Where is my big data: security, privacy and jurisdictions in the cloud

•

1 like•854 views

This document summarizes Chris Swan's presentation on big data security, privacy, and jurisdiction in the cloud. The presentation covers Swan's background in technology, defines big data, discusses cloud security concerns and challenges of regulation across jurisdictions. It concludes by suggesting some steps individuals can take to protect their data, such as only using services from providers with strong privacy policies and avoiding services from countries with surveillance laws that compromise privacy.

Technology

copyright 2015
Where is my big data: security,
privacy and jurisdictions in the cloud
Chris Swan
@cpswan

copyright 2015
Agenda
• My background
• What do I mean by big data?
• Cloud security
• Regulation and Jurisdiction
• So what can you do?

copyright 2015
My background
CTO
CTO Client Experience
Co-head CTO Security
Corporate Finance
fintech, early stage
IT R&D – Networks and security
Grid, app server engineering
Combat System Engineer

copyright 2015
Recent adventure with Big Data

copyright 2015
Misquoting Roger Needham
Whoever thinks their analytics
problem is solved by big data,
doesn’t understand their analytics
problem and doesn’t understand
big data
5

copyright 2015
What do I mean by ‘big data’?

copyright 2015
The 2x2 view
7
Based on a blog post from April 2012 – http://is.gd/swbdla
Problem Types
Algorithm Complexity
DataVolume
Simple
Big Data
Quant

copyright 2015
Advertising is the canonical use
“By and large, the story of web advertising and ad
companies and networks is a story of organizations
aggressively and unapologetically tracking and intruding on
people for years.”
Chris Siebenmann
http://utcc.utoronto.ca/~cks/space/
blog/web/AdblockingAndMorality

copyright 2015
Regulation and Jurisdiction

copyright 2015
Three common approaches
14
Based on Example
Rules Singapore
Principle UK/US
Comparison Switzerland

copyright 2015
The ‘tin foil hats’ were right
16

copyright 2015
Real legislative dangers
17
@CasparBowden
Patriot Act
FISA 702
EO 12333

copyright 2015
Physical location is not enough
Alexander Hanff
http://www.computing.co.uk/ctg/opinion/2403739
/why-amazons-new-eu-data-centres-are-just-as-
vulnerable-to-nsa-surveillance-as-their-us-ones

copyright 2015
Do as your government does

Lewis Crawford is the principal architect of the DataShed, a consultancy that helps large clients leverage big data technologies. The document discusses how big data projects often fail due to an assumption that more data automatically provides insights, rather than understanding the problem. It advocates understanding the problem, applying appropriate tools, and automating processes. The DataShed helps businesses with analytics and data challenges, even small ones, using big data solutions like deduplicating 250,000 customer records. The document concludes by emphasizing understanding the problem, using new technologies as enablers rather than deliverables, and automating testing.

SecureAuth & 451 Research Webinar: Connected Security - A Holistic Approach t...

SecureAuth

In 2015 alone, over 3000 cyber attacks were reported globally – with many more never reported or even detected. Enterprises deploy security point solutions in the hopes of stopping a data breach, while savvy attackers work to exploit the whitespace between them. In this webcast, Garrett Bekker, Senior Analyst, Enterprise Security of 451 Research and Stephen Cox, Chief Security Architect of SecureAuth explored how the Connected Security Alliance is bringing together best-of-breed cyber security vendors to close the gap between isolated security products. Originally presented October 19, 2016.

A Comprehensive Guide to Data Management for Businesses by Infinit Datum

Infinit-O Global, Limited

Trust :: Data: Beyond blockchain hype, Tradestreaming Money Conference, Novem...

Digiday

This document discusses challenges with transitioning analog data to digital formats and proposes solutions using new technologies. It notes that while data becomes more valuable when shared, centralization poses security and privacy risks. The author proposes a framework using CoreID for robust digital identity, combined with OPAL/ENIGMA technologies, to address these issues by providing over 1000x better security, using behavioral biometrics, and enabling data to be encrypted and still useful. This would allow building better systems for transitioning analog to digital data while facilitating secure data sharing.

Cybersecurity investment trends, Chris Lynch, Partner, Atlas Ventures.

MIT Startup Exchange

Internet of Things and Governance

Kate Carruthers

The document discusses the challenges of governing internet of things (IoT) devices and data. It notes that as more devices become connected through technologies like artificial intelligence, ensuring privacy, security, and appropriate use of data will become more difficult. It explores approaches to IoT governance taken by the EU and others, including prioritizing privacy by default, transparency, and technological solutions. Developing comprehensive governance strategies and standards that can adapt to rapid technological changes is presented as key to addressing these issues.

