4 ms·
I wonder if OP works in healthcare, after HIPAA passed encryption at rest was the buzz word of the decade as it was one of the primary requirement of HIPAA. Th
by bearjaws 2y ago
I wonder if OP works in healthcare, after HIPAA passed encryption at rest was the buzz word of the decade as it was one of the primary requirement of HIPAA.
The problem of course being, most health care breaches are on applications that aren't at rest so all the data was being stolen anyway.
From 2012-2021 I worked in health tech and on many calls with large customers and security questionnaires were on whether we were actually storing their data encrypted at rest. We even had to get audited for Aetna to validate encryption at rest (amongst other things). To me this seemed like such a joke of a requirement because all our data was in AWS, and breaches were far more likely from other avenues.
So to me this reads as a jaded SWE or CISSP who has dealt with how much attention this one attack vector is paid, but ultimately it is kind of a given now in modern cloud infra.
- CiPHPerCoder 2y ago> I wonder if OP works in healthcare No, I work in applied cryptography. When I joined Amazon, the team I was hired on was called AWS Crypto Tools (which owned the AWS Encryption SDK, among other developer tools), while another team was called Transport Libraries (which owned S2N). When I left in 2023, they started adopting more of the "Encryption At Rest" lingo for what was previously called Crypto Tools. I don't know if they landed on different verbage since then. > after HIPAA passed encryption at rest was the buzz word of the decade as it was one of the primary requirement of HIPAA. Interesting. Thanks for sharing.
- steelframe 2y agoIt sounds like you left pretty close to when Greg did? What precipitated that, if you don't mind my asking?
- CiPHPerCoder 2y agoAndy Jassy decided that it was time to Return To Office. I was hired in 2019 as a fully remote employee. This means my options in 2023 were a) move to Seattle or b) walk. I chose to walk. The leadership of the Cryptography org fought tooth and nail to get an exception for me, but were unable to do so. I still hold everyone in AWS Cryptography in high regard.