Symposium Agenda

WELCOME AND OPENING REMARKS:  "EVERY SILVER LINING HAS A CLOUD"

Peter Brown, Official of the European Parliament (on leave) and Member of the OASIS Board of Directors

During the first annual "International Cloud Symposium (ICS)," attendees will discover how very different this Cloud event really is.  ICS brings together a wide range of people from the global standards' community, including practitioners, government agencies, vendors, as well as policy makers.  With much of the responses to the need for policy and standards in the Cloud being driven primarily on a national level, members of the ICS programme committee felt strongly about broaden the dialogue to a more global level.  Expert speakers from the U.S., Canada, South Africa, India, China, Japan, and many countries throughout Europe have been invited to share their views -- offering attendees a truly global perspective.  

Assisted by a key speakers featured during the next few days, Peter Brown, will tell the story of how and why the decision was made to bring such a diverse group of people together, and highlight the core message that every major success story in technology deployment today does involves Cloud Computing...

GOVERNANCE:  RETAINING CONTROL IN A CLOUD ENVIRONMENT

John Borras, Chair, OASIS eGov Member Section  |  Joe Baguley, Chief Technology Officer, EMEA, VMWare   
Andy MacLeod, Head of Policy and Strategy Public Sector, Cisco Systems  |   Chris Parker, Managing Director, CS Transform  |  Marnix Dekker, Application Security Officer, European Network and Information Security Agency (ENISA)

In using Cloud infrastructures, the client necessarily cedes control to the Cloud Provider (CP) on a number of issues. This loss of governance and control could have a potentially severe impact on the organisation’s strategy and therefore on the capacity to meet its mission and goals. The session addresses these concerns and looks at ways that the client can remain in control of its assets.

Topics to be covered:

• Governance Policies and Structures – What are the additional policies and organisational structures that need to be put in place to mitigate the possible loss of control and governance?
  

• Loss of Control – Loss of control and governance could lead to the impossibility of complying with the security requirements, a lack of confidentiality, integrity and availability of data, and a deterioration of performance and quality of service, not to mention the introduction of compliance challenges.

• Governance Standards – Certification processes and standards for Clouds environments.

• Risk Management – What should be the key aspects of a client’s risk management strategy for Cloud Computing?

• Lock-in – There is currently little on offer in the way of tools, procedures or standard data formats or services interfaces that could guarantee data, application and service portability. This can make it difficult for the customer to migrate from one provider to another or migrate data and services back to an in-house IT environment. This introduces a dependency on a particular CP for service provision, especially if data portability, as the most fundamental aspect, is not enabled. In addition the Cloud provider may outsource or sub-contract services to third-parties (unknown providers) which may not offer the same guarantees (such as to provide the service in a lawful way) as issued by the Cloud provider. Or the control of the Cloud provider changes, so the terms and conditions of their services may also change.

• Business Continuity – Providing continuity is important to an organisation. Although it is possible to set service level agreements detailing the minimum amount of time systems are available, there remain a number of additional considerations. a. Does the provider maintain a documented method that details the impact of a disruption? b. What are the RPO (recovery point objective) and RTO (recovery time objective) for services? Detail according to the criticality of the service. c. Are information security activities appropriately addressed in the restoration process? d. What are the lines of communication to end customers in the event of a disruption? e. Are the roles and responsibilities of teams clearly identified when dealing with a disruption?
  

• Impact on Policy and Business Objectives – What is the impact of Cloud Computing on the policy and business objectives of an organisation, eg their Green IT targets? Does the introduction of a Cloud based service provision require changes to current policies and business objectives?

IDENTITY & ACCESS CONTROL CHALLENGES IN THE CLOUD

Mike Small, Senior Analyst, KuppingerCole |  Tomas Gustavsson, Chief Technology Officer, Primekey
Matt Rutkowski, Senior Engineer, Master Inventor, IBM  |  Babak Sadighi, Co-Founder & CEO, Axiomatics 
Brendan Peter, Deputy Commissioner TechAmerica Foundation, CA Technologies  

The move to Cloud Computing brings with it a number of special challenges when it comes to security. One particular area is that of identity and access management - managing who can access information is fundamental to information security. Cloud computing has introduced two key changes: firstly although responsibility for access management still lies within the organization, the IAM technology is physically distributed; secondly individuals now have significant presence in IT systems outside of the organization. In this session, the panellists will address some of these concerns including:

• Identity Related Risks in the Cloud - Impersonation or theft of the identity of employees and individuals can lead to losses through fraud, theft and damage to reputation. When the system is hosted in the Cloud it is implicitly open to access through the internet and so extra measures are needed to ensure security.
  
