In cloud computing, our personal and organization’s private and sensitive data is stored, transmitted, and utilized to facilitate unparalleled levels of communication, virtualization, scalability, and production capabilities. However, due to the vast amount of information that can exist in the Cloud, securing and ensuring the privacy of those that own the data is vital in both the overall goal of Cloud computing and the public’s perception of the technology. In this article, I will provide an example template for conducting a privacy impact assessment (PIA) on a cloud service provider (CSP), service, or application; to accomplish this, I will merely be listing relevant questions to ask or state what information needs to be gathered.
| Question/Data Needed | Answer |
| Project title: | |
| Project manager: | |
| Major stakeholders- cloud provider: | |
| Major stakeholders- customer’s company: | |
| Other significant stakeholders, 1: | |
| Other significant stakeholders, 2: | |
| Date of project initiation: | |
| Date of projected project close: | |
| Current date: | |
| Type of cloud model: | |
| Cloud project’s goal: | |
| Cloud provider’s goal: | |
| Customer’s company’s goal: | |
| Main userbase of project: | |
| Internal user type: | |
| External user type: | |
| Project audit log/changelog location: | |
| Local, state, federal agencies involved: | |
| What data is currently being collected? | |
| What data is projected to be collected? | |
| How is the data currently being collected? | |
| How will the data potentially be collected in the future? | |
| What data is integral to the overall goal of the project? | |
| What data is not integral to the overall goal of the project? | |
| What are the current sources for data collection? | |
| What are the possible future sources for data collection? | |
| How is the data stored? | |
| How long is the data stored? | |
| How is data deleted? | |
| How is data verified? | |
| How is data deemed accurate? | |
| Is any data consolidated? | |
| If so, what controls are in place to protect the consolidated data? | |
| How does the Cloud provider retrieve data? | |
| How is data retrieved from the Cloud customer’s company? | |
| How is data retrieved from external users? | |
| How is data retrieved from internal users? | |
| What are the verification and authorization protocols for verifying the authenticity of users retrieving their data? | |
| What kind of reports can be generated by the Cloud provider? | |
| What kind of reports can be generated by the Cloud provider’s customer’s company? | |
| What kind of reports can be generated by external users? | |
| What kind of reports can be generated by internal users? | |
| Does the Cloud service, application, etc. currently have the ability to identify, locate, and monitor individuals? | |
| Will the Cloud service, application, etc. possibly have the ability to identify, locate, and monitor individuals in the future? | |
| What types of information are collected for the monitoring of users? | |
| How is data stored for the monitoring of users? | |
| How long is data kept for the monitoring of users? | |
| What controls are currently in place to prevent unauthorized monitoring of users? | |
| What reports can be generated by the Cloud provider regarding the monitoring of users? | |
| What reports can be generated by the Cloud provider’s customer’s company regarding the monitoring of users? | |
| Is the Cloud service, application, etc. web-based? | |
| If so, are cookies or other tracking devices utilized? | |
| If so, what is the intent of these cookies or tracking devices? | |
| What controls are in place to monitor and secure these cookies or tracking devices? | |
| How long is the data stored regarding cookies or tracking devices? | |
| Regarding cookies and tracking devices, if they are present, is the customer notified of the collection of their data and the use of these systems? | |
| Regarding cookies and tracking devices, if they are present, how is the customer notified of the collection of their data and the use of these systems? | |
| Who will have access to the majority of the data in the Cloud system, application, etc. (users, managers, developers, contractors)? | |
| What controls are currently in place to prevent misuse of the user’s browsing data? | |
| What controls are planned for the future to prevent misuse of the user’s browsing data? | |
| Are users able to access all data on the Cloud system, or will their access be restricted for only what they require? | |
| How are users prevented access to data they aren’t allowed to access? | |
| How are contractors, developers, and other temporary users’ access monitored after their access is no longer needed? | |
| How are contractors, developers, and other temporary users’ access terminated after their access is no longer needed? | |
| What other systems, processes, databases, etc., are connected to the Cloud service currently? | |
| What other systems, processes, databases, etc., might be connected to the Cloud service in the future? | |
| How are other systems, processes, and databases that are connected to the Cloud service monitored? | |
| How are other systems, processes, and databases that are connected to the Cloud service secured? | |
| How are other systems, processes, and databases that are connected to the Cloud service’s data owned? | |
| Who is responsible for protecting the privacy rights of the Cloud service in question? | |
| Who/what ensures that the privacy rights of the Cloud provider’s users are protected? | |
| Are the users of the Cloud service notified of their rights to their privacy? | |
| How are the users of the Cloud service notified of their rights to their privacy? | |
| Who ensures the users of the Cloud service are notified of their rights to their privacy? | |
| If a user declines the notification of a privacy message, what occurs? | |
| Regarding user data verification and completeness, how is this information maintained if the Cloud service is operated on more than one site or location? | |
| Regarding user data verification and completeness, how is this information maintained if the Cloud service is operated in more than one region or country? | |
| If the Cloud service operates globally, how are each different country’s privacy laws adhered to? | |
| If the Cloud service operates globally, who/what is responsible for adhering to each country’s privacy laws? | |
| What redundancies currently exist to preserve the Cloud system’s operation and data confidentiality, integrity, and availability? | |
| Has a risk assessment ever been performed on this Cloud service? | |
| If so, how often has a risk assessment been performed on this Cloud service? | |
| What risk assessments are utilized? | |
| What are the results of risk assessments in this Cloud system? | |
| Who/what is responsible for performing these risk assessments? | |
| Who/what is responsible for applying the changes identified in these risk assessments? | |
| What privacy acts, regulations, and compliances must this Cloud system adhere to? | |
| How are privacy acts, regulations, and compliances ensured to comply with this system? | |
| What are the steps and procedures for monitoring, testing, and evaluating all of the above question’s answers? |
Using the above questions, one can effectively create a template to answer all of the relevant privacy questions in a Cloud computing scenario; this includes questions and answers for all stakeholders (CSP, CSP’s customer’s company, and external and internal users). While I merely provided the vital data points to be filled during a privacy impact assessment, an actual PIA will appear as more of a structured report, thus allowing the reader to view all data at a glance, as well as be able to make sense of the vast amount of information.
References
Krill, M. & Stern, G. (2017, October 17). Privacy Impact Assessment Template. Retrieved October 26, 2020, from https://www.archives.gov/files/privacy/privacy-impact-assessments/vss-privacy-impact-assessment-signed.pdf.
D. Tancock, S. Pearson and A. Charlesworth, “A Privacy Impact Assessment Tool for Cloud Computing,” 2010 IEEE Second International Conference on Cloud Computing Technology and Science, Indianapolis, IN, 2010, pp. 667-676, DOI: 10.1109/CloudCom.2010.27.
Tancock, David & Pearson, Siani & Charlesworth, Andrew. (2011). A Privacy Impact Assessment Tool for Cloud Computing. 667 – 676. 10.1109/CloudCom.2010.27.
Categories: Security
Securing The Universe 