Hacker News Reader

Comment by astockwell | Hacker News Reader

Not to worry, the aging executives in big corps/government are already well entrenched in the belief that "all of AWS is insecure ... because remember company xyz got breached on AWS..." referring of course to someone putting user data in public, unsecured S3 buckets. Will be a while yet before they start eating the lunch that cloud providers are peddling.

View on HN

Actually, AWS offers a government-targeted region specifically to address data escape concerns [0]. Not classified-secure, but fine for ITAR stuff. Definitely not something I expected to exist.

[0] http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/what...

Their offerings are certainly impressive when you (or your leadership) are willing to look. Most of their flagship offerings are also HIPAA certified (or can be upgraded to such).

HIPAA certification isn't legally meaningful (once the government actually publishes it's certification requirement and standards, certification to those standards will be legally meaningful, and one hopes also substantive; right now it's just throw some money at some firm whose entire business model is issuing legally-meaningless certifications that the buyer can use in promotion.)

The legally-meaningful thing is that they are willing to sign a HIPAA BAA and accept responsibility, not certification.

I think what matters is not that AWS isn't any more insecure than "bare metal," but that older old guys in position of power also hold those beliefs. So if you get hauled to congress and you have to explain to a bunch of gray-haired senators why your data was on a "public cloud" all the senators are really going to hear is the "public" part and people are going to think your company was incompetent for putting private data on a public cloud.

Reply on news.ycombinator.com