Slashdot Mirror
UK Government To Share Restricted Files In the Cloud
twoheadedboy writes "The UK Government wants to use the cloud to share restricted files. Given the concerns around cloud and security, this will worry some. Nevertheless, a deal between the services arm of the Foreign and Commonwealth Office (FCO) and SaaS provider Huddle has been penned. The SaaS service will run in the FCO's internal cloud, known as the Government Secure Application Environment (GSAE). This will allow civil servants, diplomats and other Government staff to share documents up to the secrecy level IL3, or Restricted."
Summary says it will be ran on FCO's internal servers, and Huddle is providing the software and know-how. If you think about it, I think it's a good thing. Government jobs are given out pretty much on what schools you went to, or worse, who you know. They never really look or test for the actual knowledge. Here we have a provider with actual experience with various big companies and know-how to secure the network. I would trust them more than some random persons who got their job because their father works in different positions for government.
Google+ vs. Facebook, and why Google+ will fail
Given the current state of security most of these organizations are running (political, corporate, whatever) they might as well just drop plaintext files on TPB themselves. That's where it's gonna end up eventually, whether they use "the cloud" or not...
This is a non-story. Third-party provides IT services to a government. Happens all the time.
Cue Admiral Ackbar.
Please stop using that word. It makes you sound technologically illiterate.
You mean via a network, or on the internet, or something similar. "The cloud" is a stupid buzzword that needs to die RIGHT NOW.
If we pull the cloud buzzword out of the picture and consider this a remote storage/collaberation option, it can be decently secure, if controls are put in place doing encryption on multiple levels.
On the workgroup level, PGP NetShare can do a decent job, especially if the PGP keys are stored on cryptographic hardware tokens.
On the enterprise level, there are various IRM/encryption systems which can help, be it LockLizard or others. There is even one built into Windows/Office that is fairly usable.
The key (pardon the pun) is how this gets implemented. Done right, a compromise of the external disks may net a bunch of unreadable files. Done wrong, and the UK might as well just seed their snapshots to demonoid's tracker.
I thought the US government spearheaded sharing classified files with the cloud. They just called it Tor over here.
N/t
UK Government shocked when all its restricted files are found all over the internet.
What do I know, I'm just an idiot, right?
... that loosing harddrives all over the country was intentionally done to jumpstart their cloud...?
Huddle are a US company. Therefore under their "Patriot" Act, any US agency with a three-letter acronym can request all the foreign office data without a court order and without the foreign office being told. This does assume that Huddle have access to the information, which is almost certain to happen if it doesn't already. Other countries must start to use local service providers until this is resolved. Encrytion will work to a point, but encryption can be broken.
Foreign and Commonwealth Officer: "Let's store all of our secret data on the internet. How can this go wrong in any way?"
Think of all the disk space you can save by sharing it with Julian Assange.
Have gnu, will travel.
"I want to report a wrongful arrest"
"You want Information Adjustments. Different department"
link
Sorry, If it's not open source, compiled in house, and uses data encrypted BEFORE it leaves our network -- It's not a secure service. Also: I put it to you that a closed source program or OS is considered harmful in terms of security and transparency (read trust-ability) -- This goes for LockLizard, Symantec's PGP NetShare, and especially Windows -- The US, UK, Russian, Chinese and other governments have the Windows source code, why is that? Security, and also to look for exploit vectors... Being a security contentious individual, Why don't you insist on having the source of your software too?
Even if you can prove that a certain algorithm is being used to encrypt the data, how can I be sure that the program or OS doesn't contain a key-logger that sends the key and/or data where I don't want it to go (Perhaps via a update request)?
If your "SaaS service" (software as a service service?) has the keys to unlock your data -- Well, Your version of "done right" is very different from mine.
Let's not forget the "trust" we put in RSA tokens, letting RSA keep the root keys, and how hackers cracked the collective single point of failure, then used RSA's keys... If those who got hacked as a result of using RSA's "Security as a Service" had instead used Yubikey, they could have installed their own "seed" keys into their own tokens, thus eliminating the centralized key-store. (Additionally, if RSA wasn't using Windows internally they wouldn't have been vulnerable to the attack vector used against them; Google learned this lesson too.)
A true "Thin Client" or Dumb Client, won't be doing much work with your data, allowing data processing remotely means you have no control over your security. I opt for "Real Clients" and in-house services combined with a "Dumb Cloud" that just stores and fetches encrypted blobs.
In short: If someone else has the keys to your kingdom, how secure are you really? (Lockheed thought they could trust RSA in such a way -- Yep, they both got hacked).
--
Don't get me wrong, apply security as needed; Some systems don't need as much security as others (provided backups are made), but why call a less secure solution "done right"?
At least a junior civil servant can't get drunk and leave a cloud in the back of a taxi.
Unless he went for a curry after the pub.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
It depends on your objectives:
If I had a number of acquaintances and we were wanting to share documents securely (without needing a mechanism for locking individual documents), PGP/gpg encrypting them and storing them on a private sftp server would be good enough.
However, part of security with businesses is CYA. If RSA's product fails, a client can point to them and say "blame them, we acted in good faith by buying their product which is FIPS, Common Criteria, etc. certified." If a no name product failed, the buck may stop with that client, and in the Sarbanes-Oxley, HIPAA, or FERPA arenas, it might mean someone goes to prison. This is why a lot of businesses rather pony up the dollars for a commercial solution so they can say they are acting in due diligence by buying the top tier security brands.
I agree with you -- the ideal is to have anything that leaves the secured local network segment heavily encrypted. However, when one gets a business with a lot of users, there isn't much that can scale up that high.
Devil's advocate here: Yes, Windows has some security issues, but Windows has the best tools for the enterprise for management. If the BSA comes a knocking, it isn't difficult to find a tool to cough up a software inventory list on every Windows box in use company-wide. Same if a security auditor demands to know the status of every antivirus install on each machine connected to the LAN. Because of this, businesses stick with Windows.
It's worth noting that IL3 isn't exactly top secret - patient records (such as xray scans) are also classified as IL3.
Really top secret stuff is IL6 which has a very different set of security requirements. Whether this makes it more secure is a different matter, but don't expect diplomatic cables, submarine designs and MI6 café menus on this system.
Now there's one hoopy frood who really knows where his towel is!
From the NIST:
"Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction."
What you think it needs to be offsite, run by someone else or accessibly by anyone show you have no fucking clue.
I wish /. had personal tags. I would love to start filtering put poster who regularly don't read the article who has the most reasoned replies.
Would it match the general population bell? or would some people really stand out?
The Kruger Dunning explains most post on
They're not about secrecy, they're about business impact, i.e. potential consequences.
The official definitions are at http://www.cesg.gov.uk/policy_technologies/policy/media/business_impact_tables.pdf
That's becuase the cloud has more of a nebulous definition according to salesfolk that use it a lot - typically it's not really a cloud in their view unless it's something they can sell to you. If it's your own servers on site or in somebody elses rack and they don't sell rack space they insist it's not a cloud. It's used as a buzzword jammed into whatever crevice is convenient at the time.
I'm still trying to get over the urge to vomit from first reading the buzzword collision of "iCloud".
Let's save everyone a lot of time and energy. Have D.C. Bureaucrats duct tape classified documents to one anothers' ass, Then en masse assemble at Radio City doing the Can-Can in a dance line. Whatever you can read... you can keep.
Besides saving tremendous time and energy on all sides, it should prove incredibly entertaining... perhaps we can sell tickets to help reduce the deficit.