Cloud computing is about hardware-based services involving computing, network and storage capacities. These services are provided on-demand, hosted by the cloud provider and can easily scale up and down.
9
votes
5answers
1k views
Risks with Amazon S3 and costs
I have little security knowledge and looking at image hosting for a startup:
Considering S3 doesn't allow you to set a cap on costs, how likely is it that someone could flood S3 with requests for my ...
11
votes
2answers
1k views
What's wrong with storing private keys in the cloud?
I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
2
votes
1answer
435 views
What browsers support encryption or decryption using local certificates, or smartcard readers?
I am working on a cloud-based solution and I would like to encrypt / decrypt the data locally using either a SmartCard or local Machine certificate. I'm hoping to do this in Javascript, but may ...
3
votes
1answer
165 views
Can wildcard certificates hide/obscure the hostname in a TLS connection?
I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
3
votes
3answers
982 views
Google App Engine Security
I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is.
Does anyone know if there was ...
0
votes
0answers
100 views
Google App Engine Security [duplicate]
Possible Duplicate:
Google App Engine Security
I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine ...
6
votes
7answers
828 views
Is this set-up PCI-Compliant?
Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant?
Here is the setup:
1) SSL is being implemented for the whole checkout process and for the ...
19
votes
1answer
1k views
Has anyone achieved PCI compliance on AWS?
All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
1
vote
3answers
2k views
Dropbox vulnerability details
Dropbox (the online cloud storage provider) was recently in the news for some security and privacy vulnerabilities. What was the problem, and what has been done to resolve it?
5
votes
2answers
731 views
Export laws on the cloud (key size)
Do the U.S. export laws around AES-256 apply to applications hosted in the cloud?
2
votes
1answer
596 views
iOS/Android authentication and security
Here is what I am trying to do and can anyone provide some best practice advice for authentication and security?
Each user will have their own private database on the cloud. He will have his local ...
5
votes
1answer
660 views
How to operate a honeypot in the cloud?
Just finished reading "Honeypot on home network to help me learn", and the top-voted/selected answer that suggest deploying a honeypot to the cloud, but the answer does not say how to do it; also, ...
8
votes
4answers
347 views
Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node?
This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path. I'm focused on how to use technology in a way that adds value to a secure ...
7
votes
4answers
1k views
What Partial Homomorphic Encryption implementations exist and how do I leverage them?
It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
6
votes
1answer
429 views
How do I learn Cryptographic/Mathematical notation
I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation.
How do I learn this notation and how to convey my approach?
How can I annotate this ...
3
votes
1answer
586 views
Peer review of C# cryptography for Azure Table security
Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
13
votes
4answers
1k views
In what ways does Full or Partial Homomorphic Encryption benefit the cloud?
Can someone explain, in plain English, the practical ways FHE and PHE can be leveraged in the cloud? Some interesting (and confusing) links include this Microsoft Research PDF and this wiki entry.
...
5
votes
2answers
378 views
What is more secure: Many subdirectories, or many subdomains?
I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef:
www.mydomain.net/enroll
www.mydomain.net/admin
www.mydomain.net/
... or I can configure them as a ...
10
votes
3answers
584 views
Key management in cloud datacenters
In terms of infrastructure, how do Cloud providers (organizations providing SaaS, PaaS, or IaaS via the cloud) manage keys and cryptography?
From my understanding, "private" datacenters tend to ...
2
votes
2answers
405 views
What CSS is considered Safe or Unsafe within a multi tenant website?
I'm reading the Azure Patterns and Practices multi-tenant guidance and in there it says
Cascading style sheets Behaviors are
one feature that the Surveys site will
not support.
What CSS ...
10
votes
2answers
788 views
CloudFlare benefits or drawbacks
Anyone running a webserver would agree, security can be a hustle and tedious job. Recently I came across a service claiming to help with that -- CloudFlare.com. There's plenty of benefits listed on ...
6
votes
3answers
684 views
Safe implementation of sharing encryption secrets (username, password) in the cloud
I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
2
votes
2answers
83 views
When would you support the storage of Security & Application event logs in the Cloud?
Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises?
When would you consider a SaaS /hosted solution and what value add should that ...
5
votes
2answers
498 views
What are the security risks of the Azure Service Bus, and how do you mitigate them?
The Azure Service Bus is a way to relay SOAP/WCF information though the "cloud" as a XML over HTTPS payload.
One risk that I see is that it essentially allows a user with only outbound HTTP/S ...
2
votes
2answers
172 views
How does LiveID work? Is there any documentation on the LiveID provisioning site msm.live.com?
I'm trying to learn details on how LiveID works, when compared to other federation technologies.
To be honest, I'm a bit overwhelmed by all the options at https://msm.live.com/ and want to understand ...
2
votes
4answers
282 views
Does outsourcing infrastructure services reduce risk (and improve security)?
I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc. This from observing how poor they are at practicing good ...
14
votes
10answers
989 views
What are security issues which are specific to cloud computing?
Moving almost everything to the Cloud gradually becomes a mainstream.
Are there any security issues, which appeared together with this trend?
What everybody should check out, from the security point ...
