Difference between revisions of "User:Shawndouglas/sandbox/sublevel16"

From LIMSWiki
Jump to navigationJump to search
Tag: Reverted
Tag: Reverted
Line 164: Line 164:
Second, and consequently, the development of such policy and regulation may not occur in a manner more unified with global perceptions but rather largely based upon localized values, interests, and priorities. The failure here is the lack of recognition of CSPs as being integral to individual, retail, corporate, organizational, and government operations around the globe<ref name="ZuoCritical23" />, i.e. their centralized and concentrated position within a changing computing paradigm. As such, greater effort must be made by policymakers, regulators, and legislatures to find at least a minimum level of "compatibility and reconciliation" with other existing governance mechanisms, while carefully addressing both security of operation and operational robustness in tandem, such that there is greater harmonization globally.<ref name="LeviteCloud20" /><ref name="ZuoCritical23" /> And through government-level support of harmonized controls—as well as a vested interest in promoting the responsible "development, dissemination, and operation of cloud infrastructure"—cloud users will stand a greater chance of reaping the economic benefits of adopting cloud computing.<ref name="LeviteCloud20" />
Second, and consequently, the development of such policy and regulation may not occur in a manner more unified with global perceptions but rather largely based upon localized values, interests, and priorities. The failure here is the lack of recognition of CSPs as being integral to individual, retail, corporate, organizational, and government operations around the globe<ref name="ZuoCritical23" />, i.e. their centralized and concentrated position within a changing computing paradigm. As such, greater effort must be made by policymakers, regulators, and legislatures to find at least a minimum level of "compatibility and reconciliation" with other existing governance mechanisms, while carefully addressing both security of operation and operational robustness in tandem, such that there is greater harmonization globally.<ref name="LeviteCloud20" /><ref name="ZuoCritical23" /> And through government-level support of harmonized controls—as well as a vested interest in promoting the responsible "development, dissemination, and operation of cloud infrastructure"—cloud users will stand a greater chance of reaping the economic benefits of adopting cloud computing.<ref name="LeviteCloud20" />


Current and future regulatory action applies to several areas of cloud computing. How a CSP responds to and notifies affected users of a security breach is one concern. Up until 2022, the U.S. government didn't fully address in a unified fashion aspects of cloud security breaches such as protection obligations, reporting time, and required notification parties, nor any compensation mechanism for those affected.<ref name="MitnickNoMore18">{{cite web |url=https://www.accessnow.org/no-more-waiting-its-time-for-a-federal-data-breach-law-in-the-u-s/ |title=No more waiting: It’s time for a federal data breach law in the U.S. |author=Mitnick, D. |work=Access Now Blog |publisher=Access Now |date=10 April 2018 |accessdate=28 July 2023}}</ref> (All U.S. states and most territories did already have their own flavor of breach notification legislation<ref name="NCSLSecurity20">{{cite web |url=https://www.ncsl.org/technology-and-communication/security-breach-notification-laws |title=Security Breach Notification Laws |publisher=National Conference of State Legislatures |date=17 January 2022 |accessdate=28 July 2023}}</ref>, but like cannabis law, this was problematic in the face of a strong divergence with federal law or lack thereof.) In March 2022, President Biden signed into law the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), which requires covered entities to report substantial cybersecurity incidents and any paid ransom for ransomware attacks, with more scope and definition to come.<ref name="RGExpansive22">{{cite web |url=https://www.ropesgray.com/en/newsroom/alerts/2022/march/expansive-federal-breach-reporting-requirement-becomes-law |title=Expansive Federal Breach Reporting Requirement Becomes Law |publisher=Ropes & Gray |date=22 March 2022 |accessdate=14 August 2023}}</ref> While this addresses some of the prior-mentioned aspects, its thoroughness towards protection obligations and compensation remains lacking. A year later, cybersecurity thought leaders like Viakoo's CEO Bud Broomhead acknowledge it as "not the destination ... but an important waypoint toward it," with other activities like the creation of the Joint Ransomware Task Forces and Ransomware Vulnerability Warning Pilot Program further promoting stronger federal efforts.<ref name="Blair-FrasierExperts23">{{cite web |url=https://www.securitymagazine.com/articles/99138-experts-weigh-in-on-circia-one-year-later |archiveurl=https://web.archive.org/web/20230331233533/https://www.securitymagazine.com/articles/99138-experts-weigh-in-on-circia-one-year-later |title=Experts weigh in on CIRCIA one year later |author=Blair-Frasier, R. |work=Security Magazine |date=31 March 2023 |archivedate=31 March 2023 |accessdate=14 August 2023}}</ref>
Current and future regulatory action applies to several areas of cloud computing. How a CSP responds to and notifies affected users of a security breach is one concern. Up until 2022, the U.S. government didn't fully address in a unified fashion aspects of cloud security breaches such as protection obligations, reporting time, and required notification parties, nor any compensation mechanism for those affected.<ref name="MitnickNoMore18">{{cite web |url=https://www.accessnow.org/no-more-waiting-its-time-for-a-federal-data-breach-law-in-the-u-s/ |title=No more waiting: It’s time for a federal data breach law in the U.S. |author=Mitnick, D. |work=Access Now Blog |publisher=Access Now |date=10 April 2018 |accessdate=28 July 2023}}</ref> (All U.S. states and most territories did already have their own flavor of breach notification legislation<ref name="NCSLSecurity20">{{cite web |url=https://www.ncsl.org/technology-and-communication/security-breach-notification-laws |title=Security Breach Notification Laws |publisher=National Conference of State Legislatures |date=17 January 2022 |accessdate=28 July 2023}}</ref>, but like cannabis law, this was problematic in the face of a strong divergence with federal law or lack thereof.) In March 2022, President Biden signed into law the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), which requires covered entities to report substantial cybersecurity incidents and any paid ransom for ransomware attacks, with more scope and definition to come.<ref name="RGExpansive22">{{cite web |url=https://www.ropesgray.com/en/newsroom/alerts/2022/march/expansive-federal-breach-reporting-requirement-becomes-law |title=Expansive Federal Breach Reporting Requirement Becomes Law |publisher=Ropes & Gray |date=22 March 2022 |accessdate=14 August 2023}}</ref> While this addresses some of the prior-mentioned aspects, its thoroughness towards protection obligations and compensation remains lacking. A year later, however, cybersecurity thought leaders like Viakoo's CEO Bud Broomhead positively acknowledge CIRCIA as "not the destination ... but an important waypoint toward it," with other activities like the creation of the Joint Ransomware Task Forces and Ransomware Vulnerability Warning Pilot Program further promoting stronger federal efforts towards cloud security.<ref name="Blair-FrasierExperts23">{{cite web |url=https://www.securitymagazine.com/articles/99138-experts-weigh-in-on-circia-one-year-later |archiveurl=https://web.archive.org/web/20230331233533/https://www.securitymagazine.com/articles/99138-experts-weigh-in-on-circia-one-year-later |title=Experts weigh in on CIRCIA one year later |author=Blair-Frasier, R. |work=Security Magazine |date=31 March 2023 |archivedate=31 March 2023 |accessdate=14 August 2023}}</ref>


