{"id":33512,"date":"2019-10-31T21:53:01","date_gmt":"2019-10-31T18:53:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/i-tak-sojdet-chto-oblachnye-provajdery-ne-dogovarivayut-o-personalnyh-dannyh\/"},"modified":"2019-10-31T21:53:01","modified_gmt":"2019-10-31T18:53:01","slug":"i-tak-sojdet-chto-oblachnye-provajdery-ne-dogovarivayut-o-personalnyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/i-tak-sojdet-chto-oblachnye-provajdery-ne-dogovarivayut-o-personalnyh-dannyh","title":{"rendered":"\u2018Good enough\u2019: What cloud providers are not disclosing about personal data","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

We received an application for cloud services. We outlined what would be required from us and sent back a list of questions to clarify details. After analyzing the responses, we realized: the client wants to store personal data with a second level of protection in the cloud. We respond, \"You have a second level of personal data; sorry, we can only offer private cloud solutions.\" And the client says, \"You know, company X can host everything in the public cloud for me.\"<\/p>\n

\"\u2018Good
\nPhoto by Steve Crisp, Reuters<\/i><\/p>\n

Strange things! We visited company X's website, reviewed their certification documents, shook our heads, and realized: there are many open questions regarding the placement of personal data, and they need to be thoroughly examined. This is what we will address in this post.
\n<\/a><\/noindex><\/p>\n

How everything should work<\/h2>\n

\nFirst, let\u2019s understand the criteria for classifying personal data into different levels of protection. This depends on the category of data, the number of subjects of that data that the operator stores and processes, and the types of current threats.<\/p>\n

\"\u2018Good
\n
\nThe definition of types of current threats is provided in the decree of the Government of the Russian Federation No. 1119<\/a><\/noindex> dated November 1, 2012, \"On the Approval of Requirements for Personal Data Protection During Their Processing in Information Systems of Personal Data\":<\/p>\n

\"Threats of the first type are relevant to an information system if, among other things, threats related to<\/i> the presence of undocumented (undeclared) capabilities in the system software<\/i>, used in the information system.<\/p>\n

Threats of the second type are relevant to an information system if, among other things, threats related to<\/i> the presence of undocumented (undeclared) capabilities in the application software<\/i>, used in the information system.<\/p>\n

Threats of the third type are relevant to an information system if it has threats not associated with system and application software<\/i> the presence of undocumented (undeclared) capabilities , used in the information system.\"<\/i>The key aspect of these definitions is the presence of undocumented (undeclared) capabilities. To confirm the absence of these capabilities in software (in the case of the cloud, this is the hypervisor), certification by the FSTEC of Russia is conducted. If the personal data operator assumes that there are no such capabilities in the software, then the corresponding threats are not relevant. Operators of personal data rarely consider threats of the first and second types as relevant.<\/p><\/blockquote>\n

\nThe main point in these definitions is the presence of undocumented (undeclared) capabilities. To confirm the absence of undocumented features in the software (in the case of cloud, this refers to the hypervisor), certification by the FSTEC of Russia is conducted. If the data operator believes that such capabilities do not exist in the software, then the corresponding threats are irrelevant. Operators of personal data rarely consider threats of the 1st and 2nd types to be pertinent.<\/p>\n

In addition to determining the level of protection for personal data, the operator must also identify specific current threats to the public cloud and, based on the determined level of protection and current threats, establish the necessary measures and means of protection against them.<\/p>\n

All major threats are clearly listed in the database of threats. Cloud infrastructure providers and assessors use this database in their work. Here are examples of threats:<\/a><\/noindex> UBI.44<\/p>\n

: \"The threat lies in the potential for breaches of user data security by programs operating within the virtual machine, as well as malicious software operating outside the virtual machine.\" This threat is due to vulnerabilities in the hypervisor software that ensures isolation of the address space used to store user data from unauthorized access by malicious software operating outside the virtual machine.<\/a><\/noindex>The realization of this threat is possible if malicious code successfully surpasses the boundaries of the virtual machine, not only by exploiting vulnerabilities in the hypervisor but also through actions taken from lower levels of system functioning relative to the hypervisor.<\/p>\n