Why big data matters to case management

mister_moun

The document discusses how big data can help with case management. It notes that case management provides value through variable costs and opportunity for differentiation. Big data allows for data insight and business development, enterprise information governance, and data collection, protection and organization to help deliver value propositions. It also discusses how big data can help organizations know when to act, perform real-time inline analytics, use dynamic business rules, and rethink how work gets distributed.

Open Source Insight:IoT Security, Tech Due Diligence, and Software Security ...

Black Duck by Synopsys

A grab-bag of open source security and cybersecurity news is in this week’s edition of Open Source Insight. Is “many eyeballs” not enough? Some security researchers think Linus’ Law doesn’t work anymore. Black Duck by Synopsys kicks off a new video series with MITRE IoT expert, Bob Martin. Learn how open source tech due diligence helped one company close a deal securely. Should “Privacy Day” be renamed to “Lack of Privacy” day? Plus, an eye-catching infographic on how too little software security training is putting many companies at risk.

The document discusses the benefits of cloud services and open innovation for businesses. It notes that cloud services allow for fast startup with low costs and no upfront infrastructure expenses. Open innovation enables businesses to leverage external developers to create new applications, extending their capabilities. The document advocates taking risks with open approaches and starting with low-risk pilots to prove security and business models before fully adopting new technologies.

HSB15 - 0xDUDE

Splend

The document discusses responsible disclosure of security vulnerabilities found by researchers. It provides statistics on known data breaches versus prevented breaches in 2014 and 2015. It notes that responsible disclosure success rates have been higher but the number of records affected is much lower. The document recommends best practices for security researchers conducting responsible disclosure, including finding the appropriate contact, being clear on goals, making a good impression, carefully qualifying issues, avoiding demands or threats, and using clear writing.

MIT ILP STEX Cybersecurity Workshop 5.28.15

MIT Startup Exchange

This document outlines the agenda for a cybersecurity innovation workshop hosted by MIT. The agenda includes introductory remarks and keynote speeches from industry leaders on trends in cybersecurity, investment, and policy. There will also be lightning talks from startup founders and executives. The workshop will conclude with a panel discussion on important trends in cybersecurity innovation, the ecosystem, corporate priorities, and investment focus areas. The panel will be moderated by the Executive Director of Cybersecurity@CSAIL at MIT.

Inspirational Keynote Quotes - Microsoft Future Decoded 2015 "Technical Day"

Cobweb

Make Money, Save Money & Avoid Risk with The Network. Intuitive

hugopprad

20180419 DataWorks Summit Keynote - Adapting to the exponential development...

Santiago Cabrera-Naranjo

Digitalization is impacting every industry in every economy, disrupting markets and upending competitive hierarchies. Across every business discipline, from operations and manufacturing to marketing and sales, companies are struggling to integrate new data, new analytics, and new technologies into their existing processes and practices. Companies that successfully adapt to these new and accelerating changes will outperform their competitors The new challenges require new ways of organizing, new social and technical architectures. In this session, we identify the key challenges businesses face in the era of massive digitalization, and the organizational and architectural steps that will enable savvy competitors to find business value in this time of tumultuous technical change. The gap between first steps and effective digitalization is large. For instance, businesses can run scrum teams without being agile; can have a data science lab without supporting autonomous model deployment to consumer-facing processes and applications; and can stand up a Hadoop ecosystem without understanding how the components fit together or what to do with it. Based on our deep experience with dozens of clients, we describe key differences in levels of technology maturity, and practical tactics leading companies are using to turn digital innovation into competitive advantage.

Workshop on Data Science at Best Practices Meet 2017, Data Security Council o...

Shomiron Das Gupta

Five Big Bets in a Blockchain World (June 2018)

Mike Wons

Internet of Things With Privacy in Mind

Gosia Fraser

This document discusses privacy considerations for Internet of Things devices. It notes that IoT devices collect personal data that, even when fragmented, can reveal sensitive information when aggregated and analyzed. Many IoT manufacturers do not adequately explain how they collect, use, store, and allow deletion of personal information. The document advocates adopting privacy by design principles to build privacy protections into IoT technologies from the early stages of development through privacy impact assessments and data protection impact assessments. This helps understand privacy needs, shape better policies, and improve transparency while demonstrating adherence to high data protection standards.

Your clouds must be transparent - an intro to Cloud Security Alliance

David Jones

The document discusses security issues with software as a service (SaaS) and platform as a service (PaaS) models and the need for greater transparency from cloud providers. It mentions several large data breaches and outlines efforts by the Cloud Security Alliance (CSA) to establish standards and best practices through research groups and guidance documents. While compliance does not guarantee security, the CSA works to educate organizations and help negotiate security understandings between vendors and customers.

