3 ms·

I can't help it, it just doesn't make sense to me. The only people it would theoretically protect me against are your people (those with physical access). And

by moe 16y ago

I can't help it, it just doesn't make sense to me. The only people it would theoretically protect me against are your people (those with physical access). And if I don't trust your people then why should I trust your encryption? The issue of data leakage between customers (who don't have physical access) seems so trivial to prevent to me that I'm honestly wondering if I'm missing something fundamental here. What's wrong with just making a loopback file and mounting that to the customer node? I had in fact assumed that this is how most clouds do it (for sanity reasons alone, security being the bonus). Hence I'm rather baffled by the whole claim of "data leakage through reading the raw volume". Has that ever happened on any cloud provider?

cloudsigma 16y ago
The blog post looks at three main aspects to data storage: - keeping data private (to you as a user) - thinking about legal issues of location and control - thinking about migration issues Of the first point we outline how data leakage is possible in IaaS clouds. Some may already have measures in place to prevent this. We have our own measures too, some private others public. We offer encryption also as a free and convenient way to secure your data. This has nothing to do with securing physical access which is a totally separate issue. It relates to how customers secure access to their data. As outlined previously we don't have root access or file system level visibility into cloud servers in the way that other vendors generally do (although there are exceptions). As such it does pretty much come down to securing physical access. That isn't the case on other platforms for sure. Here's another article that you might like (short but sweet) which actually talks directly about EBS and others and the problem of 'data remanance' in a way we can't as a competing vendor: http://elastic-security.com/2010/01/07/data-remanence-in-the-cloud/ http://elastic-security.com/2010/01/07/data-remanence-in-the... Here's an interesting quote: "The technique of overwriting file sectors does not work without the collaboration of the cloud provider. You are not given access to the physical device, but only to higher level abstractions like file-systems (e.g. Amazon EBS) or key-value based APIs (e.g. Amazon S3). " I'll get back to you on the loopback technique once I've spoken with the relevant storage guys in our company for feedback. Kind regards, Patrick

by moe 16y ago

cloudsigma 16y ago

The blog post looks at three main aspects to data storage: - keeping data private (to you as a user) - thinking about legal issues of location and control - thinking about migration issues Of the first point we outline how data leakage is possible in IaaS clouds. Some may already have measures in place to prevent this. We have our own measures too, some private others public. We offer encryption also as a free and convenient way to secure your data. This has nothing to do with securing physical access which is a totally separate issue. It relates to how customers secure access to their data. As outlined previously we don't have root access or file system level visibility into cloud servers in the way that other vendors generally do (although there are exceptions). As such it does pretty much come down to securing physical access. That isn't the case on other platforms for sure. Here's another article that you might like (short but sweet) which actually talks directly about EBS and others and the problem of 'data remanance' in a way we can't as a competing vendor: http://elastic-security.com/2010/01/07/data-remanence-in-the-cloud/ http://elastic-security.com/2010/01/07/data-remanence-in-the... Here's an interesting quote: "The technique of overwriting file sectors does not work without the collaboration of the cloud provider. You are not given access to the physical device, but only to higher level abstractions like file-systems (e.g. Amazon EBS) or key-value based APIs (e.g. Amazon S3). " I'll get back to you on the loopback technique once I've spoken with the relevant storage guys in our company for feedback. Kind regards, Patrick