I'm going to very briefly introduce Greg
Brown of Microsoft who is he has an
official title here which is on the
board senior director strategy for Sela
corporate standards group sealers
they're basically their legal in-house
shop but in reality what Greg is like
Microsoft's standards guy who drives the
development of all of the standards work
internally and you know
well knows a lot about this yeah we'll
moderate that first of all let me thank
people for coming back from the break
some of you left your stuff which was
very encouraging but you know it's
always a bit dodgy I am going to talk a
little bit about standards which to me
are a deep passion but not to everyone
sometimes so I am what I'd like to do is
speak for about a half an hour and then
because of my role at Microsoft I do get
some insight into our sort of operations
and compliance and things like that and
we'll leave some time open for questions
not only prompted by what I'm gonna say
but but other questions about how we do
things in operations so I'll hold the
questions till then but I am open to
sort of visual signals you know as
subtle as having your forehead hit the
table or something like that I'll I'll
try and change in what I'm doing as I go
along so our group there are a lot of
people who do standards inside Microsoft
we connect to a ton of other products we
have devices that have USB ports and
things like that we do a lot of
standards work our group focuses on
international standards standards that
are both basically voted on by nations
created by technical experts and then
voted on by nations and we're really
lately been focusing on standards that
deal with security and privacy and the
cloud so we have it there is some
narrowing of my scope but our team works
on the submissions into the
international standards effort what what
do we draft to suggest would be a good
idea and as you may know this time
process the international levels very
slow it's a couple of three four years
for a standard and some of that is a
very high value because they get vetted
very deeply and they get voted on by the
experts but then they get voted on by
the national standards bodies of all the
nations and so they carry with them some
benefits they're like for example it's a
per se not a non-tariff barrier to trade
to quote an international standard so if
you have a if you have a an RFQ and you
say you have to support ISO 27001 in the
RFQ it's not it's not considered a
barrier to trade around the world right
you're allowed to do that kind of things
but that means they looked at very
carefully it takes a long time to do it
so I'll be focusing mostly on on
international standards and we'll talk
about these kinds of topics what's the
role of standards how does it work with
privacy I want to introduce you to some
standards that are bubbling up for you
to think about and maybe participate in
and then we'll we'll talk a little bit
about what's coming up next okay so what
are the roles for standards and
particularly international standards and
we tend to focus on them in two separate
ways one of which is as the basis of
certification basis of third party
audits okay and the second one is a way
to increase transparency to allow people
to be using the same terminology the
same structure of thought the same
economies in order to be able to
communicate both of those hope to
demonstrate are critical for the
upcoming complexity of conversations
we're going to have about privacy right
we'll start with certification for a
little bit you know there's in
international standards and ISO level
standards there's a chain between
there's actually three or four parts to
a certificate there is a standard upon
the standards somebody makes a scheme an
audit scheme and then there's an actual
audit process and then they issue a
certificate and for an international
standard all of those elements
are regulated by the national bodies so
if you have the British Standards
Institute come out and do an audit there
are an accredited auditor by the British
government and you will notice that on
some of those certificates there will be
the Queen's mark on it just like you
know an Altoid or something else but
that this is comes from the Queen so
these have a certain provenance of of
what you're allowed to do and not do in
those certificates but there are all
those elements you can take a standard
and create another scheme against it
CSA does this takes 27001 expands the
scope and creates another scheme of
auditing that we use as some a 27001
does some new things with it as well so
all of those elements are in place but
the key part of that is you can do a
third party audit the second one and and
there are two parts to that in the 27001
world there's a standard that says
here's how you should do things here's
how you should think about risk here's
how you should build a process that will
allow you to be risk enabled and then we
mentioned 27,000 18 which is a specific
set of controls that said for cloud
service providers acting as processors
we want you to want to tell us why
you're not doing these controls right so
put in your state but your statement of
playability why you're doing or not
doing so you can have narrower cases
that you can audit against transparency
we want to be using the same language
the same semantics the same meanings in
order to communicate some difficult
concepts and I'll talk about those
standards in a little bit so one thing
we talked about somebody has to great
question about boundaries and scopes and
