6 ms·

Its not that I don't consider physical security as important - I just do not think that the physical security provided by your private data centre is any better

by rakkhi 16y ago

Its not that I don't consider physical security as important - I just do not think that the physical security provided by your private data centre is any better than what Amazon provides. The economies of scale and the motivation to avoid a massive security incident that affects all their customers is just greater than what you have with internal IT. But of course do a risk assessment, maybe military data should not be on any sort of cloud. But I know internal government and military security is actually pretty poor - funnily enough generals care more making sure their comms work to their soldiers than whether it is encrypted - sound kind of like a business eh? Either way I predict that within 5 years, private clouds will be a thing of the past

eitally 16y ago
Except that you can physically segregate it from the public network... or even the majority of your internal LAN/WAN. Private clouds will only continue to gain momentum in the enterprise, especially as they become easier to deploy & manage.
- rakkhi 16y ago
  The difference between can and do I have never worked in a company that physically segregated their internal network to one connected to the internet - and I have worked in Fortune 50 banks, credit card processors and online businesses. Like I said military maybe different but I know colleagues that work for the government and you should hear about how their security actually is vs. the perception (much like banks) It is hard enough to get companies to segment their network into high value services vs the office network. The practical difficulty and cost of giving end users two machines connected to two different networks is just not worth the benefit gained. Especially considering you can achieve a level of risk that is acceptable to the board and executive management with logical controls private clouds are just a waste of money.
  - bmelton 16y ago
    Federal government is almost certainly what he's talking about. We have heavily guarded rooms with impressive physical security, and authorized personnel only, in which the two networks can be 'viewed' at the same time. For what it's worth, the majority of end users don't have two machines, they either visit a secured location when they need to, or have devices / software that only allow them to connect to one network OR the other at a time. Generally speaking though, the network that has access to tactical data, or knows the most recent whereabouts of Saddam Hussein is typically ignorant of Facebook, or the internet at large.
    - rakkhi 16y ago
      ok fine I have seen these type of examples but where is the weakest link - e.g. does this super secret segregated network backup to unencrypted tape which is then lost or stolen (http://bit.ly/cQZiRd http://bit.ly/cQZiRd) a hard drive stolen (http://bit.ly/aLH2xI http://bit.ly/aLH2xI), a legitimate user walks out with info (http://bit.ly/b8Iecp http://bit.ly/b8Iecp), a laptop stolen (http://bit.ly/cp0h5Q http://bit.ly/cp0h5Q) The point I'm trying to make is you have to look at security holisticly. Having a super strong segregated network has no point if you are not going to have a similar level of control everywhere else which I can guarantee you the Federal government especially in the US does not have. So why not take advantage of the cloud, enjoy the cost decrease, increase in resilience and scalability and still have an acceptable level of risk with application of reasonable logical controls?
      - bmelton 16y ago
        I think we're deviating away from the real topic at hand, but regardless, I couldn't say specifically what the weakest link is... while I know that the tapes themselves have their own procedures, I don't know what they are. The 'legitimate users' issue is largely mitigated from malice by severely limiting who those users are with background checks, security clearances, layered access levels, and a culture in which everybody reinforces the security procedures and watches for others who might be violating them, intentionally or unintentionally. This isn't 100% of course, nothing is, but it's largely effective I would guess. Stolen laptops of course happen on occasion, but it's a dramatically different problem than unintentional access to a data center, or all the data therein. Further, most of the laptops I've seen have data-at-rest encryption, remote locating devices (GPS) and fairly stringent security protections on the device. In order to connect to any sensitive networks, they'd also have to use VPN and 2 factor encryption. Largely, these things have already been thought of... but more importantly, if you're statement holds weight, and they should have stringent controls everywhere to be effective, then why would they arbitrarily allow their data to be potentially compromised in the event that Amazon has less stringent requirements -- and guess what, they do.
bmelton 16y ago
The physical security in MY data center has armed guards carrying MP5 uzis, and has absolutely zero tenancy except for us. I personally feel that the data there is quite safe, relatively speaking.
- billswift 16y ago
  There is no such thing as an "MP5 uzi".
  - bmelton 16y ago
    I guess you're right, but they look like uzis enough for me, and is otherwise a compact submachine gun. What I'm referring to specifically is this, I believe: http://en.wikipedia.org/wiki/Heckler_%26_Koch_MP5 http://en.wikipedia.org/wiki/Heckler_%26_Koch_MP5
    - rakkhi 16y ago
      Do the Mp5 Uzi's protect against people that legitimatly have access, or how about a repairman? or during a fire drill - all doors open?
      - bmelton 16y ago
        Presumably, everyone on the entire campus is trusted to be there, with increasing layers of security. There are guards posted at all entrances to the campus, where I have to present a badge + window sticker to get on. Once on campus and parked, a swipe card gets me into the building, where I am presented with an X-Ray machine for my belongings and a metal detector that I have to walk through for entrance. If I am taking any property on or off campus, I have to also present a property pass signed by someone with the authorization to allow that activity. Admittedly, I could probably sneak a flash drive on if I were so inclined, but that's probably why they do background checks on people before they're given badges and swipe cards and all that.

