On July 5, 2018, the European Union Parliament advised the EU Commission to suspend the so-called EU-US Privacy Shield. This renews and hardens the EU Parliament’s position on Privacy Shield’s privacy policy for US companies, that process and store data of EU citizens. Already in October 2017, the European Parliament published a list of 10 recommendations, which pointed to gaps and weaknesses in the Privacy Shield.
In its recommendation to the EU Commission, the Parliament pointed out that the US administration has failed to implement two core elements of the Privacy Shield. For example, there is still no ombudsman who leads the U.S. Privacy Civil Liberties Oversight Board (PCLOB), let alone any other members in this board. Thus, EU citizens lack a contact person in the event of data breaches and thus the ability to make their own rights in the US heard at all.
Privacy Shield replaces Safe Harbor
As a reminder, Privacy Shield was introduced as a replacement for the Safe Harbor Agreement. Safe Harbor fell because the European Court of Justice granted the claim of the Austrian lawyer Maximilian Schrems in 2015. The Safe Harbor rules should create a ‘safe data port’ for sensitive data outside the EU, so that this data can be processed for example in the US. Triggered by the Snowden publications (notably PRISM), this agreement was reviewed and finally replaced by Privacy Shield.
EU Parliament confirms assessment: Sensitive data is not safe at US companies
As explained in my last blog post, sensitive but also security-relevant data of a company should not leave Europe. Parliament’s assessment reinforces the urgency of data protection. Security-related data such as intellectual property or administrative access such as domain passwords should not be given to cloud providers in the US. The Cloud Act and Privacy Shield are incompatible.
More information on the resolution of the European Parliament is published here, an analysis can be found here.
https://www.greenbone.net/wp-content/uploads/01_Logo-mit-Schriftzug_500px_on_white_horiz1.jpg00Dirk Schraderhttps://www.greenbone.net/wp-content/uploads/01_Logo-mit-Schriftzug_500px_on_white_horiz1.jpgDirk Schrader2018-07-23 08:29:402018-07-23 08:29:40After Privacy Shield: EU Parliament again advises suspension of data transfer to the US
In March of this year, the US Congress passed the so-called Cloud Act. This allows US authorities worldwide access to data from US companies – even if their servers are located in the EU. For this reason, the IT Security of companies who store data with US providers is at stake.
The so-called “Cloud Act” (Clarifying Lawful Overseas Use of Data Act) commits US companies to provide data to US authorities on request, irrespective of location. US legislation thus places American law in an EU member state above EU law. Therefore, US companies are in a dilemma in future: if they deny access, they break American law and vice versa European.
Microsoft fought and lost
One of the reasons for the decision was Microsoft. The matter goes back to 2013. At that time, the US Department of Justice investigated drug crime and asked Microsoft for access to a suspect’s e-mail account. However, as the server with the data was in Ireland, Microsoft invalidated the search warrant. It came to a process that Microsoft lost in the first instance and won second place. Due to the new Cloud Act, this case has now been declared done. The question of how an acceptable solution between the US and the EU or the individual member states can look like is currently being discussed.
Sensitive Data are no longer safe at US companies
But what does that mean for companies, that uses services by US companies? First and foremost, they must be aware that true compliance with the EU GDPR can fail. Taking the next step, the Cloud Act also allows US authorities to arbitrarily gain access to all data of a company stored at a US partner or services provider – including business and enterprise secrets or information about IT Security measures.
Security-relevant Data should not leave the company
Companies, that sources IT security services such as Vulnerability Management from US providers and store sensitive data with them, should now take action. For a maximum of security, they should at least switch to a European partner, who only stores data in data centers within the EU. Finally, this raises the fundamental question of whether safety-related data should or have to leave the company at all. After all, there are certainly IT security service providers in the market whose solutions work exclusively within the company IT and do not transfer data either to the cloud or to the provider.
An example of this is our Greenbone Security Manager. It scans IT networks for vulnerabilities and forwards data and reports only within the secure enterprise network.