Other areas of cloud security also face regulatory action. For example, the applications and algorithms that drive and collect data from users of cloud-enabled applications may also face regulatory scrutiny or control by a national government, as was seen with both China's and the U.S.'s scrutiny of the TikTok application, its algorithms, and its security.<ref name="LeviteCloud20" /><ref name="BrandomTrump20">{{cite web |url=https://www.theverge.com/2020/9/2/21418496/tiktok-for-you-page-algorithm-deal-us-china-trump-microsoft |title=Trump’s TikTok deal has hit a serious roadblock |author=Brandom, R. |work=The Verge |date=02 September 2020 |accessdate=28 July 2023}}</ref><ref name="CoxOracle21">{{cite web |url=https://arstechnica.com/tech-policy/2021/02/oracles-tiktok-acquisition-reportedly-shelved-indefinitely/ |title=Oracle’s TikTok acquisition reportedly “shelved” indefinitely |author=Cox, K. |work=Ars Technica |date=10 February 2021 |accessdate=28 July 2023}}</ref> Data localization also remains a significant area of cloud computing regulation, not just for security concerns but also industrial policy, economic policy, privacy concerns, and human rights concerns.<ref name="LeviteCloud20" /> Other areas of concern that may see regulation include interoperability and portability, digital preservation (retention) obligations, and cross-border data transfer.
Other areas of cloud security also face regulatory action. For example, the applications and algorithms that drive and collect data from users of cloud-enabled applications may also face regulatory scrutiny or control by a national government, as was seen with both China's and the U.S.'s scrutiny of the TikTok application, its algorithms, and its security.<ref name="LeviteCloud20" /><ref name="BrandomTrump20">{{cite web |url=https://www.theverge.com/2020/9/2/21418496/tiktok-for-you-page-algorithm-deal-us-china-trump-microsoft |title=Trump’s TikTok deal has hit a serious roadblock |author=Brandom, R. |work=The Verge |date=02 September 2020 |accessdate=28 July 2023}}</ref><ref name="CoxOracle21">{{cite web |url=https://arstechnica.com/tech-policy/2021/02/oracles-tiktok-acquisition-reportedly-shelved-indefinitely/ |title=Oracle’s TikTok acquisition reportedly “shelved” indefinitely |author=Cox, K. |work=Ars Technica |date=10 February 2021 |accessdate=28 July 2023}}</ref> Data localization also remains a significant area of cloud computing regulation, not just for security concerns but also industrial policy, economic policy, privacy concerns, and human rights concerns.<ref name="LeviteCloud20" /> Other areas of concern that may see regulation include interoperability and portability, digital preservation (retention) obligations, and cross-border data transfer.

Revision as of 22:10, 14 August 2023

This is sublevel16 of my sandbox, where I play with features and test MediaWiki code. If you wish to leave a comment for me, please see my discussion page instead.

Sandbox begins below

2. Standards and security in the cloud

Figure 3. The NIST Cloud Computing Security Reference Architecture provides a security overlay to the NIST Cloud Computing Reference Architecture, published in 2011.

