Cloud computing is about hardware-based services involving computing, network and storage capacities. These services are provided on-demand, hosted by the cloud provider and can easily scale up and down.

learn more… | top users | synonyms (1)

4
votes
2answers
48 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
8
votes
8answers
13k views

Storing KeePass database in cloud. How safe?

It certainly would be more convenient to store my KeePass database on either S3, Dropbox, or better yet SpiderOak. My fear is having my cloud storage account compromised then having the credentials ...
22
votes
7answers
7k views

Can PHI be HIPAA compliant on a cloud?

I have read conflicting information on whether PHI can be stored and delivered on a cloud in a HIPAA compliant manner. I hear many people saying you cannot share infrastructure and be HIPAA compliant. ...
1
vote
1answer
34 views

How exactly should I interpret the term “Hybrid Cloud”?

The CISSP CBK definition says that a hybrid could is a mix of public and private. But what exactly does it mean? Is it more a conceptual idea:If you use both a public and a private your company is a ...
2
votes
3answers
684 views

Digital Ocean “Droplet” allgedly compromised for trivial, unpublicized website. Should I be worried abouty my own machine?

I got a message from D.O. about my Droplet saying they shut it down because there was a lot of outgoing traffic that looked like an attack. The site I had on that server was not very known at all. ...
-4
votes
3answers
72 views

Does MEGA cloud service say ALL the truth? [closed]

If this is not the right community for this question please inform me where to ask :-) I am talking about: encryption no enceyption key kept by MEGA and so on. I found many reviews confirming ...
6
votes
1answer
122 views

What is legally required to store HIPAA data in the “cloud”?

I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would ...
1
vote
2answers
81 views

Is Cryptree suitable for cloud storage?

I'm evaluating a cloud storage product. The marketing literature states it uses Cryptree. I pulled the paper and performed a quick read, but I don't see where Cryptree lends itself to confidentiality ...
4
votes
2answers
71 views

How to keep data private where software requires an online check

When software forces a user to verify online (phone home) before use, it creates an opportunity for private data created with this software to be physically connected to the Internet. This may not be ...
4
votes
4answers
2k views

How to mitigate SSL based DDoS attacks?

as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without ...
-3
votes
2answers
69 views

Can an attacker or law enforcement compromise apps in Google Play so that when I update I install the compromised app?

What are the chances a third party could make changes to apps on Google Play that I have installed, so that when I next update I am compromised?
5
votes
3answers
149 views

Cloud Based WAF

I'm currently evaluating different approaches to implement a web application firewall (WAF) in our architecture. We need the WAF due to PCI DSS. I would prefer using a cloud based WAF (e.g. ...
0
votes
2answers
120 views

Forensic in Cloud environment

Let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username and password for Windows instance), and I used a software like FTK Remote Agent to ...
4
votes
2answers
199 views

Is the same decryption key used for data on the server as locally with Lastpass?

Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices ...
2
votes
1answer
62 views

Will two virtual machines running on the same physical host machine get the same value from /dev/random?

Will two virtual machines running on the same physical host machine get the same value from /dev/random if read over the same time period? Say that Virtual-machine-1 wants to generate its ssh host ...
-4
votes
1answer
79 views

Does Server Mistrust improve security? [closed]

By server mistrust, I mean the fully implemented lack of customer plaintext on a vendor's system, and lack of vendor access to customer plaintext. Specific case in question: Password and SSH key ...
5
votes
5answers
2k views

How unlikely is it that a Google Doc link is guessed?

Most (if not all) of us know that a Google Doc link looks something like this: https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit There are becoming several tools ...
3
votes
1answer
2k views

can I trust Boxcryptor closed source software? Encryption of files for cloud hoster

Boxcryptor https://www.boxcryptor.com is not Open Source. Can I trust this? Is it secure? No government backdoor? Because there is no alternative for OS X and iOS.
4
votes
1answer
152 views

/dev/random in EC2 cloud

is /dev/random any good in AWS EC2 for use in making a shared key that will be passed over a secure channel? i am concerned that a launched instance would have not much entropy to begin with. what ...
0
votes
0answers
46 views

Software Defined Perimeter assumptions, properties, deployment scenarios

Since 2013, the Cloud Security Alliance has been working on an open protocol and open source code base for a "Software Defined Perimeter" (SDP). But the whitepaper at SDP Specification v1.0 : Cloud ...
9
votes
7answers
5k views

GPU powered Password cracking machine - buy metal or cloud?

As a IS consulting firm, we would like to have our very own password cracking machine. Great. Now, after some sketching and brain storming we concluded that GPU is the best way to go (contrary to CPU ...
7
votes
10answers
5k views

How can I share files with other individuals using the cloud in a secure way?

I would like to use a dropbox because it is easy and convenient. But I want to encrypt the files with the public key of the intended recipient, so he will be the only one who can access the data in ...
1
vote
1answer
197 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
1
vote
1answer
133 views

Is CloudKit or iCloud suitable for storing PII?

iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device. CloudKit is a similar technology that allows (from what I can tell) the partial ...
0
votes
1answer
50 views

What security considerations should I take when planning do to Incident Response in my hybrid public cloud environment?

