Can the Cloud Be More Secure Than Your Own Servers? (Video)

Sarah Lahav, CEO of Sysaid, believes "the cloud" can be more secure than keeping your software and data behind your firewall and administering it yourself, especially for small and medium-sized firms. Why? Because Amazon, Rackspace, and other major cloud and SaaS providers probably have lots more security experts and other IT people at their command than you do.

We've talked to Sarah before, and probably will again. She has strong opinions based on her experience in IT, and is happy to share those opinions. So take it away, Sarah...

Comments

No

[Anonymous Coward]

Next question.

Re:No

[halivar]

Here's the next question: which room do I have a better shot at breaking into: your server closet, or Amazon's data center?

Re:No

[OverlordQ]

Amazon's data center. Since they have more security experts and IT people there's more points of failure.

Re:No

[Anonymous Coward]

In addition, breaking into my closet is not worth the effort. Breaking into an Amazon's data center most certainly is.

Re:No

[halivar]

Is it? That's 3 layers of armed security, the each one under 24/7 surveillance. You have to get through each one. You would define worth rather by a risk/reward ratio, which makes that rinky-dink server closet a lot more tempting. Criminals seek low-risk opportunity targets.

Re:No

[Anonymous Coward]

wrong question. the correct question is "which room does the NSA have a better shot at breaking into: your server closet, or Amazon's data center?

Answer: They probably don't even have to break into the Amazon data center. They just tell Amazon to send them the data. To get into my server closet they need to get active, meaning surveying the place, make a plan, actually break in and hope I do not shoot them while they are at it.
This is expensive. It will make large scale data seizing prohibitively expensive .

Re:No

[Anonymous Coward]

Amazon's data center. You don't even know where my closet is. And you don't care. However, if I'm dumb enough to put my closet beside some black hat asshole hacker's, I might just be collateral damage.

Security by obscurity really is legitimate, sometimes.

Re:No

[rtkluttz]

Wrong question. Which one has many more failure points and more potential admins to go rogue. Inside jobs account many more security issues than outside hacks. With my stuff in my rack I can use open source and be relatively sure that it isn't pre-compromised from the day I install it like most hosted platforms and most big name software. I can encrypt using the encryption of my choice BEFORE it leaves my premises or touches any corporate client software that claims to encrypt it for me but still allows them to see it.

Re:No

[Anonymous Coward]

Incorrectly answering the question does not qualify you to receive another question. You struck out.

Re:No

[johnwallace123]

Not necessarily. Think about Edward Snowden, who had to pass through all kinds of security to get access to the data that he leaked. Would it have been easier for him to go to Initech and be their lead sysadmin, leaking all of their proprietary data? Certainly, but the perceived reward to him wasn't worth the risk of doing that. However, his perceived reward in leaking the NSA documents was so great that he undertook a concerted effort to undermine the many levels of security they had in place.

Note: I'm not advocating for/against Snowden. Just using him as an example that not every person goes for the lowest hanging fruit.

Re:No

[jeffmflanagan]

It's not just physical security. If your servers are connected to the Internet, and no security expert is reviewing your configuration, it's extremely likely that a cloud provider is more secure. Of course in-house servers with no Internet connection are the most secure, but most businesses seem to be Internet-connected these days, and too few focus on security.

Re:No

[MobSwatter]

Yes, advocating the cloud would no doubt bolster ones; "job security" these days. Next we will all be briefed on why putting all our eggs in one basket is so much better for your facebook account friends status, and national security. As if... Next up is how much better life is swinging from trees and fighting over low hanging fruit...

Re:No

[bickerdyke]

Depends on who you want to protect your data from. NSA may be guzzling every bit from any Amazon datacenter, but they won't (well, usually) ruin your company by selling your patent application to the highest chinese bidder a few weeks before you file it. And likewise, it does not take large scale data seizing to ruin you. It only needs getting hold of YOUR data.

But of course you're right if your data is of interest to the NSA more than to regular criminals. There is never such a thing as "more secure". There is only "more secure against X"

Re:No

[tompaulco]

Here's the next question: which room do I have a better shot at breaking into: your server closet, or Amazon's data center?

Breaking into a room doesn't get you access to a machine. Since it is on the cloud, you can feel free to break into the machine anywhere with internet access. Their IT staff might be better versed in how to secure a server, but part of the problem that I have with cloud services is the could service provider. How do I obfuscate my server such that Amazon can't get into it. The answer probably is: you can't. In my closet, I absolutely can.

Re:No

[Anonymous Coward]

Yes, your criminal organization has different requirements than an honest business, but most of us aren't involved in crimes that the NSA would get interested in. If this isn't just because of your paranoia, and you're really a criminal, maybe you should reconsider your line of work, or move to a less civilized country.
If it's just paranoia, try to stay off Slashdot and RWNJ sites, and talk to a professional about these beliefs of yours.

Re:No

[sexconker]

Amazon's data center.
  - Known location.
  - Many employees susceptible to bribery, trickery, and extortion.
  - No one would question someone snooping around at night since it's a busy 24/7 operation.
  - No one will shoot you when you break in.
  - No dogs guarding the area.
  - Susceptible to all manner of attacks ranging from cutting power, cutting data, tampering with cooling, etc. that would result in easier access (everyone running around trying to fix the problem, card scanner not working so they just let you in if you look like you're in a hurry and you need to grabs those drives ASAP or Bozos will have your head, etc.)

Rando house:
  - Which house is it?
  - Who is there right now?
  - Are they armed?
  - What am I looking for? A NAS device? A laptop? A computer?
  - Where in the house is it?
  - Is there a dog that will instantly alert when I get within 100 yards of the house?
  - Will a nosy neighbor see me peeking through the windows / trying to pick the lock?

Re:No

[sexconker]

Amazon's lunks aren't allowed to shoot you for trespassing.
A homeowner is.

Re:No

[RLiegh]

Yes, your criminal organization has different requirements than an honest business,

You're saying HIPAA compliance is criminal, are you? You're saying that protecting client/lawyer confidentiality is criminal, are you?

I don't think you've thought this out very far...

Re:No

[oh_my_080980980]

Because Chinese hackers can't hack into Amazon's data-center? So you're saying you're a first class idiot. Go it.

Re:No

[ichthus]

Who do you have a better chance of using social engineering against, for the purposes of gaining access to my data? Me at my home, or Amazon employee #43225 at Amazon's data center?

Re:No

[bickerdyke]

The original point was that the NSA doesn't even HAS to hack anything.

Re:No

[Anonymous Coward]

Most businesses don't run their servers in a residential neighborhood.

Re:No

[tnk1]

Breaking into your server closet is definitely worth it, if they have decided that you have data that they need. And you are no more able to resist the NSA than AWS would be. In fact, AWS probably has a better chance of fighting back against pseudo-legal actions that the NSA takes. Your company, unless it is another megacorp, would roll over almost immediately. That is, if they even needed to ask you for permission, which they probably don't.

AWS may be be less secure than we would like, but the safety of in-house security cannot be taken for granted.

I wouldn't use AWS for something I wanted to keep away from the government, but since I imagine most corporations are operating in a more or less legal fashion, the NSA is a non-factor for just about any business doing business on the Internet. And it is almost certain that they do as good or better at security than most in-house security teams because it is their business, not just a line item on the IT budget.

Re:No

[fahrbot-bot]

Who do you have a better chance of using social engineering against, for the purposes of gaining access to my data? Me at my home, or Amazon employee #43225 at Amazon's data center?

Of course, you mean Amazon "Independent Contractor" #43225.

Re:No

[mSparks43]

Exactly.

But she goes on to predict the fall of the cloud service providers.

She says
"we will be out of business if your data is not secure".

Ooops. Probably should of thought of that before you invested all those billions.

As an aside.
Amazon Web Services would cost $150,000 a MONTH for the computing power we bought about two years ago - with nowhere near that in initial investment.
So talking "cost effectiveness" is bullshit to.

This video smacks of desperation, they've finally caught on that the entire cloud business model is flawed.
That "big money" wont just hand over all their secrets to some unknown computer run by unknown people in some unknown country.

And "lots of small money" really can't be paying the bills.

For example:
Dropbox
Great while it was free
now less usefull than btsync
which is free to average joe.
And very cheap (and secure) for "big money".

I see the storm clouds of another impending dotcom crash.

Re:No

[The-Ixian]

I am guessing the home user (maybe not you specifically).

At least the Amazon employee has to sit through some security training on this stuff. Also, I am sure that the nameless Amazon drone does not have access to anything important anyway.

Re:No

[Anonymous Coward]

Not here one isn't.

Re:No

[tnk1]

I don't see why you think more admins are equivalent to more failure points. You need more admins and audit staff to have a proper program to secure data. Using fewer admins is the equivalent of wishful thinking. You're hoping that your few admins are more trustworthy, but you lack the resources to enforce it because you can't separate duties. A large cloud company can enforce that precisely because they have more staff.

I've worked for companies where there were only a few admins, period. There was no separation of duties for their data center, except maybe on paper. Any of the admins had complete power to grab anything they wanted and there was no staff that could adequately audit the logging and monitoring infrastructure to prevent the admins from simply disabling the logging and security monitoring. Extrusion of data was a piece of cake. All that was needed was motive to do so. Luckily, no one really cared to do so, but that was mere luck, not a security program.

Larger cloud companies run regular compliance audits and have enough staff that separation of duties is something that really happens and can be made to work. For small and medium businesses, those cloud companies have objectively better security precisely because they can specialize their staff and realistically only grant access based on least privilege. There are checks and balances, and not all rights are in the hands of all powerful admins.

Now, if you work for a big company, your IT staff may be at a level to support a comparable security program, but that will be because you have more admins, not less.

As for "pre-compromised" open source, do you really inspect and compile all your OSS software? Extremely doubtful. Do you think that a large provider would purposely install compromised binaries or allow them to be installed by someone else?

I understand that physical access is everything, but are you actually carrying out your carefully scrutinized software checks, or are you simply pointing out that it is possible to do so. Because, while anyone can compile their own OSS code, rarely have I seen anyone actually do that unless they need to, let alone run a code audit for vulnerabilities unless you're talking about the very highest security levels. For most SMBs, your argument is bogus precisely because they never actually take advantage of their ability to do so. They don't have the time or the staff or the expertise to do so.

The worst part of all of this is that many in-house IT groups understand that they theoretically have more ability to control their own environments, but utterly fail to actually do so, because they can't get the resources nor do they have the motivation to do so. In the end, it just engenders a false sense of security.

