Privacy and Security Implications of Cloud Computing

1. Privacy and Security Implications of Cloud Computing 17 November 2009 - IGF Laurent Bernat - OECD

2. OECD Technology Foresight Forum on Cloud Computing • 14 October 2009 : OECD Technology Foresight Forum on Cloud Computing • Government, Business, Civil Society, Technical Community • www.oecd.org/ict

3. The Cloud (of buzzwords) Regulatory Requirements Community Private Cloud Public Cloud Commodity Public Cloud Private Cloud SLA’s Enterprise Public Cloud Hybrid Cloud Closed Private Cloud Storage as a Service ASP CloudBursting Software as a Service Cloud Stacks Web 3.0 Inter Cloud On-premise Security 1.3a Information as a Service Infrastructure as a Service Elastic Computing Clustering Management as a Service Security as a Service Off-premise Portability Resource Democratization Platform as a Service Web 2.0 Integration as a Service Time-Sharing Database as a Service Abstraction of Infrastructure Process as a Service Interoperability Testing as a Service Grid Computing Hybrid Pricing Pay As You Go Hardware Virtualization Utility Based Consumption Desktop Virtualization Subscription Pricing Presentation Virtualization Virtualization Application Virtualization Source: Gaurav Verma, SAS, OECD Cloud Computing Forum, 14 October 2009

4. Cloud computing is… • « A model for enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction » (US NIST) • Various flavours of the Cloud: • Infrastructure as a Service, Platform as a Service, Software as a Service (degree of user control) • Public Cloud, community Cloud, Private Cloud • Difference between Cloud Computing and Web 2.0 applications ?

5. … driven by real benefits • Many benefits • Cost • Speed of development • Scalability • Ease of use • Reduction of legal complexity • Environmental impact (green ICT) • Security, reliability • Many of these benefits facilitate innovation • Concerns everybody: Individuals, SMEs, Large firms, Governments, NGOs • Opportunity for development (« Could computing »)

6. But there are issues… • Economic impact (e.g. employment) • Competition • Standards • Discrepancies in legal regimes • Environmental impact • Security • Privacy

7. Security & privacy • Security in the Cloud vs. Security today • Security is context dependent. • Risk assessment and management are essential • Cloud computing makes IT truly global: it magnifies cross-border privacy issues • « Laws are inhenrently local, Cloud is inherently global » • Problems aren’t new. Their scale is. • Need to better understand the business models

8. OECD Work • Main challenge is to devise policy approaches that foster security and privacy without stifling innovation. • « How to turn security/privacy as a competitive advantage to the market rather than a showstopper » • Work on economic aspects of security

9. OECD Work • 2007Recommendation on Privacy Law Enforcement Co-operation • 2008 Seoul Ministerial • Draft Report on the Changing Privacy Environment

10. 30thAnniversary Conference(2010)Followed by a Review of the Privacy Guidelines

11. Conclusion • Cloud computing is an important trend • Issues are not new. The scale is. • Cross-border challenges • International cooperation and dialogue • Need for innovative policies that will foster innovation AND security/privacy

12. www.oecd.org/ict