Privacy and Security by Design

Unisys Corporation

Blockchain Presentation Microsoft Tech Expo Portland 2017

Joseph Brewer, CSM, PMP, MBA, PROSCI® CCMP (Veteran)

This document provides an overview of blockchain and distributed ledger technology. It discusses how the internet has evolved over time and some of the problems it currently faces. It then introduces blockchain as an emerging technology that could provide solutions through distributed ledger systems and smart contracts. Several use cases and industries that may be impacted are examined, along with the growing interest and investment in blockchain technology worldwide.

SMART PAPER D.U.A.L. book

Smart Paper

The Privacy Advantage 2016 - Geoff Revill

Krowdthink

Close the Security Gaps of a Remote Workforce

jlieberman07

The Covid-19 pandemic demanded that businesses immediately shift to remote work environments. The quick shift however, may have created security gaps. Cyber security experts and IT executives steps companies should take to ensure secure access to sensitive corporate data when enabling employees to work from home. Let us help you stand up a secure remote work environments in 24 hours! https://bit.ly/2ScpL22

Simplifying Network Ops for the New Era of IT

Natalie Andrusyk

Cloud cop presentation

Krishnadas Manghat

Cloudcop is an advanced cloud based data protection solution for enterprises. Its unique context & content data protection algorithms protect resident data & data in motion. Our solution is >90% effective &, 1. is deployable within minutes & highly scale-able 2. provides Seamless data protection & real time response Reaching out to enterprises through partners is how we go-to market. Revenue generation is through subscription & licensing fees.

IoT: State of the Union

Amazon Web Services

8.4 billion devices were connected to the Internet of Things in 2017, with 33% from the Asia-Pacific region excluding China. Most machine data never reaches the cloud due to limitations of physics, economics, and privacy laws. To address this, AWS Greengrass extends AWS cloud computing capabilities to edge devices so that more data processing can be done locally while still taking advantage of cloud services.

Privacy and Protection in the World of Database DevOps

Grant Fritchey

Ensuring the ongoing protection of personally identifiable information is mandatory in today's business, helping you to guard against data breaches and comply with the GDPR and other compliance requirements. In a climate where cyberattacks are all too frequent and data is spread across a growing number of different environments, the challenge of protecting your data can seem daunting. This session will address the implications of the GDPR on database management and demonstrate a privacy-first approach to controlling and protecting data as it changes and moves through your SQL Server estate. As well as offering guidance for assessing your data estate for GDPR readiness, this session will include some great tips for building data protection and privacy into your development processes, and dispel the myth that database DevOps and compliance can't go hand-in-hand. With the right preparation, you can build compliance into your processes, keep sensitive data safe and deliver value quickly to your end users.

Luncheon 2016-04-21- Data Security and Privacy Issues in Cloud Contracts by R...

North Texas Chapter of the ISSA

This document discusses key issues around data privacy and security in cloud computing contracts. It notes the rapid growth of the cloud market and outlines regulatory compliance risks under laws like GLBA, HIPAA, and PCI. Specific requirements are discussed, including conducting risk assessments, implementing security measures, and potentially requiring business associate agreements. The presentation recommends provisions to address in cloud contracts regarding insurance, indemnification, liability limits, regulatory compliance, and security commitments.

Security and Privacy Issues of Cloud Computing; Solutions and Secure Framework

IOSR Journals

This document discusses security and privacy issues related to cloud computing. It begins by defining cloud computing and noting its benefits. However, it also acknowledges security concerns, such as lack of control over data, network security issues, and potential insider threats. The document then examines specific security risks like weak client security, insecure APIs, lack of encryption, and not having backups and disaster recovery plans. It proposes some solutions like access controls, encryption, firewalls, regular security audits and penetration testing. Finally, the document presents a secure framework for cloud computing that incorporates many of these solutions to help providers and consumers mitigate risks and enhance security.

The Accidental Cloud: Privacy and Security Issues in a BYOD World

mkeane

The document discusses the growing trend of employees using mobile devices and cloud services for both personal and work purposes. It notes that this "accidental cloud" means employers have little control over company data stored externally by third parties. The document recommends that employers establish clear BYOD and data security policies to manage risks and privacy issues related to dual-use devices and cloud data storage.

What's hot

Cloudinnovationl

peter williams

HSB15 - 0xDUDE

Splend

MIT ILP STEX Cybersecurity Workshop 5.28.15

MIT Startup Exchange

Inspirational Keynote Quotes - Microsoft Future Decoded 2015 "Technical Day"

Cobweb

Make Money, Save Money & Avoid Risk with The Network. Intuitive

hugopprad

20180419 DataWorks Summit Keynote - Adapting to the exponential development...

Santiago Cabrera-Naranjo

Workshop on Data Science at Best Practices Meet 2017, Data Security Council o...