If you take the great number of SMBs in the market and add them to AWS or Azure or whatever, even though you might be theoretically opening them up to some issues, you will be realistically improving their actual security posture by a significant amount because now there is actually a real security program in place for their assets and data where there was not one before.

Re:No

[suutar]

actually, turn the question around: "Can your servers be less secure than the cloud?" That's pretty much got to be "yes", though it would be rather embarassing.

Re:No

[Anonymous Coward]

Answer: They probably don't even have to break into the Amazon data center. They just tell Amazon to send them the data. To get into my server closet they need to get active, meaning surveying the place, make a plan, actually break in and hope I do not shoot them while they are at it.

Theyll just come over and take what they want. Honestly this ridiculously childish idea that you have some unbreakable security and you will kill anybody that tries to break in to your server is hilarous! I suppose it's no surprise to see so many security breaches when the the average slashdotter thinks they are some gun-toting, security cowboy.

Re:No

[Stone316]

What does it matter if Amazon has 100 or 1000 more IT personal than you?

The more I hear about cloud, the more I realize that everyone isn't talking about the same thing and truly doesn't understand it. Are you hosting your applications in someone else's datacenter and still maintaining them yourself? Are you paying someone else to support them? Or are you using hosted applications such as Salesforce.com?

The bottleneck in most part isn't the IT resources, its the failure of management to let their resources do the job properly. So in alot of cases it doesn't matter if you maintain your own server room or in the cloud. If your management won't allow downtime for security patches, or what not, then it doesn't really matter where your applications are. Unless your used hosted applications and have no control.

Cloud has nothing to do with who can do it better, but management taking a layer of risk off their own shoulders and making someone else liable. Speaking as someone who supports applications hosted in the "cloud".

Re:No

[fustakrakich]

I don't see why you think more admins are equivalent to more failure points.

It depends if they are serial or parallel...

Re:No

[Anonymous Coward]

No. The Cloud is NOT, nor will it ever be more secure, because it's not under your control. If you are a Medical or Government related business, storing private data in the cloud is suicide. It's not the blackhat brute-force hacker that you need to worry about, it's the idiotic management who doesn't vet the people who have access to the cloud.

A million records at a medical insurance company going missing is the result of staff accessing that data on a laptop and the laptop being stolen without the credentials of the staffer being revoked within seconds of it being stolen. Ever see how slow "corporate" security is? By the time that employee reports that laptop stolen, the damage will be done because they are more worried about being fired and trying to recover the laptop than trying to prevent the laptop from being misused.

This has happened... repeatedly. If you really think AWS is more secure, please quit your IT job and go work at McDonalds. Go look at all the current botnets and look at how many IP addresses are owned by cloud hosting or are Tor End nodes. A "botnet" inside a cloud service has free run of the cloud service network, so cloud services are less secure. Period.

Re:No

[Anonymous Coward]

That's 3 layers of armed security

Wait, the media keeps telling me guns are bad! You mean they're useful for protecting things from bad guys?

Re:No

[Antique Geekmeister]

> With my stuff in my rack I can use open source

I'm sorry to say this, but "so what"? Many vulnerabilities are due to tardy or inconsistently applied software updates, architecture, shared passwords, plaintext stored passwords, and unsanitized inputs. And many business, educational, and private environments say "we trust the people we work with" and apply _no_ security steps beyond their own border. The base OS images templates are reasonably good, reasonably well integrated, and their ability to handle "Virtual Private Clusters" gracefully encourages the use of genuine, maintainable "demilitarized zones" for exposed services. Coupled with the robust snapshot and system transfer capabilities, and genuine multi-zone hosting, and you're in far better shape.

There are some policies I'd change, but they're mostly human ones: The S3 storage is not a replacement for a secure, managed backup system, and the firewall configuration tools are fairly fragile. But they certainly beat most working environments I've encountered in decades of IT service.

Re:No

[ranton]

As an aside.
Amazon Web Services would cost $150,000 a MONTH for the computing power we bought about two years ago - with nowhere near that in initial investment.
So talking "cost effectiveness" is bullshit to.

Well that is bullshit. $150k a month is about 1000 m3.2 x-large EC2 machines. That is the equivalent of about 800 XEON E-5 2670 v2 processors, 30 TB RAM, and 160 TB SSD. Double that for similar availability, and you are looking at about $4 million to buy equivalent hardware. That comes out to $110k per month amortized over three years (standard for a data center). And considering server cost is about half the cost of running a data center, not counting personnel, that comes closer to $220k per month to do it yourself. I'm not sure how much personnel it takes to maintain 800 servers, but that will probably be at least $50k-$100k per month.

These are all just rough figures and your use case may vary, but there is no way you can provide the same level of service as Amazon for significantly less cost. Not when counting in all costs, such as networking equipment, bandwidth, power distribution and cooling, personnel, etc. Amazon's scale is simply too great for almost any company to compete. If there were great cost savings to be made, there would be far more companies offering cloud systems for a fraction of what Amazon / Microsoft / Google charge. And there aren't.

Re:No

[aaronb1138]

You're too late. Her message isn't for the technology elite and knowledgeable implementers. It's meant for the technologically moderately literate and illiterate CIOs and CTOs who have enough ethics still to question outsourcing to South-East Asia and Cloud hosting.

It doesn't matter how good the network security team at Amazon is when management is actively designing around the use case of the most security compromising end users: Software Developers.

The funny thing I can't believe is that the smaller, more ethical, higher performance, and higher cost Cloud hosts aren't bundling pentesting and remediation with those ASAv's, Check Point open servers, and Juniper olives. It's a no-brainer upsell where remediation and compliance can be part of the monthly fee or an hourly / fixed fee post-scan offering. Security is ALWAYS an easy sell after you hand the CIO the results.

Re:No

[Lennie]

You are right, the NSA probably already have legal access Amazon:
https://media.ccc.de/v/31c3_-_...
https://media.ccc.de/v/27c3-42...

Re:No

[mSparks43]

We're on a large group of X5680's with about 2 times that in storage (SAS), less in CPU.

And the hardware was 2 orders of magnitude less than $4million.

There was a big cost overrun on cooling (was much harder than expected), but as one off costs the whole kit paid for itself in the first month, that's been good for a while now:
http://i67.tinypic.com/mr8v3o....

Personell - virtually nothing - especially given the personell they replace, everything is pretty much fully automated.

So should probably get something more than "rough figures" for how much it would cost. because they are way out.

Dell gives significant discounts for bulk orders.

Re:No

[Anonymous Coward]

Well - glad my company is not based in America then...

Re:No

[EvilAlphonso]

Having worked in that sort of places, there's a mandatory 1 hour training once a year. The contents of which are promptly forgotten about 1 hour after the mandatory test happening at the end of the training.

Re:No

[TheRaven64]

There was a vulnerability found in Xen a couple of weeks ago that allowed any PV guest running on any version of Xen released in the last 7 years, to map the whole of physical memory and tamper with the contents of any other VMs. This is, what, the fourth such exploit in Xen in the last year? Many of the others came from QEMU code, which was never intended to be used in security-critical situations. VMWare and HyperV almost certainly have similar issues, though they may not be so public about announcing them.

You may trust Amazon more than your own badly treated and underpaid IT staff, but do you also trust all of Amazon's customers more than your IT staff? Even if you're using VMs for your local deployment, the odds are that you aren't running VMs from third parties on the same physical hardware as your own VMs. If you host your stuff in someone else's cloud, then you aren't just trusting them, you're trusting either that their hypervisor is bug-free or that their other customers are all trustworthy.

Re:No

[ranton]

We're on a large group of X5680's with about 2 times that in storage (SAS), less in CPU.

If this is the case, then your figure of $150k per month seems also way off base. You say you needed about 320 TB of HD space, and considering you said you spent in the order of magnitude of $50k that is obviously not SSD. That comes to 14 d2.4xlarge storage optimized machines, which costs $8600 per month.

Where on earth did you get $150k per month from if your computing needs could be handled by around $50k of hardware?

Also, I'm even curious how you get 320 TB of data with high availability for $50k. Even without thinking about failover or backup, 160 4TB hard drives in RAID 1 in Dell Poweredge R730s would cost about $83k. I'm not sure what their SAS pricing is, but since the hard drives would be $50k if you build the machines yourself I doubt it is much cheaper. That is just for the hard drives, not counting processors, RAM, etc, and certainly not counting cooling, networking equipment, backup, and failover machines.

So should probably get something more than "rough figures" for how much it would cost. because they are way out.

You can add whatever details you want to my rough figures, but it will always end up with AWS not being orders of magnitude more expensive than doing it in house. The only cost savings are going to come from having less availability. My guess is you are not factoring in the cost of fail-over or redundancy because you are not in an environment that needs high availability, and in that case you are comparing apples and oranges.

Re:No

[pnutjam]

I think your inadvertently highlighting another of the cloud problems. How much does it cost? It's difficult to judge ahead of time and there is risk that you will over utilize and spend a boatload more then you intended. That's not a risk on my own hardware.

Re:No

[pnutjam]

The " the technologically moderately literate and illiterate CIOs and CTOs" will fail if they don't include someone who know tech and security. It's only a matter of time. They are not going to get that level of service from a cloud provider. They will have more opportunities to open holes and overspend. The cloud is not a security panacea, it still requires significant planning to ensure security and robustness.

Re: No

[mSparks43]

Only slight less in cpu.
I'm getting he 150k from
testing before we bought new hardware.

We spent about $15,000 in 2 weeks.
For the equivalent of the hardware we were already running.

Which we then bought 5 more batches of.

Re: No

[mSparks43]

Bleh bit sleepy.

4 more batches for 5 in total.

Some other things we found.
Internally we are on a mix of 10gb and 1gb ether net.

On aws save performance was abysmal. Some jobs that would take about an hour on what we had were still running a day later when we tested aws.

Debugging was also a nightmare. Because watching the events in real time on our kit slowed everything to an absolute crawl trying to watch them over the Internet.

That was a few years ago. I'm sure they have improved and got cheaper since then.

But trying to do that securely over the Internet on hardware in an unknown location with access by who knows who and monitored by god knows what nsa abomination...

Actually.
That was the other thing.
I was mostly against going aws because I was convinced the nsa were doing.
What Snowden leaks proved they were doing.

Got a lot of criticism for that. Apparently I was overly paranoid. I'd of gone with our own kit even if it was more expensive. If it wasn't we'd of been on aws and had to leave afterwards. The level of vindication I felt when news of those leaks broke can't be over exaggerated.

Re:No

[tnk1]

Seriously. Do you even know how AWS works?

No. Botnets are run on the client OS'es and VMs. You could have a million compromised AWS client servers and still not be in danger yourself. You certainly do not get access to the whole "AWS network" internally because just because some client has malware running in a VM.

