1

When it comes to storing my data "in the cloud" (aka: on someone else's server), I alway have kind of a bad feeling that something like "Google's deleted an artist's blog, along with 14 years of his work" might happen to my data, too.

On the other hand, even big companies like Microsoft store lots of source code on GitHub.

My question:

What is the usual policy of companies storing their source code on external servers when it comes to minimizing risks of data loss?

E.g.

  • They could rely on GitHub making enough backups.
  • They could have a policy to always store data in local data centers before publishing to GitHub.
  • They could have special contracts with GitHub to get additional backups.
  • They could fetch the data through GitHub APIs and store it locally.

So actually I'm just trying to understand why/how Microsoft (or other companies) can publish code to their public GitHub repositories and which security strategies they are applying to protect themself from data loss.

Maybe my question is to some degree opinion based, on the other hand there could be a chance that someone from Microsoft (or other similar companies) reads here and can actually answer that question.

Update 1

I'm not asking on how Git(Hub) technically allows you to distribute your source code. I do hope that I understand most of these concepts.

I'm more asking how to convince management from a security point-of-view to allow their intellectual property (i.e. source code) being stored on external servers by an external company.

And since lots of companies, including big ones like Microsoft actually do use GitHub, I'm interested on how they deal with this.

Update 2

I've added some extra words to hopefully make it more clear that I'm mostly concerned about data loss.

Don't know if this is still security related, though.

closed as too broad by Stephane, GdD, Steve, Scott Pack, Steffen Ullrich Aug 4 '16 at 19:56

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 8
    Are you actually familiar with the way GIT works ? Its distributed nature means pretty much everyone working on the project has a full copy of the "central" repo. As backups goes, that should be enough for everyone. – Stephane Aug 4 '16 at 7:14
  • 1
    Thanks, @Stephane - I do think I understand most of this. I'm asking from a policy-kind-of-view. I.e. do the companies have any policy on how to deal with the fact that their source code is hosted externally? Once your data is (acidentially or not) gone from an external server, it is probably too late to hope that someone has created a local backup. – Uwe Keim Aug 4 '16 at 7:21
  • 1/ this isn't the question you actually asked. 2/ This is unrelated to security 3/ this is opinion-based: every company will deal with such a thing in their own terms. – Stephane Aug 4 '16 at 7:23
  • 1
    Instead of using the free github, enterprise can subscribe PaaS (Platform as a service) from github or even host the their own github server. Whether PaaS or hosting own server, it is enterprise that control their github server. Go contatc thte provider or read this : enterprise.github.com/features#pricing – mootmoot Aug 4 '16 at 7:47
  • 1
    Securing digital intellectual property should include "availability" and "business continuity". – mootmoot Aug 4 '16 at 8:54
1

Contracts

The artist was presumably using Google's free services. The terms and conditions of such services tend to boil down to "we own everything, you have no rights" (disclaimer: I don't know the exact terms for the artist).

When companies pay serious money for an enterprise cloud platform, they have a contract that is much more in their favour. There is still a risk the provider could mess up, but this particular scenario could not happen.

Some other approaches are multi-provider redundancy and offline backups. Multi-provider does seem a good solution - although I've not seen it done in practice. Offline backups are problematic because of the high bandwidth needed to perform a backup.

  • 1
    Thanks a lot! So although Microsoft's public GitHub repositories look like being similar to my very own public GitHub repositories, they are most likely completely different "under the hood" when it comes to data protection, backup and the like?!? – Uwe Keim Aug 4 '16 at 12:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.