Amazon EC2 security compared to a standalone server

Question

Lets say I want to run a out-of-the-box instance on Amazon EC2 and on my own standalone server. I don't run anything on them, just let them idle by themselves. What is the relative level of security offered by Amazon in that situation in comparison to a standalone server (say, if someone wanted to brake into those servers and install some malware on them)? What attack types are less likely to be successful?

Answer 1

They are relatively similar and there is nothing special about an Amazon EC2 server that you can not achieve at home.

However, the two defaults that won't occur (by default) in an ordinary install of, say, CentOS are:

• +Security Groups - By default all external traffic is forbidden. You must set up a 'security group' to allow specific ports and I.Ps. However, allowing all ports and all I.Ps is relatively simple.
• +Key-Pair Authentication - By default it is not possible to log in to an EC2 server with a simple password. You must generate a private key and use that to log-in. Making bruteforcing much less likely.

Of course, there is a clear security negative with the EC2 cloud:

• -Public I.P - All EC2 instances have a public I.P., if you modify the security groups improperly then you're potentially opening yourself up to malicious traffic. Whilst on a local network your server can hide behind a NAT or not be connected to the internet at all.

There are other advantages of EC2 over, say, keeping the server in your bedroom. But these apply more generally to data center vs. bedroom:

• +Physical security
• +Safety from Natural Disasters
• +Safety from Power failure
• +etc. etc.

Answer 2

I would consider an EC2 image equally secure to its corresponding common operating system. If I run the same image on my home machine and on EC2, they present the same security profile. There's nothing magically different in the security of a VM versus running directly on hardware.