Privacy and Security Implications of Cloud Computing

1
Privacy and Security Implications of Cloud
Computing

• 17 November 2009 - IGF
• Laurent Bernat - OECD

2
OECD Technology Foresight Forum on Cloud Computing

• 14 October 2009 OECD Technology Foresight Forum
  on Cloud Computing
• Government, Business, Civil Society, Technical
  Community
• www.oecd.org/ict

3
The Cloud (of buzzwords)
Community Private Cloud
Regulatory Requirements
Public Cloud
Commodity Public Cloud
Private Cloud
SLAs
Enterprise Public Cloud
Hybrid Cloud
Closed Private Cloud
Storage as a Service
ASP
CloudBursting
Software as a Service
Cloud Stacks
Web 3.0
Inter Cloud
Information as a Service
On-premise
Security 1.3a
Infrastructure as a Service
Elastic Computing
Clustering
Security as a Service
Management as a Service
Off-premise
Portability
Platform as a Service
Resource Democratization
Web 2.0
Integration as a Service
Time-Sharing
Database as a Service
Abstraction of Infrastructure
Process as a Service
Interoperability
Testing as a Service
Grid Computing
Pay As You Go
Hybrid Pricing
Hardware Virtualization
Utility Based Consumption
Desktop Virtualization
Presentation Virtualization
Subscription Pricing
Virtualization
Application Virtualization
Source Gaurav Verma, SAS, OECD Cloud Computing
Forum, 14 October 2009
4
Cloud computing is

•  A model for enabling convenient, on-demand
  network access to a shared pool of configurable
  computing resources that can be rapidly
  provisioned and released with minimal management
  effort or service provider interaction  (US
  NIST)
• Various flavours of the Cloud
• Infrastructure as a Service, Platform as a
  Service, Software as a Service (degree of user
  control)
• Public Cloud, community Cloud, Private Cloud
• Difference between Cloud Computing and Web 2.0
  applications ?

5
driven by real benefits

• Many benefits
• Cost
• Speed of development
• Scalability
• Ease of use
• Reduction of legal complexity
• Environmental impact (green ICT)
• Security, reliability
• Many of these benefits facilitate innovation
• Concerns everybody Individuals, SMEs, Large
  firms, Governments, NGOs
• Opportunity for development ( Could computing )

6
But there are issues

• Economic impact (e.g. employment)
• Competition
• Standards
• Discrepancies in legal regimes
• Environmental impact
• Security
• Privacy

7
Security privacy

• Security in the Cloud vs. Security today
• Security is context dependent.
• Risk assessment and management are essential
• Cloud computing makes IT truly global it
  magnifies cross-border privacy issues
•  Laws are inhenrently local, Cloud is inherently
  global 
• Problems arent new. Their scale is.
• Need to better understand the business models

8
OECD Work

• Main challenge is to devise policy approaches
  that foster security and privacy without stifling
  innovation.
•  How to turn security/privacy as a competitive
  advantage to the market rather than a
  showstopper 
• Work on economic aspects of security

9
OECD Work

• 2007Recommendation on Privacy Law Enforcement
  Co-operation
• 2008 Seoul Ministerial
• Draft Report on the Changing Privacy Environment

10
30thAnniversary Conference(2010)Follow
ed by a Review of the Privacy Guidelines
11
Conclusion

• Cloud computing is an important trend
• Issues are not new. The scale is.
• Cross-border challenges
• International cooperation and dialogue
• Need for innovative policies that will foster
  innovation AND security/privacy

12

• www.oecd.org/ict