4 ms·

That seems like a fairly reasonable thing given you're talking about encrypted PHI... it's some extra $ for a considerable reduction to overall attack surface w

That seems like a fairly reasonable thing given you're talking about encrypted PHI... it's some extra $ for a considerable reduction to overall attack surface when processing the most sensitive type of personal data. I don't think this meets OP's definition of "wrong".

harryh 10y ago
In practical terms I don't agree that the threat of someone doing all of the following things is worth worrying about (in comparison to many other more likely failures): 1) determine what physical hardware in aws the target is running code on 2) somehow get the aws virtual machine manager to let the attacker run their malicious code on the same hardware 3) somehow pierce the protections of the virtual machine to read memory being used by the target application 4) figure out how the data is stored in memory in order to make sense of anything that was read
- dragonwriter 10y ago
  > In practical terms I don't agree that the threat of someone doing all of the following things is worth worrying about In AWS case, this is an AWS rule about when they will sign a HIPAA BAA, even though there is no HIPAA regulation that specifically prohibits the arrangement at issue. AWS clearly thinks it is worth worrying about. When you run your own public cloud, you can determine what risks are worth accepting potential liability for.
  - harryh 10y ago
    Yes, I agree that Amazon is behaving perfectly rationally given the legal environment. My point is that the legal environment has been designed in an un-optimal way from a technical perspective. Identifying such a situation was rayiner's request.
    - dragonwriter 10y ago
      > Yes, I agree that Amazon is behaving perfectly rationally given the legal environment. I'm not commenting on Amazon's rationality (I haven't actually evaluated the security concerns that would determine that.) > My point is that the legal environment has been designed in an un-optimal way from a technical perspective. And you haven't pointed to anything in the legal environment that is suboptimal from a technical perspective. You haven't even pointed to anything in the legal environment at all. Amazon (as a BAA) has certain administrative responsibilities for putting administrative and technical safeguards in place to prevent breaches, and certain obligations and liabilities in the case of breaches. HIPAA and related laws and regulations do not specify the specific administrative or technical safeguards, though they do specify areas that must be addressed. Amazon has decided that the particular technical arrangement you prefer is too high of a risk, but you haven't pointed out anything that indicates that this is the result of an outdated regulation that results in poor technical choices rather than technology-neutral regulation and a reasonable evaluation of the security concerns of the particular technical arrangement you would prefer.
- Spooky23 10y ago
  People said the same thing about cold boot attavks against encryption keys. Yet today the police and others are using that and other NAND attacks regularly. HIPPA is a very easy compliance standard to meet. If it seems difficult to meet those requirements with your standard tool configurations, you should think about what that means with respect to the integrity of your data.
  - dogma1138 10y ago
    I would like to see a case of a cold boot attack by the police.
    - Spooky23 10y ago
      Memory forensics is a thing. Google around with terms like forensics and "Volatility" or "Volatility toolkit" and you should find some presentations and other references.
      - dogma1138 10y ago
        I know what memory forensics is and I use Volatility and Second Look and quite a few other things pretty often, I've asked specifically about an instance of cold boot attack that you claimed in a hyperbole that are used often or at all by the police. You know what I don't need a case, please find me a jurisdiction in which cold boot attacks have passed forensic certification, e.g. a link to the process like for example from a body equivalent to the ASTM https://www.astm.org/Standards/forensic-science-standards.html#E30.12 https://www.astm.org/Standards/forensic-science-standards.ht... would suffice.

harryh 10y ago

In practical terms I don't agree that the threat of someone doing all of the following things is worth worrying about (in comparison to many other more likely failures): 1) determine what physical hardware in aws the target is running code on 2) somehow get the aws virtual machine manager to let the attacker run their malicious code on the same hardware 3) somehow pierce the protections of the virtual machine to read memory being used by the target application 4) figure out how the data is stored in memory in order to make sense of anything that was read

dragonwriter 10y ago
> In practical terms I don't agree that the threat of someone doing all of the following things is worth worrying about In AWS case, this is an AWS rule about when they will sign a HIPAA BAA, even though there is no HIPAA regulation that specifically prohibits the arrangement at issue. AWS clearly thinks it is worth worrying about. When you run your own public cloud, you can determine what risks are worth accepting potential liability for.
- harryh 10y ago
  Yes, I agree that Amazon is behaving perfectly rationally given the legal environment. My point is that the legal environment has been designed in an un-optimal way from a technical perspective. Identifying such a situation was rayiner's request.
  - dragonwriter 10y ago
    > Yes, I agree that Amazon is behaving perfectly rationally given the legal environment. I'm not commenting on Amazon's rationality (I haven't actually evaluated the security concerns that would determine that.) > My point is that the legal environment has been designed in an un-optimal way from a technical perspective. And you haven't pointed to anything in the legal environment that is suboptimal from a technical perspective. You haven't even pointed to anything in the legal environment at all. Amazon (as a BAA) has certain administrative responsibilities for putting administrative and technical safeguards in place to prevent breaches, and certain obligations and liabilities in the case of breaches. HIPAA and related laws and regulations do not specify the specific administrative or technical safeguards, though they do specify areas that must be addressed. Amazon has decided that the particular technical arrangement you prefer is too high of a risk, but you haven't pointed out anything that indicates that this is the result of an outdated regulation that results in poor technical choices rather than technology-neutral regulation and a reasonable evaluation of the security concerns of the particular technical arrangement you would prefer.
Spooky23 10y ago
People said the same thing about cold boot attavks against encryption keys. Yet today the police and others are using that and other NAND attacks regularly. HIPPA is a very easy compliance standard to meet. If it seems difficult to meet those requirements with your standard tool configurations, you should think about what that means with respect to the integrity of your data.
- dogma1138 10y ago
  I would like to see a case of a cold boot attack by the police.
  - Spooky23 10y ago
    Memory forensics is a thing. Google around with terms like forensics and "Volatility" or "Volatility toolkit" and you should find some presentations and other references.
    - dogma1138 10y ago
      I know what memory forensics is and I use Volatility and Second Look and quite a few other things pretty often, I've asked specifically about an instance of cold boot attack that you claimed in a hyperbole that are used often or at all by the police. You know what I don't need a case, please find me a jurisdiction in which cold boot attacks have passed forensic certification, e.g. a link to the process like for example from a body equivalent to the ASTM https://www.astm.org/Standards/forensic-science-standards.html#E30.12 https://www.astm.org/Standards/forensic-science-standards.ht... would suffice.