Yes, clients have a need to secure their own VMs and software, and if they don't, they get malware, just like every other machine. That does not spill down into everyone else's VM automagically. You need to be attacking their hypervisor or management processes to get general access to other people's stuff. Even then, it's not that simple.

There are ways to potentially jump between tenants on a Cloud service, but normal botnet malware is not one of them.

Point being, you can be infected by malware in the Cloud or in-house with an equal probability because you can make the same mistakes on your tenant instances in either place.

However, the piece of the puzzle an AWS takes over, for instance physical security, hypervisor security, much of the network device security are pieces that in-house groups frequently manage inadequately.

As for medical records, I agree the Cloud isn't necessarily right for high sensitivity items like that, but that is true *if and only if* your operation is taking the steps to actually do more than AWS would do. An in-house setup where you store medical or other highly classifed information is no safer than the Cloud just because it is in-house. Period. You have to actually take the steps to take advantage of those inherent benefits. If your security program is actually just saying that you're in-house while doing less than AWS, you're selling security theater and FUD.

In the case of highly sensitive data, you are a target whether you're on an AWS or not, because they want the data you have, not because you were on AWS and somehow "easier". Being in-house doesn't make you invisible. A Sony or an Ashley Madison both had shit security practices and both would have been hacked whether in-house or in the Cloud because of that, and nothing else. They might as well have had their stuff in the public cloud and saved themselves some money for all the good their shitty in-house network was to them.

Re:No

[tnk1]

I agree that in the general sense there is a certain level of IT staff where it no longer matters how much IT staff you have as long as you have qualified people who are executing the right tasks.

However, when we talk about SMB, we're talking about businesses that generally have a very small IT staff. Small enough that the amount of IT staff a cloud provider has allows for process and practices that those in-house groups simply can't (or won't) replicate with their small staff.

Now, if you're a big player with dozens of admins already that are being used under a proper security program, then you're capable of doing all right. At that point, you evaluate if you are then doing *better* than the cloud provider. Being in-house has advantages over public clouds in some respects, but is your security program actually taking advantage of those practices? Or are they just feeling more emotionally satisfied because they can touch the server?

And at the point, what is the cost? You're paying a bunch of IT security people, sysadmins, and operators salaries to effectively duplicate the effort that a Cloud brings you for less operating expense. As long as your team is even of equal quality to the AWS team, you're wasting money unless you are very specifically using those in-house advantages. And those are fewer than people want to believe, precisely because if you're connected to the Internet, it doesn't matter if you are housing your machines in a vault surrounded by a bunker, guarded with tanks, you're still open to attack if you screw up your configuration.

Congratulations, you're spending possibly hundreds of thousands of dollars more so you can watch your own security camera footage of your own racks of servers. If you even set that up and bother to review it regularly to begin with.

Re:No

[ranton]

I think your inadvertently highlighting another of the cloud problems. How much does it cost? It's difficult to judge ahead of time and there is risk that you will over utilize and spend a boatload more then you intended. That's not a risk on my own hardware.

You only have to worry about variable pricing if you use spot instances, and there are controls on how much you spend. You reserve a certain amount of computing resources, and if you go over that you run out of hard drive space, max out at 100% CPU utilization, or start paging the hard drive when RAM runs out. Just like with your own hardware. The bonus is you can easily increase or decrease your equipment, as opposed for waiting for new hardware to be delivered.

Re: No

[mSparks43]

Also

We paid about 4c or 5c a GB iirc.

Which is no more than $16,000 for 320TB.

Configured in raid 5 where we need fall over protection

And "raw" where we don't.

Have roughly 1TB of throughput a day in peak usage. So most of the data gets thrown away. Everything we can cache reduces the time for a job to complete.

Re:No

[Anonymous Coward]

No shit. I didn't WTFV (jesus christ)!!!! CEO of a cloud based company telling me they are better than me. OK, whatever...fuck off! No self interest there.

Re:No

[Anonymous Coward]

If the NSA or some well-heeled government/corporation wanted in my server closet, I'm fscked.

However, my main threat is some group compromising a cloud provider, stuffing the juicy tidbits on pastebin, and then making a huge torrent of everything else. Most likely done under the excuse of "hacktivism", but most likely because the target company didn't pay up when the extortion notice was served [1].

So, the server (or more aptly, the servers, as I am using two compute nodes with a backend NAS for a NFS backing store ), is not as redundant and secure as a data center, but with offsite backups sent to a remote place via duplicity, security isn't 100%, but it protects against both the meth-head scooping up the equipment in a burglary (as it is encrypted on the NFS server), as well as the mass grabbing of data if a cloud provider gets completely breached.

[1]: Even though BitCoins are 100% non-anonymous, one can do a lot of shell games with wallets, converting into alternate currencies, and other items to launder them.

well, i'm convinced

[fattmatt]

"...probably have lots more security experts and other IT people at their command than you do" well, i'm convinced ... here's all my data!

This is stupid.

[SecurityGuy]

Can the cloud be more secure than your own servers? Yes.
Can the cloud be less secure than your own servers? Yes.

Re:This is stupid.

[Anonymous Coward]

Can the cloud be more secure than your own servers? Yes.
Can the cloud be less secure than your own servers? Yes.

cloud greaterThan own
cloud lessThan own

You forgot one case (cloud equalTo own): Can the cloud be equally as secure as your own servers? Yes.

Re:This is stupid.

[Anonymous Coward]

Can the cloud be equally as INsecure as your own servers? Yes

FTFY

Re:This is stupid.

[__aaclcg7560]

Quantum security - just what we needed.

Re:This is stupid.

[Attila Dimedici]

That is close to what I wanted to post.

Q:Can the cloud be more secure than your own servers?
A:Of course it can

A much more important question is:

Q:Is the cloud more secure than your own servers?
A:That all depends on how hard you are willing to work to make your servers secure.

Re:This is stupid.

[vitaminyes]

Exactly!

Re:This is stupid.

[Anonymous Coward]

Completely agree and well stated!!

Re: This is stupid.

[Anonymous Coward]

Your both secure and insecure until you check?

Re:This is stupid.

[martinfb]

Further: It is possible for cloud companies to cooperate with government requests for info, where your own servers COULD be configured to protect against that. It is prudent to never trust any cloud service with sacred data!

Connection stability

[Anonymous Coward]

Guess what it costs me to have a connection so stable that it never goes down?

As it turns out, it is far more (measured over 5 years, the length of our ISP contracts) than proper redundancy in my equipment costs.

Airgap your servers if you want them secure

[Anonymous Coward]

Airgap security is the only true way to keep system's secure from external threats.

Re:Airgap your servers if you want them secure

[Anonymous Coward]

Airgap security is the only true way to keep system's secure from external threats.

There are several in the wild examples of air gapped systems being infected. And even of establishing command and control communication to air gapped systems.

Re:Airgap your servers if you want them secure

[tnk1]

Stuxnet, anyone? How safe were those centrifuge controllers from infection? Not at all. No one infected them from the Internet.

Oh, well then...

[Anonymous Coward]

Words like 'probably' and 'lots' sure do inspire confidence.

Your Data is worthless

[Anonymous Coward]

Amazon, Rackspace, et-al don't give a shit about your data.

They care about the data your data generates. That is backed-up, carefully guarded and controlled. Your data on the other hand, it stored on the B and C grade disks, tapes and run on any old CPU in the farm that is past it's prime.

Centralized data is great, for hackers. One target, lots of data, lots of reward. Targeting that one user, with the firewall? Not so much.

Re:Your Data is worthless

[Anonymous Coward]

There's nothing wrong with reusing old hardware, use your own server if you want to have control over that.

Re:Your Data is worthless

[hawguy]

Amazon, Rackspace, et-al don't give a shit about your data.

They care about the data your data generates. That is backed-up, carefully guarded and controlled. Your data on the other hand, it stored on the B and C grade disks, tapes and run on any old CPU in the farm that is past it's prime.

Centralized data is great, for hackers. One target, lots of data, lots of reward. Targeting that one user, with the firewall? Not so much.

I don't care what grade disks my data is on as long as they don't use it. I several hundred TB's of data on EBS volumes (magnetic and SSD) and haven't lost any of it in the 3+ years it's been there. I have thousands of terabytes of data on S3 volumes and haven't lost any of that either.

I have, on the other hand, lost data that was stored on local ephemeral volumes when instances stopped working and had to be restarted, but that was no surprise since they is a reason they are called "ephemeral" disks.

If AWS can store data on cheap disks while still providing reasonable access times and durability, well good for them and good for me.

Re:Your Data is worthless

[darkmeridian]

No, you're wrong. Look at Cryptolocker and all the other random ransomware/malware/spyware. Lots of easy money out there going after consumer-grade "security". Heck, Synology had a huge ransomware scandal because of lax security. Do you really think the average guy who clicks on all the attachments to his emails is not going to get rooted and punted?

Depends, do you have a dedicated security team?

[Anonymous Coward]

If you are managing your own server and have a 24/7 *dedicated* security team, then you probably can keep your servers as safe as Amazon and other serious cloud providers.

If you think you are safe because you are a master of setting up and updating your Linux distro of choice, you are not.

Re:Depends, do you have a dedicated security team?

[Junta]

Problem being that if you do not take care of your security, you are also likely to not take care of your own security in your cloud instances.

For example, not too long ago some company got bit by leaving something wide open in how they set up their EC2 instances.

You cannot sprinkle on security as an afterthought either way, security is a factor that must be kept in mind as you do the design.

Re:Depends, do you have a dedicated security team?

[tnk1]

True. A cloud provider protects *part* of what would be considered a data center, but it does not protect your poor software configurations or shitty code from compromise. And if you open up your security groups/ACLs to everyone, you will be open to attack.

You still need competent IT security for a cloud installation. What you don't need is a data center of your own.

But...

[TiggertheMad]

While a cloud server has more security resources, they also have more professional hackers targeting them, since a single exploit has a good chance of bagging all the cloud provider's customer data. Think attacks like the Sony breach were bad? Just wait until you can get Sony, Microsoft, Facebook and the state of Ohio all at once because they happen to be hosted by the same cloud provider.

OTOH, perhaps that might just be the best place to be when a zero day drops. A cyber criminal won't likely bother with a small business and just go straight for the 23 terabytes of customer data on the next rack over...

Re:But...

[Anonymous Coward]

While a cloud server has more security resources, they also have more professional hackers targeting them, since a single exploit has a good chance of bagging all the cloud provider's customer data. .

