5 ms·

'The Cloud' is just 'Someone Elses Computer'. Would you process confidential documents on 'Someone Elses Computer'? The bigger mistake was made before this dat

'The Cloud' is just 'Someone Elses Computer'. Would you process confidential documents on 'Someone Elses Computer'? The bigger mistake was made before this data breach even happened.

golergka 8y ago
> Would you process confidential documents on 'Someone Elses Computer'? If it's a big megacorp like Google or Microsoft, and I don't consider myself a target for state-level actors, easy.
vkou 8y ago
Every[1] computer is, at worst, a misconfigured firewall and a late security patch - or, at best, one moron clicking a phishing e-mail away from being 'Some Martian script kiddie's computer'. Keeping your data on cloud introduces new attack vendors. It closes others. If you're going to be an idiot[2][3], and host a production database which doesn't require any authentication on the cloud, I don't have much hope for your non-cloud-deployed security. [1] For most reasonable definitions of every. [2] I have had the dubious pleasure of working in a ~15 year-old software company where ~half of the machines were virus-infested (Mostly Conficker, but also some other shit that I forget. This was in 2012. If I recall correctly, we had one part-time IT guy for ~30 engineers. His job was ordering computer parts, and keeping e-mail working. The health of the dev machines was not his problem.) The SOP was to do all your work in a VM running Windows XP, and wipe it every few weeks, or whenever performance would grind to a halt - whichever came first. One of my tasks, a few months in, was to deal with the virus situation on the build server, so that we could 'securely' build the release, and sign it with the encryption key that only the VPs had access to. [3] I have also had a chance to work in a company obsessed with security (Because of the nature of their products). One of my discoveries, a few months before I left, was that one of their products' updates were pushed via an insecure HTTP downloader. While I was there, nobody budgeted time to get it fixed.
- GhostVII 8y ago
  The difference with computers in the "cloud" is that there is a much higher incentive to hack them since there is much more data on them, and hackers can be fairly confident that they will get valuable data in a hack. This is not the case with your personal computer. So if you are bad at security, I would argue that it is much safer (from a security point of view, at least) to store things on your own computer, since your mistakes are much less likely to be noticed.
tdb7893 8y ago
Even if they were Amazon and actually owned the hardware being run on it wouldn't have changed the outcome at all so I don't understand how it being someone else's computer is relevant.
- zAy0LfpBZLC8mAC 8y ago
  It's not about property rights, it's about who is in control of and has insight into what is going on on the machine.
  - tdb7893 8y ago
    In my experience you have control and insight into machines in AWS, what insight or control do you think was lacking here? It seems to me more they didn't understand the technology they were building on.
    - zAy0LfpBZLC8mAC 8y ago
      As far as I am concerned, see p1necone's comment above: It's not about the relation between Abbyy and Amazon, it's about the relation between them and their customers who stored their documents with some company where they had not insight into how they were handling their data.
      - tdb7893 8y ago
        Oh that makes sense, apologies for misonterpreting.
  - LeifCarrotson 8y ago
    Right. In this case, the OCR software dev had control of the clound machines. However, the customers that uploaded sensitive documents to this cloud OCR service did not have control of the computers, the code, or the configuration. Yes, if you don't trust anyone you can't get anything done but this feels like the kind of task where you should be a little bit nervous each time you do it.
gruez 8y ago
how's this any different than someone self-hosting a FTP server and allowing anonymous users?
refoundglory 8y ago
Of course I would. I do already - I give them to my accountant, my doctor, their secretaries, etc.
9712263 8y ago
Actually, leaking customer information does not really matter to the company. What the company cares is the leak itself is not their fault. They just want someone to take those responsibility, so putting in 'Someone Elses Computer' is actually a good strategy. Only when losing customer information equals to revenue drops, company will take security more seriously. Enforcing a law to company storing customer to have common security practice is a possible solution, though it hurts low budget startup.
- pilsetnieks 8y ago
  It would in Europe under GDPR. If your subcontractor leaked your data, you are at fault as well, for improperly vetting your subcontractors.

