3 ms·
The authors of SPECTRE, Meltdown, Rowhammer (1-4),and whatever else is next would probably disagree with you. Running in cloud providers absolutely without doub
by scurvy 7y ago
The authors of SPECTRE, Meltdown, Rowhammer (1-4),and whatever else is next would probably disagree with you. Running in cloud providers absolutely without doubt exposes your presence to hostile neighbors scheduled on the same hyoervisor.
- ENOTTY 7y agoNone of these attacks seemed to use the speculative execution vulnerabilities. They're not very relevant here
- scurvy 7y agoNo, you're missing the point. The comment I replied to said, "your servers are vulnerable no matter on prem or cloud." If you're in the cloud, you're vulnerable to an entire suite of attacks that you're not exposed to on-prem. That's my point. I could care less what was used in the attack detailed by the article. I was replying to a specific comment, not the article.
- robocat 7y agoSecurity is all about making the best compromises and shoring up the weakest links. SPECTRE, Meltdown, Rowhammer are just a few risks amongst thousands. Most importantly they at least have runtime signatures that could be detected. There are weaker areas for directed attacks against an organisation (e.g. spear-fishing). When attacked by highly skilled, highly motivated, highly resourced and foreign opponents, an org may find they are better relying upon an external team for securing your VMs. I would expect Google Cloud to be far better than the majority of fortune 500 companies at securing hypervisors and VMs.
- scurvy 7y agoa) You're ignoring the "and whatever else is next" part of my statement. If you're on-prem, you don't need to worry about hostile neighbors. Google Cloud engineers could be great at securing public cloud workloads, but even they don't know what's yet to be found. b) You're not running untrusted, random stranger code on your Fortune 500 VM's. I can't signup for an account on Ford's VM's and start ripping through memory like I can with a public cloud.