4 ms·

Not to worry, the aging executives in big corps/government are already well entrenched in the belief that "all of AWS is insecure ... because remember company x

Not to worry, the aging executives in big corps/government are already well entrenched in the belief that "all of AWS is insecure ... because remember company xyz got breached on AWS..." referring of course to someone putting user data in public, unsecured S3 buckets. Will be a while yet before they start eating the lunch that cloud providers are peddling.

samfriedman 9y ago
Actually, AWS offers a government-targeted region specifically to address data escape concerns [0]. Not classified-secure, but fine for ITAR stuff. Definitely not something I expected to exist. [0] http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/whatis.html http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/what...
- astockwell 9y ago
  Their offerings are certainly impressive when you (or your leadership) are willing to look. Most of their flagship offerings are also HIPAA certified (or can be upgraded to such).
  - dragonwriter 9y ago
    HIPAA certification isn't legally meaningful (once the government actually publishes it's certification requirement and standards, certification to those standards will be legally meaningful, and one hopes also substantive; right now it's just throw some money at some firm whose entire business model is issuing legally-meaningless certifications that the buyer can use in promotion.) The legally-meaningful thing is that they are willing to sign a HIPAA BAA and accept responsibility, not certification.
jdavis703 9y ago
I think what matters is not that AWS isn't any more insecure than "bare metal," but that older old guys in position of power also hold those beliefs. So if you get hauled to congress and you have to explain to a bunch of gray-haired senators why your data was on a "public cloud" all the senators are really going to hear is the "public" part and people are going to think your company was incompetent for putting private data on a public cloud.

samfriedman 9y ago

Actually, AWS offers a government-targeted region specifically to address data escape concerns [0]. Not classified-secure, but fine for ITAR stuff. Definitely not something I expected to exist. [0] http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/whatis.html http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/what...

astockwell 9y ago
Their offerings are certainly impressive when you (or your leadership) are willing to look. Most of their flagship offerings are also HIPAA certified (or can be upgraded to such).
- dragonwriter 9y ago
  HIPAA certification isn't legally meaningful (once the government actually publishes it's certification requirement and standards, certification to those standards will be legally meaningful, and one hopes also substantive; right now it's just throw some money at some firm whose entire business model is issuing legally-meaningless certifications that the buyer can use in promotion.) The legally-meaningful thing is that they are willing to sign a HIPAA BAA and accept responsibility, not certification.

jdavis703 9y ago

I think what matters is not that AWS isn't any more insecure than "bare metal," but that older old guys in position of power also hold those beliefs. So if you get hauled to congress and you have to explain to a bunch of gray-haired senators why your data was on a "public cloud" all the senators are really going to hear is the "public" part and people are going to think your company was incompetent for putting private data on a public cloud.