Cloud computing is about hardware-based services involving computing, network and storage capacities. These services are provided on-demand, hosted by the cloud provider and can easily scale up and down.
0
votes
2answers
131 views
Vulnerability of the open port
I'm installing service on the cloud machine and I was wondering on port vulnerabilities for my customers.
My service which lives on server A (often on a customer site) needs to access server B ...
0
votes
1answer
72 views
opening up Active directory to cloud services?
We are testing SPAM/Virus cloud solutions and they can read active directory users and groups to help with users set-up and configuration. All they need from me is a user name, a password and the ...
1
vote
1answer
53 views
Security of data distributed to different cloud providers
This is an purely educational question:
Suppose we have different cloud storage providers. Imagine a files as a stream of bits and we save each 'th byte on the ( module )'th cloud provider's storage ...
16
votes
7answers
4k views
Can PHI be HIPAA compliant on a cloud?
I have read conflicting information on whether PHI can be stored and delivered on a cloud in a HIPAA compliant manner. I hear many people saying you cannot share infrastructure and be HIPAA compliant.
...
2
votes
1answer
79 views
Secure Development Environment for University dealing with private data
We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out ...
-2
votes
1answer
70 views
Pedometer with strong privacy (no data in cloud, local analysis software, no iOS) [closed]
I wish to do 10,000 steps a day. Now searching for an accurate pedometer. I don't wish a cloud solution, data must be local and a nice analysis software.
What do you recommend me? I am using a Mac.
2
votes
1answer
118 views
How secure is a static site hosted on Amazon S3?
I'm thinking about separating the static content from the dynamic content, and put the main www domain with the static content on Amazon S3. The main reason I want to do this is security. This site ...
7
votes
4answers
1k views
What Partial Homomorphic Encryption implementations exist and how do I leverage them?
It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
2
votes
1answer
200 views
What is the best practice for storing a secret on the cloud?
This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
4
votes
2answers
241 views
Evernote hacked - precautions?
On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software.
...
0
votes
1answer
66 views
Mechanisms to detect service abuse in the cloud
I want to ask if it is possible to detect the abuse of a service in the cloud. How can the SaaS provider be sure that the client does not use the service for criminal acts? For example how can Google ...
0
votes
5answers
194 views
Can I scan with nmap from cloud services?
Can i conduct nmap scanning from cloud services (i.e AWS)? i am looking to do external scanning for my company and want to set up something that will be quick, efficient, and cheap. I dont want to ...
2
votes
3answers
180 views
Evaluating Cloud Provider Security
I am trying to make a judgement call on a cloud provider's security. This is what I know :
Provider A - PRGMR.COM (not very well known but competent and reliable)
Is very transparent - seeks ...
1
vote
4answers
252 views
How unlikely is it that a Google Doc link is guessed?
Most (if not all) of us know that a Google Doc link looks something like this:
https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit
There are becoming several tools ...
0
votes
2answers
553 views
Anyone out there using Umbrella from OpenDNS? What exactly is it?
I'm still looking for a centrally-managed AV/malware management system and I've been testing out both Panda and Webroot (due to their 'cloud-based' structure that doesn't require a server for me to ...
1
vote
1answer
91 views
What does key, key pair and signature mean here?
I was reading How are possible uses for X.509 (SSL) certificates denoted? on IT SE. It begins with:
X.509 certificates can be used for servers, clients, email, code signing and more
...
3
votes
5answers
492 views
Building a Security Training Simulation environment
My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
1
vote
3answers
140 views
What are the security implications of Digital Lifeboat (or other p2p storage solutions)
From Digital Lifeboat's about us section
Our solution is a distributed storage cloud service. Digital Lifeboat will compress and encrypt each file selected for backup. We then process your ...
0
votes
2answers
202 views
encrypted cloud storage with partial local copy
Is there a cloud storage solution with the following features:
partially copied locally. Not fully like dropbox so it can be larger than the local disk. Not fully in the cloud but just a local disk ...
5
votes
7answers
2k views
GPU powered Password cracking machine - buy metal or cloud?
As a IS consulting firm, we would like to have our very own password cracking machine.
Great.
Now, after some sketching and brain storming we concluded that GPU is the best way to go (contrary to CPU ...
3
votes
3answers
90 views
Are mail-servers removed from security concerns in contrast with cloud storage?
I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
0
votes
2answers
82 views
Security in the breaking cloud? Storage Wars?
If access to a cloud server instance that stores personal/important information is lost or removed by the provider, is my data protected? Can the provider access my data and copy it, distribute, or ...
3
votes
1answer
155 views
How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?
Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? ...
2
votes
1answer
107 views
What security risks are involved with sending data over the internal network on Rackspace Cloud servers?
What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers?
Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
2
votes
1answer
137 views
smart AND secure cloud document archive
I am thinking of creating a cloud-based document archive. The intention is to make it impossible for the system to read the users' files, and be more than just a storage provider.
Looking at this ...
7
votes
2answers
152 views
Cloud-specific standards and regulations
Not specific to any particular industry or requirements, but in general - are there currently commonly accepted standards regarding cloud-based applications?
I* am developing a system that will be ...