In a 2010 Cloud Computing Adoption Survey by Mimecast, the leading response (46 percent of surveyed IT managers) to the question "Why did you decide against moving to the cloud?" was "security concerns."[1] In a separate survey published around the same time by the IEEE and Cloud Security Alliance, "93 percent of respondents said the need for cloud computing security standards is important; 82 percent said the need is urgent."[2] Fast-forward to today and it's easy to see worries about cloud security have eased somewhat in comparison. A Cloud Threat Report by Oracle and KPMG in 2020 found that "40% of cybersecurity and IT professionals from private and public businesses perceive public clouds as more secure than on-premise environments ... 12% believe public clouds are no more secure or insecure than what they can deliver with on-premises environments, and 2% think public clouds are less secure."[3] A survey less than a year before found similar numbers, also noting, however, that while confidence in cloud security was strong, a strong majority of respondents (71 percent) still believe there are at least moderate concerns about "malicious activity in cloud systems."[4]

To be sure, there are undoubtedly opportunities for malicious activity within the cloud, which has its own share of complexities. A 2023 collaborative report by Check Point Software Technologies and Cybersecurity Insiders points to annual increases in attack attempts on cloud-based networks, needlessly complex and inadequate security policies, and insufficient and unsecure cloud configurations and interfaces as being drivers of security mishaps in the cloud.[5] Additionally, given that cloud computing is internet-based (i.e., networked), a networking approach based on normal internet and network standards is not sufficient to address the complexities inherent to many cloud computing implementations.[6] From integrating public and private clouds to meeting regulations mandating localized data storage, additional considerations must be made as to how best ensure standardized cloud services remain driven on solid security principles. With the transition to cloud, on-site data storage has moved online, with its own set of security nuances. Additionally, increased scalability, interfacing, and proximity to other networked data and systems adds more complexity to security.[7] As complexity is added, a more standardized approach is called for. Just as the Cloud Native Computing Foundation's (CNCF's) Certified Kubernetes Conformance Program attempts to ensure a standardized conformance of all Kubernetes instances to the Kubernetes application programming interfaces (APIs) for consistency and interoperability across cloud platforms[8], standards organizations like the Institute of Electrical and Electronics Engineers (IEEE), International Organization for Standardization (ISO), and National Institute of Standards and Technology (NIST) develop standards and guidelines to ensure quality and security across all cloud computing platforms.[9][10]

The next few sections examine the various organizations, agencies, and industries developing and promoting standards, guidelines, and recommendations that shape the proper use of cloud computing platforms. Note that you won't see much about laboratories and cloud computing in this chapter, as we pan outward and look at cloud standards and security from up high. We'll focus on how all this information relates to laboratories in the coming chapters.


2.1 Standards and regulations influencing cloud computing

Numerous organizations have taken up the mantle in developing and disseminating cloud compliance standards, guidelines, and recommendations since the late 2000s, some independently (e.g., the Storage Networking Industry Association) and others by government mandate (e.g., National Institute of Standards and Technology). Some organizations have tailored their content to a specific industry (e.g., PCI Security Standards Council and the financial industry), while others have focused on a sector of business (e.g., FedRAMP and the U.S. Federal government). As the development of these standards, guidelines, and recommendations has continued, the groundwork has been created for future updates. NIST's early work with its SP 500-293 NIST Cloud Computing Technology Roadmap, Volume I and II and SP 500-299 NIST Cloud Computing Security Reference Architecture (Figure 3) have gone on to further define a modern approach to categorizing, evaluating, comparing, and selecting cloud services.[11] And those documents were influenced by even earlier work by the Cloud Security Alliance's Enterprise Architecture efforts.[12]

The work to improve and expand upon existing standards continues today, even as new service models for cloud computing emerge. Examples of the prior mentioned and other organizations contributing to these efforts are shown in Table 3.

Table 3. Organizations that have developed and are developing cloud compliance standards, guidelines, recommendations, and frameworks
Organization Description Link to standards, etc.
Crown Commercial Services and G-Cloud Though not a standards organization, the U.K. Crown Commercial Service's (CSS's) G-Cloud program and framework allows companies considering selling cloud-based services to the U.K. government to make their services available "through a front-end catalogue called the Digital Marketplace." The framework agreements place specific requirements on the various services being offered by the provider, and in return, the provider can bid on government opportunities without going through the full procurement process.[13] G-Cloud standards, etc.
DMTF Formerly known as the Distributed Management Task Force, DMTF "creates open manageability standards spanning diverse emerging and traditional IT infrastructures."[14] This includes cloud standards, virtualization standards, networking standards, and more. DMTF standards, etc.
European Telecommunications Standards Institute ETSI "supports the timely development, ratification and testing of globally applicable standards" for information and communications technology (ICT) hardware, software, and services.[15] ETSI standards, etc.
General Services Administration and FedRAMP Though not a standards organization, the U.S. General Services Administration's (GSA's) FedRAMP program "provides a standardized approach to security authorizations for cloud service offerings" for the U.S. Federal government.[16] FedRAMP "standardizes security requirements for the authorization and ongoing cybersecurity of cloud services" as authorized by a number of regulations and policies.[17] FedRAMP standards, etc.
IEEE Computer Society and IEEE Standards Association The IEEE Cloud Computing Standards Committee, which is chartered "to promote the development of standards in all aspects of the cloud computing ecosystem," has four working groups that help develop cloud computing standards for the IEEE Standards Association.[18] IEEE SA standards, etc.
International Organization for Standardization (ISO) The ISO is a primary global standards organization that has been developing a wide variety of standards for decades. Numerous cloud-computing standards have been published under International Classification for Standards (ICS) code 35.210.[19] ISO standards, etc.
International Telecommunication Union (ITU) The ITU is the United Nation's specialized agency for information communication technologies (ICTs). Among their activities, the agency develops technical standards and facilitates international connectivity in communication networks.[20] Many recommendation documents have been developed through its Telecommunication Standardization Sector (ITU-T), SG13 Study Group, including cloud computing recommendations (Y Series). ITU-T standards, etc.
National Institute of Standards and Technology (NIST) NIST is a U.S. Department of Commerce institute which focuses on scientific measurement and standardization. They have developed a numbers roadmaps, guidelines, and definitions through its SAJACC[21] and NCCP[22] initiatives. NIST standards, etc.
OMG Cloud Working Group Previously known as the Cloud Standards Customer Council (CSCC), OMG's Cloud Working Group (CWG) "publishes vendor-neutral guidance on important considerations for cloud computing adoption, highlighting standards, opportunities for standardization, cloud customer requirements, and best practices to foster an ecosystem of open, standards-based cloud computing technologies."[23] CWG standards, etc.
Open Grid Forum (OGF) The OGF is "an open global community committed to driving the rapid evolution and adoption of modern advanced applied distributed computing, including cloud, grid and associated storage, networking and workflow methods."[24] OGF standards, etc.
Organization for the Advancement of Structured Information Standards (OASIS) OASIS Open is a standards body that "offers projects—including open source projects—a path to standardization and de jure approval for reference in international policy and procurement."[25] OASIS Open standards, etc.
PCI Security Standards Council (PCI SSC) PCI SSC "is a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments worldwide."[26] PCI SSC Open standards, etc.
Storage Networking Industry Association (SNIA) SNIA develops and promotes "vendor-neutral architectures, standards, and educational services that facilitate the efficient management, movement, and security of information,"[27] including the Cloud Data Management Interface (CDMI) standard.[28] SNIA standards, etc.
The Open Group This organization attempts "to capture, clarify, and integrate current and emerging requirements, establish standards and policies, and share best practices."[29] Open Group standards, etc.
TM Forum This global alliance attempts "to collaboratively solve complex industry-wide challenges, deploy new services and create technology breakthroughs to accelerate change."[30] As a result of this collaboration, several technical documents and guides related to cloud computing have been developed. TM Forum standards, etc.

