Cloud computing is about hardware-based services involving computing, network and storage capacities. These services are provided on-demand, hosted by the cloud provider and can easily scale up and down.
25
votes
4answers
5k views
How can PrivateSky not see your data?
PrivateSky is a website that promises encrypted "cloud-like" secure information exchange. They promise that except the sender and receiver, nobody can see your data. After testing it yesterday, I do ...
18
votes
1answer
1k views
Has anyone achieved PCI compliance on AWS?
All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
16
votes
7answers
4k views
Can PHI be HIPAA compliant on a cloud?
I have read conflicting information on whether PHI can be stored and delivered on a cloud in a HIPAA compliant manner. I hear many people saying you cannot share infrastructure and be HIPAA compliant.
...
13
votes
10answers
962 views
What are security issues which are specific to cloud computing?
Moving almost everything to the Cloud gradually becomes a mainstream.
Are there any security issues, which appeared together with this trend?
What everybody should check out, from the security point ...
13
votes
4answers
1k views
In what ways does Full or Partial Homomorphic Encryption benefit the cloud?
Can someone explain, in plain English, the practical ways FHE and PHE can be leveraged in the cloud? Some interesting (and confusing) links include this Microsoft Research PDF and this wiki entry.
...
10
votes
2answers
1k views
What's wrong with storing private keys in the cloud?
I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
10
votes
3answers
573 views
Key management in cloud datacenters
In terms of infrastructure, how do Cloud providers (organizations providing SaaS, PaaS, or IaaS via the cloud) manage keys and cryptography?
From my understanding, "private" datacenters tend to ...
10
votes
2answers
765 views
CloudFlare benefits or drawbacks
Anyone running a webserver would agree, security can be a hustle and tedious job. Recently I came across a service claiming to help with that -- CloudFlare.com. There's plenty of benefits listed on ...
9
votes
5answers
1k views
Risks with Amazon S3 and costs
I have little security knowledge and looking at image hosting for a startup:
Considering S3 doesn't allow you to set a cap on costs, how likely is it that someone could flood S3 with requests for my ...
8
votes
5answers
454 views
Encrypt Virtual Machine in the cloud
I am no expert when it comes to security in virtualized environments.
However a problem I always saw is: What happens if the host OS gets hacked and an attacker gains administrative privileges?
How ...
8
votes
4answers
345 views
Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node?
This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path. I'm focused on how to use technology in a way that adds value to a secure ...
7
votes
4answers
1k views
What Partial Homomorphic Encryption implementations exist and how do I leverage them?
It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
7
votes
2answers
406 views
Protection of Keys/Passwords on Virtual Hardware (XEN, KVM, VMWare, etc.)
Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, ...
7
votes
2answers
152 views
Cloud-specific standards and regulations
Not specific to any particular industry or requirements, but in general - are there currently commonly accepted standards regarding cloud-based applications?
I* am developing a system that will be ...
6
votes
6answers
6k views
It is safe to store photos and documents on skydrive / google cloud services?
I have over 20GB of photos and documents stored on my hard disk without a backup. I'm thinking about saving all of them in a cloud service such as Microsoft Skydrive or google cloud, but I'm wondering ...
6
votes
7answers
789 views
Is this set-up PCI-Compliant?
Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant?
Here is the setup:
1) SSL is being implemented for the whole checkout process and for the ...
6
votes
3answers
665 views
Safe implementation of sharing encryption secrets (username, password) in the cloud
I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
6
votes
1answer
417 views
How do I learn Cryptographic/Mathematical notation
I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation.
How do I learn this notation and how to convey my approach?
How can I annotate this ...
5
votes
7answers
2k views
GPU powered Password cracking machine - buy metal or cloud?
As a IS consulting firm, we would like to have our very own password cracking machine.
Great.
Now, after some sketching and brain storming we concluded that GPU is the best way to go (contrary to CPU ...
5
votes
2answers
359 views
What is more secure: Many subdirectories, or many subdomains?
I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef:
www.mydomain.net/enroll
www.mydomain.net/admin
www.mydomain.net/
... or I can configure them as a ...
5
votes
2answers
659 views
Export laws on the cloud (key size)
Do the U.S. export laws around AES-256 apply to applications hosted in the cloud?
5
votes
1answer
640 views
How to operate a honeypot in the cloud?
Just finished reading "Honeypot on home network to help me learn", and the top-voted/selected answer that suggest deploying a honeypot to the cloud, but the answer does not say how to do it; also, ...
5
votes
2answers
476 views
What are the security risks of the Azure Service Bus, and how do you mitigate them?
The Azure Service Bus is a way to relay SOAP/WCF information though the "cloud" as a XML over HTTPS payload.
One risk that I see is that it essentially allows a user with only outbound HTTP/S ...
