Cloud computing is about hardware-based services involving computing, network and storage capacities. These services are provided on-demand, hosted by the cloud provider and can easily scale up and down.

learn more… | top users | synonyms (1)

5
votes
1answer
54 views

Can secrets be made safe in memory?

Say, I am running an application on a cloud server such as AWS. Suppose I supply a key at run-time (so its not stored anywhere alongside/inside code), is there a way to secure this key in memory? So ...
1
vote
2answers
22 views

How to rank the security strength of a cloud SaaS app

If my manager asked me to rank how secure/vulnerable our SaaS system is, what methods are available to do so? I know there are certifications available but I'm looking for something which can be ...
10
votes
2answers
835 views

Is it safe to store SSN's in Azure Cloud?

I'm doing due diligence on a company. They are entirely cloud based and need to collect lots of personal information from users (including SSN). Is this something I should be majorly concerned with? ...
2
votes
1answer
40 views

Recommendation Key Management and Storage in Cloud Storage

I am currently researching about key management in the cloud storage and looking for alternative for it. The current system stores encryption key for each file in the server and each key is encrypted ...
1
vote
1answer
25 views

Virtulization in cloud and security

From a security perspective, which type of hyper-visor cloud is more secure - one that runs on bare-metal (using minimal boot strap build into hyper-visor) or one which is loaded as a part of the OS ...
1
vote
1answer
22 views

How to reliably backup to cloud services without hampering security?

There is a huge number of articles advising to enable two-factor authentication on sensitive cloud services. I understand the benefits for my accounts' security, but doesn't it defeat the purpose of ...
1
vote
0answers
51 views

MyQNAP Cloud security [closed]

I recently set up my new QNAP NAS, and have been accessing it through OpenVPN running on my Raspberry Pi through my home network. For convenience, I decided to test out MyQNAPCloud, which puts it ...
1
vote
0answers
43 views

Are OpenStack SSH keys secure? [closed]

I found two places that describe OpenStack SSH keys, but nothing seems to say whether or not they're generated on VMs. Is this configurable? I have read and heard here (How can you securely ...
4
votes
1answer
57 views

Security monitoring in the cloud?

I am working for a company which works with PHI, HIPAA, PCI and other highest sensitivity data. Their current security architecture uses hardware network monitoring tools to monitor the network ...
0
votes
2answers
75 views

Personal Cloud Storage vs. File Sharing Services

In terms of maintaining Confidentiality, Integrity, and Availability, what are the risks and benefits associated with setting up a personal cloud storage device on your home network versus using a ...
1
vote
0answers
19 views

How to know and disallow corporative Google Apps users to access third party apps with their corporative Google Apps accounts?

How can a security administrator of Google Apps for an organization that has linked @organization.com accounts to Google Apps to know and disallow that users use their users@organization.com accounts ...
1
vote
0answers
17 views

Is a business associates contract required to use hosted R&D services? [closed]

I'm on the "configuration management" team which, among other things, means I'm responsible for R&D systems, like: source control, issue tracking, team collaboration (wiki), etc. These are not ...
0
votes
1answer
31 views

Sophos Safeguard detecting content of zip files being uploaded

Is it possible to use Sophos safeguard to detect when computers in the network upload certain files online when they are compressed in a zip file? (or 7z or similar). I've seen it is possible with ...
2
votes
1answer
148 views

Should I trust Grive2?

I am trying to run Google Drive on LUbuntu 64 bit, but since there isn't an official version yet, I was thinking to follow this tutorial. Since it's not an official software from Google, I am ...
1
vote
2answers
63 views

How do personal/private cloud products work?

On amazon.com I found some personal cloud NAS products and was wondering how some of them work. In this article the author discusses the My Cloud app and how it can be used from any internet ...
0
votes
1answer
72 views

OpenVPN and running other services on same server

What security implications should I know about/look for when running OpenVPN on the same server as my network cloud controller and apt-cache-ng? I plan on using the same server to run apt-cacher-ng ...
6
votes
1answer
114 views

Benefits of cloud based full disk encryption

Microsoft announced in May that it supported full disk encryption for VMs. They have recently merged a github branch into the Azure Powershell tools to enable this. The basic theory is that you ...
2
votes
2answers
60 views

Does ISO 27001 allow cloud based Spam/Malware filter solutions

We are currently switching over to Exchange 2013 and we are thinking about outsourcing the spam and malware filtering to Microsofts Exchange Online Protection. Its implemented by changing the MX ...
3
votes
1answer
196 views

How do Cloud Encryption Gateways and CASB work?

Cloud Encryption Gateways (CEG) and Cloud Access Security Brokers(CASB) are becoming popular to ensure the security and confidentiality of the data leaving to Cloud Service Providers. How do they ...
2
votes
0answers
25 views

What are the security implications when dealing with cloud on boarding services like Migrationwiz or Skykick?

There is a large push these days to move Email and communication to the cloud. Such as Google Apps, Office 365 or Hosted Exchange. Many company's hire partners to assist with these moves. Most ...
3
votes
2answers
80 views

Reverse proxy or Public load balancer?

What would be the difference between putting in a load balancer or reverse proxy on the perimeter to send requests back to a system in our LAN? We don't want to have people NAT directly into the LAN, ...
0
votes
0answers
46 views

What is “Intentionally misleading Artificial Intelligence to create a misleading outcome” called?

I'm writing about a computer system that relies on Artificial Intelligence and the threats that this may include. One threat vector (for example) is to seed Bayesian AI with content to skew the ...
-1
votes
2answers
53 views

Secure protocol for a backup server? [closed]

I want to make a back up system in my home, but I don't know I should use a FTP server or a TPC-based cloud server or a SSH-based server. Which method is best in security? I just want to upload and ...
2
votes
1answer
97 views

Can we determine how securely files are stored on a cloud storage service?

