Hacker News Reader

Comment by blickentwapft | Hacker News Reader

I kind of assumed all my cloud computing resources were already private and confidential.

Not so?

You are right, data is private and confidential when it is ingested to the cloud and/or stored in the cloud, not when processed. Encryption of "data-in-use" is the 3rd leg in data protection of sensitive data, and it became possible with hw capabilities in new CPU chipsets, from AMD and Intel, as it has to be hardware based (better security and performance).

As storage and ingestion requires processing, that's the same as saying it's not private at any point when in the cloud.

And that's not necessarily a big deal. If you trust Google or AWS to hold all your business and customer data, no problem (and if your customers transitively have that trust). But I think there's a lot of denial about this fact: the cloud has all your data and all your customers data. Fixing that is really, really hard. It's not anywhere near as simple as Google are claiming in this announcement, certainly not "tick a box and it's switched on".

Do you mean those resources physically located with you? That's a good assumption.

Or do you mean those resources physically located in someone else's data center running on their hardware and software platforms among their infrastructure and only assigned to your task as-needed? That's a bad assumption.

Data in cloud and probably on the device you're using right now is mainly only encrypted while sitting on the disk and when bouncing around the net. The difference here is that the data is also encrypted throughout its life - while in memory and while the data is getting processed on the machine.

Reply on news.ycombinator.com