Cloud computing is about hardware-based services involving computing, network and storage capacities. These services are provided on-demand, hosted by the cloud provider and can easily scale up and down.

learn more… | top users | synonyms (1)

39
votes
8answers
5k views

What are some considerations before moving personal data to Google Drive?

I am considering uploading some (all) of my digital personal data to Google Drive. I guess this would instantly grant access for NSA to my data. (Is that right?) Who would have access to my data on ...
29
votes
4answers
5k views

How can PrivateSky not see your data?

PrivateSky is a website that promises encrypted "cloud-like" secure information exchange. They promise that except the sender and receiver, nobody can see your data. After testing it yesterday, I do ...
20
votes
7answers
6k views

Can PHI be HIPAA compliant on a cloud?

I have read conflicting information on whether PHI can be stored and delivered on a cloud in a HIPAA compliant manner. I hear many people saying you cannot share infrastructure and be HIPAA compliant. ...
19
votes
1answer
2k views

Has anyone achieved PCI compliance on AWS?

All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
16
votes
10answers
1k views

What are security issues which are specific to cloud computing?

Moving almost everything to the Cloud gradually becomes a mainstream. Are there any security issues, which appeared together with this trend? What everybody should check out, from the security point ...
15
votes
4answers
2k views

In what ways does Full or Partial Homomorphic Encryption benefit the cloud?

Can someone explain, in plain English, the practical ways FHE and PHE can be leveraged in the cloud? Some interesting (and confusing) links include this Microsoft Research PDF and this wiki entry. ...
14
votes
2answers
3k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
13
votes
3answers
2k views

Is amazon S3 secure enough to hold personal documents?

I have a client who is looking to hold personal information such as Driving Licences and Insurance documents in order to verify if a user of the site is who they say they are and lives where they say ...
12
votes
5answers
3k views

Risks with Amazon S3 and costs

I have little security knowledge and looking at image hosting for a startup: Considering S3 doesn't allow you to set a cap on costs, how likely is it that someone could flood S3 with requests for my ...
12
votes
4answers
859 views

Key management in cloud datacenters

In terms of infrastructure, how do Cloud providers (organizations providing SaaS, PaaS, or IaaS via the cloud) manage keys and cryptography? From my understanding, "private" datacenters tend to ...
12
votes
2answers
845 views

Protection of Keys/Passwords on Virtual Hardware (XEN, KVM, VMWare, etc.)

Is there any reasonable way to secure data on virtual hardware? What I mean by "virtual hardware" is the various hosted systems that one can rent from various online hosters, that run on top of XEN, ...
10
votes
2answers
1k views

CloudFlare benefits or drawbacks

Anyone running a webserver would agree, security can be a hustle and tedious job. Recently I came across a service claiming to help with that -- CloudFlare.com. There's plenty of benefits listed on ...
9
votes
7answers
2k views

Encrypt Virtual Machine in the cloud

I am no expert when it comes to security in virtualized environments. However a problem I always saw is: What happens if the host OS gets hacked and an attacker gains administrative privileges? How ...
8
votes
4answers
2k views

What Partial Homomorphic Encryption implementations exist and how do I leverage them?

It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
8
votes
4answers
430 views

Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node?

This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path. I'm focused on how to use technology in a way that adds value to a secure ...
8
votes
2answers
177 views

Cloud-specific standards and regulations

Not specific to any particular industry or requirements, but in general - are there currently commonly accepted standards regarding cloud-based applications? I* am developing a system that will be ...
7
votes
3answers
573 views

Can cloud based password managing services be trusted?

I'm a big time user of cloud based password managing services like LastPass. But in the light of recent revelations like various government backdoors in popular sites, programs like prism, etc. I'm ...
7
votes
7answers
1k views

Is this set-up PCI-Compliant?

Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant? Here is the setup: 1) SSL is being implemented for the whole checkout process and for the ...
7
votes
9answers
2k views

How can I share files with other individuals using the cloud in a secure way?

I would like to use a dropbox because it is easy and convenient. But I want to encrypt the files with the public key of the intended recipient, so he will be the only one who can access the data in ...
7
votes
1answer
574 views

AWS VPC - should connections between instances be over SSL?

Say I have a few EC2 instances in an AWS VPC network, each assigned its own private address for the subnet at creation. Say one of them is a DB, and another one some kind of web app talking to the DB. ...
7
votes
1answer
950 views

How to operate a honeypot in the cloud?

Just finished reading "Honeypot on home network to help me learn", and the top-voted/selected answer that suggest deploying a honeypot to the cloud, but the answer does not say how to do it; also, ...
6
votes
6answers
14k views

It is safe to store photos and documents on skydrive / google cloud services?

I have over 20GB of photos and documents stored on my hard disk without a backup. I'm thinking about saving all of them in a cloud service such as Microsoft Skydrive or google cloud, but I'm wondering ...
6
votes
7answers
4k views

GPU powered Password cracking machine - buy metal or cloud?