However, organizational standards, guidelines, and recommendations alone do not influence how cloud computing services can and should be implemented and operated. Regulatory bodies, legislative bodies, and government agencies also directly or indirectly have an impact on cloud service operations. In some cases, the law, regulation, or guidance coming from such bodies may not even mention "cloud computing," yet because they mandate how specific data and information can be managed, used, and distributed, they ultimately influence what a cloud service provider (CSP) does and how they do it. This can be observed by more than a few of the examples in Table 4. The California Consumer Privacy Act, for example, makes no mention of the word "cloud," but CSPs and cloud users alike must consider aspects of the regulation, e.g., what can and cannot be done with a consumer's information based on location of the stored information.[31]

Table 4. Examples of some common regulations, recommendations, and guidance that shape the proper use of cloud-computing platforms
Regulation, recommendation, or guidance Creator Description Link
California Consumer Privacy Act (CCPA) The State of California The CCPA "provides California consumers with a number of privacy protections, including right to access, delete, and opt-out of the 'sale' of their personal information."[32] Cloud solutions such as Google Cloud attempt to help users meet CCPA obligations, as well as meet their own commitments.[32] Link
Cloud Computing Regulatory Framework (CCRF) Kingdom of Saudi Arabia The KSA's CCRF "is based on international best practices and governs the rights and obligations of cloud service providers (CSPs), individual customers, government entities and businesses."[33] It is one of only a few existing cloud-specific regulatory frameworks created by a government.[33] Link
Cloud Security Principles Government of the United Kingdom The U.K. developed a collection of 14 Cloud Security Principles that "include important considerations such as protection of data in transit, supply chain security, identity and authentication, and secure use of cloud services."[34] This is an example of a national government developing a cloud-specific set of guidance for its public sector. Link
Federal Information Security Modernization Act of 2014 (FISMA) United States Government Amending the prior FISMA 2002, FISMA 2014 achieves several things, chief among them giving Federal government the ability to better respond to cybersecurity attacks on its departments and agencies. Compliance with FISMA means implementing "recommended information security controls for federal information systems as identified in the NIST SP 800-53."[35] Link
General Data Protection Regulation (GDPR) European Union The GDPR is a non-trivial regulatory hurdle with positive intentions, with the goal of strengthening personal data protection in Europe. The regulation "lays out specific requirements for businesses and organizations who are established in Europe or who serve users in Europe."[36] Cloud vendors like Google may stipulate in their contracts with European clients how they meet that guidance, as well as offer tools, documentation, and other resources to assist with assessment of the vendor's services.[36] Link
Guidance on Outsourcing to Cloud Service Providers Germany's Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) BaFin's Guidance document on cloud service outsourcing "provides specific outsourcing guidance for financial institutions on contractual terms, including information and audit rights, the right to issue instructions, data security / protection, termination and chain outsourcing."[37] Cloud vendors like Google may stipulate in their contracts with German clients how they meet that guidance.[37] Link
Health Insurance Portability and Accountability Act (HIPAA) United States Government The HIPAA Rules "establish important protections for individually identifiable health information ..., including limitations on uses and disclosures of such information, safeguards against inappropriate uses and disclosures, and individuals’ rights with respect to their health information."[38] HIPAA compliance is so vital for some organizations that U.S. government entities like the U.S. Department of Health & Human Services (HHS) have published their own guidance towards how HIPAA covered entities can best comply when using cloud services.[38] Link
Joint Statement: Security in a Cloud Computing Environment Federal Financial Institutions Examination Council (FFIEC) In this document, the FFIEC—an interagency group of federal and state banking regulators—addresses "the use of cloud computing services and security risk management principles in the financial services sector" and "highlights examples of risk management practices for a financial institution’s safe and sound use of cloud computing services and safeguards to protect customers’ sensitive information from risks that pose potential consumer harm."[39][40] Link
OMB Circular A-130, Managing Information as a Strategic Resource United States Government This (revised) Obama-era circular "establishes general policy for the planning, budgeting, governance, acquisition, and management of Federal information, personnel, equipment, funds, IT resources, and supporting infrastructure and services," including cloud services.[41] In addition to FISMA, this circular supports the FedRAMP program and its standardized security requirements.[16] Link
Personal Data Protection Law (KVKK) Government of Turkey Turkey's KVKK (Kişisel Verileri Koruma Kanunu) "regulates the protection of personal data and outlines the obligations that entities and individuals dealing with personal data must comply with."[42] It has significant relevancy to cloud computing efforts in the country.[43] Link
Protective Security Policy Framework Australian Government The PSPF "assists Australian Government entities to protect their people, information, and assets, both at home and overseas." It contains multiple statements about how cloud computing should be handled.[44] Link

