Cloud Compliance in 2022

This is the second in our series of 2022 trends. Last week we covered employee information management trends for 2022. This week we look at the trends for cloud compliance in 2022. 

Compliance – which in our context is specifically cybersecurity compliance – continues to be the way in which cybersecurity is managed and measured in modern IT. This is especially true is cloud services, where compliance standards have been an enabler to cloud growth. Cyber compliance standards like HIPAA, PCI DSS, NIST, and ISO 27001, help set the standards that businesses can use when evaluating how secure the cloud services are that they are evaluating and purchasing. 

As the nature of cybersecurity attacks change, so too do the standards for cybersecurity compliance. This leads to our big trends in cloud compliance for 2022. 

1. Companies Will More Broadly Apply CMMC to Their Non-Federal Clouds 

We discussed Cybersecurity Maturity Model Certification (CMMC) in a post a couple of weeks ago. This measurement standard from the Federal government will continue to expand into and provide influence over cybersecurity in the private sector. 

CMMC incorporates NIST SP 800-171 standards and provides a convenient five-level maturity measure. This type of measure has been used in IT in the past with the Capability Maturity Model (CMM) which was used by many CIOs in the early 2000s to measure their path toward better IT process and service orientation. 

With the recent announcement of CMMC 2.0, and with the prevalent knowledge of consultants that can lead IT organizations down the path of better cybersecurity, 2022 looks to be the year that CMMC measurement and reporting of the cloud becomes commonplace. 

2. Private-Public Hybrid Cloud Models Will Add Compliance Nuance 

In 2022, more companies will generate more of their data in the public cloud. Many of those companies will have policies to move portions of that data to their private cloud within defined periods of time. Which data is moved and when and where will continue to be a compliance challenge both for security as well as privacy. As compliance rules shift – like frequency of vulnerability scanning – companies that maintain hybrid clouds will need to update their procedures in both private and public contexts as well as the reporting for audits. Enforcement of data-related policies such as right to erase personal data will increase  

 3. Multi-cloud Application Compliance Will Become More Complex to Track  

When companies implement applications in a cloud today, they mostly isolate each application in one cloud – typically called hybrid cloud. Multi-cloud applications span more than one cloud and are increasing in popularity as different cloud vendors develop specialized and unique services. In 2022, more companies than ever will be using multiple clouds for a single application. 

For instance, maybe you develop a customer relationship management application for your sales team. You might store customer phone numbers in one cloud because their database service has privacy protections built-in, but you use a slick emailing app from another cloud that is easy to implement and extend. When emails and first names are temporarily stored in the second cloud, there becomes a second location for personally identifiable information (PII) to reside. Privacy policy understanding and enforcement is needed in both clouds, but without a rather technical review of each component of the application, this can be missed. 

Compliance audits and policy enforcement will need to get increasingly into the “weeds” on each application to understand where the cyber-risks are and how cyber-compliance policies apply. 

4. Compliance Ownership When Using Cloud-native Services Will Shift 

All the major clouds – AWS, Azure, GCP, IBM – have co-management models for cloud compliance, but the policies are mostly utilized for first-gen cloud technologies like virtual machines. The differences in co-management of cloud compliance with cloud-native services have been treated as a special case by cloud providers. In 2022, the prevalent usage of cloud-native services will make it necessary for cloud providers to address the ambiguities of cloud compliance responsibilities that these services create. 

For example, with virtual machine implementations, responsibility for user credentials is clearly on the side of the customer. With cloud-native services, though, user credentials are exposed as they are used to access various services and/or are passed between services. How the user credentials are being handled by the cloud provider becomes important for compliance and security purposes for the cloud customer. 

What do you think about cloud compliance in 2022? What are your big concerns for the upcoming year? Let us know what you think at info@montra.io.

Tis the Season for Cyberthreats: 3 Ways to Keep Your Device Secure Over Turkey

It’s that time of year for travel, visiting family, eating too much, and rushing around for last-minute errands and gifts. It is a hectic and wonderful time but if you are like me, it is also when you are trying to fit work into different locations, times, and levels of sobriety.  

It is easy to be distracted in this season. Cyber attackers know this and you should be rightfully concerned. 

Here are a few ways to keep you and your devices safe as you find yourself in new workplaces during the holidays. 

1. Watch Where and How You Connect 

Whether you are connecting on your parents’ wifi or from the closest Panera, you will be connecting differently and probably less securely than your normal home office. If your mom’s wifi doesn’t have “one of those silly passwords”, then you need to protect your presence on that connection: 

 

  • If your company has a VPN, you should use it. Or consider a paid VPN service. 
  • Keep your laptop firewall always running. Windows and Mac both have this built-in. 
  • Set yourself in stealth mode if you can. 
  • Make sure you have updated antivirus (AV) or endpoint detect and respond (EDR) software installed 
  • On your mobile device, use a security app like what AT&T and Verizon provide for free. 
  • If you want to be the safest, skip the wifi and tether your laptop to your phone with security app running.  

If you follow these basic steps, you should be safe at your closest coffee shop to “get some work done” while enjoying some peace and quiet.  

2. Think About How You Are Mixing Your Work and Personal Tasks 

You are going to be doing a lot more personal tasks on your laptop than you normally do. This could lead to exposure on shopping sites, gaming sites, or elsewhere, which opens you to new threats. Be mindful of where that search for “adult sized Elf costume” or “Thanksgiving movies on Netflix” is taking you. Also keep in mind that if you are connected to your company VPN, you are traversing company property and are subject to their acceptable use policy. Tread carefully. 

To help keep your focus, you might consider using one browser for your personal stuff and one for your work. Or if your browser supports tab groups, you can group your personal and work tabs separately. If you keep your screen organized, you are less likely to be confused by a popup or email request that is really a phishing attempt. 

3. Be Aware of Who is Using Your Device 

It’s easy to leave your laptop open on the table after you’ve found that recipe for leftover turkey melts. While you are searching your mom’s fridge for gruyere, your weird Uncle Steve might ask to “check his fantasy team.” You and your uncle might have a different idea of what a fantasy team is, and you could get the leftover spyware and bloatware that his surfing has put on your laptop. 

A few items to help you with your potentially “over-shared” device: 

  • Make certain your device quickly locks when not in use. This is easy on phones, but on laptops you may want to set it to the minimum setting for the holidays. 
  • Close your devices and put them away if you won’t be using them for a while. Not that anyone is going to do anything to them, but gravy in the keyboard is just as problematic as privacy loss. 
  • If your device is running the Jackbox game or your phone someone got volunteered to play Heads Up!. Just make certain that you get it back at the end of the game. It is easy after a few glasses of wine to forget that your work laptop with all your year-end data is still sitting by the fire when midnight rolls around. 

 So while your uncle or cousin may not be trying to hack your device themselves, they are not going to be as concerned as you about what sites they visit and what fun new games they download. It is the season of giving, but I think you should be a bit selfish with your devices. 

Stay safe and stay private this holiday season!