UBI.101<\/p>\n

: \"The threat lies in the possibility of unauthorized access to the protected information of one consumer of cloud services by another. This threat is due to the fact that, due to the nature of cloud technologies, cloud service consumers have to share the same cloud infrastructure. The realization of this threat is possible if there are mistakes in separating elements of the cloud infrastructure among consumers of cloud services, as well as in isolating their resources and segregating data from one another.\"<\/a><\/noindex>Protection against these threats can only be achieved through the hypervisor, as it is responsible for managing virtual resources. Therefore, the hypervisor should be viewed as a means of protection.<\/p><\/blockquote>\n

\nAnd in accordance with<\/p>\n

FSTEC order No. 21 by FSTEC Order No. 21<\/a><\/noindex> As of February 18, 2013, the hypervisor must undergo certification for the absence of undeclared capabilities (NDC) at level 4; otherwise, using personal data of levels 1 and 2 with it will be illegal (\"Clause 12. \u2026 To ensure levels 1 and 2 of personal data protection, as well as to ensure level 3 of personal data protection in information systems, for which threats of type 2 are relevant, protection tools are used, the software of which has been tested at a minimum of level 4 for the absence of undeclared capabilities\"<\/i>).<\/p>\n

The required certification level, NDC-4, is possessed by only one hypervisor developed in Russia \u2014 Horizont VS<\/a><\/noindex>. To put it mildly, it is not the most popular solution. Commercial clouds are generally built on VMware vSphere, KVM, or Microsoft Hyper-V. None of these products have NDC-4 certification. Why? Probably, obtaining such certification is not economically justified for manufacturers yet.<\/p>\n

And we are left with Horizont VS for personal data of levels 1 and 2 in the public cloud. Sad but true.<\/p>\n

How everything (in our view) actually works<\/h3>\n

\nAt first glance, everything is quite strict: the specified threats must be eliminated by properly configuring the built-in protection mechanisms of the hypervisor certified for NDC-4. But there is one loophole. According to Order No. 21 of the Federal Service for Technical and Export Control (\"Clause 2 The security of personal data during processing in a personal data information system (hereinafter \u2014 information system) is ensured by the operator or a person processing personal data on behalf of the operator in accordance with the legislation<\/a><\/noindex> of the Russian Federation\"<\/i>), providers independently assess the relevance of potential threats and choose protection measures accordingly. Therefore, if the threats UBI.44 and UBI.101 are not accepted as relevant, there will be no need to use a hypervisor certified for NDC-4, which is specifically supposed to provide protection against them. And this will be sufficient to obtain a compliance certificate for the public cloud at levels 1 and 2 of personal data protection, which will be fully satisfactory to Roskomnadzor.<\/p>\n

Certainly, in addition to Roskomnadzor, the FSTEC may come for an inspection \u2014 and this organization is much more meticulous regarding technical issues. They will likely be interested in why exactly threats UBI.44 and UBI.101 were deemed irrelevant. However, FSTEC usually conducts inspections only when they receive information about a noticeable incident. In this case, the federal service first approaches the personal data operator \u2014 that is, the customer of cloud services. In the worst case, the operator receives a small fine \u2014 for example, for Twitter at the beginning of the year. fine<\/a><\/noindex> in a similar case amounted to 5000 rubles. Then FSTEC proceeds to the cloud service provider, which could very well lose its license due to non-compliance with regulatory requirements \u2014 and this brings entirely different risks for both the cloud provider and its clients. But, I repeat, FSTEC usually requires a clear reason for an inspection.<\/i> So cloud providers are ready to take risks. Until the first serious incident. <\/p>\n

There is also a group of 'more responsible' providers who believe that all threats can be addressed by adding a hypervisor enhancement like vGate. However, in a distributed virtual environment among clients, an effective protection mechanism for some threats (such as the aforementioned UBI.101) can only be implemented at the level of a hypervisor certified according to NDV-4, since any enhancement systems do not affect the hypervisor's core functionalities related to resource management (particularly RAM).<\/p>\n

How we operate<\/h3>\n

\nWe have a cloud segment implemented on a hypervisor certified by FSTEC (but without certification for NDV-4). This segment is accredited, so personal data can be hosted in the cloud based on it. levels 3 and 4 of security<\/i> \u2014 the requirements for protection against undeclared capabilities do not need to be observed here. By the way, here is the architecture of our secure cloud segment:<\/p>\n

