4 ms·
How is the cloud less secure than your on-prem servers? I would argue that it's easier to keep track of all the threats with the tools available from big cloud
by aspyct 6y ago
How is the cloud less secure than your on-prem servers? I would argue that it's easier to keep track of all the threats with the tools available from big cloud providers.
- badpun 6y agoThe big question is - how much do you trust these providers.
- deleted 6y ago[deleted]
- quicklime 6y agoI would guess that approximately zero banks own data centers that are operated by their own employees. There might be a few exceptions to this, but the reality is that most banks don't view technology as part of their core business. So this largely gets outsourced to IT consulting firms like Infosys, IBM, Wipro, etc. The big question is - how much do you trust these providers, and do you think they are more competent at security than Amazon/Google/Microsoft?
- dathinab 6y agoOr formulate it differently: 1. Trust a provider which whole existence relies on trust and which you can audit or at last cross-check the audit and security processes (as a Bank you are normally not a small customer). 2. Trust a provider which might 1st be a potential competitions in some business fields. 2nd is so big that it can easily afford losing you. 3nd for the same reason doesn't allow you any insights into there internal processes. etc. Plus many of the banks having their own hardware also have their own IT team. So it's often about trusting your own people. I mean either you keep your it or you outsource _and_ go into the cloud. Keeping local servers but outsourcing IT at the same time seems kind not very clever tbh.
- badpun 6y agoOperations is one thing, but security policies setting is another. The cloud provider can for example actively lie to you about having some security measures implemented, while it's not going to happen with your Wipro-like consulting firm, as these people just don't call the shots around the bank and are there typically only to execute procedures written on the bank side.
- toast0 6y agoThe cloud provider has physical access to the machines. They may have software access to the machines. I'm sure they're contracted not to do anything bad, but there is risk of an insider incident at the cloud provider leading to an incident the customer can't prevent.
- vikramkr 6y agoThe server is in someone else's building. They have hippa compliant stuff for healthcare, but at a point there is just that risk that you have to take with the servers and data not physically being entirely under your control and having to trust the providers
- michaelt 6y agoForget the bank for a moment, and imagine if you were in direct competition with Amazon and concerned about insider risks. Now imagine you're aware that Amazon's retail arm is quite happy to launch competing products based on sales data from marketplace sellers, so it's not like they have strict firewalls protecting competitors who pay Amazon for services. Now imagine Amazon offers you a bunch of security options that sound suspiciously like snake-oil. Like an encrypted storage service where they store the encryption key and transparently decrypt files when you request them. Now imagine you know people with hypervisor access can do what they like to your VM and leave no evidence whatsoever. And your on-prem experience is that there will definitely be some people with hypervisor access. Now imagine you've been through various audit and certification processes yourself, and you don't find yourself reassured by the knowledge Amazon has too. Now imagine if you were a boss at AWS and you found an insider had violated policies and accessed things they shouldn't have. Would it be better for your career to publicise that widely, or reprimand the guy then hush things up? Now imagine you've been an ambitious cowboy at certain times in your career, and although you've never accessed a competitor's data to give an edge to something you were working on, you can see how it would be a temptation. I can understand how a person who believed all that would believe putting their business in their competitors hands would be a naive decision.
- dathinab 6y ago> I can understand how a person who believed all that would believe putting their business in their competitors hands would be a naive decision. That sounds like it's hard to believe all this. But some thinks you state actually had some proves that they do happen...
- dathinab 6y agoNormally it's not. But if certain thinks went wrong you might have much less control to fix thinks. Like consider how many cases of "help big company randomly blocked our account" popped up on hacker news and twitter the recent years. Also consider news like: "Amazon spies on seller to get a competitive advantage when selling their own products". Or e.g. companies short term massively changing their service terms or API's. Deprecating old ones etc. This might be fine for customers which products are always changing anyway. But for banks this isn't attractive at all, they only want changes if they are really needed for them.
- drpixie 6y agoSystems in the cloud are always going to be less secure than local systems. With cloud you have the same issues with in-house access and data leaking, because you have the same people with access to the same data, PLUS with cloud you also have additional issues with the various third party/parties (over whom you have little control).