I agree that cloud hosting opens up many new vectors of attack, but I completely disagree about building the app from the ground up. The larger your app is, th

I agree that cloud hosting opens up many new vectors of attack, but I completely disagree about building the app from the ground up. The larger your app is, the less likely it is to be secure. A better strategy is to keep your app lean and mean, and build it off of existing security technologies which have proven to be reliable. But as we've seen with Heartbleed, some of your security measures will fail. Its important to follow the principle of least privileged, and to isolate your system as much as possible; for instance, Colin Percival uses stunnel to isolate OpenSSL from his webserver[1]. This solution is far from perfect, and it still puts your private key at risk in a Heartbleed-like event. But that majority of your user's data is kept away from OpenSSL; it limits your exposure. [1] http://www.daemonology.net/blog/2009-09-28-securing-https.html http://www.daemonology.net/blog/2009-09-28-securing-https.ht...