That is a very unsubstantiated claim, hackers are also well known for going after the easiest targets that still net good value, and there is a lot of companies with valuable data running setups that are a hell of a lot easier to compromise -- and keep compromised undetected over time -- than the big cloud providers.

Also when you hack someone on Amazon you don't hack all servers on Amazon, as you imply. I have never seen any serious security experts that have looked at Amazon infrastructure consider that a risk, when they usually are not shy about claiming security risks, but please feel free to cite some.

Re:But...

[Anonymous Coward]

You shouldn't talk of citations and unsubstantiated claims when spewing bullshit. There have been many reports of cloud providers giving up the goods due to just one exploit, Amazon is no exception.

The fact is that a zero day is likely to be patched in a hurry so experienced attackers hit the largest target they can. Thinking anything else is naive ignorance.

Re:But...

[tnk1]

So... Sony got breached in-house. Are you saying the Cloud companies would do a *worse* job?

Also, it is a fallacy that access to the AWS "datacenter" gives you access to everything. They have numerous network segments, firewalls, loads of servers, and multiple actual physical locations. Chances are, your hacker who does get access gets access to a segment that they don't even know what that segment contains.

And there is petabytes of data. I suppose they can spend a few years trying to figure out which set of bits is the segment they want, but frankly, I doubt they would. Perhaps they access the Management console. Which account ID is Sony? Which one is WhateverCompany? Can they figure that out before the hole is closed? Maybe, maybe not.

Hackers are still going to do what they already did: target specific companies and/or scan all IPs for basic vulnerabilities. Sure, someone is going to try and hack AWS, but what do they get out of it? In this case, I believe there is safety in numbers. It's a more central target, but it is a huge target to digest.

It may well be that Sony can get hacked in AWS, but if they're going to get hacked, they might as well pay less to get hacked than to pay the salaries of their clearly incompetent administrators and IT managers.

Re:But...

[Anonymous Coward]

Well - If you are a company that's not based on American soil, it is less secure to store your data on something like Amazon.

As Amazon can be legally forced to hand over all your data, but America has no jurisdiction in your home country, your data is probably more secure locally.

Re:But...

[Anonymous Coward]

There have been many reports of cloud providers giving up the goods due to just one exploit, Amazon is no exception.

Please point to just one incident of Amazon being hacked at a level that have led to anything close to "bagging all the cloud provider's customer data". Since you claim there have been many reports of this that should be easy.

Because they don't outsource to the lowest bidder!

[Anonymous Coward]

Oh wait, they do. Never mind. The (overused buzzword) Cloud is safer if you presently hire delinquent Nigerian children to protect your data and you host it on Brazilian porn servers.

Flash is perfect for security related videos

[Anonymous Coward]

That is where I get all of my information about how to operate securely: videos produced by security professionals and distributed through Flash.

How can the "Cloud" be more secure?

[fustakrakich]

Somebody flashes a badge, and they just hand your shit over, no questions asked... if they know what's good for them.

Re:How can the "Cloud" be more secure?

[subanark]

And you better believe that Amazon/Microsoft/Google are much better at telling the government "no" than your average small business.

Re:How can the "Cloud" be more secure?

[fustakrakich]

They put on a better show. What they say and what they do can be two entirely different things. We will never know.

Re:How can the "Cloud" be more secure?

[Anonymous Coward]

I wish I could properly construct a joke about how good Hillary was at telling the government no when it came to raping her server...

Re:How can the "Cloud" be more secure?

[thegarbz]

Fighting a lengthy court battle in the name of privacy of their clients is quite telling.

Re:How can the "Cloud" be more secure?

[fustakrakich]

Workfare for lawyers... We still don't know what they gave away. When the money this big calls, there can be no trust. We just don't enter into the picture.

Re:How can the "Cloud" be more secure?

[Anonymous Coward]

No, they are not better at it:

1) They are FAR FAR FAR more dependent upon having government contracts than the average small business is. They MUST, on some level, show cooperation.
2) They have many layers of management, ANY one of which can say "Yes" to them and it will require only ONE "Yes," while EVERY layer must say, "No," from the CEO down to the flunky in the data center. A smaller structure has better odds of getting No across the board.1
3) Any small businessman can begin with, "Let me see your warrant. No? Then you may talk to my attorney." Any serious seizure/guns out action will get into the public view.
4) Amazon. One target. Number of small businesses in the United States? You go figure it.

Re:How can the "Cloud" be more secure?

[thegarbz]

I'm inclined to give them the benefit of doubt. There's not too many companies out there that just throw shareholder earnings at lawyers because they have too much cash burning a hole in their pocket.

Re:How can the "Cloud" be more secure?

[Anonymous Coward]

Depends where your business is based..

Re:How can the "Cloud" be more secure?

[Agripa]

At least with your own servers, you *know* when the government seizes your data. Amazon/Microsoft/Google can just hand it over silently.

Re:How can the "Cloud" be more secure?

[subanark]

Except when your admin is issued a court order to turn over the data, and a gag order not to tell anyone. Does your small business have audit logging for read operations? Mandatory shadowing when working with data directly?

Big business have a reputation to hold up, and have the deep pockets to eat the court battles and potential fines for non-compliance. A small business has a major risk of going out of business for pulling a stunt like that. Very few will try and take the high ground. Plus, if the government raided a major business for data, it would be all over the news and the media would have a field day. No reasonable government official is going to push the envelope for that, and if they do, they ain't going to be with a job for very long.

Re:How can the "Cloud" be more secure?

[Agripa]

Except when your admin is issued a court order to turn over the data, and a gag order not to tell anyone. Does your small business have audit logging for read operations? Mandatory shadowing when working with data directly?

How would that work though? If the admin is discovered, fired, and the company asks for criminal charges to be filed (violation of the CFAA?), does the agency issuing the gag order intervene? What happens when the evidence is used in court and the defense asks how it was acquired? Because of the gag order, can the now fired admin even mount a defense in civil and criminal court? Ether would lead to revealing the gag order. Or do they just leave their agent out to dry? Are there any examples of this happening in real life? It strikes me as a good way to get lawsuits, adverse court decisions, and loads of bad public relations.

Big business have a reputation to hold up, and have the deep pockets to eat the court battles and potential fines for non-compliance. A small business has a major risk of going out of business for pulling a stunt like that. Very few will try and take the high ground. Plus, if the government raided a major business for data, it would be all over the news and the media would have a field day. No reasonable government official is going to push the envelope for that, and if they do, they ain't going to be with a job for very long.

Big businesses like Qwest Communications International?

A cloud services company is just going to hand the data over and if they do challenge the order, the customer is not going to know about it for years if ever. You cannot challenge a warrant for instance; the best you can do is get evidence excluded. Apple will also (and has in the past without challenging the order) hand data over to the extent that they can which is why they are pushing for user controlled encryption. They are under no obligation to do the impossible and so far absent statutory law, they are under no requirement to compromise their security.

Re:How can the "Cloud" be more secure?

[subanark]

The admin is given a choice, hand over data in secret or go to jail. A company would be on shaky legal ground for firing someone for following a court order.

For every big business you hear that they handed over data to the government, there are a dozen of small businesses that do so you don't hear about, as they just aren't news worthy. Pretty much every small agency that tried to oppose the government went out of business trying.

Re:How can the "Cloud" be more secure?

[Agripa]

The admin is given a choice, hand over data in secret or go to jail. A company would be on shaky legal ground for firing someone for following a court order.

We are not talking about a court order but something like an administrative subpoena. If a court order included a gag order, then the employee can be fired because they cannot say why they stole data. How can the company be on shaky ground for firing someone following a court order that they cannot be notified about?

What are they going to say? You cannot fire this person because of national security? That right there violates the purpose of the gag order.

For every big business you hear that they handed over data to the government, there are a dozen of small businesses that do so you don't hear about, as they just aren't news worthy. Pretty much every small agency that tried to oppose the government went out of business trying.

Businesses and individuals have to follow court orders and various administrative subpoenas. The discussion here is about *knowing* that the government seized your data and making sure that your data is legally protected as much as possible.

If you use a cloud provider, all of this goes out the window; you have already lost. Under the third party doctrine, the government can just siphon up all of your data with minimal justification and never notify you. If you do your own hosting, then you still have to hand the data over but at least you know about it and can take legal action. If they turn an employee into an agent, at least there is a chance of the agent getting caught.

Statistically, it's probably true

[Overzeetop]

In aggregate, it's probably true. Now, I'm sure *your* servers are more secure.

To make a transportation analogy, it is far safer to fly somewhere on a commercial airline than it is to fly a private plane. Heck, It's even safer to fly commercial than it is to drive. And yet I know a lot of people who are terrified of flying.

Don't get me wrong...someone is going to die in a commercial plane crash this year. And if you fly a private aircraft, your chances of dying in a crash of your own plane are exceptionally small - you'll probably never die in a plan crash if you fly yourself, tbh. But, from a statistical standpoint, you're still better off flying commercial.

Global Touble-Makers Vote: Yes

[snadrus]

Where have the past 2 years major data breaches occurred: Off-Cloud.
But what about adjusting for Cloud vs Off-Cloud %-usage: Still no contest.

Re:Global Touble-Makers Vote: Yes

[Hognoxious]

Where have the past 2 years major data breaches that we know about occurred: Off-Cloud.

FTFY.

Re:Global Touble-Makers Vote: Yes

[Anonymous Coward]

Good lord, is /. completely overrun by shills now? You might as well have included a company watermark in that unperson statement.

Most drivers are above average

[Overzeetop]

Most drivers consider themselves to be above average. Why would that not extend to server operators?

Um.... maybe... sometimes.... it depends

[Anonymous Coward]

Because Amazon, Rackspace, and other major cloud and SaaS providers probably have lots more security experts and other IT people at their command than you do.

But those experts aren't regularly upgrading software I run on their cloud systems to fix security holes, nor monitoring my sites for exploits. So their expertise buys me little--other than the underlying infrastructure hopefully will be sound. That's all. That's not lot. The majority of security bugs/holes I've had experience seeing exploited were holes in application packages (think WordPress). Unless you mean hosting your resources on a specific application hosting provider who handles all upgrades (i.e. a hosted WordPress provider in this example, who guarantees up-to-date bug fixes on WordPress and some set of commonly used plugins).

Re:Um.... maybe... sometimes.... it depends

[bickerdyke]

But those experts aren't regularly upgrading software I run on their cloud systems to fix security holes, nor monitoring my sites for exploits. So their expertise buys me little--other than the underlying infrastructure hopefully will be sound. That's all. That's not lot. .

Then by a plan where they do! If you rent out only infrastructure and still run your stuff yourself, there's not much difference to .. well.. running your stuff yourself. With all pros and cons.

