HEAD IN THE CLOUD — As the White House races to plug porous cyber defenses everywhere from hospitals to power stations, it is finally setting its sights on the cloud providers, as I reported this weekend. In doing so, the White House is seeking to narrow the growing chasm between the immense power that companies like Microsoft, Amazon, Google and Oracle wield over the country’s digital fortunes — and what few tools the government has to ensure their cybersecurity practices keep more than their own pocketbooks in mind. “We're now at a point where we're not talking about something that is growing but something that is absolutely critical to the U.S. economy,” Rob Knake, deputy national cyber director for strategy and budget, told me. “And so therefore, [the cloud] needs to have a regulatory structure around it.” Same theme, different problems — Behind the push to regulate the cloud industry is not one goal, but three, Knake and staff in the Office of the National Cyber Director told POLITICO during exclusive conversations over the last three weeks. First, the government wants more help from the cloud providers to prevent criminal and nation-state hackers from abusing their services to stage attacks within the U.S. — an issue MC highlighted two weeks ago. Second, White House officials view the cloud providers as the most efficient way to fast-track enhanced security to mom-and-pop businesses and under-resourced government agencies across the country, even as they worry that cloud giants often upcharge customers for security products. Above all, there is increasing concern within the White House that the U.S. economy is growing too reliant on a small number of companies whose risk management processes no one — at least not anyone outside the companies — seems to have much insight into. Catch-22 — The White House has only a hodgepodge of tools to throw at those problems, Knake said. Moreover, solving one problem can come at the expense of another. For example, pushing companies and government agencies to migrate to the cloud can rapidly improve the country’s short-term security posture, Kemba Walden, acting national cyber director told me. But it risks exacerbating the long-term dependency problem the White House is concerned about. Moving to the cloud can “take a lot of the security burden off of end users,” Walden said. But, she cautioned, “if we're going to do this … if migrating to the cloud is a good idea, then we have to make sure that cloud doesn't fail.” About that failure — It's the collapse of a major cloud provider that seems to most worry the White House. It’s also the problem the government seems furthest from addressing. A 2018 study from the insurance giant Lloyd’s assessed that a three-to-six-day outage at one of the top three cloud providers could cause $15 billion in damages in the U.S. The risk has undoubtedly grown since then, though no one has a firm grasp on the scale of the problem — or what companies are doing to address it. In a study last month, the Treasury Department warned that banks and regulators were unable to assess “the significance of the concentration in cloud services across the sector” due to inadequate transparency from the cloud providers. “Even if we assume that [their security] was just perfect … We need to know that they're doing that right,” said Knake. “If a major provider goes down and our critical infrastructure depended on it, that's a problem.” Betting on yourself — In the coming months, Walden, Knake and ONCD staff will undertake a study of how best to resolve these problems. And while they have no illusions about the difficulty of the task ahead, it’s clear the stakes are high not just for the cloud providers but for the office that wants to regulate them. The cloud is “quite central to our strategy,” said Walden, in reference to the administration’s just-released National Cybersecurity Strategy. “It's not the only constituency that's central to our strategy,” she qualified, “but it is one of the most important.”
| 
No comments:
Post a Comment