when you go to a cloud service provider
it's worthwhile for the kind of
practitioners that are sitting in front
of me in the audience to go look at the
actual services that you're going to buy
and see which actual certificates are
against those scope of services I
pictured here our
our broader services with our strongest
set of certificates on it but if you for
example the extreme case take a beta
product it may be out of scope we just
bought LinkedIn LinkedIn services I'm
sure they have some stuff but I'm sure
I'm not sure it's 27001 certified to our
level yet so you will see from Microsoft
these services and this is the highest
level these services have these
certificates about it and that's worth
looking at right that means they being
certified and they've gone through
things now how do we do all of those as
we you know I for once this is my first
presentation without the set of logos
but how do we do all of those
certificates
well Microsoft participates in beginning
in the external process we work with the
definition of standards we have I think
a very good communication with NIST
about what should happen in FedRAMP they
listen and they do whatever they want to
do but they do listen but so we work on
standards to try and condition them to
make them realistic to what we think is
happening in cloud and then internally
we do a business process that says which
customers want which certifications how
much market will it open up what does a
kid who cares about it and determine on
a set of certificates and then as Doug
mentioned we go look to see what
controls do we already have in place
that we can do a control equivalency
mapping to and what new controls come in
place and phrase and that applies the
standards of course applies to
everything else so GDP are we are in
active daily conversations right now
pouring through GDP are saying okay are
there new obligations in there that we
are not covering in this service that we
have to add new controls in in order to
do that's an accumulative process office
365 has around 900 controls in the
control set right now 2/3 3/4 of those
are active can
okay and then when an auditor comes the
process is to say okay these controls
are equivalent to the controls in socket
two these controls are equivalent of the
controls in in FedRAMP here is our
control evidence will you go through the
control evidence checked we're running
the process check the controls and give
us the certificate so we do not have a
whole twenty seven thousand one set and
then a full FedRAMP set and then a full
SOT to set it is a combined set of
certificates it's the only way we can
manage this death and realistically you
know this there are new threats so there
are new things you can do but after a
while there's only so many ways you can
secure a system right I mean you're
doing everything you know how to do
right and so until a new threat comes
and you go close the barn door after
that particular horse in case there are
any more horses you put a new control in
place you start to asymptotically
approach what you can do all right so
that's how we handle it today but I will
tell you that I think we as an industry
our customers are driving us this way
particularly our sophisticated customers
are moving to a post certificate world
where they no longer perhaps in the
early stages of evaluating a service or
deciding well is this something I even
want to investigate as a potential in
the in the solution design phase or
something they look at the certificate
bases but usually their risk management
organization wants to see the actual
control evidence and we are moving more
and more to the point where and this is
something called the it's not the TSP
now what's called Service trust portal
Service trust portal where you will be
able to get the evidence that we
provided the auditor against the
controls so you can go look at the
evidence directly and that's one of the
ways that our customers can talk to
their regulators by doing evidence
layering they can say okay our
responsibilities are this our cloud
service providers
here's the evidence they provide here's
our evidence and provide that package
and go get their own audits or
certification but we're moving out of a
world where the certificate is enough
into a world where there is a lot of
evidence that the cloud service provider
is gonna give the customer it's good
news because it's transparent it's bad
news because there's a lot of stuff and
how did you know that you asked for all
the right stuff right so one of the
standards that the standards community
is has worked on in order to sort of
respond to this issue of how do you
organize all of the evidence that you
need to think about is cloud service
level agreement framework fondly known
as one 908 six and that was developed
it's being work developed worldwide came
from two routes one from NIST and
another one from the European Commission
sets of documents merged pulled together
and when you really look at it it's a
due diligence checklist for the cloud so
when we when we're thinking about this
hard we said how do we avoid a symmetry
of information between the cloud service
provider and the customer so you can
make a fair deal right so somebody can
actually make a deal and know what what
happened what should they look at and
that standard this is a checklist that
is derived from that standard that
standard will be published November has
elements in it of for example cloud
service customer data define cloud
service customer data and usage terms
