Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cloud-computing]

Cloud computing is about hardware-based services involving computing, network and storage capacities. These services are provided on-demand, hosted by the cloud provider and can easily scale up and down.

0
votes
2answers
31 views

AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation

I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture. We are using components such as AWS Lambda, AWS ...
-1
votes
0answers
28 views

What is stopping someone from reading memory of an application on the cloud? [duplicate]

Lets say if I have a cloud computing service I could run my code on. This code involves an https-secured web application. My question is: what is stopping the provider from just reading the ssl ...
0
votes
1answer
47 views

The main things a cloud data center could inject into its hardware

So some cloud service providers like Amazon use custom hardware to improve different characteristics of their servers. This also means they can control the security better, because there is nothing ...
0
votes
0answers
52 views

What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?

When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2. I have gone ...
1
vote
1answer
48 views

do we need VPN for SaaS cloud applications?

If we need to connect to the corporate network from home, we need to have the VPN connection. However, what if for accessing SaaS applications like Google Doc, Salesforce, etc, do we need still need ...
0
votes
0answers
54 views

Meltdown checker says AWS and Rackspace is vulnerable - Why?

Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with 7 of 8 variants OK (the failed one is apparently ...
1
vote
1answer
225 views

Is it safe to keep my KeePassX database on my server or cloud with encryption? [duplicate]

My KeePassX file has a long and strong password. I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus ...
2
votes
1answer
251 views

Amazon EC2 Abuse Report

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance. The email states: We observed machines under your control ...
1
vote
1answer
75 views

What are some attacks to consider in a cloud deployment? [duplicate]

I want to discuss the following scenario: I use a cloud provider like Amazon where every instance of the OS is a VM. The hypervisor launches the VMs as needed. So let's assume there are two VMs ...
1
vote
1answer
102 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
3
votes
5answers
345 views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
1
vote
2answers
142 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
0
votes
3answers
99 views

Security risks of exposing a VM to single IP address on the Internet

I have a small office network with about 10 workstations and a single physical domain controller. I want to move it to the cloud. For that, I deployed a Windows VM on Azure, which I'm going to promote ...
0
votes
2answers
86 views

Privacy of client's virtual machine in cloud computing

As we know clients can create and run their virtual machines (VM)in the cloud computing. My question is about the confidentiality of data stored in the client's VM. Question 1: Does data stored in a ...
1
vote
1answer
32 views

Safely connect to remote site from cloud based code

I am connecting my computer located at my home to a remote server. To communicate with the server, I use a config file that contains my private and public keys and a passphrase. My code reads the ...
3
votes
1answer
54 views

How does security work in a cloud-to-cloud backup scenario?

I'm thinking of using Spinbackup which is a cloud-to-cloud backup of gmail, but I was resistant to the idea of telling Spinbackup my gmail password for obvious reasons. However, on the Spinbackup ...
1
vote
1answer
112 views

Penetration Testing of IaaS/PaaS environment - CVSS Score

How can I measure the effectiveness of a Penetration Testing carried out in a Cloud Environment (IaaS/PaaS) by a third Party Vendor ? Should I ask for a CVSS score or something else ? Any advise will ...
0
votes
1answer
127 views

How does the TPM provide security for the cloud?

The primary scope of TPM is to assure the integrity of a platform. In this context, "integrity" means "behave as intended". ~Wiki I'm learning more about how the TPM performs integrity covering ...
0
votes
1answer
32 views

Do I need to trust my Paas provider?

I am currently entering the world of deploying my web application to the cloud. While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The ...
5
votes
3answers
201 views

What are the privacy conerns with cloud based submission in antivirus?

It seems like many antivirus programs use the cloud to scan files for malware. Isn't this a privacy concern if local files are being uploaded to the cloud? For example with Automatic Sample Submission ...
0
votes
1answer
418 views

Detect and Scan Open Ports

I am trying to understand two questions - I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
-1
votes
1answer
148 views

How can I protect my cloud processing from everyone … even those with root access?

How can I run my top secret code and data on any cloud hosting provider such that everyone even the hosting vendor with root is denied access ? ... a research proposal What is the current state of ...
0
votes
0answers
36 views

Office 365 - Conditional Access AND Tenant Restrictions

I'm putting together a set of security control recommendations for use with Office 365 and am trying to figure out if there is any reason why Tenant Restrictions (to stop people hooking up to their ...
2
votes
0answers
168 views

HIPAA compliant chat app with 3rd party provider without signing a BAA?

Short: If the data (PHI) I send to a third party is already encrypted, do I still need to sign a Business Associate Agreement (BAA) with them to stay HIPAA compliant? Long: To be specific, I was ...
2
votes
2answers
115 views

How do companies manage resources shared with 3rd parties on cloud platforms?

Over the years people at my company have shared resources on cloud platforms with 3rd many parties. This can be files on Google Drive, articles on Confluence, repositories on Github, slack channels, ...
9
votes
1answer
362 views

What does Spectre mean for public cloud computing?

