privacy implications of cloud-based security

in my continuing efforts to get caught up on my rss feeds (i'll get there eventually) i came across an interesting post at the stopbadware blog about establishing expectations for av vendors. it raises some interesting concerns about data collection and lack of transparency / informed consent.

this is a tough call. recall that when trend bought hijack this and added a button to send the log to trend for analysis people went ape over the idea that it was sending data without informing the user (even though the behaviour seemed clear to me just by looking at what the UI stated).

all cloud-based security inherently is going to collect data and send it into the cloud - that's how you leverage the cloud for security. clearly there is the potential for a privacy violation if the vendor isn't careful and there is certainly room for people to assume there already is a privacy violation. some people are inevitably going to cry foul if you tell them that their security software is sending data into the cloud.

and yet on the other hand if you don't tell them then they can't make intelligent, informed decisions about whether they want to accept the risk associated with cloud-based security technologies and so may fall into a false sense of privacy (not unlike a false sense of security).

i'm a big fan of informed decisions - i think that given enough information, reasonable people will be able to make intelligent decisions and hopefully that works out in the vendor's favour (if they're doing enough to protect customer's privacy).

i think security vendors absolutely need to inform their users, and i think the failure to do so should be considered a badware sort of behaviour. i think the risk of backlash can be mostly mitigated by informing the user HOW their privacy is being protected in spite of the data collection (ie. exactly what data is being collected and how the data is being anonymized - maybe even let them audit the data being sent). assuming the vendor is doing an adequate job of protecting users' privacy, only unreasonable people should continue to have a problem in the face of such transparency - and there isn't really much you can do for unreasonable people. all cloud-based technologies involve data collection, so those unreasonable folks will simply have to learn to be reasonable or seek out one of the dwindling number of products that don't have any cloud-based components.

trend micro and cloud watching

last thursday mike rothman wrote the following:

Is traditional signature-based AV dead? It's definitely on life-support, as Trend announces a cloud-based something or other. Will it work? Who knows, but clearly the sacred cow of AV will be served for dinner sooner rather than later. - Trend Micro release

if you're like mike and think this has anything to do with moving away from signature-based technology then you need to read that release a second time... or a third time... or an nth time - it doesn't really matter how many times you've read it before you need to read it again, especially the following passage:

By storing the majority of pattern files in an Internet cloud database and keeping them at a minimum on the endpoint, Trend Micro helps stop Web, file and email threats before they reach the end-user or the corporate network. This new approach lightens bandwidth consumption on customers’ networks and endpoints and provides faster and more comprehensive up-to-date protection.

in other words, it's still signature-based, they're just putting the signatures in the cloud rather than the endpoint now... it's not your grandmother's scanner but it's still signature-based av...

one of the benefits of letting this post stew a little is that i've gotten to see what others have said about the subject... as a not-so-accurate barometer of av innovation, amrit williams thinks it's the most innovative thing to come out of the av industry in the past decade but alan shimel rightly points out that it sounds a lot like something panda has been doing for some time now... i would add that both are conceptually reminiscent of the digital immune system developed by ibm (starting more than a decade ago) and sold to symantec (and we know what symantec does with the things it buys, or rather we don't)... it would be hard to imagine that either trend or panda came up with their 'in-the-cloud' architectures without taking a few lessons away from this progenitor and so i wonder if we can really say this innovation came about within the past decade at all...