Government Security News April May 2015

More documents

Recommendations

Info

The vast amount of personal information (PII) stored in the cloud needs to be better secured By Paul Rosenzweig, The Chertoff Group State and local law enforcement hold vast quantities of personally identifiable information (PII) about their citizens. Arrest records; conviction records; finger prints; mug shots – all of them are collected by police departments around the country. And, increasingly, this information is stored in a digital form with a cloud service provider. How secure is that cloud storage? Jennifer Lawrence and other celebrities know that the answer is “not necessarily as secure as we might hope.” And therein lies an alphabet soup of rules and standards. Cloud data privacy is an alphabetic minefield of confusing three letter acronyms (TLAs to those of us in the know). State and local law enforcement who don’t make the effort to get to know these acronyms and what they mean do so at their own peril – at least insofar as they collect and store data about their citizens in cloud-based storage systems. The latest entry into this derby of acronyms is the ISO, which is the International Standards Organization. If you are familiar with the American National Institute for Standards and Technology (NIST) then you know what ISO does – it is a consensus-based body that is intended as a technical standard setter for the world, in a host of disciplines – the international version of NIST. ISO standards are not binding law. Nobody enforces them and companies that want to comply with the standards do so at their own initiative. They then have their practices audited by independent third parties who certify compliance. In short, they are an authoritative set of non-binding best practices for an area of expertise. What does all this have to do with state and local law enforcement? Well, ISO 27018 is the latest standard issued for how to maintain privacy in the cloud. Under ISO 27018 cloud service providers must: • Tell customers where their data is stored and what subcontractors have access to it • Set explicit time limits for returning or deleting data • Notify customers about breaches • Only use data for purposes explicitly authorized by the customer • Not use customer information for advertising or commercial purposes without explicit consent (and they can’t make such consent a mandatory requirement for gaining access to the service) The list should look familiar. In the United States, law enforcement who store data in the cloud must, generally, comply with the FBI-issued Criminal Justice Information Standards (CJIS). Under the current CJIS policy, cloud services may be used to process CJI. As a condition of that use, however, the cloud service provider must disable many of its metadata analytical functions. In other words, commercial cloud service providers are required to contractually guarantee that any data mining or ad-related features have been disabled when they provide cloud-based services to law enforcement agencies. Thus, according to the new policy, “[t]he metadata derived from CJI shall not be used by any cloud service provider for any purposes. The cloud service provider shall be prohibited from scanning any email or data files for the purpose More on page 46
GET CERTIFIED TODAY! Certified in Information Assurance, CIA In this digital age, information is what drives the world. Information has always been critical, wars have been won or lost based on who had the best intelligence. It is believed that China depends on economic espionage to drive its economy; and that the Russian government largely turns a blind eye to organized cyber criminal activity. The CIA certification will ensure that you have the information you need to recognize, and prevent the most common methods of information theft. It will assure that you have the basic understanding of how to secure your workspace against active theft of sensitive information, and how to identify and avoid social engineering attempts. WWW.ABCHS.COM/CIA Certified in Cyber Warfare TTP’s 1 Certified in Cyber Warfare TTP's 1 is 1 an is entry-level an entry-level certification certification for individuals for individuals who would who like would to like join the to join information the information security workforce. security workforce. This certification This certification will validate will the validate knowledge the and knowledge skills a and candidate skills you needs to to begin their your journey in in the exciting world of cyber warfare! Cyber warfare specialists are are in demand in demand from from the Pentagon the Pentagon to Fortune to 500 Fortune companies. 500 companies. WWW.ABCHS.COM/TTPS1 1-877-219-2519 USE DISCOUNT CODE GSN50 AND RECIEVE $50 OFF THE CERTIFICATION OF YOUR CHOICE!
Page 1 and 2: Government Security News APRIL/MAY
Page 3 and 4: NEWS AND FEATURES DOT Secretary Fox
Page 6 and 7: Partner Alliance for Safer Schools
Page 10 and 11: What vulnerabilities are lurking in
Page 12 and 13: Communication: Use tweets and texts
Page 15 and 16: A quiet revolution in biometrics fr
Page 17 and 18: Video Surveillance/Analytics/Video
Page 19 and 20: -based analytics at ISC West terns
Page 21 and 22: DarkFighter Network Camera Conventi
Page 23 and 24: Rigid Strength No other Pole can ma
Page 25 and 26: costs—by 50 percent, on average.
Page 27 and 28: it’s garnered from the community.
Page 29 and 30: Employing a high degree of image pr
Page 31 and 32: Dateline Phoenix: Dispatches from 2
Page 33 and 34: MIR Systems unveils mobile incident
Page 35 and 36: activity. In addition, federal bord
Page 37 and 38: Rugged HD video surveillance camera
Page 39 and 40: steadfastness and courage, her stor
Page 41 and 42: to DEA Administrator Michele Leonha
Page 43 and 44: hancement Filter allows officials t
Page 45 and 46: say they will work closely with sch
Page 47 and 48: 2015 Airport/Seaport/Border Securit
Page 49 and 50: AXIS introduces new launches-and ne
Page 51 and 52: at the World Trade Center and the N
Page 53 and 54: The News Leader in Physical, IT and

Government Security News April May 2015

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?