Beltug has joined forces with our Dutch sister organisation CIO Platform Nederland, other communities across Germany, France, the EU, and the US, and over 30 organisations in urging Big Tech companies to improve global cyber security by implementing baseline cloud security controls as a default. If you are interested in signing the document, you can download it below and then return it to Beltug once signed.
02 / 09 / 24
The call to action was initiated by Freddy Dezeure, an independent strategic advisor and former head of the EU’s CERT-EU, Lokke Moerel, professor of Global ICT Law at Tilburg University, and George Webster, CEO of a stealth startup and former Chief Security Architect at HSBC. Their efforts date back to 2022, when Moerel published an article on Europe’s digital sovereignty. Since then, they have continued to advocate for Big Tech to take responsibility for ‘cloud security by default’. You can find more information on the manifesto, supporting organisations, and related publications and events on the ‘Cloud Security by default’ webpage.
The current state of cloud security is flawed, with cyber criminals thriving. The three believe Big Tech has the potential to enhance global cyber resilience, given that the existing system, which relies on customers to secure their configurations, is broken. This has led to widespread misconfigurations, making our infrastructure insecure by default, and creating a booming market for cyber criminals and security vendors alike.
Dezeure, Moerel and Webster acknowledge the challenges of their proposal, including the possibility of pushback, the need for Big Tech to invest while facing reduced revenue, and the potential legal implications. However, they argue that implementing baseline cloud security by default will significantly improve security, despite some imperfections.
With ‘cloud security by default’, systems, software and networks are configured with essential security controls from the start. The authors recommend default settings such as DMARC, strong TLS protocols, AV/EDR protection, removal of default admin passwords, automated patching, and more. They call for a review of the entire user infrastructure suite, covering office automation, identity management, networking, data encryption and more.
There is already extensive guidance available on secure baseline controls, such as from the Centre for Cyber Security Belgium (CCB), which aims to make Belgium one of the least vulnerable countries.
Beltug supports this mobilisation effort, and calls on major cloud providers to implement baseline cloud security by default across their entire customer infrastructure, while also advocating for backing from the EU and US governments.
If you are interested in signing the document, you can download it above and then return it to Beltug once signed.