  

• Privileged User Management – The infrastructure upon which the Cloud is built needs to be managed and the management tools and accounts pose a particular risk. This is especially true where the administrators are outside the direct control of the owners of the information being processed.
  
  

• Compliance - Organizations are ultimately responsible for the security and integrity of their own data, even when it is held by a service provider. How can an organization using the Cloud ensure compliance with the laws and regulations that they are subject to?
  
  

• Authentication and Authorisation – How can you trust the identity of the many people who have access to the Cloud? How can the identity of people making access be assured and how can access to the data in the Cloud be controlled in a granular way? This session will explore new paradigms for authentication and authorisation in the realm of public sector.

LEGAL IMPEDIMENTS TO SUCCESSFUL CLOUD IMPLEMENTATIONS

John Borras, Chair, eGov Member Section  |  Tim Cowen, Partner, Sidley Austin  |  Steve Mutkoski, Regional Director for Interoperability and Innovation, Microsoft  |  James Bryce Clark, General Counsel, OASIS

Customers and potential customers of Cloud provider services should have regard to their respective national and supra-national obligations for compliance with regulatory frameworks and ensure that any such obligations are appropriately complied with. This session identifies the most common legal aspects that need attention in the development and operation of Cloud based services.

Topics to be covered:

• Contracts: Most legal issues involved in Cloud Computing will currently be resolved during contract evaluation (ie, when making comparisons between different providers) or negotiations. The more common case in Cloud Computing will be selecting between different contracts on offer in the market (contract evaluation) as opposed to contract negotiations. Unlike traditional Internet services, standard contract clauses may deserve additional review because of the nature of Cloud Computing. The parties to a contract should pay particular attention to their rights and obligations related to notifications of breaches in security, data transfers, creation of derivative works, change of control, and access to data by law enforcement entities. Some of the key legal questions the customer should ask the Cloud provider are: - In what country is the Cloud provider located? - Is the Cloud provider’s infrastructure located in the same country or in different countries? - Will the Cloud provider use other companies whose infrastructure is located outside that of the Cloud provider? - Where will the data be physically located? - Will jurisdiction over the contract terms and over the data be divided? - Will any of the Cloud provider’s services be subcontracted out? - Will any of the Cloud provider’s services be outsourced? - How will the data provided by the customer and the customer’s customers, be collected, processed and transferred? - What happens to the data sent to the Cloud provider upon termination of the contract? - If a PaaS or SaaS provider goes into bankruptcy, how is the customer protected?

• Service Level Agreements: At the present time, most of the legal issues involved in Cloud Computing will be resolved during the evaluation of contracts, ToUs, User Licensing Agreements (ULAs) and SLAs by the customer. It is important to differentiate between the case of a small to medium sized organisation which would make a choice between different contracts offered on the market, and a larger organisation, which would be in a position to negotiate clauses. In the legal analysis of this paper, we take the perspective of the small-to-medium sized organisation which is assessing different contracts, SLAs, etc, offered on the market, since this is the more common case. This is because the business model of Cloud Computing differs from that of outsourcing: in order to deliver some of the benefits to its customers, Cloud Computing relies on the economies of scale from providing a low cost, commodity service, as opposed to a service specifically tailored to a customer’s needs. Larger organisations may however use the same considerations when negotiating contracts. While past experiences with similar Internet technologies provide some guidance to allow customers and Cloud providers to assess the security risks involved in Cloud Computing, it is necessary for both to consider the unique nature of Cloud Computing when evaluating these risks. 

• Intellectual Property: As with all intellectual property, if not protected by the appropriate contractual clauses problems can arise. What are the specific IP issues that need to be addressed when operating in a Cloud environment?

• Liability and Taxation Issues: Providing Cloud based services can raise some difficult questions about liabilities and taxation, particularly where these services cross jurisdictional boundaries. What aspects do clients and Cloud providers need to be aware of before committing to a new service? 

• How selected Standards bodies are addressing the needs for best practices or draft guidelines, rather than actual standards


• The types of standards architecture that seem most relevant and useful relating to Cloud issues


• How might new partnerships between Standards bodies [de jure, fora and consortia] develop to meet the needs identified by the Siena and similar initiatives


• And how the industry perceives its needs.

CLOSING REMARKS