Cloud Act calls for action
Once again, the Cloud Act shows that the US attaches far less importance to privacy than the EU: while the Europeans consider data security as human rights, in the United States it is “only” a civil right – which therefore only refers to Americans. In the American legislation, the interest of European citizens will therefore continue to receive little or no consideration in future. Companies have to adjust that. They should use the Cloud Act as an opportunity to bring sensitive data outside the reach of American authorities. This can happen for example by switching to European or German service provider. However, the best option for IT security is to choose solutions in which sensitive data does not even leave the company.
Currently, reports are accumulating about insecure processors that have been used for years. The two attack scenarios, Meltdown and Spectre exploit these vulnerabilities. Especially explosive: Every operating system on which more than one user is working is affected. Thus the “unprivileged user” is able to read each memory area of the RAM, as long as he can run the software at the system. An attacker can do this by placing malicious code on a website called from a web browser.
How massive the scale really is becomes clear when you realize that the vulnerability “Meltdown” affects every Intel-CPU since the Pentium II in 1997. Furthermore, “Spectre” affects ARM and AMD microprocessors. with similar influence to PCs, laptops, tablets, servers and smartphones. By taking advantage of these gaps, hackers are able to avoid barriers between user program and RAM to extract sensitive data such as passwords.
Cloud solutions are also affected: Office 360 or AWS data can be read by unauthorized users, as they usually are not encrypted in RAM. As long as Microsoft, Amazon and IBM have not patched and restarted their entire clouds, cloud applications should not be used for confidential information.
Greenbone‘s solution is protected
The Greenbone Security Manager is not affected by these vulnerabilities! Our authorization concept and system hardening does not allow users to exploit the proof-of-concept gap. In addition, since JAN 5th 2018 the security feed of our solution identifies unpatched systems and supports the user to quickly recognize and remediate the vulnerabilities.
https://www.greenbone.net/wp-content/uploads/01_Logo-mit-Schriftzug_500px_on_white_horiz1.jpg00Lukas Grunwaldhttps://www.greenbone.net/wp-content/uploads/01_Logo-mit-Schriftzug_500px_on_white_horiz1.jpgLukas Grunwald2018-01-08 12:47:042018-01-25 14:06:34Being among the most widespread and biggest security gaps in IT history:
After Privacy Shield: EU Parliament again advises suspension of data transfer to the US
Blog, NewsOn July 5, 2018, the European Union Parliament advised the EU Commission to suspend the so-called EU-US Privacy Shield. This renews and hardens the EU Parliament’s position on Privacy Shield’s privacy policy for US companies, that process and store data of EU citizens. Already in October 2017, the European Parliament published a list of 10 recommendations, which pointed to gaps and weaknesses in the Privacy Shield.
In its recommendation to the EU Commission, the Parliament pointed out that the US administration has failed to implement two core elements of the Privacy Shield. For example, there is still no ombudsman who leads the U.S. Privacy Civil Liberties Oversight Board (PCLOB), let alone any other members in this board. Thus, EU citizens lack a contact person in the event of data breaches and thus the ability to make their own rights in the US heard at all.
Privacy Shield replaces Safe Harbor
As a reminder, Privacy Shield was introduced as a replacement for the Safe Harbor Agreement. Safe Harbor fell because the European Court of Justice granted the claim of the Austrian lawyer Maximilian Schrems in 2015. The Safe Harbor rules should create a ‘safe data port’ for sensitive data outside the EU, so that this data can be processed for example in the US. Triggered by the Snowden publications (notably PRISM), this agreement was reviewed and finally replaced by Privacy Shield.
EU Parliament confirms assessment: Sensitive data is not safe at US companies
As explained in my last blog post, sensitive but also security-relevant data of a company should not leave Europe. Parliament’s assessment reinforces the urgency of data protection. Security-related data such as intellectual property or administrative access such as domain passwords should not be given to cloud providers in the US. The Cloud Act and Privacy Shield are incompatible.
