Government Security News April May 2015

Personal information in the cloud needs to be better secured
Continued from page 8
of building analytics, data mining, advertising, or
improving the services provided.” Of course, read
literally this might prohibit even clearly appropriate
security-oriented metadata analysis,
but we are certain this is not what was
intended. Such a reading would not be
consistent with the FBI’s constructive, operational
approach.
Other elements of the new ISO
27018 standard are also reflected in the
cybersecurity whitepaper included in the
CJIS policy. This paper offers law enforcement
a list of CJIS compliance areas that
need to be addressed as part of a cloud deployment
and recommendations to address security
and data privacy issues. These recommendations,
like the ISO standards, cover a host of areas , including
governance, compliance, trust, identity
and access management, data protection, availability,
and incident response.
Moving forward, it seems very likely that the
FBI’s CJIS cloud data storage policy will be harmonized
with the new ISO 27018 standards. This
FBI policy is a pragmatic and forward-looking
approach to cloud computing which minimizes
technological mandates and affords flexibility to
individual law enforcement organizations. The
ISO 27018 standard is consistent with that mandate
inasmuch as it tells customer organizations
Paul Rosenzweig
that the cloud service providers they use will protect
their users PII and will be transparent about
how they handle this PII - including geo location
and the ban on advertising or commercial
use. The ISO self-certification
process provides cloud service providers
with a benchmark certification that they
can present to potential law enforcement
customers as evidence of their ability to
comply with CJIS requirements. Indeed,
one can (and should) envision a CJISspecific
annex under which cloud service
providers supplement their ISO 27018
certification with a CJIS-compliant supplemental
certification.
In short, the alphabet soup of CJIS, PII and
ISO in the end spell out a simple message: secure,
confidential cloud storage of criminal justice information.
And that is an easy text to understand.
Paul Rosenzweig is a senior adviser to The
Chertoff Group, a global security advisory firm that
advises clients on information security, including
cloud computing, and former Deputy Assistant Secretary
for Policy at the U.S. Department of Homeland
Security.
46