While Big Tech was as early as 2010 asking the U.S. government to take a more proactive regulatory approach to cloud computing[45], actual direct regulation of cloud computing by the world's governments has been limited.[46][47] This leads to complicated viewpoints about the value of regulation vs. its drawbacks. Yes, careful regulation can help ensure consistent, affordable, and secure access to cloud services and may even encourage organizations to adopt the technology.[46] However, a headstrong approach to regulations for CSPs, without sector- and industry-specific considerations, may have unintended consequences, e.g., unduly raising compliance costs or forcing insufficient levels of access control on an entity.[46]

At least in the U.S., lawmakers and regulators may soon be pressured to increase regulatory approaches to cloud computing. This may be driven by the increasingly concentrated nature of cloud services in a handful of tech giants, though at the same time hampered by the widely varying approaches to addressing cloud-related issues via policy and regulation at the national and international levels. First, the very nature of these cloud services—and the ever increasing criticality they attain—as centralized services ensures the regulatory eye will increasingly be placed upon those cloud vendors. In fact, discussion about and designation of cloud services as critical infrastructure is already occurring in earnest, as they have "become essential to the performance of a growing swath of other sectors that have not heretofore been massively dependent on centralized cloud functionalities, and hence vulnerable to their disruption."[46][6] A 2023 Digital Forensic Research Lab report by Zuo et al. highlights this further by nodding to the U.S. government's designation of "critical infrastructure" sectors and how their loss would result in a "debilitating effect on security, national economic security, national public health or safety, or any combination of those matters." Their report argues that "the maturation of current [regulatory] policy tools, and creation of others," is vital going forward.[48] These and other such spotlights may lead to policymakers, regulatory bodies, and legislators being left with little choice but to move forward with more policy and regulation.

Second, and consequently, the development of such policy and regulation may not occur in a manner more unified with global perceptions but rather largely based upon localized values, interests, and priorities. The failure here is the lack of recognition of CSPs as being integral to individual, retail, corporate, organizational, and government operations around the globe[48], i.e. their centralized and concentrated position within a changing computing paradigm. As such, greater effort must be made by policymakers, regulators, and legislatures to find at least a minimum level of "compatibility and reconciliation" with other existing governance mechanisms, while carefully addressing both security of operation and operational robustness in tandem, such that there is greater harmonization globally.[46][48] And through government-level support of harmonized controls—as well as a vested interest in promoting the responsible "development, dissemination, and operation of cloud infrastructure"—cloud users will stand a greater chance of reaping the economic benefits of adopting cloud computing.[46]

Current and future regulatory action applies to several areas of cloud computing. How a CSP responds to and notifies affected users of a security breach is one concern. Up until 2022, the U.S. government didn't fully address in a unified fashion aspects of cloud security breaches such as protection obligations, reporting time, and required notification parties, nor any compensation mechanism for those affected.[49] (All U.S. states and most territories did already have their own flavor of breach notification legislation[50], but like cannabis law, this was problematic in the face of a strong divergence with federal law or lack thereof.) In March 2022, President Biden signed into law the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), which requires covered entities to report substantial cybersecurity incidents and any paid ransom for ransomware attacks, with more scope and definition to come.[51] While this addresses some of the prior-mentioned aspects, its thoroughness towards protection obligations and compensation remains lacking. A year later, however, cybersecurity thought leaders like Viakoo's CEO Bud Broomhead positively acknowledge CIRCIA as "not the destination ... but an important waypoint toward it," with other activities like the creation of the Joint Ransomware Task Forces and Ransomware Vulnerability Warning Pilot Program further promoting stronger federal efforts towards cloud security.[52]

Other areas of cloud security also face regulatory action. For example, the applications and algorithms that drive and collect data from users of cloud-enabled applications may also face regulatory scrutiny or control by a national government, as was seen with both China's and the U.S.'s scrutiny of the TikTok application, its algorithms, and its security.[46][53][54] Data localization also remains a significant area of cloud computing regulation, not just for security concerns but also industrial policy, economic policy, privacy concerns, and human rights concerns.[46] Other areas of concern that may see regulation include interoperability and portability, digital preservation (retention) obligations, and cross-border data transfer.

