Our servers incorporate unicorn horn technology!

Comment

Comment by Daniel Leuck on July 26, 2010 at 7:22pm

I've been thinking a bit more about this stuff lately. My gut reaction is not to trust the cloud entirely.

Its a good idea not to trust anyone other than your mom entirely :-) There is always risk. The questions is what is riskier, building your own systems or using a trusted cloud provider like Amazon or Google?

There are huge advantages of scaled up security and expertise that smaller locations can't achieve, for absolute sure.. but like you they're still vulnerable.

Its true that they are vulnerable, but not like you. When thinking about the security of hosting something within your company relative to GAE (Google) or EC2 (Amazon), ask yourself these questions:

• Do you have a dedicated team of world class security experts?
• Do your processes, policies and systems undergo regular independent SAS 70 Type II security audits?
• Is your company incentivized to have the world's best security by a market cap of over $150 billion that could be lost overnight by a serious security breach?
• Do you have the experience that is gained by hosting the core IT infrastructure for hundreds of thousands of organizations including companies like Genentech and government organizations such as the city of Los Angeles?
• Are your data and systems protected by geographic redundancy with no single points of failure?

The idea that any organization, even a large organization, that does not specialize in this area, and has not invested tens of millions in infrastructure and security could provide comparable protections is pure myth.

UH had 100% control over the parking system that exposed 40,000+ social security numbers to a hacker. Control != security. Expertise, experience and independent audits == security. Economies of scale are also very much in play.

Comment by Paul Graydon on July 26, 2010 at 1:09pm

I've been thinking a bit more about this stuff lately. My gut reaction is not to trust the cloud entirely. The moment you don't have direct control over your data you have no control at all. There are huge advantages of scaled up security and expertise that smaller locations can't achieve, for absolute sure.. but like you they're still vulnerable. You're trading one security for another. You take your pick.

That said, here's the main thing I'm increasingly wondering (please excuse the brain dump):

Why is data accessible over the Internet / public network? What can be or should be accessible to the Internet should only be what is absolutely necessary for the function. Over the last 20 years corporate networks have increasingly gained Internet connectivity, and with it firewalls have become essential devices for network security, but rarely does it seem anyone asks why the connectivity is needed with the main (or secure) network at all.

In the old days to steal company data you'd need to break in to their office.
By the time we reached the start of Kevin Mitnick's era ('79-95) modems were already cropping up. It still required social engineering (con artist) tricks to find out phone numbers of the modems but it meant you no longer had to have physical access. You didn't even need to be in the same country to break in. The moment that modem got hooked up you went from mostly local thieves to worldwide with potentially instant access.
Now it's even easier, you don't even have to get a phone number, just figure out an IP address (look at e-mail headers?) and away you go. Social engineering will make getting past the firewall a lot easier, but there is plenty of low-hanging fruit out there in the form of unpatched machines, 0 day exploits and the like.

No matter what the security put in place it can never get past the simple fact that if it's not connected to the Internet, it's a lot more secure.

Private / Public networks with clear physical isolation are a lot more laborious, though, which in a roundabout way brings me back to the cloud. Getting rid of physical isolation is a security choice companies have made at some stage or another, whether they realised it or not. If you've made that acceptance is it really that hard a step to move to the cloud? You've sacrificed ultimate security in the name of convenience once, the cloud isn't that big a step from there.

Comment by Brian on July 8, 2010 at 12:04am

Thanks Dan, I appreciate the compliment.

Like the nested virtualization we mentioned earlier.. there is still that legacy part of my brain that cries foul occasionally, but I have basically swallowed the koolaid at this point ;)

A few weeks ago a coworker asked (on behalf of a friend) - what sort of IT setup would I recommend for a new company? I replied that I'd suggest they all get androids and just use google's services. Integrated calendar.. email.. collaboration.. much better security and uptime than they could manage.. everything synching and backing up to the cloud... an entire community constantly improving your IT for you from hardware to apps.. etc.. all for basically free!

You have to wonder why companies even have big telecom infrastructure anymore - why not just get everyone unlimited cell phone plans?

Are there unique situations? Sure. If you're doing video for example - local storage is really still the norm for that.

What's funny is when people use regulatory requirements like SOX as some justification for inhouse infrastructure. Yeah I'm sure you can manage those requirements better than.. someone that does it fulltime - and has made it THEIR business.

That's okay, someday the lemurs will rise up and crack the DJ in half ;)

Comment by Daniel Leuck on July 7, 2010 at 11:27pm

(Lemur mug raised) Spot on. Great post. Local does not necessarily mean more secure. In fact, at most organizations, it means less secure. I'm consistently amazed by the number of local organizations that think they have better security than Google and Amazon. This is almost never the case, not because they are incompetent, but because they don't have the same incentives (billions in lost sales, tens of billions of assets to protect from lawsuits, etc.) and they don't benefit from economies of scale or enormous budgets to spend on specialists. As you said, there are special cases, but the percent of actual special cases is exceeded by the organizations that think they are special cases 10 to 1. After nearly 20 years of consulting for companies ranging from local Hawaii businesses to banks in NY, I'm still amazed at the millions I see thrown away annually due to NIH (not invented here) syndrome. Engineers love to write software, and it doesn't matter if a dozen open source and/or inexpensive commercial solutions that solve the business need are readily available. Systems engineers love to build IT infrastructure, even if it can be done cheaper, better and more securely by best of breed SaaS and cloud solutions from well established vendors.

As you mentioned, although there was clearly a significant lapse in the system, this situation is far from being unique to UH, and they were more transparent about it than most. Although I don't agree with all of their policies, there are a lot of talented, hard working techies at UH and they have made significant contributions to TechHui and the wider tech community.

• ‹ Previous
• 1
• 2
• Next ›
• Page