Subject: [Nsaas] Some thoughts about SAAS

From: Hosnieh Rafiee <[email-masked]>
Date: Thu, 28 Aug 2014 16:03:47 +0000

Hello,

Since security as a service (SAAS) is really a critical role for each customers in different countries and for governments as well, I am thinking about how would be possible to also protect customers from Surveillance agents and monitoring. 

Because if SAAS is offered by a country that its government is known to be a surveillance agent, Is there any particular requirement should be considered in standard architectures to avoid such role? 

If the target customer is a government/or any important company in a country, does it accept to use a SAAS that is located in another country? (fearing of spy)

How to avoid governments to force SAAS vendors/operators to access the detail information about security services so that they can monitor and access customer's data. Are these assumptions only operational issues or it might also impact the standards in this regard?

Thanks,
Best,
Hosnieh

---

From: Linda Dunbar <[email-masked]>
Date: Thu, 28 Aug 2014 20:48:04 +0000

Hosnieh, 

Are you saying having a way for customers to avoid being monitored by government? 
I can see the potential for customers to be notified when their traffic is actually monitored. But if government wants to monitor someone, can you avoid?

Linda

-----Original Message-----
From: Nsaas [mailto:[email-masked]] On Behalf Of Hosnieh Rafiee
Sent: Thursday, August 28, 2014 11:04 AM
To: [email-masked]
Subject: [Nsaas] Some thoughts about SAAS

Hello,

Thanks,
Best,
Hosnieh
_______________________________________________
Nsaas mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nsaas

---

From: Hosnieh Rafiee <[email-masked]>
Date: Fri, 29 Aug 2014 08:03:48 +0000

Linda,

> Are you saying having a way for customers to avoid being monitored by

Both government or any other surveillance agents.

> I can see the potential for customers to be notified when their traffic
> is actually monitored. But if government wants to monitor someone, can
> you avoid?

The answer is really difficult. But this raises the next questions that are whether or not this impacts on the standards? Whether or not it leads to having each country follow certain specifications and again there is problem for operators to offer service to customers or force to be limited to the service offered by their own country? Isn't it difficult to think about a unified framework?

Thanks,
Best,
Hosnieh