And then there's the proverbial "elephant in the room": overall data privacy and protection considerations in the cloud. This is a major concern typically because of statutes—like the California Consumer Privacy Act[32]—that broadly protect a collective of affected individuals and how their cloud data is collected, preserved, organized, stored, and used not only within the governing entity (e.g., state, country, political and economic union) but also as its transferred to and from the governing entity. The previously mentioned data localization and cross-border data transfer issues fall under this heading.[55] These often prove to be some of the most challenging regulations to develop, as lawmakers and regulators don't always anticipate the rate of change of technology. They're also difficult for CSPs and organizations to comply with, particularly due to the variance in requirements among all governing entities' laws.[55]

Other approaches to regulation also affect how cloud computing services are implemented and managed. For example, rather than taking a broad approach towards regulation, addressing everyone providing and/or using cloud services, it's possible that regulators and legislators may take a more focused, sector-based approach. But that comes with its own set of problems, as Maurer and Hinck noted in their 2020 Carnegie Endowment paper[6]:

[T]he impact of a cloud security incident usually depends on what type of data or service is affected. Thus, the most suitable potential regulatory requirements with respect to security may differ across sectors that deal with different types of data—from the highly sensitive, fast-moving data common in the financial sector to the more privacy-sensitive personal data used by medical service providers. However, crafting regulation on a sector-by-sector basis would likely create conflicting requirements and incomplete standards.

Finally, as a third option, rather than direct regulation of the broad market or even specific sectors, some governments may simply use their considerable weight to influence how CSPs provide their services, influencing future regulation, as Levite and Kalwani note in their 2020 paper for the Carnegie Endowment[46]:

Finally, some of the efforts to influence CSP behavior may not come through explicit regulation, but rather through exercise of the government’s market power. Cloud adoption strategies and trends in e-governance have made governments some of the largest and most important clients of CSPs. Governments will likely use their market clout and status as a large and powerful consumer as a source of leverage over industry to set standards of contracting fairness and other provisions that transcend the immediate cloud service contracts they enter. While formally these provisions will only apply to government contracts, they could over time cross over to public clouds as well, or at least help set precedents that drive regulatory attention and inform industry standards. Yet over the longer run, government privatization of many services might actually weaken their leverage, given lock-in issues. How the balance between the two parties ultimately will play out remains to be seen.

Whatever direction regulators and legislators continue take, it ideally will be done with thorough consideration of how to implement regulation, as well as the potential effects regulation will have on various markets.