Re:Um.... maybe... sometimes.... it depends

[tnk1]

Actually they *do* upgrade your software, if you know how to do it.

They provide upgraded images for you to use for your servers all the time. You just have to rip down your old servers and replace with the new images.

Sure, if you didn't write your app so it could handle coming up on new anonymous VMs every time, this is less possible, but to be honest, they provide huge capabilities for you to keep your OS and software up to date, you just need to be able to make use of the capabilities that are there.

Yes, they don't upgrade your running instance for you, but if you're using cloud servers like you used old rack mounted servers, you've missed the whole point of where we've been going for a decade now with VMs and software defined hardware and network.

Re:Um.... maybe... sometimes.... it depends

[Anonymous Coward]

And their security "experts" are not free, they will just bill you the time...

Re:Um.... maybe... sometimes.... it depends

[Anonymous Coward]

Actually they *do* upgrade your software, if you know how to do it.

They provide upgraded images for you to use for your servers all the time. You just have to rip down your old servers and replace with the new images.

Sure, if you didn't write your app so it could handle coming up on new anonymous VMs every time, this is less possible, but to be honest, they provide huge capabilities for you to keep your OS and software up to date, you just need to be able to make use of the capabilities that are there.

Yes, they don't upgrade your running instance for you, but if you're using cloud servers like you used old rack mounted servers, you've missed the whole point of where we've been going for a decade now with VMs and software defined hardware and network.

Sorry. But that's only semantic. Images and updates are also available for your local server farm. Apps don't even need to run on new anonymous VMs every time as the orchestration tools set up the new image. You also don't need the cloud to use VMs. Cloud provider have to fetch the updates from somewhere and if they aren't automatically installed by them and the process is handled by yourself, they don't beat colocation centers.

And what you actually said was that they don't upgrade your stuff. Just that they provide images you might or might not trust as much as the vendor's images.

Please fire the interviewer

[Anonymous Coward]

What... a terrible... interviewer. "Talk to us" -- What kind of an interview question is that? Geez this was painful to listen to. I think this is the first /. video I've bothered to watch; is this typical?

Cloud is less secure in one critical way

[alispguru]

If data is on my personal server and the US government wants to see it, they need a warrant.

If it's on a cloud server, they don't.

Re:Cloud is less secure in one critical way

[halivar]

But you encrypted your sensitive cloud^H^H^H^H^H data because you care about regulatory compliance and best practices, right?

Re:Cloud is less secure in one critical way

[cdrudge]

It's cute how you think that a warrant is going to stop them, or that it's not trivially easy for them to get if they want one.

Re:Cloud is less secure in one critical way

[Anonymous Coward]

Physical control is critical in more ways than search warrants. I pull the network cable (assuming no Wi-Fi connection), and the data is secure from all but physical attacks. This is useful for when I am heading out on vacation and have no need for access to anything personal or work related.

A cloud provider, I have no control of where the data is. I cannot just throw a switch and have it not accessible to all and sundry on the Internet. Encryption helps, but there is always metadata, and an attacker can find when data is accessed, and infer from that.

Not to say cloud providers are useless... but cloud storage needs to be treated as a storage medium, just like tape, disk, optical, or hard copy, with the advantages and disadvantages of that.

Re:Cloud is less secure in one critical way

[Anonymous Coward]

If US government really wants to see your data they'll get it no matter where you put it.There's always some loophole to exploit one way or another.

Sure, there might be servers that US gov can't break into, but dude, yours is not one of them ;-)

And why everyone is so obsessed with USA or governments in general? Do you all use your servers for illegal purposes? Or do you think that US government is really interested in your mystartup12345678.com data?

Re:Cloud is less secure in one critical way

[MightyMartian]

Not to worry. Encryption is going to be illegal soon!

Re:Cloud is less secure in one critical way

[ItsJustAPseudonym]

alispguru did not say that they would not be able to get a warrant. Only that they would need one, as per legal process.

Re:Cloud is less secure in one critical way

[tnk1]

That is all well and good for you personally, or even a one man business. However, no business I know of that has more than a few people is going to shut off their internet when someone goes on vacation. I don't think that's really a case that this person is trying to make.

Of course, in the cloud you're much, much less likely to permanently lose your data through misplacing it, or by theft, or search warrant in.

Cops want your physical data devices and PC? No copy of the data elsewhere? You're done. Copy in the cloud? Yeah, the cops will get a copy of it, they may even put a block on your account maybe, but you're getting the data back eventually, maybe even immediately. Same goes for theft, only you're even more likely to never get it back, ever.

Cloud storage is only a problem if your data is so secured that it cannot tolerate the risk of being stored elsewhere, even after you have taken the precaution of encrypting it. If you encrypt data in the Cloud and someone hacks in and steals it... you still have your data, and they have an encrypted blob.

Re:Cloud is less secure in one critical way

[Anonymous Coward]

The ancient philospher William Hicks understood the issue here. Some people think there is no difference between the freedom to burn the nation's flag if you wish to, and being forced to.

Re:Cloud is less secure in one critical way

[Agripa]

But if your data is located on a third party server, the requirements to seize it are less than if it is on your own server and you will not necessarily be notified. At least on your own server, a warrant is required and you will know when they serve you with it.

Real Security - or Security Theatre?

[Anonymous Coward]

Do they have:

-Rotating port knocking sequences?
-Logs?
-Custom firewall rules - ip blocking?
-Encryption?
-Reporting?
-Use Non-standard ports?
-hardware and software watchdogs?
-carefully controlled software?
-read only filesystems?
-Security Cameras?

Because these are a -few- of the security techniques I use.

More than likely though the are just as vulnerable to social engineering, probably even more so, than the average savvy user.

Show a badge, any badge, and some official looking paper work, and data/access is yours. All without any oversight too!

Re:Real Security - or Security Theatre?

[Anonymous Coward]

You sound like the "security" guy at my company. He implements all these security measures and declares himself secure, and neglects to consider the fact that a can of compressed air and an air of "I belong here" are all that's required to walk in, jack a device into our core network, and then just go sit out in the parking lot recording all the data he sees.

Signing keys? Oh those have to be air-gapped, stored in a big fancy safe, logged in and out, and all signing must occur on special read-only liveboot devices that were painstakingly constructed to be completely secure. You'll NEVER get our signing keys! Oh, unless you drive to his house, break in, and go through his kitchen drawers, where the USB key with the backup copies of signing keys are stored. Who needs a secure off-site storage service, when we have his knife drawer?

Re:Real Security - or Security Theatre?

[Anonymous Coward]

So like this?

https://xkcd.com/538/

Re:Real Security - or Security Theatre?

[tnk1]

I take it you have never been to a real data center if you honestly believe someone can just sort of walk into a cloud data center. You can't just walk into a secure facility with a security guard, man-trap and biometric scanners by flashing a badge. And that is just to get you into the general access area. The cages are usually individually locked too.

And yes, everything you listed is done by Cloud providers except perhaps the items that would need to be done by the tenant. And nothing stops you from doing that yourself on top of what they provide.

Read the FedRAMP requirements or ISO 27000-series. All of that is in there, and all of those providers have been third party audited that they comply.

Re:Real Security - or Security Theatre?

[thogard]

I've seen someone talk their way into real data centers so many times, i've lost count. One case the guy talked his way into the building then talked his way into the data center and then removed a servers from a rack that he didn't have a key for and took the server away.

Re:Real Security - or Security Theatre?

[Anonymous Coward]

It's just pretend security. Biometric scanners are easy to defeat.

Rent-a-cops will accept any badge you flash.

I've worked in a "real" security environment. Staffed by folks with sub-machine guns, following me EVERYWHERE. Server to Server, to the bathroom, breakroom, EVERYWHERE. That's real security, because if someone fucks up, millions-billions get lost.

In "pretend security" if someone fucks up, you get a month of free credit monitoring.

Re:Real Security - or Security Theatre?

[Antique Geekmeister]

> I take it you have never been to a real data center if you honestly believe someone can just sort of walk into a cloud data center.

I've done it, mostly by pretending interest in starting a contract there. "The cloud" does not necessarily mean data centers as robust, and expensive, as AWS.

Repeating Flaws

[Tablizer]

and other major cloud and SaaS providers probably have lots more security experts and other IT people at their command than you do.

That's true, but if a hacker figures out how to crack one system in the host's server farm, they can probably crack many of the rest because the hoster probably uses the same equipment, setups, and conventions.

Whether that factor outweighs the extra expertise is hard to say.

Why the fuck is this a video

[Anonymous Coward]

Why is this taking megabytes of bandwidth to convey a message that could take kilobytes? Is there something visual about this concept that can't be communicated in writing? Stop the dumbing down of of /.

Re:Why the fuck is this a video

[Anonymous Coward]

Is there something visual about this concept that can't be communicated in writing?

Yes, the interview subject is a reasonably attractive blonde woman, and they can't state that in the summary, but they'll let you see it in the preview image, which almost guarantees you'll click "Play," since you want to see if she sounds hot.

Don't be a dumbass.

Re:Why the fuck is this a video

[cascadingstylesheet]

Why is this taking megabytes of bandwidth to convey a message that could take kilobytes? Is there something visual about this concept that can't be communicated in writing? Stop the dumbing down of of /.

I'm guessing it might have something to do with her femaleness.

See?!? She's female and a geek! Female! Geek! See?!?

wow

[PopeRatzo]

This is like saying that Budweiser has better beer than a local brewery because they have bigger vats and more distributors.

I think the trick to security is not in how many experts you have, but in how willing you are to cut corners to increase profits.

Re:wow

[bickerdyke]

That is something completly differnt. Your example aims on size, but the article aims on expertise.

But even budweiser tastes better than my first homebrew. Not because they are big or small, but because I'm a bloody amateur (even if I had some decent brews by now) but they have people who learned how to make beer.

Re:wow

[Anonymous Coward]

Bud still sucks despite all that "expertise".

Re:wow

[tnk1]

Who is more likely to cut corners on a security budget?

A company that will live and die based on it's IT security reputation....
or the IT department of some random company that doesn't have IT as a source of revenue and IT security is therefore overhead.

There's always going to be some business or agency that needs to keep things in-house, but in no way is the Cloud model inferior to the laughable efforts of most IT shops today.

Re:wow

[chihowa]

Budweiser sucks because the goal of the company's management is to make it taste like that, but their brewmasters are actually very good brewers. (I have some friends who work at AB, so I've been able to try some of their small batches and little project brews.)

Expertise only counts for so much when the management hamstrings you and insists that you cut corners.