4
votes
2answers
285 views
Using intranet SSO to access sites hosted on public cloud
We are thinking to move some of our intranet sites to public cloud.
Is there any way to keep using company SSO to authorize access to those sites from the company intranet?
4
votes
4answers
822 views
Cloud computing: future security challenges and solutions
I am currently writing a paper on the future security challenges of Cloud Computing, and possible solutions to these problems. After many hours of reading articles on the internet (my nearby library ...
4
votes
2answers
416 views
Amazon EC2 security compared to a standalone server
Lets say I want to run a out-of-the-box instance on Amazon EC2 and on my own standalone server. I don't run anything on them, just let them idle by themselves. What is the relative level of security ...
4
votes
2answers
239 views
Evernote hacked - precautions?
On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software.
...
4
votes
1answer
119 views
Insider threats for Private Clouds
Any one has any information or pointers to insider threats when cloud platforms like openstack etc deployed within corporate data centers ?
What are different kinds of internal threats in general ...
3
votes
5answers
477 views
Building a Security Training Simulation environment
My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
3
votes
3answers
919 views
Google App Engine Security
I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is.
Does anyone know if there was ...
3
votes
3answers
90 views
Are mail-servers removed from security concerns in contrast with cloud storage?
I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
3
votes
4answers
299 views
Security of Cloud Storage
What are the main security risks of popular cloud storage services such as Dropbox? I am torn between the convenience of cloud storage and the potential security risk of it. How can I evaluate whether ...
3
votes
2answers
184 views
Concerns of data being on the cloud
Would you prefer a private cloud for your data or a public one?
Who takes care of financial liability in case of any breach?
Do companies still keep the most critical within their data centers, ...
3
votes
1answer
573 views
Peer review of C# cryptography for Azure Table security
Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
3
votes
1answer
153 views
How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?
Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? ...
3
votes
1answer
161 views
Can wildcard certificates hide/obscure the hostname in a TLS connection?
I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
3
votes
3answers
256 views
Dedicated Server in Cloud Environment - SSL Remote Login vs Dedicated VPN
Thanks for taking your time to look into this question.
Background
I have my website hosted in a dedicated server in the cloud. The server is a Windows 2008 R2 machine. To publish I FTP files to ...
3
votes
2answers
108 views
Someone else's cloud infrastructure too sketchy for large enterprise SaaS application?
I have a set of geared-to-enterprise SaaS services I will be trying to sell soon to a number of large companies. In IT and Security reviews for critical software in the past, as a vendor you were ...
3
votes
1answer
146 views
Do any cloud storage system offer an append-only mode for buckets, directories, etc.?
I'm curious what cloud storage systems offer an append only mode, especially open source ones. In particular, would any cloud storage systems support the following workflow :
Anonymous users may ...
2
votes
2answers
386 views
Securing a Ubuntu system on Amazon Web Services
I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following:
A relatively simple Java-based website (using the Noir framework)
A Java-based ...
2
votes
4answers
276 views
Does outsourcing infrastructure services reduce risk (and improve security)?
I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc. This from observing how poor they are at practicing good ...
2
votes
2answers
911 views
Storing password in Java application
What is best secure way to store passwords in Java web application?
I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
2
votes
1answer
137 views
smart AND secure cloud document archive
I am thinking of creating a cloud-based document archive. The intention is to make it impossible for the system to read the users' files, and be more than just a storage provider.
Looking at this ...
2
votes
2answers
397 views
What CSS is considered Safe or Unsafe within a multi tenant website?
I'm reading the Azure Patterns and Practices multi-tenant guidance and in there it says
Cascading style sheets Behaviors are
one feature that the Surveys site will
not support.
What CSS ...
2
votes
2answers
82 views
When would you support the storage of Security & Application event logs in the Cloud?
Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises?
When would you consider a SaaS /hosted solution and what value add should that ...
2
votes
1answer
64 views
Can we just provide VM snapshopts to LEA
Currently Law enforcement agencies (LEA) take your entire server (or perhaps all servers) in a VPS/Cloud or multi-tenant situation.
Have we thought of any policy guidelines where VM images/snapshots ...
2
votes
3answers
180 views
Evaluating Cloud Provider Security
I am trying to make a judgement call on a cloud provider's security. This is what I know :
Provider A - PRGMR.COM (not very well known but competent and reliable)
Is very transparent - seeks ...
2
votes
1answer
584 views
iOS/Android authentication and security
Here is what I am trying to do and can anyone provide some best practice advice for authentication and security?
Each user will have their own private database on the cloud. He will have his local ...
2
votes
1answer
78 views
Secure Development Environment for University dealing with private data
We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out ...
2
votes
1answer
116 views
How secure is a static site hosted on Amazon S3?
I'm thinking about separating the static content from the dynamic content, and put the main www domain with the static content on Amazon S3. The main reason I want to do this is security. This site ...