by rakkhi 16y ago

eitally 16y ago

Except that you can physically segregate it from the public network... or even the majority of your internal LAN/WAN. Private clouds will only continue to gain momentum in the enterprise, especially as they become easier to deploy & manage.

rakkhi 16y ago
The difference between can and do I have never worked in a company that physically segregated their internal network to one connected to the internet - and I have worked in Fortune 50 banks, credit card processors and online businesses. Like I said military maybe different but I know colleagues that work for the government and you should hear about how their security actually is vs. the perception (much like banks) It is hard enough to get companies to segment their network into high value services vs the office network. The practical difficulty and cost of giving end users two machines connected to two different networks is just not worth the benefit gained. Especially considering you can achieve a level of risk that is acceptable to the board and executive management with logical controls private clouds are just a waste of money.
- bmelton 16y ago
  Federal government is almost certainly what he's talking about. We have heavily guarded rooms with impressive physical security, and authorized personnel only, in which the two networks can be 'viewed' at the same time. For what it's worth, the majority of end users don't have two machines, they either visit a secured location when they need to, or have devices / software that only allow them to connect to one network OR the other at a time. Generally speaking though, the network that has access to tactical data, or knows the most recent whereabouts of Saddam Hussein is typically ignorant of Facebook, or the internet at large.
  - rakkhi 16y ago
    ok fine I have seen these type of examples but where is the weakest link - e.g. does this super secret segregated network backup to unencrypted tape which is then lost or stolen (http://bit.ly/cQZiRd http://bit.ly/cQZiRd) a hard drive stolen (http://bit.ly/aLH2xI http://bit.ly/aLH2xI), a legitimate user walks out with info (http://bit.ly/b8Iecp http://bit.ly/b8Iecp), a laptop stolen (http://bit.ly/cp0h5Q http://bit.ly/cp0h5Q) The point I'm trying to make is you have to look at security holisticly. Having a super strong segregated network has no point if you are not going to have a similar level of control everywhere else which I can guarantee you the Federal government especially in the US does not have. So why not take advantage of the cloud, enjoy the cost decrease, increase in resilience and scalability and still have an acceptable level of risk with application of reasonable logical controls?
    - bmelton 16y ago
      I think we're deviating away from the real topic at hand, but regardless, I couldn't say specifically what the weakest link is... while I know that the tapes themselves have their own procedures, I don't know what they are. The 'legitimate users' issue is largely mitigated from malice by severely limiting who those users are with background checks, security clearances, layered access levels, and a culture in which everybody reinforces the security procedures and watches for others who might be violating them, intentionally or unintentionally. This isn't 100% of course, nothing is, but it's largely effective I would guess. Stolen laptops of course happen on occasion, but it's a dramatically different problem than unintentional access to a data center, or all the data therein. Further, most of the laptops I've seen have data-at-rest encryption, remote locating devices (GPS) and fairly stringent security protections on the device. In order to connect to any sensitive networks, they'd also have to use VPN and 2 factor encryption. Largely, these things have already been thought of... but more importantly, if you're statement holds weight, and they should have stringent controls everywhere to be effective, then why would they arbitrarily allow their data to be potentially compromised in the event that Amazon has less stringent requirements -- and guess what, they do.

bmelton 16y ago

The physical security in MY data center has armed guards carrying MP5 uzis, and has absolutely zero tenancy except for us. I personally feel that the data there is quite safe, relatively speaking.

billswift 16y ago
There is no such thing as an "MP5 uzi".
- bmelton 16y ago
  I guess you're right, but they look like uzis enough for me, and is otherwise a compact submachine gun. What I'm referring to specifically is this, I believe: http://en.wikipedia.org/wiki/Heckler_%26_Koch_MP5 http://en.wikipedia.org/wiki/Heckler_%26_Koch_MP5
  - rakkhi 16y ago
    Do the Mp5 Uzi's protect against people that legitimatly have access, or how about a repairman? or during a fire drill - all doors open?
    - bmelton 16y ago
      Presumably, everyone on the entire campus is trusted to be there, with increasing layers of security. There are guards posted at all entrances to the campus, where I have to present a badge + window sticker to get on. Once on campus and parked, a swipe card gets me into the building, where I am presented with an X-Ray machine for my belongings and a metal detector that I have to walk through for entrance. If I am taking any property on or off campus, I have to also present a property pass signed by someone with the authorization to allow that activity. Admittedly, I could probably sneak a flash drive on if I were so inclined, but that's probably why they do background checks on people before they're given badges and swipe cards and all that.