4 ms·
Every potential threat should be considered, but weighed against likelihood when prioritizing. Sometimes you make cost/benefit consolations. 100% airtight wou
by nkozyra 9y ago
Every potential threat should be considered, but weighed against likelihood when prioritizing.
Sometimes you make cost/benefit consolations. 100% airtight would be great, but 100% airtight doesn't actually exist. Most organizations with finite resources have to make risk/reward decisions when there are as many threats as there are with web development.
- spydum 9y agoThe cost for encryption at rest is single digit percentages these days. I push for encryption at rest on ANY cloud provider storage for one main reason: I have no control over their disk disposal or reuse mechanisms. They can claim they wipe the data, but I have no way to test that reliably. As for disk encryption plus FS encryption, keep in mind in AWS or Azure, it's possible for a misconfigured IAM or SPN to leak access to the disk blob.. If it was encrypted with a key separately, the risk is mitigated. Again, it's just too easy to implement on almost every cloud provider thes days.