  1. ↑ Mimecast (2010). "Cloud Computing Adoption Survey" (PDF). https://system.netsuite.com/core/media/media.nl?id=181214&c=601905&h=2ef3796f7c4d9c8a585e&_xt=.pdf. Retrieved 28 July 2023. 
  2. ↑ IEEE; Cloud Security Alliance (1 March 2010). "Survey by IEEE and Cloud Security Alliance Details Importance and Urgency of Cloud Computing Security Standards". Cloud Security Alliance. https://cloudsecurityalliance.org/press-releases/2010/03/01/survey-by-ieee-and-cloud-security-alliance-details-importance-and-urgency-of-cloud-computing-security-standards/. Retrieved 28 July 2023. 
  3. ↑ Bizga, A. (19 May 2020). "40% of IT professionals believe that public clouds are more secure than on-premise environments". Security Boulevard. https://securityboulevard.com/2020/05/40-of-it-professionals-believe-that-public-clouds-are-more-secure-than-on-premise-environments/. Retrieved 28 July 2023. 
  4. ↑ "Cloud is safer than on-premise say that majority of security leaders". Continuity Central. 4 September 2019. https://www.continuitycentral.com/index.php/news/technology/4384-cloud-is-safer-than-on-premise-say-that-majority-of-security-leaders. Retrieved 28 July 2023. 
  5. ↑ "Cloud Security Threats Remain Rampant: Check Point Survey Reveals Heightened Concerns for 76% of Organizations Amid 48% Increase in Cloud-Based Network Attacks". Check Point Software Technologies Ltd. 26 June 2023. https://www.checkpoint.com/press-releases/cloud-security-threats-remain-rampant-check-point-survey-reveals-heightened-concerns-for-76-of-organizations-amid-48-increase-in-cloud-based-network-attacks/. Retrieved 14 August 2023. 
  6. ↑ 6.0 6.1 6.2 Maurer, T.; Hinck, G. (31 August 2020). "Cloud Security: A Primer for Policymakers". Carnegie Endowment for International Peace. https://carnegieendowment.org/2020/08/31/cloud-security-primer-for-policymakers-pub-82597. Retrieved 28 July 2023. 
  7. ↑ "What is Cloud Security?". Resource Center. AO Kaspersky Lab. 2021. https://usa.kaspersky.com/resource-center/definitions/what-is-cloud-security. Retrieved 28 July 2023. 
  8. ↑ Sarrel, M. (4 February 2020). "Why cloud-native open source Kubernetes matters". enterprise.nxt. Hewlett Packard Enterprise. Archived from the original on 18 December 2022. https://web.archive.org/web/20221218143215/https://www.hpe.com/us/en/insights/articles/why-cloud-native-open-source-kubernetes-matters-2002.html. Retrieved 28 July 2023. 
  9. ↑ "IEEE 2301-2020 - IEEE Guide for Cloud Portability and Interoperability Profiles (CPIP)". IEEE Standards Association. 13 August 2020. https://standards.ieee.org/ieee/2301/5077/. Retrieved 28 July 2023. 
  10. ↑ Kirvan, P. (17 December 2020). "Top cloud compliance standards and how to use them". TechTarget SearchCompliance. Archived from the original on 21 December 2020. https://web.archive.org/web/20201221150028/https://searchcompliance.techtarget.com/tip/Top-cloud-compliance-standards-and-how-to-use-them. Retrieved 28 July 2023. 
  11. ↑ Simmon, E.D. (23 February 2018). "Evaluation of Cloud Computing Services Based on NIST SP 800-145". NIST. https://www.nist.gov/publications/evaluation-cloud-computing-services-based-nist-sp-800-145. Retrieved 28 July 2023. 
  12. ↑ "CSA Enterprise Architecture Reference Guide v2". Cloud Security Alliance. 2020. https://cloudsecurityalliance.org/artifacts/enterprise-architecture-reference-guide-v2/. Retrieved 28 July 2023. 
  13. ↑ "Ultimate Guide to G-Cloud". AdviceCloud. https://advice-cloud.co.uk/knowledge-hub/ultimate-guide-to-g-cloud/. Retrieved 28 July 2023. 
  14. ↑ "About DMTF". DMTF. https://www.dmtf.org/about. Retrieved 28 July 2023. 
  15. ↑ "About ETSI". European Telecommunications Standards Institute. https://www.etsi.org/about. Retrieved 28 July 2023. 
  16. ↑ 16.0 16.1 "FedRAMP". General Services Administration. https://www.fedramp.gov/. Retrieved 28 July 2023. 
  17. ↑ "Program Basics". General Services Administration. https://www.fedramp.gov/program-basics/. Retrieved 28 July 2023. 
  18. ↑ "IEEE Cloud Computing Standards Committee". IEEE Computer Society. https://www.computer.org/volunteering/boards-and-committees/standards-activities/committees/cloud. Retrieved 28 July 2023. 
  19. ↑ "ICS > 35: 35.210 Cloud Computing". International Organization for Standardization. https://www.iso.org/ics/35.210/x/. Retrieved 28 July 2023. 
  20. ↑ "About International Telecommunication Union (ITU)". International Telecommunication Union. https://www.itu.int/en/about/Pages/default.aspx. Retrieved 28 July 2023. 
  21. ↑ "Standards Acceleration to Jumpstart Adoption of Cloud Computing (SAJACC)". National Institute of Standards and Technology. 3 June 2018. https://www.nist.gov/itl/standards-acceleration-jumpstart-adoption-cloud-computing-sajacc. Retrieved 28 July 2023. 
  22. ↑ "NIST Cloud Computing Program - NCCP". National Institute of Standards and Technology. 9 July 2019. https://www.nist.gov/programs-projects/nist-cloud-computing-program-nccp. Retrieved 28 July 2023. 
  23. ↑ "Cloud Working Group". Object Management Group. https://www.omg.org/cloud/. Retrieved 28 July 2023. 
  24. ↑ "Open Grid Forum". Open Grid Forum. https://ogf.org/ogf/doku.html. Retrieved 28 July 2023. 
  25. ↑ "About Us". OASIS Open. https://www.oasis-open.org/org/. Retrieved 28 July 2023. 
  26. ↑ "About Us". PCI Security Standards Council. https://www.pcisecuritystandards.org/about_us/. Retrieved 28 July 2023. 
  27. ↑ "Vision and Mission". Storage Networking Industry Association. https://www.snia.org/about/vision-mission. Retrieved 28 July 2023. 
  28. ↑ "Standards Portfolio". Storage Networking Industry Association. https://www.snia.org/tech_activities/standards/curr_standards. Retrieved 28 July 2023. 
  29. ↑ "The Open Group". The Open Group. https://www.opengroup.org/. Retrieved 28 July 2023. 
  30. ↑ "About Us". TM Forum. https://www.tmforum.org/about-tm-forum/. Retrieved 28 July 2023. 
