Data Ownership & Encryption in the Cloud

New advancements in encryption technology can help businesses keep their data secure and private even when it is stored with a cloud provider.

A US federal court recently ruled that Microsoft had to give up a clients data stored in one of its databases in Ireland. The decision adds a new element to putting data in the cloud: Cloud providers could be forced to give up their clients data, even if the data is stored in another country, and they have no obligation to notify the client. If thats the case, then clients putting their data in the cloud are essentially giving up control of their data and trusting the cloud provider to advocate for the protection and privacy of that data, says Elad Yoran, the CEO of Vaultive, a provider of data encryption solutions for cloud adopters.

Normally when the government serves a subpoena for a companys data, the companys legal department will try to protect as much data as they can. At the minimum, they will ensure that only data directly related to the subpoena is handed over, explains Yoran, who will be speaking about data encryption in the cloud at Interop in New York City next month.

But if Microsoft gets a subpoena for your data, they have to hand [the data] over, and you dont get a seat at the table, he adds.

[Learn more about the Internet of Things at Interop's Internet of Things Summit on Monday, September 29.]

Losing control over company data in this fashion could understandably make organizations hesitant about cloud adoption. But new advances in encryption technology can help companies keep control over their data even when it resides in the cloud, he says.

Traditionally, data encryption meant encrypting the data when it was in transit or at rest. But in order for the data to be used, it had to be decrypted. For instance, if a company is using a cloud provider for email, then the data has to be decrypted for employees to search their messages. However, new advancements in encryption technology now allow data to be encrypted even when it is in use, which could keep control of the encrypted data in the hands of the client as the data never has to be decrypted on the server.

[For more on data encryption in the cloud: Making the Cloud Secure for Sensitive Data]

The important thing for businesses is that, even if their data is encrypted in use, they have to keep control of the encryption keys, he shares. In that case all the cloud provider can hand over to the government is encrypted data. The government still has to go to the client and ask for the keys, and then they can go through the standard legal process, he explains. Before the provider needed the encryption keys to decrypt the data so that it could be used. Now with encryption in-use, thats no longer the case.

This kind of complete control over important data can be important, particularly for financial services firms when dealing with compliance, since regulators have begun to focus on data privacy and security. One financial services client that works with Vaultive had previously dismissed using cloud-based Office 365, because it knew that having the data decrypted by Microsoft could raise concerns among its regulators, Yoran says. But once the people in that company found they could encrypt the data in-use, they were able to adopt Office 365. They can also tell their auditors that they have complete control over their data in the cloud, he adds.

View original post here:
Data Ownership & Encryption in the Cloud

Los Alamos National Lab’s R&D fueling new quantum-crypto firm

Technology development firm Allied Minds says it has set up a new company, Whitewood Encryption Systems, to develop quantum-crypto technology under an R&D licensing arrangement with Los Alamos National Laboratory.

John Serafini, vice president at Boston-based Allied Minds, which funds early-stage companies, is expected to be general manager at Whitewood Encryption Systems until its further expansion. Serafini says the goal is to have two quantum-crypto products during the second quarter of next year in the form of hardware modules for quantum random-number generation and scalable quantum key management. Serafini acknowledges Whitewood Encryption Systems aspires to compete with Swiss company ID Quantique, one of the few vendors selling available quantum cryptography products.

+ Also on NetworkWorld: Quantum crypto, standard key blended for first time+

Photon-based quantum crypto has been known to face some technical difficulties, such as geographical distance limitations, but it offers considerable promise due to ways it can be used to generate what are believed to be unique unbreakable keys, among other attributes.

Serafini says the basic quantum-crypto technology developed by engineers at Los Alamos National Laboratory is well along in "alpha" stage toward full commercialization.

Ellen Messmer is senior editor at Network World, an IDG website, where she covers news and technology trends related to information security. Twitter: MessmerE. E-mail: emessmer@nww.com

Tags securityencryption

More about IDGQuantumTechnology

See more here:
Los Alamos National Lab's R&D fueling new quantum-crypto firm

Online xTuple University Beta Opens for Enterprise Software Training

Norfolk, Virginia (PRWEB) August 29, 2014

xTuple announces the immediate availability of xTuple University (xTupleU) an online learning center for the enterprise software open source community. During the beta period, registered users enjoy complimentary, unlimited access to all training videos on the site.

The xTupleU no-charge beta period closes October 20, 2014, at the end of the companys global user conference #xTupleCon14. The beta includes two months of full access to the complete video library. This is all new content, published now for the first time, with more subject matter expertise added daily.

Registration for a beta account at xTupleU is open to anyone.

More and more small- and mid-sized business owners find it difficult to leave their organizations for long periods of time, even for a training class that directly impacts their bottom line. Technology-focused educations future is online, self-guided, and video-based, and xTuple has responded in kind to the communitys expanded training requests with the launch of xTupleU.

The xTupleU site is a perfect do-it-yourself learning opportunity for users of xTuples free and open source software version, PostBooks, used by tens of thousands small- and mid-sized businesses globally," said Pierce Tyler, vice president of xTuple knowledge management.

xTuple enjoys a reputation as extremely responsive to the open source community when it comes to improving product quality, as evidenced by the third prize-filled haxTuple bug-squashing competition. xTuple developers also lead the world among open source enterprise resource planning (ERP) projects in resolving reported bugs, with a close rate of over 94 per cent, according to statistics.