how do you use cloud customer data
commercial services the answer is almost
always well for our services we don't
use it for anything but the provision
and improvement of the service and we're
going to talk more about that but we
have a very limited scope of how we use
customer data but it also talks about
account data derived data other classes
of data and we'll talk about that a
little bit
but how is data use good data location
where is the data stored where is it
processed where did it go in transit
these are things that you should find
out about when you go through the cloud
service evaluation process and what are
the processes for law enforcement access
so this is about a quarter to a fifth of
the elements on the checklist for one
908 6 and it's simply something that
when you're writing an RFP or you're
evaluating a cloud service it's a due
diligence checklist help you organize
all of that evidence and figure out how
to to get it now we're a work running
around in background now that the
standards starting to close up saying
how do we organize the information we
have on all our websites and give people
a rosetta stone that is also organized
by one 908 six so we can respond quickly
to these requests but this is a way of
communicating between these two that's a
transparency standard so when we had a
good question about we had a couple of
good questions about the data center in
Germany and some of the work we're doing
the US federal government and I had some
great questions about how the cloud
works and what you want to do when it
gets right down to it the thing about
the cloud is the cost curve is
extraordinary
so it's 20% the cost to run 10,000
servers as it is a thousand service for
the same unit of work it's a fifth and
it keeps dropping and oh by the way it's
not just 1 over X it's just not
amortization of cost it actually drops
off more rapidly than that 100,000
servers is a lot less expensive again
all right so how do we want to provide
those economies of scale to people but
still maintain data localization
requirements handling requirements
special handling for data well the
secret is to define data probably
right we would like to be able to
process and store locally managed
globally right so if we find a threat
and we want to do an update to servers
we want to propagate update to servers
worldwide without concern right so
there's a whole level of management that
we would like to be able to do without
fettered access you have to talk to
people about that that I gave you the
two really obvious things your data
stored locally you know where exactly
where it is the temperature that comes
off of the server racks that we monitor
you don't care right I should be able to
pull that from Germany or Washington DC
or Beijing nobody cares but in the
middle is where the interesting
conversation is about data end user
identifiable information
organizationally identifiable organized
information that we may want to work
with around the world to improve our
services you may consider confidential
how do we talk about it
$1.99 for four is a technology that's
probably q3 next year and a summer next
year
which is a taxonomy of data types for
cloud data you know I'll show you a
taxonomy picture there's that this
button either gives me a laser or ends
the world alright this is a big red dot
so this is literally the taxonomy of
data so for example customer content for
all of you who have a been working on
gdpr and thinking about it here are four
new entries that came in just recently
into the standards development process
personal genetic data biometric data
data of children political opinions
financial details starting to segment
out the data that is specifically
addressed as sensitive data and the GDP
are so people can talk about it right
these are a taxonomy of data types so
people can talk about data use and
that means we should be able to build an
agreement right a contract that says we
treat all customer content this way
right we only use it for this however
your account data which is specifically
about your payment instrument data we
can work with worldwide can we agree to
that so we're not just saying where's
the day you know bird data we're talking
about specific elements of data and the
standard also allows for the creation of
very specific data use statements and
I'll click through this quickly if
anybody wants to talk to me afterwards
I'm happy to go in more detail but it
basically says I'm gonna say I'm gonna
qualify by how linked it is to an
individual I'm gonna say a data type
from somewhere is used by something to
do something that results in something
else it's a structured statement that
allows you to write a sentence like
aggregated telemetry data from this
capability is used by this service to
improve the CSP services and every term
in red is defined in the standard so you
can put that statement in the data use
statement and somebody can go and find
out quite precisely what do you mean by
that okay
and so this is there's two versions of
it a passive voice and an active voice
it's an international standard this
allows you to write very very precise
data use statements in short form but
that boiled down to actual commitments
and we're you know as we get more
complicated use of data we think we're
gonna have to communicate more
specifically with customers we're very
excited about this standard as a result
another standard in the same mode that
is in development I'm gonna answer a
question you haven't asked her haven't
asked me yet what keeps me up at night