Shomiron Das Gupta

Five Big Bets in a Blockchain World (June 2018)

Mike Wons

Internet of Things With Privacy in Mind

Gosia Fraser

Your clouds must be transparent - an intro to Cloud Security Alliance

David Jones

Privacy and Security by Design

Unisys Corporation

Blockchain Presentation Microsoft Tech Expo Portland 2017

Joseph Brewer, CSM, PMP, MBA, PROSCI® CCMP (Veteran)

SMART PAPER D.U.A.L. book

Smart Paper

The Privacy Advantage 2016 - Geoff Revill

Krowdthink

Close the Security Gaps of a Remote Workforce

jlieberman07

Simplifying Network Ops for the New Era of IT

Natalie Andrusyk

Cloud cop presentation

Krishnadas Manghat

IoT: State of the Union

Amazon Web Services

Privacy and Protection in the World of Database DevOps

Grant Fritchey

What's hot (19)

Cloudinnovationl

HSB15 - 0xDUDE

MIT ILP STEX Cybersecurity Workshop 5.28.15

Inspirational Keynote Quotes - Microsoft Future Decoded 2015 "Technical Day"

Make Money, Save Money & Avoid Risk with The Network. Intuitive

20180419 DataWorks Summit Keynote - Adapting to the exponential development...

Workshop on Data Science at Best Practices Meet 2017, Data Security Council o...

Five Big Bets in a Blockchain World (June 2018)

Internet of Things With Privacy in Mind

Your clouds must be transparent - an intro to Cloud Security Alliance

Privacy and Security by Design

Blockchain Presentation Microsoft Tech Expo Portland 2017

SMART PAPER D.U.A.L. book

The Privacy Advantage 2016 - Geoff Revill

Close the Security Gaps of a Remote Workforce

Simplifying Network Ops for the New Era of IT

Cloud cop presentation

IoT: State of the Union

Privacy and Protection in the World of Database DevOps

Viewers also liked

Luncheon 2016-04-21- Data Security and Privacy Issues in Cloud Contracts by R...

North Texas Chapter of the ISSA

Security and Privacy Issues of Cloud Computing; Solutions and Secure Framework

IOSR Journals

The Accidental Cloud: Privacy and Security Issues in a BYOD World

mkeane

Security and privacy of cloud data: what you need to know (Interop)

Druva

Big Data, Cloud Computing, and Privacy Implications

Antigone Peyton

Security & Privacy In Cloud Computing

saurabh soni

This document discusses security and privacy issues in cloud computing and proposes solutions. It outlines the differences between public and private clouds, with private clouds residing inside an enterprise's firewall and providing full security through antivirus software and access only by registered users, while public clouds have no control mechanisms and data can be publicly available and accessed by fraudulent users. Current solutions like antivirus and VPNs increase overhead on every update and do not prevent unauthorized access. The proposed solution is an extra cloud access code mechanism that is managed centrally and only requires one-time updates, controlling traffic and only allowing authorized users via access codes.

Security issues associated with big data in cloud

sornalathaNatarajan

This document discusses security challenges in big data and cloud computing environments. It notes that HDFS and MapReduce do not provide adequate security for sensitive data. It proposes several techniques to improve security, such as encrypting data, using honeypot detection, logging all MapReduce jobs and user information, and having honeypot nodes to trap hackers. Encrypting network communication and data is also recommended to prevent hackers from extracting meaningful information even if they are able to access data or network packets.

Lecture01: Introduction to Security and Privacy in Cloud Computing

ragibhasan

Viewers also liked (8)

Luncheon 2016-04-21- Data Security and Privacy Issues in Cloud Contracts by R...

Security and Privacy Issues of Cloud Computing; Solutions and Secure Framework

The Accidental Cloud: Privacy and Security Issues in a BYOD World

Security and privacy of cloud data: what you need to know (Interop)

Big Data, Cloud Computing, and Privacy Implications

Security & Privacy In Cloud Computing

Security issues associated with big data in cloud

Lecture01: Introduction to Security and Privacy in Cloud Computing

Similar to Where is my big data: security, privacy and jurisdictions in the cloud

Big data debunking some of the myths

Where is my big data: security, privacy and jurisdictions in the cloud

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Viewers also liked

Viewers also liked (8)

Similar to Where is my big data: security, privacy and jurisdictions in the cloud

Similar to Where is my big data: security, privacy and jurisdictions in the cloud (20)

More from Chris Swan

More from Chris Swan (20)

Recently uploaded

Recently uploaded (20)

Where is my big data: security, privacy and jurisdictions in the cloud