring an entire market segment to its knees by raising questions about the very fabric on which the solutions are built. As they say, “Caesar’s wife must be above suspicion.” Snowden’s exposure of the National Security Agency (NSA) surveillance programs PRISM and XKeyscore are very scary. This has made companies rethink their business and solution delivery strategy going forward. In recent years, many companies have had a “CloudFirst” strategy; now I’m hearing “ConfusionFirst” from them.
The Snowden incident, and the new fiasco of RSA and NSA backdoor deals, didn’t create a conducive environment for cloud-based businesses to gain the lost trust. Such programs are causing uneasiness among the companies using cloud providers (U.S. providers, in particular). Obviously, localization of data storage and processing can ease the burden on companies as they will be limited to worrying about just the hackers and not about powerful government agencies. Check out my article on VentureBeat about how localization of processing can help with this issue: http://venturebeat.com/2013/10/02/location-specific-privacy/.
Just because a particular cloud provider hasn’t yet been accused, or found guilty of violating a particular country’s data residency or privacy laws, doesn’t mean data isn’t being moved across country borders. On the contrary, it may only mean they haven’t yet been caught.
Unfortunately, the cloud community spent years building their reputation, which is lost in a matter of years (or in a few months since the fiasco). Now you add an element of more powerful governments to the list that, based on rumors, have a backdoor mechanism to weaken the algorithms. So just encrypting the information based on someone else’s solution may not be 100 percent foolproof either.
Foreign governments aren’t only skeptical about privacy and protection of their citizens when the data is sent to other countries, but they’re angry, too. They want to penalize the companies that are setting themselves up for such situations. For example, Germany has set data protection laws across the European Union, with sanctions for U.S. firms that violate them (see www.industryweek.com/public-policy/germany-demands-sanctions-us-firms-over-privacy-0).
Though the intent might be good, the goals and net effect of such actions might be dubious at best. The cost associated with sanctioning cloud providers coupled with damage to the brands’ reputations is far greater than any benefit that might be derived from the compensation obtained.
There are reports suggesting that the U.S. cloud computing industry could lose as much as $35 billion over the next three years (see www.itif.org/publications/how-much-will-prism-cost-us-cloud-computing-industry). A recent Cloud Security Alliance (CSA) survey provides an early indication of this (see https://cloudsecurityalliance.org/download/government-access-to-information-survey-results/). About half of the survey’s non-U.S. participants say they’re going to move away from U.S. clouds. To where exactly? Is that really going to be better for them or more like the proverbial “frying pan to the fire”?
For foreign entities, such as European/APAC corporations, choosing a U.S.-based cloud provider is desirable because they may not have mature providers in their own countries. This is because there’s a higher number of cloud providers in the U.S. that offer mature solutions with competitive pricing. Until now, all you had to worry about was the data residency (or privacy) issue, but recent events have led everyone to worry about whether a government agency is covertly inspecting their data.
Looking for an easy way out? Keep the sensitive data with you. Send either encrypted garble or tokens that look like the original data wherever you want to send it. When data is within your trusted boundaries, you control its fate. Though you lose control of the data when you move it around, it doesn’t mean that you have to lose it all. You need to encrypt the data with a proper encryption key, strong algorithm and solid key management. This means you get to control “who gets to see what, when and how much.” If anyone needs to see your sensitive information, they should have been pre-established and vetted by you. This includes your data sitter. You control the “keys to your kingdom.” However, if the rumors were true about RSA weakening its algorithms, then this will do you no good.
Another very effective option could be “tokenization” (or tokenisation, as it’s known everywhere else). In this case, you take the original sensitive data out, store it in a secure vault and replace it with a random token that looks, feels and acts like original data. The premise of tokenization is that “what isn’t there can’t be stolen.” Let hackers and governments have fun with it without knowing they have fake data.
This is where solutions such as the Intel Expressway Tokenization Broker (ETB) can help. It intercepts any message that goes out, in any enterprise messaging format (structured or unstructured data), scans for sensitive data in the message, removes this sensitive data (such as credit card, personal info, health records, financial records, etc.), stores it in a safe place and replaces it with random data that’s formatted exactly as the original data. Only you can correlate the token to the original. No one else can even come close, as they don’t know where to go to resolve the token to the original data.
The great thing about these “touchless” solutions is that you don’t have to modify any portion of your existing applications (or a negligible portion if any). This is huge because most companies still have all kinds of legacy applications that are moving the data from/into the cloud. If you’re expected to modify those applications, it won’t only cost you a lot of money but it also might be hard for you to find the right skills to do that. In addition, touching these legacy applications might even break them. Using solutions such as Intel tokenization means these solutions will be in the line of traffic rather than requiring integration with any specific systems. This means just reroute the traffic rather than rewrite the applications. The impact to enterprise messaging systems will be minimal.
While you can’t avoid government agencies legally asking for this information, this at least gives you an option to control who you give what, when and how and be aware of it!