\"\u2018Good
\nSystems for personal data levels 1 and 2 of security<\/i> We only implement on dedicated equipment. Only in this case, for example, the threat of UBI.101 is truly irrelevant, since server racks not united by a single virtual environment cannot affect each other even when located in the same data center. For such cases, we offer a dedicated hardware rental service (also known as Hardware as a Service).<\/p>\n

If you are unsure about the level of protection required for your personal data system, we also assist in their classification.<\/p>\n

Output<\/h3>\n

\nOur small market research showed: some cloud operators are quite willing to risk both customer data security and their own future to secure a contract. However, we adhere to a different policy on these matters, which we briefly outlined above. We will be happy to answer your questions in the comments.
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0438\u0448\u043b\u0430 \u043a\u0430\u043a-\u0442\u043e \u043a \u043d\u0430\u043c \u0437\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0443\u0441\u043b\u0443\u0433\u0438 \u043e\u0431\u043b\u0430\u043a\u0430. \u041c\u044b \u043f\u0440\u0438\u043a\u0438\u043d\u0443\u043b\u0438 \u0432 \u043e\u0431\u0449\u0438\u0445 \u0447\u0435\u0440\u0442\u0430\u0445, \u0447\u0442\u043e \u043e\u0442 \u043d\u0430\u0441 \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f, \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0432 \u043e\u0442\u0432\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u043b\u044f \u0443\u0442\u043e\u0447\u043d\u0435\u043d\u0438\u044f \u0434\u0435\u0442\u0430\u043b\u0435\u0439. \u0417\u0430\u0442\u0435\u043c \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u0432\u0435\u0442\u044b \u0438 \u043f\u043e\u043d\u044f\u043b\u0438: \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a \u0445\u043e\u0447\u0435\u0442 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0442\u044c \u0432 \u043e\u0431\u043b\u0430\u043a\u0435 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438. \u041e\u0442\u0432\u0435\u0447\u0430\u0435\u043c \u0435\u043c\u0443: \u00ab\u0423 \u0432\u0430\u0441 \u0432\u0442\u043e\u0440\u043e\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043f\u0435\u0440\u0441\u0434\u0430\u043d\u043d\u044b\u0445, \u0438\u0437\u0432\u0438\u043d\u0438\u0442\u0435, \u043c\u043e\u0436\u0435\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u0442\u043d\u043e\u0435 \u043e\u0431\u043b\u0430\u043a\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c\u00bb. \u0410 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25212,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33512","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\"This will do\": What cloud providers don't disclose about personal data | ProHoster","description":"We once received a request for cloud services. We estimated what would be required from us in general terms and sent a list of questions in response to clarify the details.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/i-tak-sojdet-chto-oblachnye-provajdery-ne-dogovarivayut-o-personalnyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u00ab\u0418 \u0442\u0430\u043a \u0441\u043e\u0439\u0434\u0435\u0442\u00bb: \u0447\u0442\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b \u043d\u0435 \u0434\u043e\u0433\u043e\u0432\u0430\u0440\u0438\u0432\u0430\u044e\u0442 \u043e \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u041f\u0440\u0438\u0448\u043b\u0430 \u043a\u0430\u043a-\u0442\u043e \u043a \u043d\u0430\u043c \u0437\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0443\u0441\u043b\u0443\u0433\u0438 \u043e\u0431\u043b\u0430\u043a\u0430. \u041c\u044b \u043f\u0440\u0438\u043a\u0438\u043d\u0443\u043b\u0438 \u0432 \u043e\u0431\u0449\u0438\u0445 \u0447\u0435\u0440\u0442\u0430\u0445, \u0447\u0442\u043e \u043e\u0442 \u043d\u0430\u0441 \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f, \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0432 \u043e\u0442\u0432\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u043b\u044f \u0443\u0442\u043e\u0447\u043d\u0435\u043d\u0438\u044f \u0434\u0435\u0442\u0430\u043b\u0435\u0439.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/i-tak-sojdet-chto-oblachnye-provajdery-ne-dogovarivayut-o-personalnyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:53:01+00:00","article:modified_time":"2019-10-31T18:53:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33512","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 15:35:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:39:23","updated":"2026-01-21 15:35:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/33512","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=33512"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/33512\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/25212"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=33512"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=33512"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=33512"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}