So much cloud encryption is a total checkbox. As a security professional I sometimes don't have a clear threat model that the magic crypto is meant for.
Azure is really far ahead on security compliance with EU regulation, perhaps mostly on the image side of things though. But that’s important too, because when I ask our data protection officer and our lawyers which way to go, they point to Azure.
Which is great and bad. I really, really like Microsoft and Azure is awesome for .Net. Only we’re doing less and less .Net, and more and more of the development pool I have to chose from in hiring situations live in AWS.
Our main cloud will continue to run in Azure, because that’s where our 365 platform is, it’s where our IT crew is certified and Microsoft has been a good partner for decades. But I do want the option for us to use smaller software houses that are AWS only to develop minor systems that we operate in AWS ourselves as well. I think this will help AWS in that regard.
So not only is the data kept in Europe, it’s also kept on instances that are separated from the rest of AWS and Azure and we can physically visit our specific hardware in their data enters. Hardware which only runs our stuff.
This is one of the reasons we don’t use google, because they don’t offer this. I’d love to use firebase for instance, but not if I can’t be sure citizen data is absolutely safe.
We killed the local datacenter a decade ago when we started renting iron to house our own cloud. The majority of our systems still operate on VMs in that setup, but even that is more expensive than going full Azure/aws. We don’t, because a lot of our legacy systems wouldn’t run in the full cloud and if we need a SQL cluster on our own internal network anyway, then we might as well use it. Though, we’re nearing the point where a DB cluster in Azure will be considered our own network.
Then there’s the stuff we can’t do, like spin up 5000 servers on demand. Say we train some ML to find something specific missing from millions and documents. With Azure we can call Microsoft and plan to execute this, and they’ll give us exactly the resources we need for exactly how long we need it, and you just can’t beat that.
So it’s a cost-benefit thing. By going Azure and AWS, we get to spend more money on our primary function, which isn’t IT.
One example is the case files I told you about. It's basic image recognition really, but it's millions of poorly scanned pages. 10 years ago, we would've gone through it by hand, and it would've taken 8-12 full time employees 3 months to do it.
Now we can have one PHD student do a 2-3 month training project that he/she uses for their research, and we have an algorithm that can go through the case files in 5 hours, provided we rent enough iron to do so. With AWS or Azure that's not a big problem, depending on size you can do it on-demand, but we had to call Microsoft and prepare 5000 server instances when we did it. That was some years ago by the way, so maybe it's on-demand now. Anyway, they went through the case files in 5 hours, and had a lower error margin than our employees would have had.
After those 5 hours, you shut everything down. There is really nothing comparable to that. You can certainly do that without moving other things to AWS or Azure, like I said, but it's often the financially solid decision.
And what's the problem with it exactly? Our own internal network has been breeched more than once, our Azure instances have never been hacked.
I have built quite a few Azure services, most of which are written in Python or Java and running on Linux.
I also have plenty of .NET Core code running, but the non-.Net experience is just as good as the .NET one.
Is this supposed to be a differentiator?
Now .Net Framework on AWS is a completely different beast.
It is like taping the key above the door lock. Access control to the door is the important part.
In such an environment, encryption at rest can come in handy because it mitigates some of the physical attack vectors.
I don't make any real adjustments to my risk models until I enable customer-managed keys. At this point, the encryption is really facilitating a secondary access control mechanism audit mechanism. That said, these additional mechanisms can be quite effective when you know how to use them.
One might hypothesize government auditors and warrants compelling raw disk contents to be turned over for criminal prosecution, but that scenario supposes that a government entity would lack the creativity to imagine options like arresting the root login user, and jailing them until they enter the root account password to offer access to the encrypted data at rest.
Just because there are complex vectors doesn’t mean you give up on the basic ones.
This is a valuable thing, and for now, a differentiator.
That's a silly threat model, but it takes a long time for rules and regulations to catch up with realities.