Regulatory attention to note – the Biden administration is focusing on cloud security. Per reporting in Politico, the White House is, quote, embarking on the nation’s first comprehensive plan to regulate the security practices of cloud providers like Amazon, Microsoft, Google, and Oracle, whose servers provide data storage and computing power for customers ranging from mom-and-pop businesses to the Pentagon and CIA.
The cloud has “become essential to our daily lives,” Kemba Walden, the acting national cyber director, said in an interview. “If it’s disrupted, it could create large potentially catastrophic disruptions to our economy and to our government.”
And I am further quoting.
The Biden administration recently said it would require cloud providers to verify the identity of their users to prevent foreign hackers from renting space on U.S. cloud servers (implementing an idea first introduced in a Trump administration executive order). And last week, the administration warned in its national cybersecurity strategy that more cloud regulations are coming — saying it plans to identify and close regulatory gaps over the industry.
The strategy and budget office is racing to find new ways to police the industry using a ‘hodgepodge’ of existing tools, such as security requirements for specific sectors — like banking — and a program called FedRAMP that establishes baseline controls cloud providers must meet to sell to the federal government.
This is sensible because, just like other utilities may be regulated even if private, with cloud infrastructure literally including infrastructure in its name, there is a prominent area for the government. Healthy debates are to be had over where the guard rails are, but make no mistake… it’s infrastructure.
Identity seems to be a core construct here, and that’s logical. Let’s solve the bulk case with identity and figure out the edge cases as needed.