What the Brexit vote will mean for data sovereignty

(c)iStock.com/john shepherd

The only certainty about Brexit, the UK’s departure from the European Union, is that it is going to create uncertainty in terms of data sovereignty, particularly in the field of cloud computing. Data sovereignty refers to data being held in a country in adherence to the laws of that state. That is fine if your company is based in a single location and single market but it becomes trickier if you have diverse locations and lots of different laws with which you need to comply.

When the UK is part of the European Union it has the same data sovereignty laws as other countries in the EU but when the UK breaks away those laws could change. In time companies operating in Europe may have to manage one set of data laws for the UK and another for EU member countries. By voting to leave the European Union the UK fractured what was becoming a single digital market into potentially two or more jurisdictions for technology issues.

If the UK wants to participate in the free flow of data across European borders after leaving the EU, it will have to adopt the same data-protection standards as the EU’s new General Data Protection Regulation. As the UK’s Information Commissioner’s Office has stated “international consistency around data protection laws and rights is crucial, both to businesses and organisations and to consumers and citizens”. Unless the UK follows the new EU rules foreign companies may lose the ability to process European consumer data in the UK. This has ramifications for companies that want to use data centres in the UK – even just as backups – if their data centres in other EU countries go down.

People are waking up and recognising that the cloud is about data centres built on land under national laws. Cloud and managed service providers may need to offer additional options for customers to host data across Europe and enterprise end users may need to reconsider where their data is stored and ask themselves “if I move my data to your cloud, where will it be stored and what sovereign laws will it be subject to?”. For UK and international companies moving data in and out of Europe this could become a minefield but it doesn’t have to be.

The fact is cloud computing companies are getting used to dealing with issues of data sovereignty. Gavin Jackson, Amazon Web Services (AWS) UK and Ireland managing director said, whilst speaking at the recent AWS Summit in London, that in spite of the referendum result, Amazon was still committed to opening a new data centre in the UK by the end of this year.  Whilst in the past restricting types of data that can be stored in specific locations hampered their flexibility to move data from one data centre to another, patented technology now solves that problem.

By opening a data centre in the UK Amazon can guarantee UK data will remain in the UK whilst other data can still be available to the rest of Europe to be shared and processed accordingly. How is this possible? In a shameless plug for my own company, WANdisco has patented “active transactional data replication” technology which led us to be one of Amazon’s partners (along with IBM, Microsoft and Google). The advantage of our WANdisco Fusion technology is that it doesn’t have to replicate all the data which allows data controllers to apply security controls to the data that is replicated. This means that cloud computing companies can quickly control where data is shared and ensure that data sovereignty requirements are met.

The hybrid cloud model can also help with issues of data sovereignty as companies keep sensitive data on site behind the firewall and only move certain data-processing activities to the cloud. Our technology means businesses can migrate data with no downtime thus potentially saving thousands in potentially loss revenue or capital outlay.

Ultimately Brexit doesn’t have to mean the balkanisation of a company’s data strategy but clarity is needed so the right measures can be put in place. 

Machine Learning and #CognitiveComputing | @ThingsExpo #BigData #IoT #ML

Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations.
In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to improve safety, performance, and reliability in today’s modern wind turbines.

read more

Proper Incident Management | @CloudExpo #API #Cloud #BestPractices

Mitigating downtime requires good workflows, human response and – most importantly – proper alarms to alert relevant individuals when things go wrong. Proper incident notification is crucial to effect management of IT downtime.
Proper IT management requires proper incident management. Otherwise, you court Murphy’s law at your peril. In the IT world, if a server can fail, a cache overload or traffic overload the network – it will. And the consequences are significant.

read more

FreeStor Maximizes the Benefits of the Cloud | @CloudExpo @FalconStor #API #Cloud #DRaaS #Storage

FalconStor Software has announced that organizations using FreeStor® to seamlessly migrate, protect and recover data in the cloud are able to do so without being tied to specific hardware, networks or protocols, making it an ideal solution for businesses that are looking to cut costs and recovery time, as well as enabling Managed Service Providers (MSPs) to offer Backup-as-a-Service (BaaS) or Disaster-Recovery-as-a-Service (DRaaS) offerings.

read more

Privacy Shield rubber stamped amid dissent

dataThe European Commission has formally adopted the controversial ‘Privacy Shield’ framework intended to replace the previous Safe Harbour agreement, reports Telecoms.com.

Both schemes covered the transfer of data between the EU and the US, with the balance between free movement of data and the protection of individuals a tricky one to strike. Privacy Shield has many critics who fear it does little to address the issues faced by Safe Harbour. In spite of that the EC has decided to plough forward as anticipated.

“We have approved the new EU-US Privacy Shield today,” said Andrus Ansip, Commission VP for the Digital Single Market. “It will protect the personal data of our people and provide clarity for businesses. We have worked hard with all our partners in Europe and in the US to get this deal right and to have it done as soon as possible. Data flows between our two continents are essential to our society and economy – we now have a robust framework ensuring these transfers take place in the best and safest conditions.”

“The EU-U.S. Privacy Shield is a robust new system to protect the personal data of Europeans and ensure legal certainty for businesses,” said Věra Jourová, Commissioner for Justice, Consumers and Gender Equality. “It brings stronger data protection standards that are better enforced, safeguards on government access, and easier redress for individuals in case of complaints. The new framework will restore the trust of consumers when their data is transferred across the Atlantic. We have worked together with the European data protection authorities, the European Parliament, the Member States and our U.S. counterparts to put in place an arrangement with the highest standards to protect Europeans’ personal data”.

