CJIS Rules Not Impossible To Comply With, But It'll Cost Ya

Even as some municipal technology leaders are complaining of chafing from policies laid out by the FBI's Criminal Justice Information Systems (CJIS) rules for securing systems containing CJIS database information, the FBI has gone public this week in restating its commitment to applying those rules to cloud deployments for law enforcement agencies. According to database security and encryption experts, the requirements are hardly unreasonable for protecting the nation's most sensitive police information.

"I don't believe the requirements the FBI has put forward are particularly onerous," says Josh Shaul of Application Security Inc., which provides some of the database security tools the FBI uses to protect CJIS data stores internally. "The pushback here is almost funny. Some cloud providers are saying, 'Well, you want to know every one of our employees who has access to this data, and we don't know how to figure that out, and you want background checks on our employees to vet them, but not all of them are U.S. citizens because our data centers are scattered all over the world.'"

While it is unclear which CJIS requirement actually scuttled the project, the city of Los Angeles ran into trouble late last year in deploying Google Apps across its municipality operations due to its inability to comply with CJIS rules in developing systems for 13,000 Los Angeles Police Department employees. In December, two L.A. officials, Gerry Miller, chief legislative analyst, and Miguel Santana, city administrative officer, went so far as to say that "Criminal Justice Information Systems (CJIS) regulations are currently incompatible with cloud computing" (PDF).

However, that is not necessarily the case, at least technically. According to Todd Thiemann, senior director of product marketing for Vormetric, the encryption requirements made by the FBI are "very doable" as long as encryption is done at the file level.

"If you're encrypting the storage volume in the data center, that doesn't translate to the cloud -- you have to do something at the file level," he explains.

Meanwhile, many of the same security practices for database security used on premises still apply in the cloud, though there are other considerations to take into account, Thiemann says.

"A lot of the security processes are the same as on premises, but the potential exposure in the cloud is that the database is also accessible -- potentially to the cloud provider's employees," Shaul says. "Also, the architecture of how that cloud is being used could open the door to attack. For example, take Gmail. Before when a company's email was on an Exchange server deep in the network, it wasn't so easy for attackers to start plugging emails into the system and guessing passwords. When the system is exposed, that's a lot easier to do."

As a result, it follows that background checks and robust monitoring are put in place -- two features that cost extra money and which some cloud providers are offering as a value add. However, that cost issue may actually be what's holding up the show.

"What that may effectively do is kill the cloud for law enforcement because it will add so much additional cost that it may make more sense for them to keep it on premise," Shaul says.

However, it may spur government organizations to get more creative with how they leverage cloud technologies. For example, the state of Florida is in the process of moving all of its emails to a private cloud. The private architecture allows the Sunshine State to build systems to CJIS spec while still getting the benefit of cloud scalability.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.