Re: wow

[Anonymous Coward]

Nice generalizations. Of course you have zero idea of the internal workings of cloud shops beyond the drivel their marketing people feed you, so your comparison is meaningless.

Re:wow

[SecurityGuy]

I don't think it's different at all. Corporations are made of people, and I don't care how big you are, the work is going to be done by a person who really can't possibly have more than a couple decades of experience, and the old experience is largely irrelevant anyway.

A cloud vendors expertise isn't necessarily better than mine or yours. If my next job happens to be at a cloud vendor, I'm not magically better at it than before because I work there, not here. If you're going to claim $CLOUDVENDOR has policies/procedures/practices that are distilled from many people's worth of experience, then you're right back to making an argument based on scale.

Re: wow

[tnk1]

Seriously though... time and time again in my own career and those of the people I know who work in this business I hear the same thing. You slap a security program on paper if you're lucky, and as soon as it gets in the way of revenue or development, the exceptions start flying.

I know cloud shops are audited to be compliant with security standards that I am personally familiar with. No one is saying that those processes are perfect or that they aren't able to present an audit compliance fiction, but compare that with the efforts that most shops put into that, and they still come out on top.

I've worked in IT and IT security for a couple of decades. I know that in the SMB market, it's a challenge to get the right expertise and any sort of process which audits and holds IT staff accountable for security process. That's because IT is overhead and IT security is overhead to the overhead. Everyone cuts corners at that level. I'm sure there are small shops that that security seriously, but by and large, that's the exception, not the rule.

wood...

[Anonymous Coward]

But I wouldn't be thrilled about it.

there experts are required to provide backdoors

[Anonymous Coward]

The problem with most of these providers do business in the US, or have assets there. This means that the quantity and quality of there security experts is meaningless, since they can be asked to step aside at any time, and must keep this fact secret from the customer.
Most of our NDA's force us to keep data as secure as we would keep our own private data, which makes it impossible to use these services, and notify immediately if there is a data breach. If we host data ourselves (using server software that we can inspect for backdoors), and a (local) judge orders us to give up the data, at least we know about it.
By now it's public knowledge that _all_ countries use espionage primarily for economic espionage, to give there own companies an advantage, so as a non-US company, you are the target, terrorist are just an excuse.

In the words of John McEnroe...

[erp_consultant]

YOU CANNOT BE SERIOUS!!!!

She is the CEO of a cloud based company. What the fuck do you expect her to say?

The real question is not...is the cloud secure? The question is...who is more likely to be a target of hackers?

Can cloud services be made secure? Of course it can. But it doesn't necessary mean that it is. It all depends on policies and procedures which you, as an end user, have absolutely no say in. And what happens if there is a data breach? You get a year of free credit monitoring. Thanks for playing. There is no implicit guarantee, or liability, on their part.

If you are a hacker who will you target? Me - with maybe a few credit card details or Amazon with millions or credit card details. The answer is obvious.

When it comes to the cloud I am reminded of the Tony Montano (Scarface) quote: "Who do I trust? ME!".

Re:In the words of John McEnroe...

[Anonymous Coward]

"She is the CEO of a cloud based company. What the fuck do you expect her to say?"

I thought CEO's that knew what their company did went extinct decades ago. Oh, wait.

Re:In the words of John McEnroe...

[Anonymous Coward]

It's entirely in her interest to say the cloud is more secure than on-premise. She needs to win business and that means, mainly, shifting people from on-premise to cloud.

Does she believe it? Probably. Can she point to appalling on-premise implementations? Of course, those are going to be marquee wins for her company!

However she's never going to see well-run on-premise setups where the company has no interest in public cloud options. And there's still the self-interest thing. And you aren't going to hear from her instances where her cloud offering maybe isn't fully up to snuff.

You certainly aren't going to hear about those National Security Letters she has received, with their accompanying gag orders. Makes no difference you say, an NSL is an NSL and you'll disclose either way? In fact there is a difference. You will know about the NSL you receive but not one she receives. Furthermore you can easily be dragged into an NSL that has nothing to do with you when you are dealing with a multi-tenant cloud provider. There's another risk you won't hear from a cloud services provider.

Re:In the words of John McEnroe...

[tnk1]

I will target *you* if I suspect that you have credit cards and a shitty security program. You personally may not be bad at security, but if you're working at an SMB, chances are that you have an insufficient program. It's the whole "look to the left and look to the right... two of the three of you have a bad security posture."

Sure, AWS has more credit cards, but all you need to have are *enough* credit card numbers for me to steal. Hacking AWS is real work and AWS doesn't have one file where its millions of credit card numbers are just listed. There are thousands of separate vendors all with their varying databases and levels of security.

Hacking small timers like you and twenty like you is easy. Don't assume that smaller is safe. If you can be batched with a bunch like you, then volume makes up for your shorter list of data. And your local cops can't help, and the FBI won't give a shit about you.

If you have a small time security program now, you're probably no safer in-house now than you'd be in the cloud, even if it is bigger target in general.

Re:In the words of John McEnroe...

[dave420]

So what if she's a CEO of a cloud services company - it doesn't mean she's incorrect.

If you hack into Amazon's AWS you won't get a directory with "creditcards.xls" and "passwords.txt" in it, you'll be faced with a network architecture you won't understand, with hundreds of thousands of servers you won't recognize, virtualized and sequestered in ways you've never heard of.

It would help if you understood what's being discussed before leaping into a rant about your imagination.

Re:In the words of John McEnroe...

[erp_consultant]

"So what if she's a CEO of a cloud services company - it doesn't mean she's incorrect." - I didn't say she was incorrect. But she is clearly biased.

"If you hack into Amazon's AWS you won't get a directory with "creditcards.xls" and "passwords.txt" in it, you'll be faced with a network architecture you won't understand, with hundreds of thousands of servers you won't recognize, virtualized and sequestered in ways you've never heard of." - Then why is it that data breaches happen so often? Even given that the credit card numbers are tucked away in remote locations and not in a single file, SOMEONE knows how to find them. I'm not claiming that I know where to find it, or that I even have the skills to do it. But there are people out there than can, and do, break into systems and steal stuff.

24/7 dedicated security teams...

[tlambert]

Depends, do you have a dedicated security team?

The security grunts are paid in Alpo, and the supervisors are paid in Meow Mix. I also pay their medical.

Re:24/7 dedicated security teams...

[micheas]

I wish I had mod points.

Probably not

[grimmjeeper]

Start with the fact that cloud services are big, ripe, juicy targets for anyone and everyone. Continue that there's probably never a time when their service isn't under some kind of attack in one way or another. Add in the fact that my server contains nothing of any real value to anyone but me. And extrapolate that to a very low likelihood that anyone would bother to take the time to attack my server. Consider also the fact that the cloud provider has to succeed 100% of the time to make my data secure while the hackers can fail almost forever and only have to succeed once.

I'm going to go with the fact that my data is more secure in my server at home than it would be in the cloud.

Of course, small businesses without a dedicated security teams are legitimate targets. But whether they store their data in the cloud or in company servers, their business internet connection is vulnerable to attack and provides a much easier road into the cloud storage than trying to directly attack the cloud servers. So realistically, the businesses accessing the cloud servers in bulk are a significant vector for attacking a cloud service. As a result, it doesn't matter where the business stores its data, it is no more or less vulnerable to attack in either location.

When it comes to large corporations, they are bigger targets but they have the budget to hire security experts just like the cloud provider has. So while they too are probably under constant attack 24/7/365, they are not necessarily any more or less vulnerable than the cloud provider.

So on balance, I'm going to go with no, the cloud does not necessarily make your data any more (or less for that matter) secure than not using it.

Re:Probably not

[cdrudge]

And extrapolate that to a very low likelihood that anyone would bother to take the time to attack my server.

An exposed server is scanned, if not "attacked" almost immediately anymore. Before moving the default port for my ssh server from 22 I had nearly a constant flow of attempts to break into my "home server". Seeing attempts to log in with usernames of administrator, oracle, mysql, dba, etc as well as common names always made me chuckle. Now I consider it a really lame attempt at breaking into my server, but I'd still say it was an attack.

Re:Probably not

[halivar]

Continue that there's probably never a time when their service isn't under some kind of attack in one way or another.

But this statement goes to prove that their security is better tested than yours. You're just hoping no black hats notice you, because if they do, you're toast.

Re:Probably not

[grimmjeeper]

They can have copies of all the pictures and videos from the Jeep trips I've gone on and they're welcome to my pron collection. That's about all I really keep on my server.

Re:Probably not

[grimmjeeper]

I don't have my server directly accessible to the outside ports. In fact, nothing from my router redirects into any of my home computers because I don't remotely connect from the outside world. I personally have no interest in enabling that functionality. Though that doesn't stop a Trojan Horse from opening up a port but that has to be initiated from the inside once I've downloaded it. And given the combination of ad blockers and script blockers I run, that's unlikely.

Re:Probably not

[Fwipp]

Add in the fact that my server contains nothing of any real value to anyone but me.

So what you're saying is, it doesn't matter at all if you get hacked. Why talk about security if nobody wants to look at your data?

Re:Probably not

[Anonymous Coward]

Add in the fact that my server contains nothing of any real value to anyone but me.

Then it is irrelevant which is more secure. You'd probably be better off assuming the security of either approach is sufficient and decide to either save yourself some money by not paying a cloud provider, or save yourself some time by paying a cloud provider to maintain the infrastructure.

This is like worrying about the relative security merits of carrying my newspaper around with me vs storing it in a safety deposit box. Very few people would consider mugging me for a newspaper, but banks are a desirable target. It's a ridiculous consideration. If my newspaper gets stolen it amounts to a very minor inconvenience at most. If I'm seriously considering how best to protect it, then I've got the wrong priorities.

Re:Probably not

[cascadingstylesheet]

Start with the fact that cloud services are big, ripe, juicy targets for anyone and everyone. Continue that there's probably never a time when their service isn't under some kind of attack in one way or another. Add in the fact that my server contains nothing of any real value to anyone but me. And extrapolate that to a very low likelihood that anyone would bother to take the time to attack my server.

That was a good argument in the past, maybe, but today the attacks are all automated (and the ones that aren't are against high value targets that don't meet your criteria anyway).

Low value or not, your server get hammered against every day simply for being on the internet.

Re:Probably not

[naughtynaughty]

Your router can be compromised from the Internet side and your internal network exposed. An internal attack is not needed.

Re:Probably not

[grimmjeeper]

My router probably gets probed but since I don't forward any port requests to any of my home computers, my server never sees those requests. Hammering not found.

Of course it can be more secure.

[tlambert]

Of course it can be more secure.

Unplug it and bury it in cement. It works for all servers, but Amazon has deeper holes in which to bury them.