Not everyone in Brussels was convinced, however. “The Commission has today signed a blank cheque for the transfer of personal data of EU citizens to the US, without delivering equivalent data protection rights,” said the Green Party MEP Jan Philipp Albrecht. “The ‘Privacy Shield’ framework does not seem to address the concerns outlined by the European Court of Justice in ruling the Safe Harbour decision illegal. In particular the individual rights of consumers are still too weak and blanket surveillance measures are still in place. In this context, the Commission should not be simply accepting reassurances from the US authorities but should be insisting on improvements in the data protection guaranteed to European consumers.

“The European Parliament already underlined concerns about the lack of general data protection provisions in the US when the initial Safe Harbour decision was concluded in 2000. Independent data protection authorities are still lacking in the US. EU justice commissioner Jourova must now make clear that, once the EU’s new General Data Protection Regulation enter into force in 2018, there will also be a need to revise the Privacy Shield decision.”

Elodie Dowling, VP, EMEA General Counsel at BMC Software reckons there’s still plenty of work to do. “Following negotiations between EU and US officials, the formal adoption of Privacy Shield has officially started today in the EU’s 28 member states,” said Dowling. “Starting August 1, it will then be for businesses across the US and the EU to innovate and comply around this in order to create a culture of trust amongst their customers.

 

“However, with the ongoing discussions generated throughout the negotiation period, it’s unlikely that the official adoption of the Privacy Shield closes the loophole completely. For example, it remains unclear the type of ‘assurances’ the US has provided to the EU to ensure mass surveillance does not apply or, if it does, that it happens in a transparent and framed manner for EU citizens. Surely this particular item is going to be carefully considered by data privacy activists.”

[session] Properly Secured Mobile and Cloud Technology By @IBMSecurity | @CloudExpo #Cloud #Security

Human interaction has long been altered by the introduction of new technology. In the world of today those alterations have been rapidly accelerated by technology that incubates the creation of new and innovative applications that interconnect people. Specifically, properly secured cloud technology that can leverage mobile devices has allowed for inventors and innovators alike to permeate their ideas into everyday human technology at a faster rate than can be seen anywhere in history.

read more

FCA gives green light to financial firms using cloud technologies – but with a caveat

(c)iStock.com/Keith Kiska

The Financial Conduct Authority (FCA) has issued a series of guidelines on how financial firms can migrate to the cloud and provisionally giving the green light to them.

“We see no fundamental reason why cloud services (including public cloud services) cannot be implemented, with appropriate consideration, in a manner that complies with our rules,” the report notes.

The authority notes that they have successfully supported many firms to use cloud and other IT service solutions, yet the updated guidelines come after concern from organisations over how the term ‘cloud’ should be defined and how it applies to them, as well as operational and supply chain risks.

The FCA insists firms need to review the contract with their outsourcing provider to ensure it meets their standards; in terms of regulations, organisations need to ensure their operational risk is not worsened by cloud migration, as well as identifying all service providers in the supply chain and ensuring compliance through all those steps. The finalised guidance insists that it is keeping in line with these guidelines despite concerns over the supply chain being ‘impractical’ and ‘unduly burdensome’.

Regarding data security, the FCA argues firms should agree a data residency policy with their chosen provider, understand the provider’s data loss and breach processes, as well as comply with the eight principles of the Data Protection Act (DPA). Similarly, the importance of continuity planning – “appropriate arrangements to ensure that it can continue to function and meet its regulatory obligations in the event of an unforeseen interruption of the outsourced services” – and an exit strategy were also highly emphasised.

Alongside this, the FCA insists the report, which can be viewed in full here (via FinExtra), should not be read in isolation – citing the Prudential Regulation Authority (PRA) as another important body – nor is exhaustive. “We expect firms to take note of the guidance and, where appropriate, use it to inform their systems and controls on outsourcing,” the report notes.

While industries such as finance, healthcare and manufacturing have been traditional laggards in moving to the cloud, this view, backed up by the FCA paper, is changing. Tony Connor of Datapipe, writing for this publication back in March, argued the shifting view on cloud security but insisted trust was key. “With a trusted partner and careful planning, even the most complex IT ecosystems in a financial institution can be moved to the cloud and start reaping its numerous benefits,” he wrote.

AWS – Monitoring the Memory of your Virtual Machine (AMI)

Out of the box, AWS CloudWatch by default monitors 4 things:

  1. CPU
  2. Network
  3. Disk
  4. Status Checks

Can you tell which resource CloudWatch doesn’t monitor out of the box? Memory! (update:  According to AWS technical support “Right now, you do not need to deploy anything in you AMI to monitor your instance. Metrics like memory utilization and disk space require us to look into the OS running in the instance and that is why we do not have these valuable metrics.  We are looking at ways to provide more insight into your OS and applications and will have more details as we firm up the plans”).  Amazon provides 2 articles for doing this, one for most Linux flavors and another for Windows. This article is basically a walkthrough of the Linux article (since I know Windows and want to learn more Linux anyway).

  1. Create a CloudWatch role in IAM (if you don’t know how to do this see my previous article)
  2. Spin up a new Amazon Linux AMI instance using the new CloudWatch role in the IAM section of the instance creation (check out THIS article if you get stuck)
  3. SSH into your new instance & run the following command:
    1. sudo yum install perl-Switch perl-DateTime perl-Sys-Syslog perl-LWP-Protocol-https
    2. curl http://aws-cloudwatch.s3.amazonaws.com/downloads/CloudWatchMonitoringScripts-1.2.1.zip -O
    3. unzip CloudWatchMonitoringScripts-1.2.1.zip
    4. rm CloudWatchMonitoringScripts-1.2.1.zip
    5. cd aws-scripts-mon
  4. At this point you have downloaded and unzipped the Perl script necessary to make the remote calls to CloudWatch and installed the Perl bits needed to run said script.

 

To read the rest of Chris’ post, click here!

 

By Chris Williams, Enterprise Consultant

 

The cloud news categorized.