5 ms·

If you are handling data that is subject to national regulations concerning personal data (e.g., health care) using a cloud provider for all your needs is risky

If you are handling data that is subject to national regulations concerning personal data (e.g., health care) using a cloud provider for all your needs is risky and might not be legal. If you use one of the big-name (and therefore affordable) providers such as Amazon, your data may very well fall under America's Patriot Act — there is a lot of legal uncertainty about this. If I go with a local party instead, there is also no guarantee that this company in turn won't branch out to the US, or get bought up by an American company, again putting citizen's private data in reach of (in my case) foreign governments.

rcarmo 10y ago
Erm, no. All major cloud providers have clear statements regarding data sovereignty, compliance and whatnot. There is no uncertainty, only lack of awareness (but I'll freely grant that it is not a simple matter). Look for the equivalent of https://www.microsoft.com/en-us/TrustCenter/Transparency#Transparent https://www.microsoft.com/en-us/TrustCenter/Transparency#Tra... (Full disclosure: I work at Microsoft)
- eveningcoffee 10y ago
  Sorry but, I am afraid that this train has already left the station.
- thinkMOAR 10y ago
  So just because mickeysoft and other 'major' clouds providers as you say, have some certificates and a webpage where it says to play nice it's all good? Wow...
- cyberpunk 10y ago
  Do you honesty believe that? Maybe I'm too cynical these days, but I find it pretty laughable that a statement regarding 'data sovereignty' has any real meaning at all these days. Unless you control the hardware, you have no idea what the hypervisors are doing on your rented vm's. The idea that national actors don't / wouldn't pull anything they want from them seems comically naive to me. Christ, we can barely trust our own hardware anymore with backdoored firmware crap, IME and such.. Realistically though, most companies don't care so it's not a problem if you keep the blinkers on; their compliance folks just want the document which says it's not happening and they'll never know when it does so who cares. Their ops folks can barely use the APIs probably, let alone contemplate the impact of someone reading the memory of my databases from the hypervisors. As an individual and someone who cares for my data or that of my clients though, that's not enough for me, and I'd never trust tnese folks with any data, only mindless compute and serving public content...
  - kesor 10y ago
    Don't you share this data over networks from time to time? Is all your data siloed and bolted down to one place never to move anywhere? How do you trust the data to not take a hike in some random direction you don't fully trust?
    - cryptarch 10y ago
      By encrypting anything you transmit over the Internet?
      - arpa 10y ago
        and anything you have on hardware you don't own. And on hardware you own.
    - cyberpunk 10y ago
      Well, depends on the data. Most things are CRUD; Current gig is a load of on-prem DBs' -- AWS boxes might hit an API in one of the datacentres which can query it for a given user, I think there's a difference between using AWS to serve HTTPS vs Hosting the whole db there (this is marketing/tracking data) It's the difference between AWS/USGVT being able to decrypt a HTTP convo to a specifc user after we've combined a lot of data and having access to all 200TB of it..
    - kkapelon 10y ago
      Let's say that I am a pharma company. Q. Don't you share this data over networks from time to time? A. Hell no. Q. Is all your data siloed and bolted down to one place never to move anywhere A. Yes that is the plan actually. Q. How do you trust the data to not take a hike in some random direction you don't fully trust A. Easy, it never gets out of my data center. An IT director that works in a pharma company, will simply laugh after reading the "don't build private clouds" article
- iuguy 10y ago
  Clear statements are not forms of assurance. A policy does not stop packets, unless it's a physical firewall ruleset.
- yq 10y ago
  Just few things happened recently related to data on cloud. 1> Google deleted People's account who bought Pixel from reseller. They have to beg google to restore their data, contacts. Not going to happened if you have it in your own cloud. 2> Windows 10 is full of telemetry. Imagine someone knows exactly what software you used, when you used it, for how long. Advertisement are built-in with system level. You don't own your machine anymore, Windows 10 can decide when it want to upgrade itself then lock you out from using it for hours. Your data now is in Microsoft's cloud, but you don't decide how they can use it, who they are going to sell to. For depository reason? Sure of course, cloud is reliable on up time, expandable with a few click. But if Cloud provider decided to wipe the account with whatever reason, what you are going to do?
  - kesor 10y ago
    If a cellular network, or a power-grid provider decided to foreclose your accounts. What are you going to do?
    - arpa 10y ago
      The difference is that i can build my own email server, file server, web server, and so can you. The internet needn't be in the hands of powerful few.
      - RamenJunkie_ 10y ago
        You can also build your own power to some level, with solar and wind.
        arpa 10y ago
        Not enough to power my mail & web server and an electric kettle, unfortunately, where I live, especially during winter months (~2-3kWh / day, when electricity is most needed). It's more viable to use diesel generator if i were thinking of going off-grid. To go on further minimizing dependency on something that isn't readily available, i'd probably go with gasoline engine generator equipped with wood gasifier [1]. Green power, unfortunately, is no libertarians dream - it only works when you can scale - that is, basically, if you're state-level actor. [1] https://en.wikipedia.org/wiki/Wood_gas https://en.wikipedia.org/wiki/Wood_gas
- dozzie 10y ago
  Uhm... And why would we actually believe Microsoft about that? They have screwed their customers numerous times already, and they were more than happy to cooperate with NSA.
- rcarmo 10y ago
  Wow. I got downvoted for being straightforward and transparent?
  - Freak_NL 10y ago
    You probably got downvoted because of the antagonistic wording of your post: > Erm, no. That can come across as a rude way to disagree with someone (it does to me). > There is no uncertainty, only lack of awareness […] That's dismissive (it reads as “you are not uncertain about this matter, you just think you are”) and not very helpful either.
dancek 10y ago
Yes. We were building a website for a bank and wanted to put some services in the cloud (after all, the online banking system was completely separate). The security team of the bank was originally very opposed to the idea. It's been a while so I don't remember the specifics, but we did eventually have some but not all parts in the cloud.