Re:Of course it can be more secure.

[micheas]

You need to wrap it in lead before burying it in cement.

Umm, no. Surface area?

[holophrastic]

There's often a lot of focus on actual/active security, and a lot less on determining the need for that security. Think of security like a power-to-weight ratio for performance.

The goal isn't to have great security. The goal is to have no successful attacks. "no successful attacks" is approachable from two primary vectors: "successful" and "attacks". Security focuses on the successful vector, by resisting.

Certainly, when it comes to contracting a provider, or rolling my own, a big provider might be better than I am. Of course, I can hire a consultant and get the best of both, and a big bill to match.

Obfiscation is not security. But it is a reduction in the actual number of attacks -- so long as it's working, of course.

I've been with small providers, I've been with large providers, I've been with Rackspace, and I've rolled my own.

The truth is that all four scenarios have had plenty of attempted attacks. But dive a little deeper, and something way more interesting appears.

When I rolled my own, I got loads of random attacks, mostly from China. Nothing persisted for very long. Nothing was particularly focused. And nothing was complicated. Almost all were easily dodged with standard surface-area-of-attack controls, like closing unused ports and not having general server bloat.

When I was with Rackspace, I had loads of help from their excellent support teams, and on occasion, wow did I ever need it! Persistant attacks, lasting for days, targeted attacks, ddos attacks with large systems on the other end. At one point we had over a dozen rackspace support personnel just fighting to kill stuff fast enough to keep performance up long enough to identify and resolve the issue without needing to take the server entirely offline.

I was very happy with Rackspace, and was with them for a decade. Now I'm rolling my own again, things are just much more stable that way.

So what's your preference? Being in a military compound, protected by a thousand soldiers in the middle of a war-zone; or being completely unprotected, on a mountain side, in upstate montana?

I'm choosing big-sky country, personally.

Also, I believe that Rackspace is partnered with a very familiar government spy agency quite directly -- since they both moved campuses at the same time the other year, and I was greeted quite aggressively, as you would imagine, when I visited Rackspace for a tour, and accidentally pulled up to the unmarked neighbour. Probably appropriately so, given that it was on a september 10th.

If you operate your own server

[Anonymous Coward]

Haven't you already insourced your operations to the lowest bidder?

probably...

[koan]

"probably"

*sigh*

And if it's not secure, you probably won't know

[Anonymous Coward]

Our company contracted with an external supplier to manage an application for us that we had been managing in house. We got the usual assurances about their data centre, nailed down the SLA, and did a PIA. All good. As we were working with them to get our data moved over one of our sysadmins came upon a SQL Server admin id/password, unencrypted, in one of their .ini files. It was pretty generic (the name of the application with a few numbers instead of letters). That looked suspicious to us, so we contacted another one of the same vendor's hosted customers and said,"I'll bet we can guess your SQL Server admin password in one try." Turned out they were using the same admin credentials for all their hosted customers databases. Which they kept unencrypted in an .ini file.

So yeah,maybe their data centre was secure, but their application level management was amateur hour. And it was a bit of a fluke we discovered that.

Needless to say, we never did move the application into the cloud. They promised to fix the problem when we brought it to their attention, but we didn't trust them after that. And even though they arguably violated the terms of our SLA, they were such small potatoes that there was no point getting the lawyers involved.

Re:And if it's not secure, you probably won't know

[SpectreBlofeld]

Won't you be a dear and tell us what provider that was?

ho seriously

[Anonymous Coward]

since when number make it for skill in IT security ?

It is also easy to secure a base image, try to secure the customer code. this is where it fail you're code does not become secure if you run it at amazon....

What wonderful logic!

[Anonymous Coward]

Her entire view is accurately reflected in the summary: cloud providers "probably have lots more security experts and other IT people at their command than you do." Of course, if you talk to a "security expert," they will tell you many things about what you can do that you can't do when you move to a commercial cloud. Things such as monitor all traffic going into and out of your servers, and perform forensics on systems you believe might be compromised. It is much easier for cloud providers to stay quiet about small intrusions (that is, intrusions that are small to them, but not necessarily to you), and they have a financial incentive to do exactly that.

There are many good reasons to occasionally put services and data in clouds, but that doesn't make stupid claims like this valid.

Brought to you by Amazon.com

[Anonymous Coward]

BEGIN SARCASM
The preceding is the opinion of our sponsor, Amazon.com. Slashdot makes no claims as to the veracity of the content contained therein.
END SARCASM

Cloud is less secure in another critical way

[Kludge]

Clouds may have better defenses, but they are also bigger targets.

NATIONAL SECURITY LETTERS = NO

[Anonymous Coward]

enough said.

"They care about the data your data generates."

[Anonymous Coward]

Please elaborate.

It depends what you mean for "secure"

[fabrica64]

If you don't trust your cloud provider then, no matter how many expert they have your data is not secure

Is there a transcript?

[Hognoxious]

Is there a transcript? I don't have time to watch the video as I'm getting my hair cut on my barber's advice.

Re:Is there a transcript?

[Fwipp]

Recommend clicking on "Show transcript"

why talk to a CEO again?

[Anonymous Coward]

Why are we talking to Sarah The CEO again and again? Let her buy advertising.

Video Stories

[RendonWI]

Could you at least get some decent audio if you are going to do these? I listened to the first 10 seconds and could not stand the sound. Also you have a smart audience, we would much prefer to just read the story. We all thought the book was better.

Re:Video Stories

[Roblimo]

Read the transcript. We provide one for almost every video.

This lady has no clue.

[Anonymous Coward]

It doesn't matter how good your security is if your endpoint is not protected.

Wow, you have a server farm with a staff of PHD's. Good for you.

The guy who bought some space on your cloud service runs windows xp and likes to look at doggy porn.

He is still going to get hacked and there is nothing your cloud security can do about it.

experts like those at Experian?

[dltaylor]

That "answer" is nonsense; having more minimally paid and competent "security" staff is no indication of the quality of the actual security.

You want security? Make the bosses go to jail if a business is breached. THEN they'll spend the time and money to provide security.

Only if you are not IT literate

[Anonymous Coward]

If you make physical backups and transport of-site I would still go local. If not maybe your better off in the cloud. Still you are a much bigger target in the cloud than on your own little box.

Do the cloud providers make any kind of offline backups?

Bunk

[pubwvj]

Bunk. BS.

1) She has a vested interest in presenting that her systems are secure.

2) She offers a weak link in the data chain. Every time any link is added the system gets LESS secure. Adding a weak link further weakens the system.

Only non-secure data gets stored on the cloud. Remember, it's like a postcard.

I'll provide my own security.

Re:Bunk

[Anonymous Coward]

Which number is smaller?

10, or 100000 - 10 - 10 - 10 - 10 - 10 - 10 - 10 - 10?

By your logic, the second one, because it has more links in the chain making it weaker.

Self Interest Interview

[Anonymous Coward]

Joe-Bob, You sell Gee-wiz-bang-product. Do you think everyone in the world should buy it?
Answer: Of course they should.

Duh.

Can the cloud make you more ignorant? Yes.

[geekmux]

Because Amazon, Rackspace, and other major cloud and SaaS providers probably have lots more security experts and other IT people at their command than you do.

Oh yes, and because of this, your cloud environment is automagically more secure.

Did we suddenly become ignorant of these things called contracts? More often than not, I've found that the devil is in the details as to just how much "other IT people" actually have to give a shit about your cloud environment when it goes down for any reason.

They protect the cloud not your application

[Anonymous Coward]

The IT and security experts just protect the cloud infrastructure, but cannot do anything if your "cloud" app (be it a web app or a vm instance) gets hacked and all your data stolen....

Seriously?

[oh_my_080980980]

"Because Amazon, Rackspace, and other major cloud and SaaS providers probably have lots more security experts and other IT people at their command than you do."

That has to be one of the stupidest statements ever. Bimbo does not even cover it. Hey blondie, how many security experts did the NSA have when Edward Snowden walked out the door with a flash drive full files.

"Were more secure because we employ more security experts." Tell that the China...

Re:Seriously?

[Anonymous Coward]

"Because Amazon, Rackspace, and other major cloud and SaaS providers probably have lots more security experts and other IT people at their command than you do."

That has to be one of the stupidest statements ever.

That argument was probably directed at me, and I find it convincing. I don't have any security experts or IT people at my command. My brother installed a database and set it up to store payment info for my customers, but I'm not really sure if there are security patches or how to install them. I did some testing, so I think it works fine and no matter what I clicked on it didn't let me hack in, so I guess it's pretty secure. Do you think that I'm better off going it alone? Maybe you could do my security for me. I'm willing to pay you $20/month.

Re:Seriously?

[Anonymous Coward]

Why are you bringing this persons gender and hair colour into your argument? Would her argument also be affected by her skin colour too?

Her Second Sentence

[Anonymous Coward]

Her second sentence in the video 00:48 she says:

I'm not saying more secure.

Roblimo you just suck. You;re WAY past your expiration date.

You trust the competition?

[Anonymous Coward]

Do you really trust the competition, (specifically Amazon ), to keep your data secure?

If you're in business, you're selling something and Amazon is competing--remember they "Sell Everything from A to Z".

YES Most in-house security is an afterthought

[Timmy D Programmer]

Where Amazon and Microsoft at least know and cover the basics, and make a serious effort most companies haven't the resources, people, or expertise to keep their servers even remotely secure.

If you are a supreme security expert perhaps 'you' could make a more secure system. Now ask yourself, how many third rate hacks think they are a supreme security expert, or worse how many companies don't even have that.

Really?

[Anonymous Coward]

Sure, they likely have more security people on the payroll but they have a ton of data mining jackasses on the payroll also.

Oh if I had a dollar...

[Hangtime]

for every time some one told me that their on-premise is more secure than cloud. To be very fair, the first thing you should look at it is where your security risks, threats, and exploits are arising. If we look at most security failures its almost exclusively due to disgruntled current or former employees within the IT organization or misconfigured external-facing software that is easily broken into. While yes the Chinese, North Koreans, or NSA are probably trying to hack the AWS, Azure, SoftLayer, and Rackspace clouds where is the likelihood of failure, a disgruntled employee walking out with data or one of the above attacking a large cloud provider.

This really akin to the argument of local gun control versus a terrorist threat. The terrorist threat is absolutely a scarier and much large potential loss, but more likely then not if you have a gun in your house - you are much more likely to be killed with it.

