In just a few years, a vast majority of organizations will rely on cloud computing. Large cloud services will have tens of millions of end users. What happens if one of those cloud services fails or is hacked?
“From a security perspective, data concentration is a double-edged sword. Large providers can offer state-of-the-art security and business continuity by spreading costs across a large number of customers. However, if a service disruption or security breach were to occur, the impact would be much greater, affecting a large number of organizations and individuals,” says Dr. Marnix Dekker.
In recent years, there have been numerous examples of failures affecting large websites with millions of users (for example, the service disruption caused by the leap year programming error). This report examines these threats from the perspective of Critical Information Infrastructure Protection (CIIP); that is, it examines how to prevent large-scale cyber disruptions and cyberattacks.
The report's key takeaways are:
• Critical infrastructure: Very soon, the vast majority of organizations will be using cloud computing, including critical sectors such as finance, energy, and transportation. Cloud services themselves are becoming critical information infrastructure.
• Natural disasters or (distributed) denial-of-service (DDoS) attacks: One of the advantages of cloud computing is its high resilience to natural disasters and (distributed) denial-of-service (DDoS) attacks, which are difficult to mitigate using traditional approaches (on-premises servers or individual data centers).
• Cyberattacks: Due to the high concentration of users and data, cyberattacks that exploit software vulnerabilities can cause breaches affecting millions of users. Physical redundancy offers no protection against cyberattacks such as data breaches that exploit software weaknesses.
The report also provides nine recommendations for bodies responsible for critical information infrastructure. Key points include: incorporating extensive cloud services into national risk assessments, tracking cloud dependencies, and working closely with providers on incident reporting programs.
ENISA Executive Director Professor Udo Helmbrecht said: “Cloud computing is a reality, and we must therefore be prepared to prevent service outages and cyberattacks on cloud services. The European Cybersecurity and Cloud Computing Strategies provide a roadmap for this.”
ENISA will launch a new working group focusing on Critical Information Infrastructure Protection (CIIP) and government cloud security.
full
report and recommendations: enisa.europa.eu/activities/Resilience-and-CIIP/cloud-computing/critical-cloud-computing/
Context: Commission Action Plan on the Protection of Critical Information Infrastructures (CIIP)
, EU Cybersecurity Strategy