this is a standard for describing
de-identification techniques by their
characteristics and the kinds of attacks
that they will withstand
it doesn't tell you how to do the
identification right it simply helps you
describe the identification if any of
you and I presume many of you have have
been trying to explain to people what
sued anonymization doesn't mean almost
anonymization okay it's not like it's
like pseudo anonymization and so those
techniques though even in documents as
seriously the gdpr are bandied about
without real understanding of what do
you mean of the injection of pseudonyms
for direct identifiers z' is what I
would call sued anonymization it's not
exactly the use in in a lot of documents
so this standard says here is a taxonomy
of data-id identification techniques
judged by their characteristics and for
Excel when you describe to a regulator
you can say I pursued this technique I
my goals were to defeat these kinds of
attacks I used these kinds of inputs
then I designed my process why is this
so one of the ones that's out here at
the end is a framework Cris logic
framework maybe I've got an old data but
is of differential privacy what keeps me
up at night at night somebody asked a
good question about is this a trend
towards it's things like our data German
data center a trend towards Microsoft
removing itself from the data so it
doesn't have direct attached to the data
the answer is is yes that is a trend
many of those techniques that keep us at
arm's length for the data are extremely
difficult to understand differential
privacy blockchain heavy encryption
just-in-time processing these are things
that are critical to our trust with
customers very difficult for people
writing policy to understand and so this
standard takes differential privacy and
says here's the goals here's the
limitations here's how it might be used
it helps define that so again it's a
transparency standards just a way to
talk about these and I would encourage
you you know when you're you're thinking
about designing the identification
systems try and get a draft at this
standard or even join us and work on it
as it goes forward so we can do a better
job of describing very precisely what we
mean by the identification by the way
the data qualifiers that were in the
data use statement are linked closely
with the identification standard those
two standards are linked so if you've
described the data as unlinked or sued
anonymized over here you can go look at
the other standard exactly what do I
mean to get that so the ties together so
in the end that's what we're trying to
accomplish in this aspect of
transparency standards and certification
standards in in AI so if you look at the
classic relationships in a protection of
PII there is a controller of course the
controller has some relationship with a
cloud service provider the controller at
least is under the observation of a PII
authority I think with gdpr
the processor is has more direct
obligations maybe indirectly talking to
the DPA but at least the controller is
talking to a DPA and these standards
help in 199 44 for example help that
controller describe here is the data and
here is how I am using it to that to
that authority we are very interested
again in allowing governments to write
their own laws but when it comes down to
sort of not their own facts right so
when it comes down to the specific
technical performance that you or we are
supposed to do have that defined by
international standards so that when
they say soon Animas ation we all know
what it means when
say provide the service we all know what
it means and we what's really expensive
for us if there is a different
definition of provide the service in
Germany than there is in France and
there is in the UK because we are then
constant and every time we make an
enhancement to the system we have to
check all of those definitions so the
specific technical performance run by
standards is our goal so that's an
important transaction same thing with
the communication with the data subject
which is tougher the standards there is
nobody posting photographs on facebook
that is read iso 29 100 to understand
what their privacy rights are nor will
they read one nine nine four four but if
there was an iconography created as
described in the gdpr that iconography
should be based on a fixed language of
use it might be based on a standard down
at the end and then the critical one of
course for us is the relationship
between the cloud service provider in
the pii controller and then there are
certification standards like twenty
seven thousand eighteen you must or
explain why not codes of practice and
then there are descriptive standards
like one 908 six tell me everything you
did that's relevant to our relationship
or 199 44 tell me in detail everything
you did with the data we're gonna write
a contract on the basis of that and that
will be a much better contract for us
over time and then finally the cloud
service provider itself defines itself
all of the NIST terminology is now being
put in international standards so we can
use it so the excellent presentation we
had on how data how the cloud is
structured all that's based on
international standards so we can go
forward okay so what would I love to
have you do well at least review 199 for
for when it comes out this November and
provide feedback directly to anybody
involved in ISO you can provide it back
to me or anybody else but also think
about using it actually I used the wrong
number there it's the wrong number one
