CJIS Rules Not Impossible To Comply With, But Itll Cost Ya

Database security and encryption pros say requirements are not unreasonable

Even as some municipal technology leaders are complaining of chafing from policies laid out by the FBIs Criminal Justice Information Systems (CJIS) rules for securing systems containing CJIS database information, the FBI has gone public this week in
restating its commitment to applying those rules to cloud deployments for law enforcement agencies
. According to database security and encryption experts, the requirements are hardly unreasonable for protecting the nations most sensitive police information.
I dont believe the requirements the FBI has put forward are particularly onerous, says Josh Shaul of Application Security Inc., which provides some of the database security tools the FBI uses to protect CJIS data stores internally. The pushback here is almost funny. Some cloud providers are saying, Well, you want to know every one of our employees who has access to this data, and we dont know how to figure that out, and you want background checks on our employees to vet them, but not all of them are U.S. citizens because our data centers are scattered all over the world.
While it is unclear which CJIS requirement actually scuttled the project, the city of Los Angeles
ran into trouble late last year in deploying Google Apps across its municipality operations
due to its inability to comply with CJIS rules in developing systems for 13,000 Los Angeles Police Department employees. In December, two L.A. officials, Gerry Miller, chief legislative analyst, and Miguel Santana, city administrative officer, went so far as to say that
Criminal Justice Information Systems (CJIS) regulations are currently incompatible with cloud computing
(PDF).
However, that is not necessarily the case, at least technically. According to Todd Thiemann, senior director of product marketing for Vormetric, the encryption requirements made by the FBI are very doable as long as encryption is done at the file level.
If youre encrypting the storage volume in the data center, that doesnt translate to the cloud -- you have to do something at the file level, he explains.
Meanwhile, many of the same security practices for database security used on premises still apply in the cloud, though there are other considerations to take into account, Thiemann says.
A lot of the security processes are the same as on premises, but the potential exposure in the cloud is that the database is also accessible -- potentially to the cloud providers employees, Shaul says. Also, the architecture of how that cloud is being used could open the door to attack. For example, take Gmail. Before when a companys email was on an Exchange server deep in the network, it wasnt so easy for attackers to start plugging emails into the system and guessing passwords. When the system is exposed, thats a lot easier to do.
As a result, it follows that background checks and robust monitoring are put in place -- two features that cost extra money and which some cloud providers are offering as a value add. However, that cost issue may actually be whats holding up the show.
What that may effectively do is kill the cloud for law enforcement because it will add so much additional cost that it may make more sense for them to keep it on premise, Shaul says.
However, it may spur government organizations to get more creative with how they leverage cloud technologies. For example, the
state of Florida is in the process of moving all of its emails to a private cloud
. The private architecture allows the Sunshine State to build systems to CJIS spec while still getting the benefit of cloud scalability.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
CJIS Rules Not Impossible To Comply With, But Itll Cost Ya