5 ms·

It's not clear that storing data on physical devices which may be stolen is worse than storing it with a hosted service that is definitely accessible by a third

It's not clear that storing data on physical devices which may be stolen is worse than storing it with a hosted service that is definitely accessible by a third party, some or all of its employees, and anybody who slips through their security, of which you have limited knowledge and control. The common practice of storing data on internal servers is generally the most secure approach, and is also what "cloud computing" is primarily trying to replace.

anamax 17y ago
Are the security problems with a "hosted service" really all that different than the security problems with a hosting center? Rackspace (generic) folks have physical access to the machines and installed the OS or at least whatever you used to get the OS on the machine. How did you verify that they didn't install a trojan or root-kit?
- extension 17y ago
  With a co-lo, there are well defined demarcation points between customer and provider with regards to access privileges and security responsibilities. In the cloud, those points are vague to non-existent, depending on the category of cloud service in question.
  - anamax 17y ago
    > With a co-lo, there are well defined demarcation points between customer and provider with regards to access privileges and security responsibilities. And which of those keeps rackspace from installing rootkits before the OS?
    - extension 17y ago
      Towards the less "cloudy" end of the service spectrum, such a practice becomes professionally embarassing, a breach of contract and ultimately criminal. At the other end, you have things like Google App Engine which, as far as I can tell, are free to do whatever they like with your data and offer no service level or security guarantees. If criminal law doesn't put you at ease, run your own servers, as I originally suggested.
      - anamax 17y ago
        > ultimately criminal In other words, the answer to my question about which of the demarkation points provides security is "none of the above". Contract and criminal law apply to the cloud as well. As with every other kind of hosting, you must decide whether the contracts offered by a specific service suit your purposes.

anamax 17y ago

Are the security problems with a "hosted service" really all that different than the security problems with a hosting center? Rackspace (generic) folks have physical access to the machines and installed the OS or at least whatever you used to get the OS on the machine. How did you verify that they didn't install a trojan or root-kit?

extension 17y ago
With a co-lo, there are well defined demarcation points between customer and provider with regards to access privileges and security responsibilities. In the cloud, those points are vague to non-existent, depending on the category of cloud service in question.
- anamax 17y ago
  > With a co-lo, there are well defined demarcation points between customer and provider with regards to access privileges and security responsibilities. And which of those keeps rackspace from installing rootkits before the OS?
  - extension 17y ago
    Towards the less "cloudy" end of the service spectrum, such a practice becomes professionally embarassing, a breach of contract and ultimately criminal. At the other end, you have things like Google App Engine which, as far as I can tell, are free to do whatever they like with your data and offer no service level or security guarantees. If criminal law doesn't put you at ease, run your own servers, as I originally suggested.
    - anamax 17y ago
      > ultimately criminal In other words, the answer to my question about which of the demarkation points provides security is "none of the above". Contract and criminal law apply to the cloud as well. As with every other kind of hosting, you must decide whether the contracts offered by a specific service suit your purposes.