More information on the resolution of the European Parliament is published here, an analysis can be found here.
US Cloud Act endangers IT Security
Blog, NewsIn March of this year, the US Congress passed the so-called Cloud Act. This allows US authorities worldwide access to data from US companies – even if their servers are located in the EU. For this reason, the IT Security of companies who store data with US providers is at stake.
The so-called “Cloud Act” (Clarifying Lawful Overseas Use of Data Act) commits US companies to provide data to US authorities on request, irrespective of location. US legislation thus places American law in an EU member state above EU law. Therefore, US companies are in a dilemma in future: if they deny access, they break American law and vice versa European.
Microsoft fought and lost
One of the reasons for the decision was Microsoft. The matter goes back to 2013. At that time, the US Department of Justice investigated drug crime and asked Microsoft for access to a suspect’s e-mail account. However, as the server with the data was in Ireland, Microsoft invalidated the search warrant. It came to a process that Microsoft lost in the first instance and won second place. Due to the new Cloud Act, this case has now been declared done. The question of how an acceptable solution between the US and the EU or the individual member states can look like is currently being discussed.
Sensitive Data are no longer safe at US companies
But what does that mean for companies, that uses services by US companies? First and foremost, they must be aware that true compliance with the EU GDPR can fail. Taking the next step, the Cloud Act also allows US authorities to arbitrarily gain access to all data of a company stored at a US partner or services provider – including business and enterprise secrets or information about IT Security measures.
Security-relevant Data should not leave the company
Companies, that sources IT security services such as Vulnerability Management from US providers and store sensitive data with them, should now take action. For a maximum of security, they should at least switch to a European partner, who only stores data in data centers within the EU. Finally, this raises the fundamental question of whether safety-related data should or have to leave the company at all. After all, there are certainly IT security service providers in the market whose solutions work exclusively within the company IT and do not transfer data either to the cloud or to the provider.
An example of this is our Greenbone Security Manager. It scans IT networks for vulnerabilities and forwards data and reports only within the secure enterprise network.
Cloud Act calls for action
Once again, the Cloud Act shows that the US attaches far less importance to privacy than the EU: while the Europeans consider data security as human rights, in the United States it is “only” a civil right – which therefore only refers to Americans. In the American legislation, the interest of European citizens will therefore continue to receive little or no consideration in future. Companies have to adjust that. They should use the Cloud Act as an opportunity to bring sensitive data outside the reach of American authorities. This can happen for example by switching to European or German service provider. However, the best option for IT security is to choose solutions in which sensitive data does not even leave the company.
Being among the most widespread and biggest security gaps in IT history:
BlogSpectre and Meltdown cause trouble worldwide
Currently, reports are accumulating about insecure processors that have been used for years. The two attack scenarios, Meltdown and Spectre exploit these vulnerabilities. Especially explosive: Every operating system on which more than one user is working is affected. Thus the “unprivileged user” is able to read each memory area of the RAM, as long as he can run the software at the system. An attacker can do this by placing malicious code on a website called from a web browser.
How massive the scale really is becomes clear when you realize that the vulnerability “Meltdown” affects every Intel-CPU since the Pentium II in 1997. Furthermore, “Spectre” affects ARM and AMD microprocessors. with similar influence to PCs, laptops, tablets, servers and smartphones. By taking advantage of these gaps, hackers are able to avoid barriers between user program and RAM to extract sensitive data such as passwords.
Cloud solutions are also affected: Office 360 or AWS data can be read by unauthorized users, as they usually are not encrypted in RAM. As long as Microsoft, Amazon and IBM have not patched and restarted their entire clouds, cloud applications should not be used for confidential information.
Greenbone‘s solution is protected
The Greenbone Security Manager is not affected by these vulnerabilities! Our authorization concept and system hardening does not allow users to exploit the proof-of-concept gap. In addition, since JAN 5th 2018 the security feed of our solution identifies unpatched systems and supports the user to quickly recognize and remediate the vulnerabilities.