  31. ↑ "TITLE 1.81.5. California Consumer Privacy Act of 2018 [1798.100 - 1798.199.100"]. California Legislative Information. Legislative Counsel Bureau. https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5. Retrieved 28 July 2023. 
  32. ↑ 32.0 32.1 32.2 "California Consumer Privacy Act (CCPA)". Google Cloud. https://cloud.google.com/security/compliance/ccpa. Retrieved 28 July 2023. 
  33. ↑ 33.0 33.1 Guseyva, V. (18 September 2020). "Data residency laws by country: An overview". InCountry. https://incountry.com/blog/data-residency-laws-by-country-overview/. Retrieved 28 July 2023. 
  34. ↑ "NCSC - Cloud Security (UK)". Google Cloud. https://cloud.google.com/security/compliance/ncsc-uk. Retrieved 28 July 2023. 
  35. ↑ "What is the Difference between FISMA and FedRAMP?". PaloAlto Networks. 2021. https://www.paloaltonetworks.com/cyberpedia/difference-between-fisma-and-fedramp. Retrieved 28 July 2023. 
  36. ↑ 36.0 36.1 "Google Cloud & the General Data Protection Regulation (GDPR)". Google Cloud. https://cloud.google.com/privacy/gdpr. Retrieved 28 July 2023. 
  37. ↑ 37.0 37.1 "BaFin Cloud Outsourcing Guidance". Google Cloud. https://cloud.google.com/security/compliance/bafin. Retrieved 28 July 2023. 
  38. ↑ 38.0 38.1 Office for Civil Rights (24 November 2020). "Guidance on HIPAA & Cloud Computing". Health Information Privacy. U.S. Department of Health & Human Services. https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html. Retrieved 28 July 2023. 
  39. ↑ "Joint Statement: Security in a Cloud Computing Environment" (PDF). 30 April 2020. https://www.ffiec.gov/press/PDF/FFIEC_Cloud_Computing_Statement.pdf. Retrieved 28 July 2023. 
  40. ↑ Ross, S.; Scott, K. (6 May 2020). "US bank regulators issue cloud computing security guidance". Financial Services: Regulation Tomorrow. Norton Rose Fulbright. https://www.regulationtomorrow.com/us/us-bank-regulators-issue-cloud-computing-security-guidance/. Retrieved 28 July 2023. 
  41. ↑ "OMB Circular A-130, Managing Information as a Strategic Resource" (PDF). The White House. 28 July 2016. https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/OMB/circulars/a130/a130revised.pdf. Retrieved 28 July 2023. 
  42. ↑ Coos, A. (30 April 2020). "All You Need to Know About Turkey’s Personal Data Protection Law (KVKK)". Endpoint Protector Blog. https://www.endpointprotector.com/blog/everything-you-need-to-know-about-turkeys-personal-data-protection-law/. Retrieved 28 July 2023. 
  43. ↑ Ersoy, E.C.; Karakaş, M. (19 June 2020). "Cloud Computing Technologies and Its Legal Dimension". Kılınç Law and Consulting. https://www.kilinclaw.com.tr/en/cloud-computing-technologies-and-its-legal-dimension/. Retrieved 28 July 2023. 
  44. ↑ "The Protective Security Policy Framework". Australian Government. https://www.protectivesecurity.gov.au/. Retrieved 28 July 2023. 
  45. ↑ Alpern, P. (10 February 2010). "Microsoft to Congress: Time For New Cloud Computing Laws". IndustryWeek. https://www.industryweek.com/innovation/article/21932894/microsoft-to-congress-time-for-new-cloud-computing-laws. Retrieved 28 July 2023. 
  46. ↑ 46.0 46.1 46.2 46.3 46.4 46.5 46.6 46.7 46.8 Levite, A.; Kalwani, G. (9 November 2020). "Cloud Governance Challenges: A Survey of Policy and Regulatory Issues". Carnegie Endowment for International Peace. https://carnegieendowment.org/2020/11/09/cloud-governance-challenges-survey-of-policy-and-regulatory-issues-pub-83124. Retrieved 28 July 2023. 
  47. ↑ Ali, O.; Osmanaj, V. (2020). "The role of government regulations in the adoption of cloud computing: A case study of local government". Computer Law & Security Review 36: 105396. doi:10.1016/j.clsr.2020.105396. 
  48. ↑ 48.0 48.1 48.2 Zuo, T.; Sherman, J.; Hamin, M. et al. (10 July 2023). "Critical Infrastructure and the Cloud: Policy for Emerging Risk". DFRLab. https://dfrlab.org/2023/07/10/critical-infrastructure-and-the-cloud-policy-for-emerging-risk/. Retrieved 14 August 2023. 
  49. ↑ Mitnick, D. (10 April 2018). "No more waiting: It’s time for a federal data breach law in the U.S.". Access Now Blog. Access Now. https://www.accessnow.org/no-more-waiting-its-time-for-a-federal-data-breach-law-in-the-u-s/. Retrieved 28 July 2023. 
  50. ↑ "Security Breach Notification Laws". National Conference of State Legislatures. 17 January 2022. https://www.ncsl.org/technology-and-communication/security-breach-notification-laws. Retrieved 28 July 2023. 
  51. ↑ "Expansive Federal Breach Reporting Requirement Becomes Law". Ropes & Gray. 22 March 2022. https://www.ropesgray.com/en/newsroom/alerts/2022/march/expansive-federal-breach-reporting-requirement-becomes-law. Retrieved 14 August 2023. 
  52. ↑ Blair-Frasier, R. (31 March 2023). "Experts weigh in on CIRCIA one year later". Security Magazine. Archived from the original on 31 March 2023. https://web.archive.org/web/20230331233533/https://www.securitymagazine.com/articles/99138-experts-weigh-in-on-circia-one-year-later. Retrieved 14 August 2023. 
  53. ↑ Brandom, R. (2 September 2020). "Trump’s TikTok deal has hit a serious roadblock". The Verge. https://www.theverge.com/2020/9/2/21418496/tiktok-for-you-page-algorithm-deal-us-china-trump-microsoft. Retrieved 28 July 2023. 
  54. ↑ Cox, K. (10 February 2021). "Oracle’s TikTok acquisition reportedly “shelved” indefinitely". Ars Technica. https://arstechnica.com/tech-policy/2021/02/oracles-tiktok-acquisition-reportedly-shelved-indefinitely/. Retrieved 28 July 2023. 
  55. ↑ 55.0 55.1 Eustice, J.C. (2018). "Understand the intersection between data privacy laws and cloud computing". Legal Technology, Products, and Services. Thomson Reuters. https://legal.thomsonreuters.com/en/insights/articles/understanding-data-privacy-and-cloud-computing. Retrieved 28 July 2023. 
Retrieved from "https://www.limswiki.org/index.php?title=User:Shawndouglas/sandbox/sublevel16&oldid=52820"