Hacker News Reader

Comment by londons_explore | Hacker News Reader

Cloud SRE should have a button to click to grant themselves access to an instance.

That button should create for them a fully logged SSH connection to the VM, and the data owner should be notified that SRE has connected. The data owner should then be able to see the commands executed via the SSH connection, and also request an explanation of what the SRE was doing.

The vast majority of instances are going to be things like "your instance hit a SIGSEGV, we logged in to grab the crash dump" or "your instance had a much higher than usage than all other users. We logged in to run tools to find where is was going".

View on HN

That would be acceptable since I could immediately close my account once SRE had connected due to the data breach.

To be more serious, it would be unacceptable for me that an employee can, for whatever reason, access my instance without my express permission and oversight. Even crash dumps could contain very sensitive information.

Well its called managed infrastructure for a reason.

Even in managed infrastructure, taking data out of the infrastructure is unacceptable.

I don't think there is a good solution yet for products like cloud SQL to make it theoretically impossible for an evil hosting company to steal your data.

But it should be possible for a client to audit all accesses, and the audit logging system be robust enough to catch evil employees.

Who audits the audit system? If I'm an evil employee I'll make sure my requests don't show up there.

So a company goes to the effort of creating an audit system, but gives everyone the ability to modify the history?

If your threat model is a single rogue employee, auditing systems address the issues. If your threat model is "the whole company works against you", you probably shouldn't be using any company to host your infra, so host it yourself, because there's no way to be secure in that situation.

I doesn't have to be impossible to access but the hoster shouldn't just log into my system and download arbitrary data from it. I'm not asking for perfect confidentiality, just contractual confidentiality.

Sounds like you should operate your own infrastructure.

He could just use AWS.

How do we know the same thing can't happen there, with respect to employees accessing data, etc? My point is unless you manage it yourself, you don't know.

Reply on news.ycombinator.com