3 ms·

Why did you answer your concern before you presented it? I'm genuinely confused.

mothsonasloth 8y ago
Well, can you honestly say to a certain degree of certainty where your EC2 instance is at any given time? It might be sharing a blade server hosting Netflix services. Equally, governments are notoriously incompetent and it wouldn't surprise me that some ill configured IAM profile or security group causes mayhem. Cloud is brilliant but scary!
- ckozlowski 8y ago
  While we've taken pains to isolate workloads from one another on EC2 and can show there's no known vulnerabilities that would allow information leakage between instances, we have customers who want that extra level of assurance that their EC2 instance is not sharing hardware with another customer. Dedicated instances fulfil this role. https://aws.amazon.com/ec2/purchasing-options/dedicated-instances/ https://aws.amazon.com/ec2/purchasing-options/dedicated-inst... As for IAM profiles, security groups, and the other, they're all security tools that can be used, but they're only as good as the admin who wields them. But the same can be said for on-premise (non-cloud) workloads that are internet facing. The times I'd found SSH (or egads, telnet!) ports exposed to the internet on a boundary router were too many to mention. It's not a cloud-specific problem, but a IT training problem. The good thing about cloud in this aspect is that when a customer is all in on say, AWS, you can enforce a high level of consistency in what those security controls should look like, which makes it easier to identify deviations. You can then pair that with features like AWS Config to automatically detect when you say, have an IAM profile that's been changed from the secure baseline. So cloud can actually make your environment more secure, because you have security tools built into all of your services, they're consistent, and you benefit from all of the engineering and research that AWS puts into them, instead of having to design solutions for everything yourself or manage lots of differing products that all require their own training, runbooks, configuration, etc. But regardless of the solution you choose, it will always come down to training your personnel to use those tools properly, because bad configurations can occur anywhere. Cloud can help minimize the occurrences of that, but only training will eliminate it. Disclaimer: I'm a TAM with AWS.

Well, can you honestly say to a certain degree of certainty where your EC2 instance is at any given time? It might be sharing a blade server hosting Netflix services. Equally, governments are notoriously incompetent and it wouldn't surprise me that some ill configured IAM profile or security group causes mayhem. Cloud is brilliant but scary!

ckozlowski 8y ago
While we've taken pains to isolate workloads from one another on EC2 and can show there's no known vulnerabilities that would allow information leakage between instances, we have customers who want that extra level of assurance that their EC2 instance is not sharing hardware with another customer. Dedicated instances fulfil this role. https://aws.amazon.com/ec2/purchasing-options/dedicated-instances/ https://aws.amazon.com/ec2/purchasing-options/dedicated-inst... As for IAM profiles, security groups, and the other, they're all security tools that can be used, but they're only as good as the admin who wields them. But the same can be said for on-premise (non-cloud) workloads that are internet facing. The times I'd found SSH (or egads, telnet!) ports exposed to the internet on a boundary router were too many to mention. It's not a cloud-specific problem, but a IT training problem. The good thing about cloud in this aspect is that when a customer is all in on say, AWS, you can enforce a high level of consistency in what those security controls should look like, which makes it easier to identify deviations. You can then pair that with features like AWS Config to automatically detect when you say, have an IAM profile that's been changed from the secure baseline. So cloud can actually make your environment more secure, because you have security tools built into all of your services, they're consistent, and you benefit from all of the engineering and research that AWS puts into them, instead of having to design solutions for everything yourself or manage lots of differing products that all require their own training, runbooks, configuration, etc. But regardless of the solution you choose, it will always come down to training your personnel to use those tools properly, because bad configurations can occur anywhere. Cloud can help minimize the occurrences of that, but only training will eliminate it. Disclaimer: I'm a TAM with AWS.