'The Cloud' is just 'Someone Elses Computer'. Would you process confidential documents on 'Someone Elses Computer'? The bigger mistake was made before this data breach even happened.

golergka 8y ago

> Would you process confidential documents on 'Someone Elses Computer'? If it's a big megacorp like Google or Microsoft, and I don't consider myself a target for state-level actors, easy.

vkou 8y ago

Every[1] computer is, at worst, a misconfigured firewall and a late security patch - or, at best, one moron clicking a phishing e-mail away from being 'Some Martian script kiddie's computer'. Keeping your data on cloud introduces new attack vendors. It closes others. If you're going to be an idiot[2][3], and host a production database which doesn't require any authentication on the cloud, I don't have much hope for your non-cloud-deployed security. [1] For most reasonable definitions of every. [2] I have had the dubious pleasure of working in a ~15 year-old software company where ~half of the machines were virus-infested (Mostly Conficker, but also some other shit that I forget. This was in 2012. If I recall correctly, we had one part-time IT guy for ~30 engineers. His job was ordering computer parts, and keeping e-mail working. The health of the dev machines was not his problem.) The SOP was to do all your work in a VM running Windows XP, and wipe it every few weeks, or whenever performance would grind to a halt - whichever came first. One of my tasks, a few months in, was to deal with the virus situation on the build server, so that we could 'securely' build the release, and sign it with the encryption key that only the VPs had access to. [3] I have also had a chance to work in a company obsessed with security (Because of the nature of their products). One of my discoveries, a few months before I left, was that one of their products' updates were pushed via an insecure HTTP downloader. While I was there, nobody budgeted time to get it fixed.

GhostVII 8y ago
The difference with computers in the "cloud" is that there is a much higher incentive to hack them since there is much more data on them, and hackers can be fairly confident that they will get valuable data in a hack. This is not the case with your personal computer. So if you are bad at security, I would argue that it is much safer (from a security point of view, at least) to store things on your own computer, since your mistakes are much less likely to be noticed.

tdb7893 8y ago

Even if they were Amazon and actually owned the hardware being run on it wouldn't have changed the outcome at all so I don't understand how it being someone else's computer is relevant.

zAy0LfpBZLC8mAC 8y ago
It's not about property rights, it's about who is in control of and has insight into what is going on on the machine.
- tdb7893 8y ago
  In my experience you have control and insight into machines in AWS, what insight or control do you think was lacking here? It seems to me more they didn't understand the technology they were building on.
  - zAy0LfpBZLC8mAC 8y ago
    As far as I am concerned, see p1necone's comment above: It's not about the relation between Abbyy and Amazon, it's about the relation between them and their customers who stored their documents with some company where they had not insight into how they were handling their data.
    - tdb7893 8y ago
      Oh that makes sense, apologies for misonterpreting.
- LeifCarrotson 8y ago
  Right. In this case, the OCR software dev had control of the clound machines. However, the customers that uploaded sensitive documents to this cloud OCR service did not have control of the computers, the code, or the configuration. Yes, if you don't trust anyone you can't get anything done but this feels like the kind of task where you should be a little bit nervous each time you do it.

gruez 8y ago

how's this any different than someone self-hosting a FTP server and allowing anonymous users?

refoundglory 8y ago

Of course I would. I do already - I give them to my accountant, my doctor, their secretaries, etc.

9712263 8y ago

Actually, leaking customer information does not really matter to the company. What the company cares is the leak itself is not their fault. They just want someone to take those responsibility, so putting in 'Someone Elses Computer' is actually a good strategy. Only when losing customer information equals to revenue drops, company will take security more seriously. Enforcing a law to company storing customer to have common security practice is a possible solution, though it hurts low budget startup.

pilsetnieks 8y ago
It would in Europe under GDPR. If your subcontractor leaked your data, you are at fault as well, for improperly vetting your subcontractors.