5 ms·

Medical data and AWS? Urks. If you host with an US-company, your data is no more secure then if they were physically in the US. Not if preventions of overreach

by onli 10y ago

Medical data and AWS? Urks. If you host with an US-company, your data is no more secure then if they were physically in the US. Not if preventions of overreach like Privacy Shield (which was mostly a joke anyway) are dismantled. Get a EU data-provider!

Beltiras 10y ago
AWS is 27001 and 27018 compliant: https://aws.amazon.com/compliance/iso-27001-faqs/ https://aws.amazon.com/compliance/iso-27001-faqs/
- onli 10y ago
  So what? You really think that if a government agency asks for data, and an US-government argues (again) that an US-company does not have the right to not give the data out, Amazon will not comply? This is exactly what was part of the whole discussion about Privacy Shield, and you saw how that ended up. Edit: grabehs answer is clearer than my own. Thanks.
- grabeh 10y ago
  Onli is talking about the potential for US authorities to order US companies to disclose information hosted by them regardless of the location of their services, not the actual security of the data. The issue of US companies being compelled to disclose is the subject of ongoing litigation between Microsoft and the US. I believe the Supreme Court will hear arguments this year. Of course if you are encrypting hosted data and AWS has no access to the keys, then that gives comfort over the disclosure. The relevant authorities/local authorities would have to come to you for disclosure of the keys and you would have any protections applicable under local laws...
  - Beltiras 10y ago
    That would exclude AWS from an awfully large segment of data hungry industries. Operating in the EU AWS has to comply with GDPR for at least the operations they have located in the EU. Frankfurt is safe.
    - onli 10y ago
      It is not. See https://www.extremetech.com/extreme/186302-us-government-asserts-unilateral-right-to-access-private-data-even-if-its-stored-outside-the-us https://www.extremetech.com/extreme/186302-us-government-ass... for a popular explanation why. AWS being excluded from business is exactly what those companies are arguing.
      - Beltiras 10y ago
        Still being litigated [1]. Last ruling was for Microsoft's position. [1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._United_States_of_America
        onli 10y ago
        That's a good caveat. Still: Being litigated means the US is trying to achieve a state which is explicitly unsafe. Which for me means already that AWS-Frankfurt is not safe. Especially for something like medical data. The potential danger is way too big, especially since we know that the US-agencies will siphon the data anyway, regardless of what the court rules. Think business: Do you really want to face the media backlash when your competitor lances the story that the medical data you collect goes directly into the tiny little hands of Trump, and to the NSA?
        Beltiras 10y ago
        If they are using extra-judicial means to get at the data I have no recourse anyways. I will have to store it somewhere and a dedicated attacker will always (eventually) find a vulnerability. The standards I have to implement do not state that I must keep the data out of the hands of attackers. They state principles and methods that make it less likely. When the regulators come knocking after an 'incident' their levying of fines will depend on standards and regulation compliance, not the leaked documents. You have an unreasonable expectation of what can be done.
        onli 10y ago
tyfon 10y ago
I work in a startup bank in Norway, and we have been explicitly denied using AWS, Azure or google cloud by the authorities for our data/services because of this. So there this is not new for us. We are currently using a EU based provider for some of the services and a Norwegian based one for the rest. We might go for azure now for some processing, but the data we can keep there has to be anonymized to the point where it is almost useless.

by onli 10y ago

Beltiras 10y ago

AWS is 27001 and 27018 compliant: https://aws.amazon.com/compliance/iso-27001-faqs/ https://aws.amazon.com/compliance/iso-27001-faqs/

onli 10y ago
So what? You really think that if a government agency asks for data, and an US-government argues (again) that an US-company does not have the right to not give the data out, Amazon will not comply? This is exactly what was part of the whole discussion about Privacy Shield, and you saw how that ended up. Edit: grabehs answer is clearer than my own. Thanks.
grabeh 10y ago
Onli is talking about the potential for US authorities to order US companies to disclose information hosted by them regardless of the location of their services, not the actual security of the data. The issue of US companies being compelled to disclose is the subject of ongoing litigation between Microsoft and the US. I believe the Supreme Court will hear arguments this year. Of course if you are encrypting hosted data and AWS has no access to the keys, then that gives comfort over the disclosure. The relevant authorities/local authorities would have to come to you for disclosure of the keys and you would have any protections applicable under local laws...
- Beltiras 10y ago
  That would exclude AWS from an awfully large segment of data hungry industries. Operating in the EU AWS has to comply with GDPR for at least the operations they have located in the EU. Frankfurt is safe.
  - onli 10y ago
    It is not. See https://www.extremetech.com/extreme/186302-us-government-asserts-unilateral-right-to-access-private-data-even-if-its-stored-outside-the-us https://www.extremetech.com/extreme/186302-us-government-ass... for a popular explanation why. AWS being excluded from business is exactly what those companies are arguing.
    - Beltiras 10y ago
      Still being litigated [1]. Last ruling was for Microsoft's position. [1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._United_States_of_America
      - onli 10y ago
        That's a good caveat. Still: Being litigated means the US is trying to achieve a state which is explicitly unsafe. Which for me means already that AWS-Frankfurt is not safe. Especially for something like medical data. The potential danger is way too big, especially since we know that the US-agencies will siphon the data anyway, regardless of what the court rules. Think business: Do you really want to face the media backlash when your competitor lances the story that the medical data you collect goes directly into the tiny little hands of Trump, and to the NSA?
        Beltiras 10y ago
        If they are using extra-judicial means to get at the data I have no recourse anyways. I will have to store it somewhere and a dedicated attacker will always (eventually) find a vulnerability. The standards I have to implement do not state that I must keep the data out of the hands of attackers. They state principles and methods that make it less likely. When the regulators come knocking after an 'incident' their levying of fines will depend on standards and regulation compliance, not the leaked documents. You have an unreasonable expectation of what can be done.
        onli 10y ago

tyfon 10y ago

I work in a startup bank in Norway, and we have been explicitly denied using AWS, Azure or google cloud by the authorities for our data/services because of this. So there this is not new for us. We are currently using a EU based provider for some of the services and a Norwegian based one for the rest. We might go for azure now for some processing, but the data we can keep there has to be anonymized to the point where it is almost useless.