15 ms·

This feels like a puff piece. > In the case of the big public clouds, the protection is the work of some of the world’s best computer scientists, hired out of

by Steeeve 10y ago

This feels like a puff piece. > In the case of the big public clouds, the protection is the work of some of the world’s best computer scientists, hired out of places like the National Security Agency and Stanford University to think hard about security, data encryption and the latest online fraud. > And they’re pretty good at keeping things safe online. Cloud providers have employees that make mistakes and bad assumptions just like everybody else. They leverage technology that wasn't created in-house that wasn't originally built for such a large scale use case. They build their own technology that is flawed at the very least because there is no perfect software. You should never assume that a cloud provider is better at managing anything better than you could do in house. You should verify and understand that the more popular a product is the more desirable a target it is. Whether you are doing things in house, in the cloud, or some sort of hybrid, plan for security failures and never assume that your environments or your datasets are secure.

epistasis 10y ago
>You should never assume that a cloud provider is better at managing anything better than you could do in house. This is a piece for a general audience, explaining what a cloud is. What percentage of its audience do you think could secure things as well as any of the major clouds? 1% 0.1%? 0.00001%? If you were to take the class of IT professionals, those with jobs working in IT, I would say less than 0.5% would be able to put something in place in their house that even matches what's going on in the large clouds whose design and policies have been vetted by multiple people. Whatever a person is doing in their own house is going to be quite difficult to match to the same level of security. Not least of which because people's houses are not secure. Breaking in and adding a keylogger or such in order to break disk encryption is much easier there.
- Steeeve 10y ago
  > If you were to take the class of IT professionals, those with jobs working in IT, I would say less than 0.5% would be able to put something in place in their house that even matches what's going on in the large clouds whose design and policies have been vetted by multiple people. What do you base that on? I googled "what does amazon do to make their cloud secure" and got Amazon's cloud security page. https://aws.amazon.com/security/ https://aws.amazon.com/security/ It says: 1. They lock the doors at their data center. 2. They meet some unknown compliance requirements. 3. You can save money and scale with them. 4. You can buy some services to make you securer. 5. You can report vulnerabilities to them. 6. They use firewalls. Click on through to their page about Pen Testing and all it says is if you want to do Pen Testing, you have to get permission first. So how can I make the assumption that they are better than the people who manage security in-house? I would bet that on more than one occasion, an employee or a customer has spoken up and said "things should REALLY be done differently." And I would bet that will happen again and again because the reality is that security is an ever-changing landscape. I personally know they do some pretty impressive things where security is concerned, but I don't know the totality of their security solution. I doubt many amazon employees know what they do from the top down. Would you have guessed that Yahoo would play cavalier with all of their users passwords? Or linkedin? Didn't they have security design and policies vetted by multiple people? I'm just using amazon as an example because they were the cloud provider I thought of first. Then I remembered Azure leaving all of their RHEL instances vulnerable by design: http://www.theregister.co.uk/2016/11/28/microsoft_update_servers_left_all_azure_rhel_instances_hackable/ http://www.theregister.co.uk/2016/11/28/microsoft_update_ser... Would 99.5% of IT professionals really have set up RHEL environments that could be owned by a remote hacker on 1st startup? I don't know. That's a pretty bold claim. I'm going to stand by my original comment. It's not meant to steer people away from the cloud. Just from making false assumptions.
  - nicky0 10y ago
    You're missing the point of the article. It's for the average Joe Public personal computer user who probably has no idea how to secure their own computer. The article isn't aimed at businesses.

by Steeeve 10y ago

epistasis 10y ago

>You should never assume that a cloud provider is better at managing anything better than you could do in house. This is a piece for a general audience, explaining what a cloud is. What percentage of its audience do you think could secure things as well as any of the major clouds? 1% 0.1%? 0.00001%? If you were to take the class of IT professionals, those with jobs working in IT, I would say less than 0.5% would be able to put something in place in their house that even matches what's going on in the large clouds whose design and policies have been vetted by multiple people. Whatever a person is doing in their own house is going to be quite difficult to match to the same level of security. Not least of which because people's houses are not secure. Breaking in and adding a keylogger or such in order to break disk encryption is much easier there.

Steeeve 10y ago
> If you were to take the class of IT professionals, those with jobs working in IT, I would say less than 0.5% would be able to put something in place in their house that even matches what's going on in the large clouds whose design and policies have been vetted by multiple people. What do you base that on? I googled "what does amazon do to make their cloud secure" and got Amazon's cloud security page. https://aws.amazon.com/security/ https://aws.amazon.com/security/ It says: 1. They lock the doors at their data center. 2. They meet some unknown compliance requirements. 3. You can save money and scale with them. 4. You can buy some services to make you securer. 5. You can report vulnerabilities to them. 6. They use firewalls. Click on through to their page about Pen Testing and all it says is if you want to do Pen Testing, you have to get permission first. So how can I make the assumption that they are better than the people who manage security in-house? I would bet that on more than one occasion, an employee or a customer has spoken up and said "things should REALLY be done differently." And I would bet that will happen again and again because the reality is that security is an ever-changing landscape. I personally know they do some pretty impressive things where security is concerned, but I don't know the totality of their security solution. I doubt many amazon employees know what they do from the top down. Would you have guessed that Yahoo would play cavalier with all of their users passwords? Or linkedin? Didn't they have security design and policies vetted by multiple people? I'm just using amazon as an example because they were the cloud provider I thought of first. Then I remembered Azure leaving all of their RHEL instances vulnerable by design: http://www.theregister.co.uk/2016/11/28/microsoft_update_servers_left_all_azure_rhel_instances_hackable/ http://www.theregister.co.uk/2016/11/28/microsoft_update_ser... Would 99.5% of IT professionals really have set up RHEL environments that could be owned by a remote hacker on 1st startup? I don't know. That's a pretty bold claim. I'm going to stand by my original comment. It's not meant to steer people away from the cloud. Just from making false assumptions.
- nicky0 10y ago
  You're missing the point of the article. It's for the average Joe Public personal computer user who probably has no idea how to secure their own computer. The article isn't aimed at businesses.