After asking two questions about the security of online cloud storage, it seems to me that we can only at best speculate as to the security practices of the hosting company, and believe what they tell ...
0
votes
0answers
18 views

How to interpret 'supplier relationship' in CSA CCM

The Cloud Security Alliance has developed a Cloud Control Matrix, which "provides fundamental security principles to guide cloud vendors and to assist cloud customers in assessing the overall ...
2
votes
2answers
104 views

Physical protection of your servers?

Here is a scenario. You are a small startup company that makes a video game. In your video game, you can exchange money for items. You are not dealing with the credit card/debit card directly but ...
1
vote
2answers
168 views

How can a seamless cloud storage service be Zero-knowledge?

Cloud based storage services like Dropbox and Google Drive are a cause for concern when it comes to privacy. They store encryption keys for your files on their servers. Therefore, anyone who manage to ...
1
vote
0answers
193 views

Does Sookasa really make Dropbox more secure? [closed]

Sookasa is a service that integrates with Dropbox and claims to make your files more secure by seamlessly encrypting them. In their article Is Dropbox secure? 3 weaknesses you should know about, ...
4
votes
2answers
642 views

Should I password protect all my archives from cloud?

I am a student and I didn't care a lot about my passwords strength and my files until now. Now I am thinking about having a backup for all my files in cloud. Questions: Should I password protect ...
0
votes
1answer
113 views

Securing communication over LAN in VPS provider [duplicate]

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. Ngnix ...
4
votes
2answers
80 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
1
vote
1answer
38 views

How exactly should I interpret the term “Hybrid Cloud”?

The CISSP CBK definition says that a hybrid could is a mix of public and private. But what exactly does it mean? Is it more a conceptual idea:If you use both a public and a private your company is a ...
-2
votes
3answers
243 views

Does MEGA cloud service say ALL the truth? [closed]

If this is not the right community for this question please inform me where to ask :-) I am talking about: encryption no enceyption key kept by MEGA and so on. I found many reviews confirming ...
6
votes
1answer
325 views

What is legally required to store HIPAA data in the “cloud”?

I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would ...
-3
votes
2answers
84 views

Can an attacker or law enforcement compromise apps in Google Play so that when I update I install the compromised app?

What are the chances a third party could make changes to apps on Google Play that I have installed, so that when I next update I am compromised?
2
votes
1answer
99 views

Will two virtual machines running on the same physical host machine get the same value from /dev/random?

Will two virtual machines running on the same physical host machine get the same value from /dev/random if read over the same time period? Say that Virtual-machine-1 wants to generate its ssh host ...
-5
votes
1answer
93 views

Does Server Mistrust improve security? [closed]

By server mistrust, I mean the fully implemented lack of customer plaintext on a vendor's system, and lack of vendor access to customer plaintext. Specific case in question: Password and SSH key ...
4
votes
1answer
459 views

/dev/random in EC2 cloud

is /dev/random any good in AWS EC2 for use in making a shared key that will be passed over a secure channel? i am concerned that a launched instance would have not much entropy to begin with. what ...
0
votes
0answers
75 views

Software Defined Perimeter assumptions, properties, deployment scenarios

Since 2013, the Cloud Security Alliance has been working on an open protocol and open source code base for a "Software Defined Perimeter" (SDP). But the whitepaper at SDP Specification v1.0 : Cloud ...
1
vote
2answers
117 views

Is Cryptree suitable for cloud storage?

I'm evaluating a cloud storage product. The marketing literature states it uses Cryptree. I pulled the paper and performed a quick read, but I don't see where Cryptree lends itself to confidentiality ...
0
votes
1answer
84 views

What security considerations should I take when planning do to Incident Response in my hybrid public cloud environment?

I am trying to compile a list of areas one should be aware of when doing Incident Response on public cloud environments, e.g. a hybrid public cloud, where some services are provisioned in local ...
2
votes
1answer
298 views

On the fly encryption for unencrypted cloud services?

Today Amazon announced their Cloud Drive with unlimited storage for only 60$/yr. Microsoft did the same with Office 365 a while ago. I don't really want to entrust either service with my dearest ...
1
vote
1answer
222 views

“It is safe if only Port 443/HTTPS is accessible from Internet!” Is it? [closed]

I was in discussion with a vendor to implement a backup solution and as flexible as most cloud applications nowadays, it needs to be access from anywhere on Internet without VPN or any special ...
1
vote
1answer
275 views

Is CloudKit or iCloud suitable for storing PII?

iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device. CloudKit is a similar technology that allows (from what I can tell) the partial ...
0
votes
1answer
163 views

Is cloud server without HTTPS secure

I am running a Seafile Open Source Cloud server (v 4.0.6) on my Raspberry Pi 2. Currently it is set up to simply run without HTTPS or even a domain name on [myIP]:8000. I am also running an Apache web ...
2
votes
1answer
225 views

Is End to End encryption possible for all servers across the whole infrastructure?

Running into a possible situation where a client I am working with is requesting that all data that leaves the servers should be encrypted and here, we are talking of hundreds of Linux servers ...
0
votes
1answer
109 views

uploading photos to cloud from an infected device [closed]

My computer is infected with Malware and (shame on me) of course I didn't back up my photos or word docs. I also happen to know almost NOTHING about computers. Is it possible to upload photos to cloud ...
1
vote
2answers
212 views

How to secure sensitive information on cloud from administrator (end-to-end encryption)

When I use end-to-end encryption to secure documents and sensitive information on cloud or on computer, there is always a risk of accessing these information by administrator. For example if you use ...
1
vote
0answers
152 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
2
votes
2answers
982 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...