4 ms·

> Yes DynamoDB has an API, but I'd wager a AWS engineer with good security skills has looked at it carefully. Do you have an equally skilled security expert on

> Yes DynamoDB has an API, but I'd wager a AWS engineer with good security skills has looked at it carefully. Do you have an equally skilled security expert on hand to look at the datacenters stack and then same for whatever you're deploying on it? Is that AWS security engineer looking specifically at how your systems interact with DynamoDB? And how you have specifically configured your DynamoDB instances? And someone rolling their own infrastructure isn’t building out their own custom software to do it. They’re using software from other companies which also have excellent security engineers that have looked into how you can safely deploy and use their software. Now, it may be true that in recent times with the amount of money made in the cloud a lot of these vendors are using carrots and sticks to push you to their cloud offerings (often by making their on Prem offerings worse), but let’s not pretend that on-prem software is two cups tied together with a string or that moving to the cloud somehow alleviates the need to have in house expertise to ensure your cloud software is running correctly and securely.

Havoc 3y ago
Again, not all configuration is equal. In hosted services a lot of the decisions have been made for you, that reduces customizability and flexibility but also footguns. >They’re using software from other companies which also have excellent security engineers that have looked into how you can safely deploy and use their software. Of course. Even with well designed software the risk is much higher for the end user though. Deploying a cloud load balancer is pretty idiot proof. If I do the same via local nginx...configuration files, local firewall, file permission, maybe my distro repackaged it, did I set up the user right, am I updating it regularly, what about my underlying operating system security etc. And on top of that it's a once off configuration...it isn't battle tested by thousands running the same load balancer. It's not that it can't be done, but you do pay the price in complexity and engineering hours. >And how you have specifically configured your DynamoDB instances? Well yeah - I'd expect them to have thought through the possible permutations in reasonable detail, which is feasible given the limited customizability. If you're self deploying the possible combinations are endless. It's a bit like testing on android vs iphone. You can reasonably test against the 30 or whatever common iphones, but you're never testing against the 1000s of funky android hardware combinations out there.

Havoc 3y ago

Again, not all configuration is equal. In hosted services a lot of the decisions have been made for you, that reduces customizability and flexibility but also footguns. >They’re using software from other companies which also have excellent security engineers that have looked into how you can safely deploy and use their software. Of course. Even with well designed software the risk is much higher for the end user though. Deploying a cloud load balancer is pretty idiot proof. If I do the same via local nginx...configuration files, local firewall, file permission, maybe my distro repackaged it, did I set up the user right, am I updating it regularly, what about my underlying operating system security etc. And on top of that it's a once off configuration...it isn't battle tested by thousands running the same load balancer. It's not that it can't be done, but you do pay the price in complexity and engineering hours. >And how you have specifically configured your DynamoDB instances? Well yeah - I'd expect them to have thought through the possible permutations in reasonable detail, which is feasible given the limited customizability. If you're self deploying the possible combinations are endless. It's a bit like testing on android vs iphone. You can reasonably test against the 30 or whatever common iphones, but you're never testing against the 1000s of funky android hardware combinations out there.