I have customers in the financial services industry that insist that a SaaS hosted on public clouds like Amazon's are not as secure as colocation in a private data center. However, I can't find specific details of what those security shortcomings might be. I can only think of 2 differences:
- Physical access and security of machines.
- Security hardware (packet inspection, intrusion detection) from Cisco et al
For (1) AWS has been audited to ensure physical security of the hardware. I can encrypt all data at rest (hard drive and DB) and all data on the internal network (VPC).
For (2) Cisco and Barracuda offer virtual security appliances that run in AWS. I can run these in a layer in front of the web servers.
Is there some security feature a bank can use with their own data center that I can't replicate on AWS?