Risk
11/5/2009
07:10 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Expresses Cloud Privacy Commitment, Concerns

In a policy paper, Microsoft affirms its support for privacy in the cloud and calls for regulatory clarity.

Cloud computing continues to evoke privacy concerns, so Microsoft has published a position paper that attempts to address the questions it's been hearing.

The paper's publication coincides with the 31st International Conference of Data Protection and Privacy Commissioners, which is taking place this week in Madrid, Spain.

"We know that cloud computing is getting a lot of attention these days and we've heard from customers and external stakeholders that they'd like to hear what we're thinking about it," said Brendon Lynch, senior director of privacy strategy for Microsoft's trustworthy computing group. "Privacy and security are the number one concern of organizations that are thinking about going into the cloud space."

Lynch contends the issue isn't really new, noting that Microsoft has been storing Hotmail user data on remote servers for about 15 years.

Nonetheless, the diversity of information being stored in cloud services, the extent to which cloud services are being used by consumers and businesses, and the architectural differences of cloud data storage all provide a reason for Microsoft to clarify its thinking about cloud privacy.

The good news is that the privacy principles Microsoft supports through the architecture of its software -- notice, consent, and choice, among others -- are the principles the company supports for the cloud.

The bad news -- if you accept the premise that Microsoft's interests are aligned with the user's -- is that Microsoft isn't always calling the shots.

Cloud service providers "can be caught in an impossible position when governments impose conflicting legal obligations and assert competing claims of jurisdiction over user data held by these providers," Microsoft's paper states. "Divergent rules on data privacy, data retention, law enforcement access to user data, and other issues can lead to ambiguity and significant legal challenges."

Lynch says that Microsoft is working on these issues, trying to encourage the harmonization of privacy laws and a consistent global privacy framework that can accommodate the reality of global data flows.

"In order to maintain trust and confident in cloud service, we really feel that cloud providers need to put forth strong privacy protections and to be very transparent," said Lynch.

Attend a Webcast on the application grid approach to modern data centers. It happens Tuesday, Nov. 3, 2009. Find out more and register.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2027
Published: 2015-03-31
eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.p...

CVE-2014-2830
Published: 2015-03-31
Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, as used in pam_cifscreds, allows remote attackers to have unspecified impact via unknown vectors.

CVE-2014-7876
Published: 2015-03-31
Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote attackers to gain privileges, execute arbitrary code, or cause a denial of service via unknown vectors.

CVE-2014-9462
Published: 2015-03-31
The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.

CVE-2014-9706
Published: 2015-03-31
The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.