3 ms·

“No, we can’t use leading cloud providers to store this data. What if someone unauthorised looks at it?” This attitude leaves the victim paying millions in ran

“No, we can’t use leading cloud providers to store this data. What if someone unauthorised looks at it?” This attitude leaves the victim paying millions in ransom. Look, Microsoft and Amazon probably have a better handle on security than your IT dept which is two people who also have to fix any issues like the WiFi not working or software not updating.

bpfrh 6y ago
There are stories of MSPs who got their offline backup from the same provider who they bought their cloud based RMM tool. One day an account get's exploited and suddenly the backups are deleted and the systems are all encrypted remotely. Cloud backups are not offline backups, if you want security use tapes or remote systems which turn on manually.
- nindalf 6y ago
  A backup that can be overwritten is not a backup. It is possible to use a cloud provider and also write an immutable backup.
AnthonyMouse 6y ago
> This attitude leaves the victim paying millions in ransom. Not if they still have backups that aren't cloud backups. > Look, Microsoft and Amazon probably have a better handle on security than your IT dept which is two people who also have to fix any issues like the WiFi not working or software not updating. And that's part of the problem, right? Your IT department isn't too bright, so they encrypt their cloud backups with a tool that does the encryption wrong, and the smarter engineers at the cloud provider know that it's vulnerable so now they can read your data when you thought they couldn't. Or you use a weak password for the cloud backup account and then some third party breaks in and gets them. Not really a concern with a backup tape stored in a fire safe.
vinay_ys 6y ago
There is no reason to believe clouds don't have security issues or software bugs that cause inadvertent data loss. Just because the cloud provider is a big company doesn't mean the security is better. At the end of the day, they are a team of software engineers with all the usual people and org problems and can have usual human mistakes. But cloud solutions are better in practice due to totally non-technical reasons. Here's how - If UCSF can afford to pay millions in ransom, they can definitely afford to hire the right experts to do their IT systems properly. It is likely that they hire the right people, but then the most commonly recommended security policies were considered but not implemented due to resistence from powerful non-security team members inside the organization. (Usually, the highly paid CISO is playing politics with peers to keep the job by ignoring those security experts). If it also possible that the IT+security team is incompetent and is only good for deploying expensive but useless vendor solutions that do a lot of security theater but do very little to improve actual security. Also possible that the vendor solutions are susceptible to be misconfigured easily to become insecure. Public cloud solutions can help overcome these above shortcomings of in-house security+IT teams in a org politics friendly manner.
- AnthonyMouse 6y ago
  > Public cloud solutions can help overcome these above shortcomings of in-house security+IT teams in a org politics friendly manner. The problem there being that the choice of "public cloud" is subject to all the same forces, so then the vendor with the best corporate marketing team gets the business even if their security is crap.

bpfrh 6y ago

There are stories of MSPs who got their offline backup from the same provider who they bought their cloud based RMM tool. One day an account get's exploited and suddenly the backups are deleted and the systems are all encrypted remotely. Cloud backups are not offline backups, if you want security use tapes or remote systems which turn on manually.

nindalf 6y ago
A backup that can be overwritten is not a backup. It is possible to use a cloud provider and also write an immutable backup.

AnthonyMouse 6y ago

> This attitude leaves the victim paying millions in ransom. Not if they still have backups that aren't cloud backups. > Look, Microsoft and Amazon probably have a better handle on security than your IT dept which is two people who also have to fix any issues like the WiFi not working or software not updating. And that's part of the problem, right? Your IT department isn't too bright, so they encrypt their cloud backups with a tool that does the encryption wrong, and the smarter engineers at the cloud provider know that it's vulnerable so now they can read your data when you thought they couldn't. Or you use a weak password for the cloud backup account and then some third party breaks in and gets them. Not really a concern with a backup tape stored in a fire safe.

vinay_ys 6y ago

There is no reason to believe clouds don't have security issues or software bugs that cause inadvertent data loss. Just because the cloud provider is a big company doesn't mean the security is better. At the end of the day, they are a team of software engineers with all the usual people and org problems and can have usual human mistakes. But cloud solutions are better in practice due to totally non-technical reasons. Here's how - If UCSF can afford to pay millions in ransom, they can definitely afford to hire the right experts to do their IT systems properly. It is likely that they hire the right people, but then the most commonly recommended security policies were considered but not implemented due to resistence from powerful non-security team members inside the organization. (Usually, the highly paid CISO is playing politics with peers to keep the job by ignoring those security experts). If it also possible that the IT+security team is incompetent and is only good for deploying expensive but useless vendor solutions that do a lot of security theater but do very little to improve actual security. Also possible that the vendor solutions are susceptible to be misconfigured easily to become insecure. Public cloud solutions can help overcome these above shortcomings of in-house security+IT teams in a org politics friendly manner.

AnthonyMouse 6y ago
> Public cloud solutions can help overcome these above shortcomings of in-house security+IT teams in a org politics friendly manner. The problem there being that the choice of "public cloud" is subject to all the same forces, so then the vendor with the best corporate marketing team gets the business even if their security is crap.