4 ms·

AWS has a better compliance story. Compare https://aws.amazon.com/compliance/ https://aws.amazon.com/compliance/ to https://cloud.google.com/security/compli

by phonon 10y ago

AWS has a better compliance story. Compare https://aws.amazon.com/compliance/ https://aws.amazon.com/compliance/ to https://cloud.google.com/security/compliance https://cloud.google.com/security/compliance

zbjornson 10y ago
As far as HIPAA compliance goes, though, AWS EC2 requires dedicated tenancy, whereas GCE allows HIPAA workloads on any VM, including preemptible VMs.
- gkop 10y ago
  This is true, however Amazon's standard BAA is a bit more robust than Google's. This didn't stop my HIPAA-compliant company from choosing Google, but it does make it more difficult to compare the two clouds on HIPAA-friendliness.
  - mikecb 10y ago
    There's been a lot of talk in the compliance gcp slack on this, seems like a lot of products are being audited and announcements will be made at Next.
    - gkop 10y ago
      Let's hope they are building the managed Postgres product from the ground up with an eye toward compliance!
      - mikecb 10y ago
        Well, since mysql compatible Cloud SQL is, I would imagine pg would be too.
        gkop 10y ago
        AWS launched Postgres RDS in November 2013. They covered MySQL and Oracle RDS under BAA in August 2015. But AWS didn't add Postgres RDS to the BAA until November 2016. We're hoping GCP doesn't delay covering Postgres Cloud SQL under BAA like AWS did with their managed Postgres.
  - boulos 10y ago
    Can you say more about what you found less robust? And (hopefully) were you unable to get the legal agreement up to snuff by the end? Disclosure: I work on Google Cloud (but not compliance).
vgt 10y ago
I know security is not compliance, and I'm not here to compare the two, but Google goes to great lengths to protect security. [0] TL;DR: - Google's global SDN is ultra-secure, and Google carries your packets on its network rather than dumping them onto public web. Google's undersea cables are shark bite-proof! [1] - Google Data Centers are mostly homogeneous and rely on Google-build hardware rather than vendors. This greatly helps with securing infra - only one vendor (Google) to trust, only one set of best practices to follow, lower risk of misconfiguration, and exposure risk is minimal. - > 600 security engineers. - Encryption-at-rest and in-transit is ubiquitous. [0] https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper [1] https://www.youtube.com/watch?v=XMxkRh7sx84 https://www.youtube.com/watch?v=XMxkRh7sx84 (work on Google Cloud, not in marketing :) )
- Johnny555 10y ago
  I can't find "ultra-secure" in any of our security certification docs. Is that better or worse than "super-duper secure"? For security, I don't care whether my traffic as routed over a private network or public web as long as the data is encrypted, because a "private network" is only as private as thousands of miles of fiber and every single network facility it traverses can be. Which means 'not very'. Does Google build it's own hard drives/SSD's and CPU's? If not, then that's at least 2 other vendors to trust since both CPU's and hard drives are related to hardware security.
  - vgt 10y ago
    Ha.ha. Did I mention I'm not in marketing? I do appreciate your passion! On your first point. There is a very strong risk of inadvertent misconfiguration or your employees not following best practices.. Or even poor documentation. Google cloud by default gives you a global secure vpc that never traverses public internet, so there's less risk because the baseline of security is high. Sure, you can run VPN tunnels between data centers. Point is, with Google cloud you don't need to. On the latter point, of course you cannot eradicate every vendor, especially within the obvious context of this specific Intel announcement... But, again, not having three dozen flavors of configs and four network router vendors does make a difference. I would encourage you to read the paper I linked to above (discussed this topic in great detail), and also perhaps [0]. Also security folks at Google, who are much more qualified to discuss this topic than I am, frequently post on hn. [1] [0] https://cloudplatform.googleblog.com/2016/02/Google-seeks-new-disks-for-data-centers.html?m=1 https://cloudplatform.googleblog.com/2016/02/Google-seeks-ne... [1]https://news.ycombinator.com/item?id=13388941 https://news.ycombinator.com/item?id=13388941
jcims 10y ago
AWS did a lot of work to improve how they share compliance information over the past year. It wasn't much better than Google's reference before that. Azure beats both of them in my opinion, as you can access many of the raw compliance reports without an NDA. It's also important to pay attention to which services you consume, as not all of them are certified to the same degree.