rcarmo 10y ago

Erm, no. All major cloud providers have clear statements regarding data sovereignty, compliance and whatnot. There is no uncertainty, only lack of awareness (but I'll freely grant that it is not a simple matter). Look for the equivalent of https://www.microsoft.com/en-us/TrustCenter/Transparency#Transparent https://www.microsoft.com/en-us/TrustCenter/Transparency#Tra... (Full disclosure: I work at Microsoft)

eveningcoffee 10y ago
Sorry but, I am afraid that this train has already left the station.
thinkMOAR 10y ago
So just because mickeysoft and other 'major' clouds providers as you say, have some certificates and a webpage where it says to play nice it's all good? Wow...
cyberpunk 10y ago
Do you honesty believe that? Maybe I'm too cynical these days, but I find it pretty laughable that a statement regarding 'data sovereignty' has any real meaning at all these days. Unless you control the hardware, you have no idea what the hypervisors are doing on your rented vm's. The idea that national actors don't / wouldn't pull anything they want from them seems comically naive to me. Christ, we can barely trust our own hardware anymore with backdoored firmware crap, IME and such.. Realistically though, most companies don't care so it's not a problem if you keep the blinkers on; their compliance folks just want the document which says it's not happening and they'll never know when it does so who cares. Their ops folks can barely use the APIs probably, let alone contemplate the impact of someone reading the memory of my databases from the hypervisors. As an individual and someone who cares for my data or that of my clients though, that's not enough for me, and I'd never trust tnese folks with any data, only mindless compute and serving public content...
- kesor 10y ago
  Don't you share this data over networks from time to time? Is all your data siloed and bolted down to one place never to move anywhere? How do you trust the data to not take a hike in some random direction you don't fully trust?
  - cryptarch 10y ago
    By encrypting anything you transmit over the Internet?
    - arpa 10y ago
      and anything you have on hardware you don't own. And on hardware you own.
  - cyberpunk 10y ago
    Well, depends on the data. Most things are CRUD; Current gig is a load of on-prem DBs' -- AWS boxes might hit an API in one of the datacentres which can query it for a given user, I think there's a difference between using AWS to serve HTTPS vs Hosting the whole db there (this is marketing/tracking data) It's the difference between AWS/USGVT being able to decrypt a HTTP convo to a specifc user after we've combined a lot of data and having access to all 200TB of it..
  - kkapelon 10y ago
    Let's say that I am a pharma company. Q. Don't you share this data over networks from time to time? A. Hell no. Q. Is all your data siloed and bolted down to one place never to move anywhere A. Yes that is the plan actually. Q. How do you trust the data to not take a hike in some random direction you don't fully trust A. Easy, it never gets out of my data center. An IT director that works in a pharma company, will simply laugh after reading the "don't build private clouds" article
iuguy 10y ago
Clear statements are not forms of assurance. A policy does not stop packets, unless it's a physical firewall ruleset.
yq 10y ago
Just few things happened recently related to data on cloud. 1> Google deleted People's account who bought Pixel from reseller. They have to beg google to restore their data, contacts. Not going to happened if you have it in your own cloud. 2> Windows 10 is full of telemetry. Imagine someone knows exactly what software you used, when you used it, for how long. Advertisement are built-in with system level. You don't own your machine anymore, Windows 10 can decide when it want to upgrade itself then lock you out from using it for hours. Your data now is in Microsoft's cloud, but you don't decide how they can use it, who they are going to sell to. For depository reason? Sure of course, cloud is reliable on up time, expandable with a few click. But if Cloud provider decided to wipe the account with whatever reason, what you are going to do?
- kesor 10y ago
  If a cellular network, or a power-grid provider decided to foreclose your accounts. What are you going to do?
  - arpa 10y ago
    The difference is that i can build my own email server, file server, web server, and so can you. The internet needn't be in the hands of powerful few.
    - RamenJunkie_ 10y ago
      You can also build your own power to some level, with solar and wind.
      - arpa 10y ago
        Not enough to power my mail & web server and an electric kettle, unfortunately, where I live, especially during winter months (~2-3kWh / day, when electricity is most needed). It's more viable to use diesel generator if i were thinking of going off-grid. To go on further minimizing dependency on something that isn't readily available, i'd probably go with gasoline engine generator equipped with wood gasifier [1]. Green power, unfortunately, is no libertarians dream - it only works when you can scale - that is, basically, if you're state-level actor. [1] https://en.wikipedia.org/wiki/Wood_gas https://en.wikipedia.org/wiki/Wood_gas
dozzie 10y ago
Uhm... And why would we actually believe Microsoft about that? They have screwed their customers numerous times already, and they were more than happy to cooperate with NSA.
rcarmo 10y ago
Wow. I got downvoted for being straightforward and transparent?
- Freak_NL 10y ago
  You probably got downvoted because of the antagonistic wording of your post: > Erm, no. That can come across as a rude way to disagree with someone (it does to me). > There is no uncertainty, only lack of awareness […] That's dismissive (it reads as “you are not uncertain about this matter, you just think you are”) and not very helpful either.

dancek 10y ago

Yes. We were building a website for a bank and wanted to put some services in the cloud (after all, the online banking system was completely separate). The security team of the bank was originally very opposed to the idea. It's been a while so I don't remember the specifics, but we did eventually have some but not all parts in the cloud.