Why Cloud Security Is Hard

    When I interviewed the head of one of the most successful Ubuntu based Linux Distributions a few weeks ago we talked about how he factors security into the project’s goals.  The metaphor he used in the interview was that security is like swiss cheese.  There are naturally going to be holes in the product, but it doesn’t become a problem unless there are too many holes allowing something to pass through, or get in too deep.  As the head of the project he’s the one ultimately responsible for its security.  I know who to reach out to if I find a bug or something goes wrong.

    One reason why Cloud Security is so challenging is because it’s often hard to know who to reach out to when holes are found.  One of the worst practices still seen in the industry is storing people’s information unencrypted.  When a local realty site asked for some personal information before they showed me a listing and then sent the information plain text to me over email I was really glad I used a burner email address (one reason why it’s good to own your own domain).  

     I called the company up and told them they weren’t following good practices and needed to encrypt my data or remove it.  The real estate market requires a broad range of skills.  Computer security isn’t one of them.  As polite as the realtor was on the phone he didn’t understand why he needed to change anything on his end.

     Irena Bojanova is a wonderful contributor to the IEEE and her article on Addressing Cloud Security provides a good overview of the trade offs involved in different types of cloud implementation.  SaaS puts the onus of security on the hosting company while PaaS and IaaS move the security requirements (minus physical security) closer to the customer.  Security is so important in the cloud that it will change the way I implement my projects significantly.

     I’m perfectly capable of setting up a LAMP server in the house and getting the port forwarding to allow outside access, but encouraging that traffic into my LAN isn’t something I want to own.  If all I need is a LAMP server I’ll often host at DigitalOcean.com because they make it easy to get it running in under a freakin’ minute!  When I host with them it’s basically a PaaS setup.  But if I run the LAMP server on DigitalOcean I get full control over it, and a lot of the responsibility for securing it.  Most of the time I don’t want to deal with the hassle–even if WordPress does do automatic updates (insecure plugins are still a good sized attack vector).  In that case I’ll build a site using Squarespace.com.  Squarespace does all the coding for me so all I really have to do is worry about layout and content.  When I went to launch jfroecker.com I decided to go with them because I’d never have to troubleshoot a denial of service attack or a code injection gone wrong.  That piece of mind makes a big difference.

    Google’s record of finding and patching bugs is impressive and so there’s some data I’ll host on google drive because of their ability to protect the content at least as much as my password will allow.  As one of the world’s largest data repositories they’re often called upon to comply with subpoenas for information and as much as they patch holes, they also comply with their legal obligations to assist law enforcement.

     There’s no perfect solution to security in the cloud.  It’s like swiss cheese.  There are going to be holes, but before you go throwing your data up online you might want to take a look at how deep and how big those holes are.