Cloud computing: Now as vital as power, transport and fresh water?
Video: Multi-cloud considered the foundation of digital efficiency
Cloud computing, search engines, and the services that underpin the internet are to be considered to be part of the UK's vital infrastructure, alongside clean water and power, under new rules aimed at boosting cybersecurity.
Under the European Union's Network and Information Systems (NIS) directive, businesses that provide essential services will have to make sure their security is good enough to protect their network and information systems from attack, as well as having to notify the relevant authorities of serious incidents.
The regulations apply to critical national infrastructure -- those basic services without which society will gradually grind to a halt.
These include healthcare, airlines, airports and air traffic control, ports, local and national rail networks, and road transport authorities. It also covers the supply and distribution of drinking water; electricity sale, distribution and transmission; oil production, refining and treatment; and gas supply, storage, sales, and distribution.
The most eye-catching feature of the guidance published by the UK government is the threat of fines -- up to £17m -- for companies that suffer a breach and are shown to have failed to have put effective cybersecurity measures in place. But perhaps more interesting is the recognition that cloud computing and other digital services are now considered essentials too.
That's because directive also covers a number of digital services, and requires top level domain (TLD) name registries, domain name services (DNS) and internet exchange point (IXP) operators to comply.
Cloud computing services providers, online marketplaces, and search engines will be covered by the NIS directive, although regulation is lighter, as regulation and enforcement can only be applied after an incident, and companies with fewer than 50 staff or an annual turnover of less than €10m are excluded.
Free download: Cloud migration decision tool
A number of responses to a consultation on the directive had said that software as a service should be excluded, but the government responded: "Software-as-a-service providers play an important role in the UK's economy and it is right that they are held responsible for ensuring the security of their network and information systems."
What happens if the cloud goes down?
The government defines cloud computing services as something that enables access to a scalable and elastic pool of shareable physical or virtual resources, which can include infrastructure as a service, platform as a service, and software as a service. However, this does not include most online gaming, entertainment, or VoIP services, as the resources available to the user are not scalable, but may include services such as email or online storage providers, where the resources are scaleable.
While the NIS directive, due to become part of UK law in May, has emerged from Europe, Brexit is unlikely to derail it. The government said that on exit from the European Union these policy provisions will continue to apply in the UK.
The UK's National Cyber Security Centre (NCSC) has published detailed guidance on the security measures to help organisations comply.
As usage of cloud services increases, there is also a growing awareness of the problems that could occur if cloud services experienced significant downtime. A recent report showed that an extended outage at one of the major cloud computing providers could have an impact on customers running into the billions of dollars, reflecting how reliant the economy has become on a small set of providers. The report from insurance market Lloyd's warned that an incident which took a top cloud provider offline in the US for three to six days could cause $15bn worth of damage to industry.
RECENT AND RELATED COVERAGE
Cloud computing: What it's like to make the move
Cloud computing customers on why they made the migration and what companies following in their footsteps should, and should not, do.
Cloud computing spending is growing even faster than expected
Most new features are being offered by vendors as cloud services only.
Cloud computing: How to build a business case
When planning a migration to the cloud, what do you need to take into account?
Why multi-cloud will become the new standard in 2018 (TechRepublic)
Cloudify CTO Nati Shalom forecasts the future of cloud tech and explains how multi-cloud solutions help enterprise companies scale operations and comply with local regulations.
READ MORE ON CLOUD COMPUTING
- Three smart cloud services that can help keep your business more secure
- Public cloud, private cloud, or hybrid cloud: What's the difference?
- What does 'hybrid cloud' mean? It depends on whom you ask
- Infographic: Companies are turning to hybrid cloud to save money
- Businesses will spend $128 billion on public cloud this year, says IDC
- Cloud computing security: This is where you'll be spending the money
- Top 5: Books about cloud computing (TechRepublic)