Cloud services described in basic terms, are services that are accessed via the internet.

Many of us use cloud services on a daily basis, not least to share files or store information.

Cloud service providers often have a centralized IT environment where all customers share the space on platforms located in large data centers somewhere in the world.
Cloud storage often means that you do not know where your data is stored.

For procurement and use of such external services, be it storage, sharing or computing capacity, there are considerations to be taken into account. Storing and managing our data in cloud services might make it vulnerable to information breaches or unauthorized access to confidential information.

The image shows how we reach a lot of things "in the cloud" using our computers.

Cloud services and public authorities

One of the most common issues with cloud services for the Swedish public authorities is the challenges of trusting third parties with confidential information.

Since Uppsala University is a public authority, data must be handled according to the regulations that govern the handling of public documents and personal data for authorities.

From a legal point of view, a cloud service is a disclosure of information/documents to an external supplier who could be operating from anywhere in the world - usually under the jurisdiction of another country’s regulations.

When the information owner uses cloud services, they lose control over their data. If the information is sensitive, it may be inappropriate to use cloud services. If the information is subject to confidentiality regulations, it may be illegal.

It is important to remember that the legal aspects are only part of a wider assessment that needs to be made every time the use of cloud services is considered.

Cloud services and information security

The question of whether it is appropriate to use an external IT service needs to be
evaluated in each unique case. The essential steps for such evaluation are carrying out information classification, requirements analysis, dialogue with the legal department, the Security and Safety Division and the university's Data Protection officer.

An IT system that has not yet been subject to requirement analysis is considered to fulfill the classification level of 111 in accordance with the university's precuderes for Risk management.

For questions regarding information security and cloud services, contact the Security and Safety Division via security@uu.se.

Storing and sharing data/information at Uppsala University

Use primarily storage solutions provided by the university.

The Department for University IT Services (UIT) offers a range of solutions for storing and sharing data. Examples of the university’s services for data storage and sharing include:

Dataportal Allvis - up to 200 Gb storage is allocated to researchers and research project free of charge: Store research data - Uppsala University (uu.se)
The storage solution Argos - home and group directories on UIT’s solution “Argos” give employees access to in-house storage and modern file management tools and a centralised back-up solution. Why choose Argos? - Uppsala University (uu.se)
The storage solution Vesta - suitable for storage of highly sensitive data: Order a storage area (folder) in Vesta - Uppsala University (uu.se)
The UPPMAX cluster environment called Bianca - a research system dedicated for analyzing sensitive data.
File Sharing system called Myfiles - suitable for sharing data both within and outside of the university. Please note that this service is not suitable for sharing sensitive data: myfiles.uu.se - Uppsala University
Cryptshare: A secure file sharing service that can be used to share sensitive data both within and outside of the University.
SharePoint, OneNote, and other Microsoft services are available for storing and sharing information with a low confidentiality classification, specifically levels K=1 or K=2.
Services provided by departments, institutions, and collaborative organizations such as NAISS and SciLifeLab

Please keep in mind that sensitive data, such as sensitive personal information and information subject to secrecy, must to be encrypted for storage in Allvis and Argos!

For more information about storage and collaboration opportunities both within and outside of the University, visit Store data and collaborate - Uppsala University (uu.se)

The Security and safety Division has developed a guide on storage solutions, data sharing, and encryption, which you will find at the end of the course.