Cybersecurity Risks in Cloud Trust Relationships: Lessons from the Adobe Cyberattack and Regulatory Developments in Europe

 

On this website, Google uses specific Blogger and Google cookies, including those for Google Analytics and AdSense, as well as other data collected by Google.

 

🛡️Dear #Network, I would like to share a few thoughts on the impact of cyberattacks on law, especially in the cloud.

✏️Cloud trust relationships between providers and users have been exploited in cyberattacks. One of the most well-known examples is the Adobe Cyberattack in 2013.

2013 Adobe Cyberattack: Hackers stole personal data from 38 million Adobe users, including usernames, encrypted passwords, credit card details, and software code. This exposed security flaws, prompting authorities in 15 U.S. states to accuse Adobe of failing to protect customer data. Adobe agreed to pay $1 million in a legal settlement. As part of the deal, the company promised to improve security measures to prevent similar breaches in the future. The attack highlighted cybersecurity risks, especially as Adobe shifted to cloud-based services. In response, the company enhanced security with better encryption, multifactor authentication, has set up new Intruder Detection System (IDS) and Intruder prevention system, improved cloud security, improved infrastructure for clouds, and awareness programs.

✏️Cyberattacks have exploited trusted cloud relationships, driving the need to increase trust in cloud providers, strengthen control over how they access data, and ensure data remains localized, which has influenced cloud security laws.

✏️Compliance with EU regulations is mandatory for placing products on the market in Europe.

✏️Several key regulations shape cloud security in Europe. One major development is the Network and Information Security Directive (NIS), which has been updated to NIS-2. This directive aims to establish a high, common level of cybersecurity across EU Member States and mandates mandatory certifications for specific entities using cloud services, particularly those deemed "essential" or "important" within critical sectors. However, not all cloud service providers are required to be certified.

In addition to the sectors previously covered by NIS 1—such as energy, transport, healthcare, finance, water management, and digital infrastructure—the new rules also apply to:

🌀 Providers of public electronic communications

🌀 Digital services (such as social media platforms)

🌀 Waste and wastewater management

🌀 Critical product manufacturing

🌀 Postal and courier services

🌀 Public administration at both central and regional levels

🌀 Space sector

Medium-sized and large entities in these critical sectors must implement appropriate cybersecurity risk-management measures and notify national authorities about significant incidents that could cause major disruptions or damage. More details: NIS-2 Directive.

✏️The European Cybersecurity Certification Scheme for Cloud Services (EUCS) introduces risk-based certification levels. The EUCS scheme aligns with:

🌀 The NIS-2 Directive

🌀 The proposed EU Cyber Resilience Act, which focuses on product security The Cyber Resilience Act (CRA) defines "products with digital elements." The scope includes all digital products—"products with digital elements"—a broadly defined category.