0

What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider.

How common is it that some IT employee within the hosting provider would/could grab the codebase and database and look through it, or worse, post it online etc?

It would seem that a very high percentage of all websites (and their data) are hosted with/entrusted to some 3rd party provider. However, I see very little talk around the security of that scenario.

What can be done to protect data and source code (from a prevention perspective) against this type of breach if it must be hosted externally?

Improve this question
2
  • 1
    This is a very broad question which probably will cause different personal opinions too. Apart from that various aspects of this question are often asked here (how to protect code, how to protect data., whom can I trust...) and you will find several answers. Therefore I suggest to close this question.
    – Steffen Ullrich
    Nov 6, 2015 at 18:29
  • I think this is a common and very real concern. It gets less press than massive break-ins because it's less sensationalist. If some employee is ever found of stealing 90M passwords, it will get lots more press then.
    – Neil Smithline
    Nov 7, 2015 at 21:07

1 Answer 1

Reset to default
1

The security and privacy of your data is something you establish in your contract with the hosting provider. You decide what needs to be kept secret and from whom, you establish penalties for violations of this trust, and you establish an arbitration method to resolve disputes. During contract negotiations, your hosting provider is free to accept your terms or to reject them. Once the contract is signed, it's up to them to live by those terms.

You can also always seek an insurance policy to help protect you in case of a violation, but those probably will not be cheap.

It's hard to determine whether or not a specific hosting provider has a good track record, as those would be resolved in contract arbitration with their clients, and not part of the public record. You can look at the overall state of violations by browsing a third party's analysis, such as the Verizon Data Breach Report, but the aggregate numbers won't identify specific violators.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .