Cloud computing is about hardware-based services involving computing, network and storage capacities. These services are provided on-demand, hosted by the cloud provider and can easily scale up and down.

learn more… | top users | synonyms (1)

4
votes
2answers
48 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
1
vote
1answer
34 views

How exactly should I interpret the term “Hybrid Cloud”?

The CISSP CBK definition says that a hybrid could is a mix of public and private. But what exactly does it mean? Is it more a conceptual idea:If you use both a public and a private your company is a ...
-4
votes
3answers
74 views

Does MEGA cloud service say ALL the truth? [closed]

If this is not the right community for this question please inform me where to ask :-) I am talking about: encryption no enceyption key kept by MEGA and so on. I found many reviews confirming ...
6
votes
1answer
122 views

What is legally required to store HIPAA data in the “cloud”?

I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would ...
-3
votes
2answers
69 views

Can an attacker or law enforcement compromise apps in Google Play so that when I update I install the compromised app?

What are the chances a third party could make changes to apps on Google Play that I have installed, so that when I next update I am compromised?
2
votes
1answer
62 views

Will two virtual machines running on the same physical host machine get the same value from /dev/random?

Will two virtual machines running on the same physical host machine get the same value from /dev/random if read over the same time period? Say that Virtual-machine-1 wants to generate its ssh host ...
-4
votes
1answer
79 views

Does Server Mistrust improve security? [closed]

By server mistrust, I mean the fully implemented lack of customer plaintext on a vendor's system, and lack of vendor access to customer plaintext. Specific case in question: Password and SSH key ...
4
votes
1answer
153 views

/dev/random in EC2 cloud

is /dev/random any good in AWS EC2 for use in making a shared key that will be passed over a secure channel? i am concerned that a launched instance would have not much entropy to begin with. what ...
0
votes
0answers
46 views

Software Defined Perimeter assumptions, properties, deployment scenarios

Since 2013, the Cloud Security Alliance has been working on an open protocol and open source code base for a "Software Defined Perimeter" (SDP). But the whitepaper at SDP Specification v1.0 : Cloud ...
1
vote
2answers
81 views

Is Cryptree suitable for cloud storage?

I'm evaluating a cloud storage product. The marketing literature states it uses Cryptree. I pulled the paper and performed a quick read, but I don't see where Cryptree lends itself to confidentiality ...
0
votes
1answer
51 views

What security considerations should I take when planning do to Incident Response in my hybrid public cloud environment?

I am trying to compile a list of areas one should be aware of when doing Incident Response on public cloud environments, e.g. a hybrid public cloud, where some services are provisioned in local ...
0
votes
0answers
24 views

Securing decentralised cloud scaling

Approach Require a certain percentage (quorum) of nodes to agree in order for my decentralised multicloud to grow. Benefits Reduced likelihood of growing too quickly (e.g.: 2 new nodes created ...
3
votes
1answer
157 views

On the fly encryption for unencrypted cloud services?

Today Amazon announced their Cloud Drive with unlimited storage for only 60$/yr. Microsoft did the same with Office 365 a while ago. I don't really want to entrust either service with my dearest ...
1
vote
1answer
144 views

“It is safe if only Port 443/HTTPS is accessible from Internet!” Is it? [closed]

I was in discussion with a vendor to implement a backup solution and as flexible as most cloud applications nowadays, it needs to be access from anywhere on Internet without VPN or any special ...
1
vote
1answer
133 views

Is CloudKit or iCloud suitable for storing PII?

iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device. CloudKit is a similar technology that allows (from what I can tell) the partial ...
0
votes
1answer
116 views

Is cloud server without HTTPS secure

I am running a Seafile Open Source Cloud server (v 4.0.6) on my Raspberry Pi 2. Currently it is set up to simply run without HTTPS or even a domain name on [myIP]:8000. I am also running an Apache web ...
1
vote
1answer
136 views

Is End to End encryption possible for all servers across the whole infrastructure?

Running into a possible situation where a client I am working with is requesting that all data that leaves the servers should be encrypted and here, we are talking of hundreds of Linux servers ...
0
votes
1answer
55 views

uploading photos to cloud from an infected device [closed]

My computer is infected with Malware and (shame on me) of course I didn't back up my photos or word docs. I also happen to know almost NOTHING about computers. Is it possible to upload photos to cloud ...
1
vote
2answers
151 views

How to secure sensitive information on cloud from administrator (end-to-end encryption)

When I use end-to-end encryption to secure documents and sensitive information on cloud or on computer, there is always a risk of accessing these information by administrator. For example if you use ...
1
vote
0answers
83 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
1
vote
2answers
433 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...
1
vote
0answers
36 views

Unrestricted file upload on a cloud based platform [closed]

We have an unsecured file upload for the user to upload any file they want, our application is Azure based so they are stored as blobs not as a traditional "file on disk". Could malicious code still ...
4
votes
2answers
71 views

How to keep data private where software requires an online check

When software forces a user to verify online (phone home) before use, it creates an opportunity for private data created with this software to be physically connected to the Internet. This may not be ...
5
votes
3answers
150 views

Cloud Based WAF

I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS. I would prefer using a cloud based WAF (e.g. ...
4
votes
2answers
199 views

Is the same decryption key used for data on the server as locally with Lastpass?

Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices ...
0
votes
0answers
29 views

Machine actions in distributed systems

I am looking at the security implications of distributed systems, and am trying to simplify the way that I can model individual machines within a distributed system interacting. The importance of the ...
0
votes
3answers
303 views

How to secure delete inside a virtual machine?

Here is a tricky one: Can you securely delete a file from a VM? I'm sure the answer is dependent on a million different variables, and I'm sure the answer is something like "not really" but I want ...
0
votes
2answers
161 views

Is it safe to store encrypted volumes on cloud syncing services?

A recent discussion on another website prompted a proclamation that storing (TrueCrypt, LUKS, DMG, etc) on cloud sync services like Dropbox is unsafe, since a version history is kept of each file, and ...
1
vote
0answers
35 views

Security schemes regularly in use on cloud

I've been looking into how connections are managed in the cloud, in order to better understand the threats users and their deployments may face. The most important and common ones in use seem to be ...
1
vote
1answer
110 views

Acquiring remote forensic image from EC2 instance

I'm trying to figure the best way to acquire remote image from an EC2 instance. Here is how I took/trying to take an image of an EC2 EBS drive: Using EnCase Remote Recovery (trial for 14 days): ...
0
votes
2answers
120 views

Forensic in Cloud environment

Let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username and password for Windows instance), and I used a software like FTK Remote Agent to ...
0
votes
1answer
44 views

Potential dangers of re-locating critical systems to cloud

It was suggested by some consultants that We relocate some of our critical systems in our environment to cloud base architecture. Besides knowing the fact that on a cloud base architecture we have no ...
0
votes
2answers
174 views

Can Amazon's AWS Identity and Access Management (IAM) be used to manage server access?

Requirement 8.1.1 of PCI DSS states: Assign all users a unique ID before allowing them to access system components or cardholder data. Using Amazon IAM I can set up individual accounts for users ...
1
vote
4answers
646 views

Security risk of allowing ICMP “destination unreachable” packets on AWS

If I configure an Amazon AWS VPC, should I explicitly allow ICMP "destination unreachable" packets inbound? I am wanting the VPC firewall to block everything by default, however does this mean this ...
1
vote
1answer
158 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
4
votes
2answers
3k views

Security of Microsoft OneDrive

A friend asked about putting some of his data on Microsoft's OneDrive. I did some research, and what I learned seems very surprising. It appears that all the user data on MS OneDrive is store ...
1
vote
2answers
132 views

IDS across seperate AWS accounts

I have 2 separate AWS accounts and I would like to a Vuln scanner/IDS on one to scan another. One environment is a regular AWS account and the other is in AWS Gov Cloud. Due to limitations within ...
8
votes
3answers
3k views

Is Firefox Password Manager less secure than LastPass?

After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager". (This option appears as long as the Firefox ...
2
votes
2answers
488 views

Steps for building a good File Encryption on Android

I want to be able to build a good file encryption on android for a cloud app. The files used are mainly pdfs, pngs, docs, audio, video, etc (all sorts of files). Edit: My constrains are that it ...
1
vote
1answer
116 views

Password for XLS files

I am not sure if this is right place to ask this question. I have created an xls file to store all my password in it. lately I have uploaded same file on Google Drive to access it from remote ...
1
vote
1answer
197 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
0
votes
2answers
69 views

what is the cons and pros of using webfiltering based on cloud security?

nowadays some vendors offering web filtering based on cloud security , where your web traffic will be forwarded to vendor cloud to be filtered and controlled at the vendor proxy , the vendor will ...
0
votes
0answers
66 views

Homomorphic encryption for query execution

We are doing our final year project which maintains log records in the cloud.. we need to execute select query on encrypted data to select particular log records based on the given condition. Is this ...
1
vote
0answers
68 views

Can user identifying information in Dropbox be derived from subscription data?

I've noticed that my Dropbox installation really loves sending unencrypted information over the net including a "user_id" and it's user-agent. What i want to know is if it's possible at all to ...
3
votes
1answer
2k views

can I trust Boxcryptor closed source software? Encryption of files for cloud hoster

Boxcryptor https://www.boxcryptor.com is not Open Source. Can I trust this? Is it secure? No government backdoor? Because there is no alternative for OS X and iOS.
0
votes
2answers
262 views

Are files hosted on cloud servers/websites/databases manually checked by people?

I was wondering ... when I upload a file to, say, Dropbox, does anybody personally check it to see what it is? Say I upload a copy of my Blu-ray movie to cloud storage ... will anyone check, and ...
14
votes
3answers
3k views

Is amazon S3 secure enough to hold personal documents?

I have a client who is looking to hold personal information such as Driving Licences and Insurance documents in order to verify if a user of the site is who they say they are and lives where they say ...
41
votes
8answers
7k views

What are some considerations before moving personal data to Google Drive?

I am considering uploading some (all) of my digital personal data to Google Drive. I guess this would instantly grant access for NSA to my data. (Is that right?) Who would have access to my data on ...
0
votes
1answer
634 views

Resources for pentesting cloud based services/web-apps?

I want to know about some of the good resources for pen-testing cloud based services or web-apps (such as AWS). I googled for it but there are really few good resources out there. For example, I liked ...
0
votes
1answer
365 views

Service traffic hijacking, how does cloud make it worse?

I read an article from CSA that they rank service traffic hijacking as the #3 threat to cloud-services. Why is it worse for the user if an attacker hijacks its service traffic on cloud? What new ...