Current xTupleU topics range from operations to accounting and system administration to software development. Hot topics such as Business Intelligence for small to larger enterprises are covered. Both the Desktop and new browser-based Mobile Web clients are featured, as is the new xTuple Server, which both applications also share. Content includes short (approximately ten minutes or less) lessons from the entire five-day basic xTuple training course entitled Setup, Configuration & Operations typically used as a refresher to in-class materials.

xTuple University features:

xTupleU delivers a professional development foundation for users of xTuple software products (and for those in the ERP evaluation process) with self-paced courses available wherever you are, day or night. All that is needed is access to the Internet and a computer, tablet, or even a smartphone at home, during work, at the library or your favorite coffee shop. Designed with the end user in mind, xTupleU promises to increase operational efficiency.

Excerpt from:
Online xTuple University Beta Opens for Enterprise Software Training

Thomas Rid on Edward Snowden and the implications of the NSA leaks – Video


Thomas Rid on Edward Snowden and the implications of the NSA leaks
Thomas Rid, author of Cyber War Will Not Take Place, discusses Edward Snowden and the NSA leaks. http://global.oup.com/academic/product/cyber-war-will-not-take-place-9780199330638 Edward...

By: Oxford Academic (Oxford University Press)

See the rest here:
Thomas Rid on Edward Snowden and the implications of the NSA leaks - Video

NSA Spying FAQ | Electronic Frontier Foundation

FAQ on NSA Spying (General Questions)

What is the NSA domestic spying program?

In October 2001, President Bush issued a secret presidential order authorizing the NSA to conduct a range of surveillance activities inside of the United States without statutory authorization or court approval, including electronic surveillance of Americans telephone and Internet communications. This program of surveillance continues through today, although the legal justifications have changed over time, and works with the major telecommunications and Internet companies.

In 2005, after the New York Times broke the story of the surveillance program, the President publicly admitted one portion of itwarrantless surveillance of Americans believed to be communicating with people connected with terrorism suspectsSenior Bush Administration officials later confirmed that the Presidents authorization went beyond the surveillance of terrorists and conceded that the program did not comply with the Foreign Intelligence Surveillance Act (FISA). The President, invoking a theory of limitless executive power to disregard the mandates of Congress, reauthorized this warrantless surveillance more than thirty times, including after the Department of Justice found the program to violate criminal laws. President Obama has continued the program, but with differing secret legal justifications. Obama has given no public legal justification for it and, in some situations, appears to be strategically denying certain portions of it. For other portions, including the collection of telecommunications records, the Obama Administration said it could neither confirm nor deny its actions until May, 2013, when the DNI finally admitted additional portions of it. Members of Congress have confirmed that additional domestic surveillance by the NSA still remains a secret.

Shortly after the initial revelations, a whistleblower named Mark Klein came forward with evidence describing the specific AT&T facilities, including one on Folsom Street in San Francisco, where the handoff of customer communications is occurring. Mr. Klein's evidence confirmed what was already indicated by numerous newspaper reports and Congressional admissionsthat the NSA is intercepting and analyzing millions of ordinary Americans' communications off of the fiber optic cables that carry our communications, with the help of the country's largest phone and Internet companies. EFF has brought two lawsuits to stop this illegal surveillance. In 2012, three NSA whistleblowers came forward to confirm Mr. Kleins evidence, as well as other information about the warrantless surveillance.

Today, the warrantless surveillance program started under Bush remains largely intact under the Obama administration, and, in June 2013, reports in the Guardian and Washington Post confirmed key facts alleged in our cases, and provided supporting documents.

While the full legal justifications remain secret, the Obama administration apparently uses strained interpretations of the Patriot Act and FISA Amendments Act to try to justify the mass collection of data on US persons, but the reality is the same as it was under the Bush administration: these program are illegal and unconstitutional.

Click here for a complete overview of the NSA Domestic Spying program.

What do the cases claim about the interception of domestic communications of millions of Americans?

The Jewel v. NSA case alleges that the government, in coordination with AT&T, intercepts communications (like phone calls and emails), and that AT&T illegally discloses communications records to the government. The core component of the surveillance is the government's nationwide network of sophisticated communications surveillance equipment, attached to the key facilities of telecommunications companies such as AT&T that carry Americans' Internet and telephone communications.

Link:
NSA Spying FAQ | Electronic Frontier Foundation

Social media ‘silence’ after NSA leaks

A "spiral of silence" has arisen on social media since NSA spying revelations emerged from Edward Snowden last year, according to a new study.

A "spiral of silence" has arisen on US social media since government spying revelations emerged from Edward Snowden last year, according to a new study.

Pew Research found that people were less likely to post their views or concerns about NSA surveillance on Facebook and Twitter than in person, due to fears that their views are not widely shared.

Around 86% of people surveyed for the study - which questioned 1,801 US adults in August and September last year - said that they were willing to have an in-person conversation about the surveillance program, but only 42% of Facebook and Twiter users were willing to post about it online.

The findings also reveal that this unwillingness to talk can spread from the online to the offline world.

"The typical Facebook user - someone who logs onto the site a few times per day - is half as likely to be willing to have a discussion about the Snowden-NSA issues at a physical public meeting as a non-Facebook user.

Professor Keith Hampton, one of the co-authors of the report, warned that the findings suggested a lack of public discussion on important issues.

"This kind of self-censoring can mean that important information is never shared," Hampton said. "Some had hoped that social media might provide new outlets that encourage more discussion and the exchange of a wider range of opinions. But we see the opposite - a spiral of silence exists online, too." International Business Times

View post:
Social media 'silence' after NSA leaks