Who owns data in the cloud? The answer could get tricky.

Feds, industry grapple with ways to protect government data in the cloud

When government moves data to the cloud, who owns it? And how can it be secured or, in extreme cases, decommissioned?

During a panel discussion on Security in Public/Private/Hybrid Clouds, part of the at the Government Technology Research Alliance meeting earlier this week, everyone involved acknowledged the need to raise the level of trust in the public cloud. Agencies and the public need to be confident that government data is properly secured within the U.S. and can be, if needed, properly destroyed.

Cloud computing refers to services, applications, and data storage delivered online through powerful file servers.

One attendee noted that his agency is working with a cloud provider, Hewlett Packard/EDS, which has its cloud computing resources in the U.S., but systems administrators in other countries such as Argentina, Brazil, Malaysia and Uruguay.

“How do we understand, other than getting a government-certified cloud, where this stuff might be run from and where assets reside?” he asked.

“Everybody I talk to in government requires data to stay within the United States," said Peter Mell, a member of the panel and a senior computer scientist in the Computer Security Division at the National Institute of Standards and Technology (NIST). He is also vice-chair of the Interagency Cloud Computing Advisory Council.

“What is implicit there is that the systems administrators will be in the U.S., which as you pointed out is not always the case,” Mell said.


Related coverage:

Continuous monitoring guidance under way at NIST

 


One of solutions to the problem – besides public cloud computing vendors providing that level of security – is to look beyond just thinking of the public cloud. Instead, agencies should think about how they are becoming more cloud-like in their information technology operations and then adopt their own private clouds.

“I believe in some ways that all of your agencies are adopting cloud computing and you don’t even know it,” Mell said.

As these agency data centers evolve and adopt virtualization, digitize applications and provide dynamic Web interfaces -- Web 2.0 stylings of data center applications – agencies are becoming more cloud-like. If agency managers then apply NIST guidelines for cloud computing to those information technology operations, they can evolve to the point where they can say they have a cloud environment.

At that stage, “You own it and control it and it will work well for you,” he said.

The federal government is vast, and vendors have been struggling with the question of who speaks for the federal government, said Phil Wenger, deputy policy lead for the Budget Formulation and Execution Line of Business for the Office of Management and Budget.

Wenger said the CIO Council’s efforts to provide assessment and authorization through the Federal Risk and Authorization Management Program (FedRAMP) should help provide cloud computing providers with a standard, governmentwide set of security requirements. However, he said the government can make it a requirement that systems administrators working with government data should be in the United States.

“Those are the things we can do,” Wenger said.

"The reality is when you put data in the cloud you should have your own copy” of the data, said Stan Wisseman, a senior associate with Booz Allen Hamilton.

As part of their relationship with contractors, agencies have to figure out their cloud provider's strategies up front. “I don’t have an obvious answer but to make sure you have the data protected elsewhere,” Wisseman said.

Part of answer to the question about getting out of the cloud is you can never get your data back, another attendee in the audience said. He asked if there are any plans for a template for service-level agreements like in commercial practices that people can follow.

“Why do we have our data in India or China or other places where they shouldn’t be?” he asked.

“I don’t’ see anything different in how you plan for enterprise computing and cloud computing,” said Alfred Rivera, director of the Computer Services Directorate of the Defense Information Systems Agency. DISA runs a private cloud known as The Rapid Access Computing Environment, which allows Defense Department users to quickly acquire computing power and build applications.

“The hard question from a public cloud perspective is, how do you ensure the data is now your property and not the property of the cloud vendor?” Rivera said. As for planning for security and the private cloud, DISA followed the constructs and guidelines that the agency and DOD would use for computing in general for data center operations. And these guidelines “are still compliant not only with the cloud but for all operations we do,” he said.

Service-level agreements aside, the data is still on de facto basis controlled by the cloud provider, another attendee said.

One possible way to maintain control is to encrypt the data before it leaves the organization’s boundary. It would only be decrypted when it gets back into the enterprise. The keys to encrypt that data would be owned by the agency or organization, he said.

Booz Allen Hamilton has worked with an agency to encrypt data in the cloud, Wisseman said, adding that encryption offers its own set of challenges. However, “I think some type of stealth protecting model is a good way of working at it,” he said.

 

Reader comments

Tue, Apr 22, 2014 JustlittlemeNumber2 Illinois

Yes. I realize I am commenting on a log from 2010. I may be stupid. But not that stupid. Anyway-if you are creating such that such needs to be eventually 'destroyed'-government or no government- IT SHOULD NOT BE CREATED TO BEGIN WITH. Or, one could look at it as, does it really matter? I mean, the CIA is part of the USA, no? Let's not make the same mistake Nixon did... choose your words wisely if you are that worried-or OBAMA. "What is that you have in that fast food bag?" - "That is a matter of National Security..." 'NUFF SAID. Besides, I do not believe the 'one' or the dozen or however many actually whom developed or own or now currently own the cloud care what goes on within it. The information is so vast, I'm sure they have much better things to do such as ... I don't know ... shark dive in Fiji? Though I do wonder-how do they make any money off of creating 'the cloud' if no one knows who they are? Stupid thing, methinks if that is where the world is headed-no internet-no world wide web!-no computers. Just a cloud. We are becoming heaven! That, or my futuristic flying car promised in year 2000 has a much different look than I initially imagined 0_0

Thu, Jun 10, 2010 Dr Bob Hacker Texas

Your money may be in the bank, but the surprise to you may be the fact that your paper receipts may be required to prove your deposits when the bank hardware fails. This has happened to mey twice: Once in New Jersey and once in Texas. The state of affairs here reminds me of a favorite quote from my grandmother: "A fool and his money are soon parted!" Some folks at the CIA and elsewhere also say: "Trust is a form of mental illness!"

Thu, Jun 10, 2010 Scott Texas

“What is implicit there is that the systems administrators will be in the U.S., which as you pointed out is not always the case,” Mell said. What should be added is that not all system administrators manage the application or data residing on their systems. Those belong to the application owners. If data moves to the cloud and the cloud is managed by a third party (not internally controlled) you have no way of knowing who exactly has access to the data at that point. How many US companies subcontract to foreign companies within IT? One just has to look at the data breaches that have already occurred across numerous companies, companies selling data without users knowledge (Facebook), or companies collecting data without consent (Google). I would be very careful in what time of applications or services I would move into the cloud.

Thu, Jun 10, 2010 david DC

Poorly written article with no new information and confusing definitions. It makes us Federal IT folks sound like complete buffoons. FCW should really get off the cloud bandwagon it is passé and irrelevant. I suppose it gives marketing folks something new in the vocab. Plus, most of us who run IT shops are still trying to reach industry service levels with the mess that grew from the other silver bullets you promoted.

Thu, Jun 10, 2010 Harvey Lee Hayes

This was a very interesting article discussing Pro’s & Con’s of Cloud computing. I am currently employed with the Federal Government as a Systems Engineer. In my opinion there are still too many unanswered questions in regards to Cloud Computing. With Cyber Terrorism at an all time high and after 911 we have a diligent responsibility to the American people to insure that all government computer and data systems are protected beyond a shadow of a doubt. The science of Risk Assessment will drive the decision making component of Cloud Computing. In the end the question will remain the same. “How much are we willing to risk, before we store data/information in the Cloud and at what cost”.

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above