My company sells an app subscription, which is hosted as SAAS on Amazon Cloud. I have had a few clients who weren't very keen on uploading their documents to my product because my product is hosted on the public cloud. Why is this general distrust seen with respect to cloud?

Even a layman looking up google, would find so many whitepapers and blogs, for instance like this, which talk about how secure Amazon Services, Network and Infrastructure are. It's hard to get this kind of security even if you host anything on your own servers (unless you are a profitable million dollar company!).

When these doubts are raised by so called 'security experts' at big firms, I wonder if I am missing something. If you have physical security for your server, network security that protects you from DDos, Ipspoofing, and etc and finally, myriad of others like disk encryption, instance isolation, SSL and etc, why would anyone doubt pushing documents/data through a secure channel to an application hosted on Amazon?

  • What your company does on top of AWS is also a large concern. AWS may be secure but you have the ability to put huge holes in it because you misconfigured something. – user9517 Nov 26 '15 at 19:06
  • yes, valid point. We run one dedicated instance per client, with ip range based access and regular authentication on top of it. – Jay Nov 26 '15 at 19:24

Amazon is root and can read everything you store on their systems, unless you're using end-to-end encryption.

Amazon is a US company and must comply with court orders (secret or otherwise) for your data. So if your client is a Brazilian airline manufacturer trying to protect trade secrets, good luck.

Your software also runs in a virtual machine, on the same hardware as other people's virtual machines. There are occasionally flaws in VMs that allow people to escape them and gain root on that computer, and read your data.

  • end to end encryption would mean what? I agree with you on the compliance part. Have there been situations where VMs have allowed people to gain root on host on Amazon? What are the practical chances of this happening? – Jay Nov 26 '15 at 20:05
  • end-to-end meaning you encrypt and decrypt on client machines only and store encrypted blobs on amazon – Neil McGuigan Nov 26 '15 at 20:07
  • Is there a way to achieve reliable end to end encryption in web applications? When browser is the client, isn't it difficult to create end to end encryption? – Jay Nov 26 '15 at 20:10
  • and re #2, yes: eweek.com/cloud/… – Neil McGuigan Nov 26 '15 at 20:12
  • @Jay ya it's not something you'd want to do in the browser. – Neil McGuigan Nov 26 '15 at 20:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.