4
votes
1answer
119 views
Insider threats for Private Clouds
Any one has any information or pointers to insider threats when cloud platforms like openstack etc deployed within corporate data centers ?
What are different kinds of internal threats in general ...
-1
votes
1answer
99 views
Cloud application Vulnerability assessment
Do you think server side assessment of application is important when application is hosted on a cloud like Amazon?
Assessment on software used to host the application not the actual application, e.g. ...
10
votes
3answers
574 views
Key management in cloud datacenters
In terms of infrastructure, how do Cloud providers (organizations providing SaaS, PaaS, or IaaS via the cloud) manage keys and cryptography?
From my understanding, "private" datacenters tend to ...
3
votes
3answers
257 views
Dedicated Server in Cloud Environment - SSL Remote Login vs Dedicated VPN
Thanks for taking your time to look into this question.
Background
I have my website hosted in a dedicated server in the cloud. The server is a Windows 2008 R2 machine. To publish I FTP files to ...
8
votes
5answers
459 views
Encrypt Virtual Machine in the cloud
I am no expert when it comes to security in virtualized environments.
However a problem I always saw is: What happens if the host OS gets hacked and an attacker gains administrative privileges?
How ...
13
votes
4answers
1k views
In what ways does Full or Partial Homomorphic Encryption benefit the cloud?
Can someone explain, in plain English, the practical ways FHE and PHE can be leveraged in the cloud? Some interesting (and confusing) links include this Microsoft Research PDF and this wiki entry.
...
2
votes
1answer
64 views
Can we just provide VM snapshopts to LEA
Currently Law enforcement agencies (LEA) take your entire server (or perhaps all servers) in a VPS/Cloud or multi-tenant situation.
Have we thought of any policy guidelines where VM images/snapshots ...
6
votes
6answers
6k views
It is safe to store photos and documents on skydrive / google cloud services?
I have over 20GB of photos and documents stored on my hard disk without a backup. I'm thinking about saving all of them in a cloud service such as Microsoft Skydrive or google cloud, but I'm wondering ...
1
vote
2answers
392 views
Can fully homomorphic encryption be practical?
Fully homomorphic encryption has been implemented by Craig Gentry using ideal lattices.
Can it be applied to data stored on a private cloud setup in practice?
I've seen references here and on other ...
5
votes
2answers
481 views
What are the security risks of the Azure Service Bus, and how do you mitigate them?
The Azure Service Bus is a way to relay SOAP/WCF information though the "cloud" as a XML over HTTPS payload.
One risk that I see is that it essentially allows a user with only outbound HTTP/S ...
3
votes
2answers
922 views
Storing password in Java application
What is best secure way to store passwords in Java web application?
I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
2
votes
2answers
127 views
Cloud services - A window to outsourcing illegal activities?
Recently I was exposed to a number of stories where alleged illegal activities (for this case, we can take brute-force) are outsourced to the cloud, and are run by the cloud providers. The providers, ...
3
votes
2answers
184 views
Concerns of data being on the cloud
Would you prefer a private cloud for your data or a public one?
Who takes care of financial liability in case of any breach?
Do companies still keep the most critical within their data centers, ...
6
votes
3answers
667 views
Safe implementation of sharing encryption secrets (username, password) in the cloud
I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
11
votes
2answers
1k views
What's wrong with storing private keys in the cloud?
I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
6
votes
7answers
796 views
Is this set-up PCI-Compliant?
Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant?
Here is the setup:
1) SSL is being implemented for the whole checkout process and for the ...
4
votes
4answers
824 views
Cloud computing: future security challenges and solutions
I am currently writing a paper on the future security challenges of Cloud Computing, and possible solutions to these problems. After many hours of reading articles on the internet (my nearby library ...
25
votes
4answers
5k views
How can PrivateSky not see your data?
PrivateSky is a website that promises encrypted "cloud-like" secure information exchange. They promise that except the sender and receiver, nobody can see your data. After testing it yesterday, I do ...
2
votes
1answer
157 views
VPS Safety in the Cloud
Imagine you are running a web server on a Virtual Private Server (VPS) hosted in a datacenter. Could the people running the datacenter covertly read files from my VPS's hard disk? Could an attacker ...
2
votes
4answers
276 views
Does outsourcing infrastructure services reduce risk (and improve security)?
I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc. This from observing how poor they are at practicing good ...
3
votes
4answers
300 views
Security of Cloud Storage
What are the main security risks of popular cloud storage services such as Dropbox? I am torn between the convenience of cloud storage and the potential security risk of it. How can I evaluate whether ...
13
votes
10answers
972 views
What are security issues which are specific to cloud computing?
Moving almost everything to the Cloud gradually becomes a mainstream.
Are there any security issues, which appeared together with this trend?
What everybody should check out, from the security point ...
8
votes
2answers
408 views
Protection of Keys/Passwords on Virtual Hardware (XEN, KVM, VMWare, etc.)
Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, ...
3
votes
2answers
108 views
Someone else's cloud infrastructure too sketchy for large enterprise SaaS application?
I have a set of geared-to-enterprise SaaS services I will be trying to sell soon to a number of large companies. In IT and Security reviews for critical software in the past, as a vendor you were ...
