6

I am building an Express (NodeJS) app and plan to host with AWS ec2. I want to protect my users' data as much as possible and am considering even outlier scenarios. And so the question arose:

The ec2 instances are physical managed in some Amazon datacenter and there are obviously personnel who manage those facilities who have physical access to those machines. Can they theoretically access the applications residing on those servers and view/monitor/steal sensitive data that is currently in use in the application?

Should this even be a concern? If so, what can we do as developers to mitigate this?

  • Can they? Yes. What can stop them? Privacy regulations. – sandyp Dec 31 '15 at 3:27
8

Yes, they can theoretically access or monitor the data.

No, this should not be a concern. Their incentives (organizationally and individually) to provide a stable, secure service are certainly greater than their incentives to steal your application's data, out of all of the millions of virtual machines and applications that they manage the infrastructure for.

As a developer, there is very little you can do to mitigate this, outside of not hosting with Amazon. Or any other cloud or managed service provider. Or collocation facility, for that matter.

Ultimately, any infrastructure that is out of your control is, well, out of your control. This should not keep you up at night though. It's like spending your time worrying about being abducted by aliens. While the risk is theoretically possible, you would get more value for your time by focusing on just about any of the more mundane and realistic risks that your application will actually be in danger of falling prey to, like any of the OWASP Top 10.

Steps you can (and should) take:

So, are there steps that you as an application developer can take to protect your data despite these realities? Sure, there are several things you can do.

The most basic (and possibly obvious) is don't collect or keep any data you don't absolutely need, and purge the data you do keep as soon as you can. Less data means less to lose in an attack.

Second, protect the data your application uses. Start by protecting it in transit. Use HTTPS/TLS for communications between your application and the users. This is an effective and inexpensive way to protect it from anyone who has access to the data center network to sniff traffic on the wire. Protect it at rest as well. If you have user passwords, protect them with a slow hash algorithm like bcrypt. This way, even if the data is accesses, it can't be easily abused. For other sensitive data you can look at encryption, and major cloud providers these days (Including Amazon AWS and Microsoft Azure) offer cloud-based HSMs for protecting encryption keys. While still not foolproof, it at least guarantees that someone who gains access to your VMs or disk images won't also capture your encryption keys.

To sum up, there are always steps that you can take that will make your application and data more secure, even when you don't control the infrastructure. It still boils down to understanding your application and business needs, the realities of how and where it runs, and then threat modeling it correctly for its purpose and environment and mitigating appropriately. From there, following standard secure design, development, and operational practices will help to ensure that your application and data are as safe as they can be.

  • Thanks for your response. Although "very little" can you recommend some methods a developer COULD use to mitigate this? Encrypt "data in use"? – ryd3r Dec 31 '15 at 12:36
  • @ryd3r Certainly, I've updated the answer with several steps you can take. – Xander Dec 31 '15 at 13:47
  • A good list until we get inexpensive homomorphic encryption. – Deer Hunter Dec 31 '15 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.