From a tweetstorm by security journalist Nicole Perlroth: The most visceral attack scenario is an attacker who rents 5 minutes of time from an Amazon/Google/Microsoft cloud server and steals data ...
4
votes
1answer
146 views

AWS Tenant Restrictions

I'm a sysadmin of a medium sized chain of Italian restaurants. While I'm not dealing with patient health records or financial information I am still security focused. I'm trying to achieve tenant ...
5
votes
1answer
143 views

Using SSL (e.g. storing private keys) in SAAS / managed applications

How does one evaluate the risk of storing a private key (secret) on services like the AWS elastic load balancer, or for the purpose of my question: any service non-self managed service that could ...
2
votes
1answer
182 views

Office 365 “ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken”

I've detected a number of illegitimate logins to Office 365 (based on Client IP). In the audit log, the operation is listed as "ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken." I'm not ...
0
votes
1answer
71 views

A term for a policy that forbids employees storing intellectualy property (e.g. Source Code) on hosted third parties services

To be honest, I was not sure if this belongs to this board or Law Stack Exchange. I am searching for a specific term that describes a policy that a company does not allow itself to share its ...
0
votes
2answers
143 views

The difference between DDoS attacks in the cloud computing and the traditional network infrastructure [closed]

Is there any difference between the DDoS attack in the cloud computing and traditional network in infrastructure? What are the important features for detection these types of attack in cloud ...
1
vote
0answers
47 views

implementing a CA and a CSP

We are in the process of implementing a CA and a CSP for our organization. I came across these issues while implementing. Can the CA and CSP be owned by the same party? Will there be a conflict of ...
6
votes
1answer
369 views

AWS Security - Dev Test Staging Production Environments

Right now all our systems are in a traditional data center and traditional network topology. We're planning to migrate to AWS and in doing so we're trying to figure out how to implement our dev/test/...
5
votes
3answers
575 views

How secure is commercial cloud storage compared to my private cloud storage?

I've been wanting to determine the most secure way to store data via Cloud storage solutions. And although at first it may seem like a duplicate question, I have read all the similar ones and nothing ...
0
votes
2answers
123 views

Email SPF record integrity

I have been reviewing my company's SPF record with a number of our SAAS providers. One service advised me to use 'include:amazonses.com' in my record to allow emails to be validated. I am rather ...
1
vote
0answers
46 views

home vs cloud security [closed]

I recommended to a friend that code would be better off stored in the cloud in Google or Amazon or some other big cloud provider than in one's home due to Google and/or Amazon having arguably the best ...
1
vote
0answers
169 views

Offline mobile app data storage Guidelines, Standards

We are currently working on a project to develop an "offline" mobile application that synchronises data with our current cloud software solution that would allow field workers in potential mobile ...
2
votes
0answers
34 views

What security guarantees do Google Cloud Platform customer supplied disk encryption keys provide over Google provided keys?

Google Cloud Platform allows for customer supplied disk encryption keys as an option to using Google supplied disk encryption keys. However, to use customer supplied keys, you must send the key (...
-1
votes
1answer
127 views

Reasons to limit password length [duplicate]

We are currently using a third party software for SSO Login in a hybrid landscape with SAP, ADFS, etc. The users have to change their password in the client software, which is then sent to a central ...
18
votes
5answers
6k views

Cloud-based DDoS as a Service

With the consolidation of cloud computing and virtualization, a really simple doubt comes to my mind: why isn't DDoS being largely offered as a service? Why don't we see cloud-based DDoS attacks? ...
3
votes
1answer
150 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
2
votes
2answers
263 views

Solutions for accessing webapp from inside and outside the corporate perimeter by same users?

I'm looking for solutions that could best address the following requirements. We plan to develop a webapp and deploy it in the cloud. Corporate users must be able to access the webapp from the ...
4
votes
2answers
316 views

How to manage customer-supplied encryption keys in a multi-tenant cloud SaaS?

I'm working at an EU-based company and we'd like to offer business customers some kind of OS-independent cloud-based SaaS platform for processing and storing sensitive (health) data. We'd like to ...
1
vote
1answer
75 views

Application used in health industry: HIPAA HITECH hosting “requirements”

We have a scenario at my employer where we host an application that is used for uploading, storing, & managing documents related to patients' bills from healthcare providers. It is our knowledge ...
2
votes
0answers
77 views

Can I trace malicious email sent through a cloud hosting service?

Around the time my phone started acting like it was hacked, I was sent a suspicious email that opened automatically into a website without clicking on anything. I tracked it to a cloud hosting service....
-3
votes
1answer
47 views

can cloud data be recovered by hacking on the servers? [closed]

i have a problem. i want to ask if cloud service providerss can run test on their storage devices to recover data we delete., and if someone can hack into the servers do recover dat which we have ...
3
votes
1answer
368 views

How does Google SQL Proxy work?

Google Cloud SQL instances are by default not exposed to the Internet. One of the connection methods supported is Cloud SQL Proxy, which is able to map the Cloud SQL instance to a local port (say, ...
0
votes
2answers
535 views

is Cryptpad safe for corporate use (logs which includes hostnames, IP and internal configuration) [closed]

We don't have an internal Gist for fast sharing snippets and logs extracts with co workers. Is it safe to use this web service? quote from GitHub site: CryptPad is private, not anonymous. Privacy ...
10
votes
1answer
357 views

What are the privacy differences with Azure trustee delegates in China, Germany, and other locations?

Azure has different privacy agreements set up with different datacenters as mentioned in this footnote Azure is now available in China through a unique partnership between Microsoft and 21Vianet, ...
1
vote
2answers
137 views

Persistent exploits on “baremetal” cloud hosting services

There are several cloud providers that offer "baremetal" hosting where tenants are allowed root-level access to the OS running directly on the hardware. What is the risk that a previous malicious ...