I am trying to compile a list of areas one should be aware of when doing Incident Response on public cloud environments, e.g. a hybrid public cloud, where some services are provisioned in local ...
1
vote
2answers
431 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...
0
votes
0answers
24 views

Securing decentralised cloud scaling

Approach Require a certain percentage (quorum) of nodes to agree in order for my decentralised multicloud to grow. Benefits Reduced likelihood of growing too quickly (e.g.: 2 new nodes created ...
3
votes
1answer
156 views

On the fly encryption for unencrypted cloud services?

Today Amazon announced their Cloud Drive with unlimited storage for only 60$/yr. Microsoft did the same with Office 365 a while ago. I don't really want to entrust either service with my dearest ...
1
vote
1answer
144 views

“It is safe if only Port 443/HTTPS is accessible from Internet!” Is it? [closed]

I was in discussion with a vendor to implement a backup solution and as flexible as most cloud applications nowadays, it needs to be access from anywhere on Internet without VPN or any special ...
0
votes
1answer
116 views

Is cloud server without HTTPS secure

I am running a Seafile Open Source Cloud server (v 4.0.6) on my Raspberry Pi 2. Currently it is set up to simply run without HTTPS or even a domain name on [myIP]:8000. I am also running an Apache web ...
1
vote
1answer
136 views

Is End to End encryption possible for all servers across the whole infrastructure?

Running into a possible situation where a client I am working with is requesting that all data that leaves the servers should be encrypted and here, we are talking of hundreds of Linux servers ...
0
votes
1answer
55 views

uploading photos to cloud from an infected device [closed]

My computer is infected with Malware and (shame on me) of course I didn't back up my photos or word docs. I also happen to know almost NOTHING about computers. Is it possible to upload photos to cloud ...
1
vote
2answers
150 views

How to secure sensitive information on cloud from administrator (end-to-end encryption)

When I use end-to-end encryption to secure documents and sensitive information on cloud or on computer, there is always a risk of accessing these information by administrator. For example if you use ...
0
votes
3answers
302 views

How to secure delete inside a virtual machine?

Here is a tricky one: Can you securely delete a file from a VM? I'm sure the answer is dependent on a million different variables, and I'm sure the answer is something like "not really" but I want ...
1
vote
0answers
83 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
1
vote
0answers
36 views

Unrestricted file upload on a cloud based platform [closed]

We have an unsecured file upload for the user to upload any file they want, our application is Azure based so they are stored as blobs not as a traditional "file on disk". Could malicious code still ...
8
votes
7answers
2k views

Is this set-up PCI-Compliant?

Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant? Here is the setup: 1) SSL is being implemented for the whole checkout process and for the ...
0
votes
2answers
161 views

Is it safe to store encrypted volumes on cloud syncing services?

A recent discussion on another website prompted a proclamation that storing (TrueCrypt, LUKS, DMG, etc) on cloud sync services like Dropbox is unsafe, since a version history is kept of each file, and ...
0
votes
0answers
29 views

Machine actions in distributed systems

I am looking at the security implications of distributed systems, and am trying to simplify the way that I can model individual machines within a distributed system interacting. The importance of the ...
1
vote
0answers
35 views

Security schemes regularly in use on cloud

I've been looking into how connections are managed in the cloud, in order to better understand the threats users and their deployments may face. The most important and common ones in use seem to be ...
1
vote
1answer
110 views

Acquiring remote forensic image from EC2 instance

I'm trying to figure the best way to acquire remote image from an EC2 instance. Here is how I took/trying to take an image of an EC2 EBS drive: Using EnCase Remote Recovery (trial for 14 days): ...
0
votes
1answer
44 views

Potential dangers of re-locating critical systems to cloud

It was suggested by some consultants that We relocate some of our critical systems in our environment to cloud base architecture. Besides knowing the fact that on a cloud base architecture we have no ...
0
votes
2answers
172 views

Can Amazon's AWS Identity and Access Management (IAM) be used to manage server access?

Requirement 8.1.1 of PCI DSS states: Assign all users a unique ID before allowing them to access system components or cardholder data. Using Amazon IAM I can set up individual accounts for users ...
6
votes
2answers
498 views

Is cloud hosting allowed for FIPS 140-2?

I am in the very early stages of making my application FIPS 140-2 compliant... so early in fact that I am not sure what level it has to be... just writing a preliminary recommendations document at ...
1
vote
4answers
645 views

Security risk of allowing ICMP “destination unreachable” packets on AWS

If I configure an Amazon AWS VPC, should I explicitly allow ICMP "destination unreachable" packets inbound? I am wanting the VPC firewall to block everything by default, however does this mean this ...
1
vote
0answers
59 views

What are the steps to securing encryption keys/databases on an unsecured DAAS provider?

Most Desktop As A Service providers store their virtual hard drives and the VMs RAM in a way that allows them to access their contents. Choosing a provider who offers a 'no-knowledge of server' ...
-1
votes
0answers
174 views

An Efficient and Secure Dynamic Auditing Protocol for Data Storage in Cloud Computing [closed]

I am doing research on this topic and have to submit research paper in my college. I've googled many times for relevant material but didn't find anything suitable. Here are some key features : ...
8
votes
3answers
3k views

Is Firefox Password Manager less secure than LastPass?

After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager". (This option appears as long as the Firefox ...
1
vote
1answer
158 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
1
vote
2answers
132 views

IDS across seperate AWS accounts

I have 2 separate AWS accounts and I would like to a Vuln scanner/IDS on one to scan another. One environment is a regular AWS account and the other is in AWS Gov Cloud. Due to limitations within ...