<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">A reality of modern cloud computing and globalism is that lots of data centers are being ‘outsourced’ outside of the country in order to keep costs down. There
isn’t anything you can do about it other switching to a competitor with a better domestic presence. Both Google and Amazon will make an effort to keep your data inside your country of origin, for example. But who knows how long that is going to be the case.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Personally, I don’t think there is much of a risk with this model currently, especially if your data is encrypted. Given state-sponsored actors, anything is
possible, however. Including insider threats and ‘layer 1’ supply-chain attacks on the infrastructure itself.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Something I proposed @Suricon was to start scoring ASNs by risk in order to start holding the big cloud players accountable and potentially allow for scoping
TLS interception using a trust model. So, for example, allowing TLS to known-good domestic ASNs while intercepting (or even blocking) it for foreign or low-trust networks.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">-Coop<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org>
<b>On Behalf Of </b>Albert E. Whale, CEH CHS CISA CISSP<br>
<b>Sent:</b> Tuesday, January 22, 2019 2:24 PM<br>
<b>To:</b> Open Information Security Foundation <oisf-users@lists.openinfosecfoundation.org><br>
<b>Subject:</b> [Oisf-users] Endpoints outside of the US<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>I'm looking at a lot of traffic to 443 connections to Singapore, Hong Kong, Japan, Netherlands and more. Some of this traffic's IP Addresses are assigned to Microsoft.<o:p></o:p></p>
<p>I want to believe the that there is nothing malicious, but I Don't believe that there is a need to send my data to Singapore or Japan, when I live in the USA.<o:p></o:p></p>
<p>Is there a need to send data to a foreign country to use Microsoft products?<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">-- <br>
-- <br>
--<br>
<br>
Albert E. Whale, CEH CHS CISA CISSP<br>
<b>President - Chief Info Security Officer</b><br>
<a href="http://www.IT-Security-inc.com">IT Security, Inc.</a> - A Service Disabled Veteran Owned Company - (<b>SDVOSB</b>)<br>
<b>HUBZone Certified</b><br>
<a href="https://www.linkedin.com/in/albertwhale">LinkedIn</a> Profile<br>
<br>
<br>
Phone: 412-515-3010 | Email: <a href="mailto:Albert.Whale@IT-Security-inc.com">Albert.Whale@IT-Security-inc.com</a><br>
Cell: 412-889-6870<o:p></o:p></p>
</div>
</div>
</body>
</html>