한 금융 회사가 주요 비즈니스 애플리케이션을 클라우드로 이전하기로 결정했습니다. 법무부는 플랫폼의 이동이 일반 데이터 보호 (GDPR)와 같은 여러 규제 의무를 준수하고 데이터 기밀성을 보장해야 한다고 주장합니다. CISO (Chief Information Security Officer)는 클라우드 공급자가 모든 규정 요구 사항을 충족했으며 데이터 기밀성을 해결하기 위해 내부 관리 암호화 키를 갖춘 자체 암호화 솔루션도 제공한다고 말합니다. CISO는이 상황에서 모든 법적 요구 사항을 해결 했습니까?
정답: A
The CISO did not address all the legal requirements in this situation, because the encryption solution is internal to the cloud provider. Moving the main business application to the cloud involves transferring the data and the processing of the data from the organization's own premises to the cloud provider's premises. This may raise several legal and regulatory issues, such as the compliance with the data protection laws, the data sovereignty laws, the data breach notification laws, and the contractual obligations. The General Data Protection Regulation (GDPR) is one of the data protection laws that applies to the organizations that process the personal data of the individuals in the European Union (EU), regardless of where the processing takes place. The GDPR requires the organizations to ensure the confidentiality, the integrity, and the availability of the personal data, and to implement appropriate technical and organizational measures to protect the personal data from unauthorized or unlawful access, use, disclosure, alteration, or destruction. One of the technical measures that can be used to protect the personal data is encryption, which is a technique that transforms the data into an unreadable or unintelligible form, using a key and an algorithm, and that prevents unauthorized access, modification, or disclosure of the data. However, the encryption solution that the cloud provider offers is internal to the cloud provider, meaning that the cloud provider has the control and the access to the encryption keys and the encryption algorithms. This may pose a risk to the data confidentiality, as the cloud provider may be able to decrypt the data, or may be compelled to disclose the data to third parties, such as law enforcement agencies or other governments.
Therefore, the CISO did not address all the legal requirements in this situation, as the encryption solution is internal to the cloud provider, and does not guarantee the data confidentiality. The organization may need to use its own encryption solution, or to negotiate with the cloud provider to have more control and visibility over the encryption keys and the encryption algorithms.