908 sick
the SLA standard is coming out in
November when that comes out start using
that to communicate with us and other
vendors about your desires for
information about the cloud and then
participate or at least review these new
transparency standards to see how
they're going to fit in the sort of
quiver of tools we have for for
transparency okay so with that questions
Thank You piata cracksman State Farm
Insurance I did not realize that there
are so many techniques for D
identification are you able to provide a
high level description for me what's the
difference between di identified data
and anonymize data
sure I'll tell you what the standard
says all right so did we pick the
identification as an umbrella term for
all the techniques underneath
anonymization is defined in the standard
as you have now reduced the data is no
longer in the form of what you would
call Micro data it is no longer a line
item of data related to an individual
even if you've removed the linkage
between that individual and a real
person it's possible to reaiiy denta fie
them if you have enough individual line
item so anonymize data now removes
aggregates the data together or adds
enough noise to the data so that you can
no longer detect a single individual in
the data it's a bad recitation what's in
the standard all of the other techniques
suit anonymization techniques which are
also called the identification
techniques take either direct or
indirect identifiers Gregg is a direct
identifier okay lids in on Queen Anne in
Seattle is an indirect identifiers you
start removing those that's levels of
pseudonym ization I'm adding usually you
replace it with a number or something a
pseudonym so that's a little bit of a
difference but you you should have a
look at the standard
lays that all out you cannot put it back
together you cannot put it back together
and the thing is you cannot put it back
together
to a guarantee and that's another thing
the standard talks about so there are
techniques in an autumn is a ssin that
say you can kind of put it together but
you'll never know with more than the
least you can get to is five people with
the same data it's called KN anemone
right so there will be no fewer than
five people that you can't tell amongst
right so there are different kinds of
attacks that people do right do they
want to find a senator out of the middle
of a set of medical records or do they
just want to find people who are likely
to have a disease and they don't care if
they're not precisely right they're
gonna stand to adds to them that's a
different kind of attack so there are
different kinds of attacks that you put
on the data different techniques in the
standard maps between those so at least
when you go talk to a regulator say this
was the attack I was trying to prevent
and this is the technique I used the
regulator can say okay that that's the
attack we care about and that technique
is reasonable one okay okay so that's I
don't know if that's an answer but okay
yeah we went through a and I skipped the
data portability standard but that was
three hundred to three hundred pages of
standardized standards on the numbers I
gave you so far
yeah are these traps all available and
where can we find them yes and no the
notorious online ISOs door well yeah the
notorious iso standard ah they go
through a dark period so like 1 908 6
right now you can't see because it's
about ready for publication
the other ones yes we can get drafts for
people who are interested in reviewing
or participating in the in the
standardization yeah at work we are
always getting surveys and they say this
is completely anonymous when you reply
to the survey and they want to know your
opinion on different things and they're
using things like Survey Monkey
sometimes so it makes me not be
completely assured that they're using
anonymization like you're describing
did you tell can you tell me what do
they usually use they're usually using
some form of what we what the scanner
would call secure pseudonym ization so
they take your data they replace it with
an ID and then they do what they call
fuzzy ID right so they take the the
number and add noise into the pseudonym
so it's it's quite hard to reify you
however it's not resistant in the attack
that said well give me everybody who had
these 5 answers to the singling out
attacks that would not be be easy to do
with that data and part of the problem
we've had with the identification in
general is we've used terms like
anonymous I think this famous Netflix
prize example where they said this data
is anonymous and the academic applied
one attack to it singled out some data
and said no it isn't and therefore
nothing can be truly anonymous right
that's one attitude the other attitude
is hippos approach to soothe
dynamization
it's quite basic I mean it takes the
direct identifiers out essentially
we really have not had a significant
difficulty with with re-identified
medical data right so it works it really
helps it's much better than not doing
anything and that's one of the things
that we really want to make sure is that
companies do apply the identification
techniques as part of their improvement
of their protection of PII
even though academically it's possible
that it's not completely anonymous so
it's not a waste of time and it's a
being a funny debate because people have
not used the terms what they mean is
your data is soon autumn eyes and not
anonymized sorry more questions perhaps
on that somewhat reassuring note thank
Greg for his