Twenty Rules for Amazon Cloud Security

http://broadcast.oreilly.com/2008/11/20-rules-for-amazon-cloud-security.html

by chaostheory • 18 years ago

38 8 18 years ago

broadcast.oreilly.com

wmf2• 18 years ago

There's an assumption here that you use EC2 even though you don't trust Amazon. What is the cost of this assumption?

It would be interesting to separate these rules into universal ones and EC2 ones. I suspect that in many cases, following all these rules would add enough cost to offset any savings of using EC2.

rgrieselhuber• 18 years ago

A lot of these rules apply to more than just Amazon's cloud. If you're deploying to any one of the major hosting providers out there, it's critical to understand where you should be encrypting network traffic, etc. This is especially true as most of the affordable service providers don't provide any real DMZ-type support for the machines you rent.

bob_dole• 18 years ago

Aren't you in an enclosed network subnet within your own cloud in ec2?

emmett• 18 years ago

No, you share network subnet space with (an arbitrary number of) other EC2 users.

mmmurf• 18 years ago

In other words, how to shave the yak for about 6 months setting up a complicated security infrastructure.

These may all be good practices, but how many of them assume that Amazon itself will get hacked?

For entrepreneur on a budget, isn't #20 the most important one?

delano• 18 years ago

How does encrypting data and not allowing passwords for shell accounts affect your budget?

wmf2• 18 years ago

I suspect that many sysadmins have little experience with dm-crypt and all the key management you'd need with it, so learning and installing that stuff has a cost. And you better test thoroughly, because losing a key could mean losing all your data.

apollo• 18 years ago

How about Google app engine?

Twenty Rules for Amazon Cloud Security

Related Stories