Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

2/25/2014
02:06 PM
50%
50%

NSA Spying Scandal Darkens Cloud Discussions At RSA

From Europe's efforts to create regulations for data localization to worries over the security of the cloud, the leaks of the past eight months have cast a shadow over cloud providers

RSA CONFERENCE -- San Francisco -- Last summer's revelations of the extent to which the U.S. National Security Agency (NSA) collected data on American and foreign targets has caused rifts between global businesses that are hindering efforts to secure the cloud, said Richard Clarke, CEO of Good Harbor and a former U.S. cyberczar, at the Cloud Security Alliance (CSA) Summit on Monday.

RSA Conference 2014
Click here for more articles about the RSA Conference.

The steady leak of documents during the past eight months detailing the operations of the NSA intelligence collection activities has damaged both U.S. policy efforts abroad and the business of a variety of multinational companies, especially cloud providers. Efforts to implement strong security guidelines for the cloud will have to overcome efforts by other nations to implement data residency restrictions to hinder competition, Clarke said.

"Non-U.S. companies are using the NSA revelations as a marketing tool," he said. "There is a great deal of hypocrisy in all of this. People are suddenly amazed that intelligence agencies were collecting intelligence."

Requirements to force cloud providers to keep data in the country of origin and not allow data to transit through the U.S. amount to technological nationalism and, worse, do not make the data any appreciably safer, Clarke said. Data hosting in Europe will be just as easy to get access to as data hosted in the U.S. or another country, Clarke said.

"I'm not revealing away any secrets here if I say that the NSA, and any other world-class intelligence agency, can hack into databases, even if they are not in the United States," he said. "If you think that by passing a law making data localization a requirement for databases in the EU or Argentina or Venezuela or wherever stops the NSA from getting into those databases, think again."

Yet Europe's own technical guru, Udo Heimbrecht, executive director of the European Union Agency for Network and Information Security (ENISA), an EU agency that works to enhance information security, argued that data that travels through the U.S. is at greater risk of interception.

"If you are sending an e-mail from Germany to Estonia, why should it go through the U.S.?" he said. "And that is the idea that we keep our data in Europe."

[Companies need cloud providers to delineate responsibilities for the security of data, provide better security information, and encrypt data everywhere. See 5 Ways Cloud Services Can Soothe Security Fears In 2014.]

Clarke served on President Obama's Review Group on Intelligence and Communications Technologies, the five-member group that issued a 308-page report on the U.S.'s intelligence-gathering efforts. The report underscored that the competing goals of the U.S. intelligence community -- protecting liberty and the right to privacy while at the same time rooting out and combatting terrorism -- could not always be met simultaneously.

Clarke voiced support for the NSA's mission, but underscored that there was a disconnect between policy makers and the intelligence collectors. While legislators gave the NSA powers to accomplish certain goals and missions, the intelligence collectors sought all manner of information that would help them achieve those goals. The technological infrastructure, however, could be used for laudable aims as well as nefarious, he said.

"We may have created, along with the CIA and FBI and other intelligence agencies, and with all these technologies ... the potential -- the potential -- for a police surveillance state," Clarke said. "We are not there yet, but the technology is."

For most companies that put their data into cloud services, there are more practical concerns of data security. Questions of security boil down to questions of trust, said David Miller, chief security officer at Covisint, a cloud identity provider.

"Do I trust the cloud? That's a little bit of a broad statement," Miller said. "I trust some vendors on the cloud; I don't trust other vendors in the cloud. I do know that we are at a point where we are going to have to use it."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.