by phonon 10y ago

zbjornson 10y ago

As far as HIPAA compliance goes, though, AWS EC2 requires dedicated tenancy, whereas GCE allows HIPAA workloads on any VM, including preemptible VMs.

gkop 10y ago
This is true, however Amazon's standard BAA is a bit more robust than Google's. This didn't stop my HIPAA-compliant company from choosing Google, but it does make it more difficult to compare the two clouds on HIPAA-friendliness.
- mikecb 10y ago
  There's been a lot of talk in the compliance gcp slack on this, seems like a lot of products are being audited and announcements will be made at Next.
  - gkop 10y ago
    Let's hope they are building the managed Postgres product from the ground up with an eye toward compliance!
    - mikecb 10y ago
      Well, since mysql compatible Cloud SQL is, I would imagine pg would be too.
      - gkop 10y ago
        AWS launched Postgres RDS in November 2013. They covered MySQL and Oracle RDS under BAA in August 2015. But AWS didn't add Postgres RDS to the BAA until November 2016. We're hoping GCP doesn't delay covering Postgres Cloud SQL under BAA like AWS did with their managed Postgres.
- boulos 10y ago
  Can you say more about what you found less robust? And (hopefully) were you unable to get the legal agreement up to snuff by the end? Disclosure: I work on Google Cloud (but not compliance).

vgt 10y ago

I know security is not compliance, and I'm not here to compare the two, but Google goes to great lengths to protect security. [0] TL;DR: - Google's global SDN is ultra-secure, and Google carries your packets on its network rather than dumping them onto public web. Google's undersea cables are shark bite-proof! [1] - Google Data Centers are mostly homogeneous and rely on Google-build hardware rather than vendors. This greatly helps with securing infra - only one vendor (Google) to trust, only one set of best practices to follow, lower risk of misconfiguration, and exposure risk is minimal. - > 600 security engineers. - Encryption-at-rest and in-transit is ubiquitous. [0] https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper [1] https://www.youtube.com/watch?v=XMxkRh7sx84 https://www.youtube.com/watch?v=XMxkRh7sx84 (work on Google Cloud, not in marketing :) )

Johnny555 10y ago
I can't find "ultra-secure" in any of our security certification docs. Is that better or worse than "super-duper secure"? For security, I don't care whether my traffic as routed over a private network or public web as long as the data is encrypted, because a "private network" is only as private as thousands of miles of fiber and every single network facility it traverses can be. Which means 'not very'. Does Google build it's own hard drives/SSD's and CPU's? If not, then that's at least 2 other vendors to trust since both CPU's and hard drives are related to hardware security.
- vgt 10y ago
  Ha.ha. Did I mention I'm not in marketing? I do appreciate your passion! On your first point. There is a very strong risk of inadvertent misconfiguration or your employees not following best practices.. Or even poor documentation. Google cloud by default gives you a global secure vpc that never traverses public internet, so there's less risk because the baseline of security is high. Sure, you can run VPN tunnels between data centers. Point is, with Google cloud you don't need to. On the latter point, of course you cannot eradicate every vendor, especially within the obvious context of this specific Intel announcement... But, again, not having three dozen flavors of configs and four network router vendors does make a difference. I would encourage you to read the paper I linked to above (discussed this topic in great detail), and also perhaps [0]. Also security folks at Google, who are much more qualified to discuss this topic than I am, frequently post on hn. [1] [0] https://cloudplatform.googleblog.com/2016/02/Google-seeks-new-disks-for-data-centers.html?m=1 https://cloudplatform.googleblog.com/2016/02/Google-seeks-ne... [1]https://news.ycombinator.com/item?id=13388941 https://news.ycombinator.com/item?id=13388941

jcims 10y ago

AWS did a lot of work to improve how they share compliance information over the past year. It wasn't much better than Google's reference before that. Azure beats both of them in my opinion, as you can access many of the raw compliance reports without an NDA. It's also important to pay attention to which services you consume, as not all of them are certified to the same degree.