As a IS consulting firm, we would like to have our very own password cracking machine. Great. Now, after some sketching and brain storming we concluded that GPU is the best way to go (contrary to CPU ...
6
votes
3answers
941 views

Safe implementation of sharing encryption secrets (username, password) in the cloud

I'm building a multi-tenant (cloud) environment that needs to push out (or make available for download) configuration files for agents (background services) that receive this information. One of the ...
6
votes
6answers
5k views

Storing KeePass database in cloud. How safe?

It certainly would be more convenient to store my KeePass database on either S3, Dropbox, or better yet SpiderOak. My fear is having my cloud storage account compromised then having the credentials ...
6
votes
2answers
870 views

What are the security risks of the Service Bus, and how do you mitigate them?

The Service Bus is software that can be installed on Windows or rented on Azure and allows someone to relay SOAP/WCF information over the internet in the form of a XML over HTTPS payload. One risk ...
6
votes
1answer
802 views

How do I learn Cryptographic/Mathematical notation

I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation. How do I learn this notation and how to convey my approach? How can I annotate this ...
5
votes
2answers
669 views

What is more secure: Many subdirectories, or many subdomains?

I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef: www.mydomain.net/enroll www.mydomain.net/admin www.mydomain.net/ ... or I can configure them as a ...
5
votes
2answers
3k views

Storing password in Java application

What is best secure way to store passwords in Java web application? I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
5
votes
2answers
2k views

Export laws on the cloud (key size)

Do the U.S. export laws around AES-256 apply to applications hosted in the cloud?
5
votes
3answers
516 views

How did the spammers get this address?

A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, ...
5
votes
1answer
170 views

Insider threats for Private Clouds

Any one has any information or pointers to insider threats when cloud platforms like openstack etc deployed within corporate data centers ? What are different kinds of internal threats in general ...
4
votes
4answers
1k views

How unlikely is it that a Google Doc link is guessed?

Most (if not all) of us know that a Google Doc link looks something like this: https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit There are becoming several tools ...
4
votes
4answers
392 views

Security of Cloud Storage

What are the main security risks of popular cloud storage services such as Dropbox? I am torn between the convenience of cloud storage and the potential security risk of it. How can I evaluate whether ...
4
votes
2answers
451 views

Using intranet SSO to access sites hosted on public cloud

We are thinking to move some of our intranet sites to public cloud. Is there any way to keep using company SSO to authorize access to those sites from the company intranet?
4
votes
4answers
1k views

Cloud computing: future security challenges and solutions

I am currently writing a paper on the future security challenges of Cloud Computing, and possible solutions to these problems. After many hours of reading articles on the internet (my nearby library ...
4
votes
2answers
561 views

Amazon EC2 security compared to a standalone server

Lets say I want to run a out-of-the-box instance on Amazon EC2 and on my own standalone server. I don't run anything on them, just let them idle by themselves. What is the relative level of security ...
4
votes
2answers
288 views

Evernote hacked - precautions?

On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software. ...
3
votes
5answers
2k views

Building a Security Training Simulation environment

My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
3
votes
2answers
993 views

Securing a Ubuntu system on Amazon Web Services

I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following: A relatively simple Java-based website (using the Noir framework) A Java-based ...
3
votes
3answers
111 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
3
votes
3answers
2k views

Google App Engine Security

I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is. Does anyone know if there was ...
3
votes
1answer
141 views

Is cloud hosting allowed for FIPS 140-2?

I am in the very early stages of making my application FIPS 140-2 compliant... so early in fact that I am not sure what level it has to be... just writing a preliminary recommendations document at ...
3
votes
2answers
218 views

Concerns of data being on the cloud

Would you prefer a private cloud for your data or a public one? Who takes care of financial liability in case of any breach? Do companies still keep the most critical within their data centers, ...
3
votes
1answer
799 views

Peer review of C# cryptography for Azure Table security

Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
3
votes
1answer
1k views

What is the best practice for storing a secret on the cloud?

This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
3
votes
1answer
375 views

How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?

Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? ...
3
votes
1answer
218 views

Can wildcard certificates hide/obscure the hostname in a TLS connection?

I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
3
votes
3answers
148 views

Are cloud-based collaboration tools “safe”?

I've tried to bring in collaboration tools at my company such as Evernote, Dropbox, OneNote, GoogleDocs etc. at our company but am finding it tough to get people on board. We use Sharepoint to store ...
3
votes
3answers
315 views

Dedicated Server in Cloud Environment - SSL Remote Login vs Dedicated VPN

Thanks for taking your time to look into this question. Background I have my website hosted in a dedicated server in the cloud. The server is a Windows 2008 R2 machine. To publish I FTP files to ...