4 ms·

I was in a meeting the other week where moving a bunch of computing services to the cloud came up. The local vendor was making great hay with the ability to ass

by zmmmmm 13y ago

I was in a meeting the other week where moving a bunch of computing services to the cloud came up. The local vendor was making great hay with the ability to assert that data stored in their cloud infrastructure would not leave our (non-US) state and their company was outside of any foreign legal jurisdiction (ie: not Amazon). But I think the impact is actually far worse, because nobody actually cared whether it was US based. PRISM has not destroyed US business, it is destroying the cloud computing business everywhere, because nobody trusts that a) their own government is not in cahoots with the NSA anyway, or b) their own government is not even worse than the NSA. Cloud computing has been one of the great revolutions of the last 10 years, and has seriously lowered the barrier to entry for large scale computing, dramatically boosting innovation. I think PRISM may well set us back 5 - 10 years in terms of migrating services to the cloud and the cost of that is pretty much immeasurable.

rdl 13y ago
We're only a few years away from having technology which could make "the cloud" provably trustworthy. Plus, just because it's in your own datacenter today, doesn't actually make your infrastructure trustworthy, either -- incompetence tends to be a greater risk, including staff malfeasance, outside of professional IT organizations (cloud providers). There is technology (hardware and software) which can make the cloud more secure on every dimension than what people have today (and which can be applied to on-premises as well). There just hasn't been enough demand for it in the past.
flatline 13y ago
In some spheres the market is already swinging back towards the "private cloud", where the technologies hammered out from large scale cloud computing are available as commodity software and hardware solutions. And so the cycle continues...if innovation slows in one area, it will pick up in another. Perhaps it will be a net boon for the cloud in the long run; some other company opaquely housing your data has always been a problem, somewhat ironically, for government agencies, for instance, and certainly is for many private companies and individuals.
- deleted 13y ago
  [deleted]
  - dragonwriter 13y ago
    This is basically false as regards HIPAA, and I suspec the others as well. HIPAA from the outset has accommodated covered entities using third-party data service vendors under Business Associate Agreements, and there are cloud vendors prepared to operate under those, including Amazon.
  - atonse 13y ago
    Not true regarding FERPA. We have a system on AWS and our clients are ok with it given our security measures.
AsymetricCom 13y ago
It stands to reason that it'll give a 5-to-10-year head start for businesses who don't have anything to worry about from being monitored by the NSA. (Assuming there are such businesses)
rayiner 13y ago
Maybe I'm outing myself as a luddite, but I never understood the point of cloud computing for sensitive data in any case. If the system isn't end-to-end encrypted so it's only in plain text locally, I don't care whether it's the government can see it or some intern you hire to sysadmin for the summer can see it--I'm not putting sensitive data on that system.
- mpyne 13y ago
  I've had the same problem trying to come up with a business plan to outsource some of our tasks away from our stupid internal government IT... I can't think up a way to ensure that the sensitive PII that would be held on such a system stays securely accessible to our organization and to no one else.
- zmmmmm 13y ago
  Yes, it's funny, you would think end-to-end encryption would satisfy most concerns, but it does not. I don't know if that is because people don't trust / understand it, or whether it's legal (maybe you still go to the same prison if your patient data was stolen encrypted as if it was stolen unencrypted). It may be logistical (how do you keep track of the keys, what do you do if the encryption system you used later becomes compromised, or a rogue employee makes off with the keys, etc.). In any case, encrypting the data is not seen as a silver bullet to resolve the risks posed by cloud computing, and certainly nobody at all is proposing to shove data up to the cloud unencrypted - so that itself is not the issue anyway.
  - damarquis 13y ago
    I think it is mainly a logistical issue. The problem is that encryption keys are a single point of failure. IT practices at most businesses would have to be very rigorous before a design with a single point of failure for any significant part of the IT infrastructure could even be remotely considered. Changing business practices to decrease the risk of using end-to-encryption to an acceptable level has an associated cost which, at most companies, probably dwarfs the cost of its technical implementation.

by zmmmmm 13y ago

rdl 13y ago

We're only a few years away from having technology which could make "the cloud" provably trustworthy. Plus, just because it's in your own datacenter today, doesn't actually make your infrastructure trustworthy, either -- incompetence tends to be a greater risk, including staff malfeasance, outside of professional IT organizations (cloud providers). There is technology (hardware and software) which can make the cloud more secure on every dimension than what people have today (and which can be applied to on-premises as well). There just hasn't been enough demand for it in the past.

flatline 13y ago

In some spheres the market is already swinging back towards the "private cloud", where the technologies hammered out from large scale cloud computing are available as commodity software and hardware solutions. And so the cycle continues...if innovation slows in one area, it will pick up in another. Perhaps it will be a net boon for the cloud in the long run; some other company opaquely housing your data has always been a problem, somewhat ironically, for government agencies, for instance, and certainly is for many private companies and individuals.

deleted 13y ago
[deleted]
- dragonwriter 13y ago
  This is basically false as regards HIPAA, and I suspec the others as well. HIPAA from the outset has accommodated covered entities using third-party data service vendors under Business Associate Agreements, and there are cloud vendors prepared to operate under those, including Amazon.
- atonse 13y ago
  Not true regarding FERPA. We have a system on AWS and our clients are ok with it given our security measures.

AsymetricCom 13y ago

It stands to reason that it'll give a 5-to-10-year head start for businesses who don't have anything to worry about from being monitored by the NSA. (Assuming there are such businesses)

rayiner 13y ago

Maybe I'm outing myself as a luddite, but I never understood the point of cloud computing for sensitive data in any case. If the system isn't end-to-end encrypted so it's only in plain text locally, I don't care whether it's the government can see it or some intern you hire to sysadmin for the summer can see it--I'm not putting sensitive data on that system.

mpyne 13y ago
I've had the same problem trying to come up with a business plan to outsource some of our tasks away from our stupid internal government IT... I can't think up a way to ensure that the sensitive PII that would be held on such a system stays securely accessible to our organization and to no one else.
zmmmmm 13y ago
Yes, it's funny, you would think end-to-end encryption would satisfy most concerns, but it does not. I don't know if that is because people don't trust / understand it, or whether it's legal (maybe you still go to the same prison if your patient data was stolen encrypted as if it was stolen unencrypted). It may be logistical (how do you keep track of the keys, what do you do if the encryption system you used later becomes compromised, or a rogue employee makes off with the keys, etc.). In any case, encrypting the data is not seen as a silver bullet to resolve the risks posed by cloud computing, and certainly nobody at all is proposing to shove data up to the cloud unencrypted - so that itself is not the issue anyway.
- damarquis 13y ago
  I think it is mainly a logistical issue. The problem is that encryption keys are a single point of failure. IT practices at most businesses would have to be very rigorous before a design with a single point of failure for any significant part of the IT infrastructure could even be remotely considered. Changing business practices to decrease the risk of using end-to-encryption to an acceptable level has an associated cost which, at most companies, probably dwarfs the cost of its technical implementation.