So it comes down to the following: would you rather be checking for a very large threat that impacts not just your organization, but many others and the solvency of an Amazon, IBM, Microsoft or Rackspace or would you rather be doing it all yourself in a very small environment that is much less a target likely much easier to penetrate especially by internal employees. BTW, last time I checked you get a bill when you try to move data out of S3 so you have trail whereas someone can stick a USB drive directly on your server and walk out.

Re: Oh if I had a dollar...

[Anonymous Coward]

Your gun analogy shows your ignorance. That garbage about a gun in your house being likely to hurt you is only true if one counts suicides. If you have no gun, you'll kill yourself via other means.

If you don't know that, then I can't trust the rest of your alleged logic and reasoning.

The only secure server...

[TheDarkener]

Is unplugged, encased in concrete, at the bottom of the ocean.

And even then...

Umm..

[Anonymous Coward]

"We've talked to Sarah before, and probably will again...So take it away, Sarah..."

Overfamiliarity kills professionalism.

There's a shocker

[kuzb]

Someone who sells cloud storage advocates that it's safer than doing it yourself. The question isn't worth much until it's answered by someone with no horse in the race.

More links makes a weaker chain.

[dsmatthews9379]

To suggest that the larger number of staff at a cloud data company proves the operation is more secure is completely illogical because the more staff there are the greater the probability that one of them is corruptible or likely to turn on their masters, just ask the CIA.

Re:More links makes a weaker chain.

[Anonymous Coward]

No, trusting the completion, like Amazon, weakens the link.

Odds are the fucking NSA already owns your ISP, and that's all they need.

More importantly, trust a competing company like Borders did with Amazon, and you will end up like Borders.

Is it still "your" data in the cloud?

[jamesdood]

The bigger question is, is it still your data in the cloud? If you miss a bill payment will you be able to access it? If the cloud owner doesn't pay the telecom provider or the data center will you be able to access it? What if they file for bankruptcy? Or have their servers repossessed? How ironclad is that contract? They may have oodles of security but is that really what you would base your business decision on? Just some things to think about...

She's not talking to YOU

[Anonymous Coward]

She's not talking to YOU. She's talking to Your Boss who think's he's hip with IT because he reads Slashdot. Or Your Boss' Boss. Or Your Boss' Golfing Buddy. She's a CEO, so she's aiming to get her name higher with other CEO's who thinks it is his/her job to raise the latest Bullshit Bingo Buzzwords to those who will be in the know.

The cloud

[AHuxley]

Is based in a nation and its laws and legal amendments:
Staff are very willing work for the government when asked, requested or have always worked for the government.
An enthusiastic surveillance partner going back decades or years?
How good is the legal department when facing paper work thats not a fax from a law enforcement official? That national security letter (NSL) with a request to add hardware on site long term?
Got some FISA Amendments Act (FAA) paperwork, ready for the FREEDOM Act?

Betteridge's law of headlines

[Trogre]

Betteridge's law of headlines applies here.

Okay, while it's theoretically possible to configure a home server to be less secure than a "cloud" solution you would almost have to go out of your way to do so.

It's lovely that a spokesperson from a Cloud provider wants to reassure us that using their services is secure, but:

What assurances do you have that they're not sharing your data with their partners or anyone else with enough cash?
What co-operation will they provide when a TLA (three-letter agency) shows up at their door, and will they tell you?
Is their replication/backup strategy as robust as they say it is?
What happens to your data when their company goes belly up?
How many security breaches have they had in the past 24 months? Would they tell you?
What scope is there for expansion should your needs grow?

Re:Betteridge's law of headlines

[Antique Geekmeister]

> Okay, while it's theoretically possible to configure a home server to be less secure than a "cloud" solution you would almost have to go out of your way to do so.

Or just think you're smarter than the folks doing real security. I can no longer count the number of "professionals" with passphrase free SSH keys on accessable network drives, or who insist on putting passphrase free SSH keys with root access on all their servers "so they can do backups". Couple this with people who run private tunnels to, and from their laptops into the internal network and you have a quite common and quite disturbing security problem.

Cloud Insecurity

[nehumanuscrede]

Cloud insecurity is similar in scope to large corporation security. The more folks have access to your hardware or your network, the less secure it becomes.

Sure it may have stellar PHYSICAL security, but your systems are merely one cash payment to an employee ( that you didn't get to screen ) who has a debt problem away from compromise.

At least if you own the data center and the hardware, you get to pick the employees and what level of access they will have to it.

In " The Cloud ", those choices are no longer made by you or even your company. You just have to hope your Cloud Provider is up to the task.

That said, I think I would keep my hardware and data under my direct control.

Cloud is fundamentally less secure

[Anonymous Coward]

The multi-tenant nature of the public cloud is fundamentally less secure than an on-premises single-tenant environemtn. Why? One example is a class of security exploits which allow a guest Virtual Machine to gain control of its hosting hypervisor operating system. Since anyone can setup a VM on the public cloud, which may run on the same physical machines as your company's VMs, this exposes you to an attack vector that simply does not exist on-premises. Here is one such example:

https://securityintelligence.c...

No amount of bug fixes, hand waving, and certifications can make this problem disappear; it is fundamental to the design choices of cloud hosting companies.

Complexity

[Etherwalk]

Most drivers consider themselves to be above average. Why would that not extend to server operators?

It's worse than that. Servers are much, much, much more complex than cars. If you have the secret formula for coca-cola, sure, keep it in house and put a billion dollars into securing it, although it really shouldn't be on any internet connected machines at all. But 99% of other stuff, who gives a crap?

See the number of massive public breaches we've had in the last few years? The guys at those companies thought their systems were okay, too.

By Neruos

[Anonymous Coward]

1. Place an infected document in a .zip file and put it on the cloud (wan) and download it back down to your corp network (lan) and run it, same outcome.
2. Build a XSS or JS Framework Hack impacted website and put it in the cloud, still has the same risk hack problem.

Somethings need more security, somethings don't. Don't put your trust in something when the something has no control over the trust.

Law #101 of security in a insecure world.

Re: Depends, do you have a dedicated security team

[Anonymous Coward]

Yes, you do need a data center of your own. Trusting the people who run cloud providers or their security is utter foolishness.

TS, DL

[Anonymous Coward]

Too squeaky, didn't listen..

Yes but the big targets are so juicy

[EmperorOfCanada]

The big targets are so very juicy. I can't see a team of world class hackers attacking my usedshoes.com site with $80 in annual sales. With a major cloud provider I can see national governments sponsoring hacks so robust that they may very well get agents hired on as staff within the provider themselves. Then once you are in the rewards are so very massive.

Re: Depends, do you have a dedicated security team

[Anonymous Coward]

Yes, you do need a data center of your own. Trusting the people who run cloud providers or their security is utter foolishness.

If you have the very significant resources to manage and protect your own data centers at similar level (in this scenario you definitely not have only one data center location), then yes that is an option. Most people - and especially medium scale Linux admins who think they are very good -- seriously underestimate what resources and investments they need to have locally to match or exceed this level.

Logic Fail - for dollars

[Anonymous Coward]

First, let's get the one thing out of the way. Anybody who makes money from "the cloud" (i.e. the 1960's client-server+leased time/storage model re-branded for gullible millennials) is going to promote the idea that it's better than the alternative. Nothing new there. Now for the fail:

With the "cloud":

1. Your data is vulnerable when you ship it via the internet from your own (possibly improperly-secured) systems, through your ISP's (possibly insecure) systems and all the intermediate (possibly insecure) systems.

2. Your data sits on some unknown number of (possibly insecure) servers you do not control or own or even have access to. You have no idea how often your data is replicated, moved between servers etc potentially being lost/corrupted/stolen/copied and no idea where all the copies generated physically are stored and who has access to them.

3. Your data is vulnerable when you ship it via the internet through all the intermediate (possibly insecure) systems and through your ISP's (possibly insecure) systems back to your own (possibly improperly-secured) systems.

Without the "cloud":

Your data is under your control secure within your hardware at your site and only as vulnerable as you decide to make it.

What SHOULD be obvious, but apparently is not to many people:

1. If you do not have physical control of your data, it may not be your data anymore.

2. "The Cloud" is a marketing breakthrough that was created to help the new giant computer monopolies (Microsoft/Apple/Google...) make more money to make Wall St happy about "earnings projections" and "growth forecasts". When you have near monopoly in your traditional marketspace, you have no room to grow by expanding your customer base, so the new task is to squeeze more money out of your existing customers. This is what all these companies are doing (it's why Adobe has gone this route too). They are going to the very business models they became rich by destroying. They knocked the old big companies off their thrones by selling the idea that you buy software and hardware ONCE and then own and control it back in the 70's and early 80's when the dinosaurs were living large on the leased systems and monthly maintenance fees model. Now that the old rebels are on the thrones, they have discovered that they like the dinosaur model and have duped an entire generation into thinking it's good for them, by calling it a fluffy white cloud - only it's FAR WORSE than the old model because now it's far more vulnerable since it sits atop an insecure internet AND they are data-mining. They have become the very evil corporate titans they once fought to tear down, but with an even more evil spying soul.

What rubbish.

[Anonymous Coward]

As soon as your data is put into a "cloud" then it's already been compromised as it's now in the possession of a third party.

Even if it's heavily encrypted then it's just a matter of somebody wanting to spend the money/time to break it.

"The cloud" is a totally stupid idea for anything but public domain or lightly copyrighted data (e.g. Wikipedia, Archive.org etc. etc.)

Anyone putting their actual business or personal data into "the cloud" is a total idiot.

Security also involves transmission

[jraff2]

With all the NSA, CIA, FBI, DOD, and other TLAs snooping EVERYTHING on the internet the actual movement of the data MUST be included in the security analysis. Unless one uses some rather extreme and hardened encryption the data will available for the TLAs to peruse. So it comes down to using 2K or 4K encryption keys and keeping those key private, only using known secure methods of transmittal, mail or courier to disburse them. The Constitution and Bill of Rights protections seem to have been thrown away even though the "oath of office" clearly says "support and defend the constitution of the US" it seems that it has been ignored. Like someone said "it's only a piece of paper" When will someone bring charges on these high and mighty Gov. officers, take them to court and take back our Constitutional rights?

Re:hippa is a fraud-

[Anonymous Coward]

Ah, I see, you're merely trolling. Well, alright. Have fun with that.

Good timing!!!

[Anonymous Coward]

This is funny we have this video, then we have this http://yro.slashdot.org/story/15/11/04/2059230/nine-out-of-ten-of-the-internets-top-websites-are-leaking-your-data
only a few hours apart.

5/10 would bang

[Anonymous Coward]

2/10 would bang

Harsh Dude. She's easily a 5/10.

P.S. How desperate are you that you're willing to take 2/10? 5/10 is my minimum requirement.