Ayup. We use AWS CloudHSM to hold our private signing keys for deploying field upgrades to our hardware. And when we break the CI scripts I see Cavium in the AWS logs.
Now I gotta take this to our security team and figure out what to do.
Now I gotta take this to our security team and figure out what to do.
I'm sure a few others here would like to see their response as well.
It confused me when researching it.
I'm pretty aware of how painful it can be to configure AWS well, IAM roles, the overly large eco-system that we won't need and unmitigated complexity to configure it all. It's not comforting to think Azure is worse yet.
The Azure Resource Manager system is much easier to use than the fragmented mess that is AWS.
The problem with Azure is that they’re still catching up to AWS. They have fewer products and the quality is worse.
Really basic issues will remain unaddressed for years.
I was a Linux Sysadmin for a decade. They initially hired me to work on the "BigData" support team
Then after hiring threw me into CI/CD instead. I told them I don't know python or ruby and would be a terrible fit
I asked if I can join the Linux team. EC2 is bread and butter, that's easy stuff
"Oh we're actually shutting that team down soon. I'll move you into containers instead"
Spoiler: they didn't "shut down" the Linux group
The Intel Management Engine always runs as long as the motherboard is
receiving power, even when the computer is turned off. This issue can be
mitigated with deployment of a hardware device, which is able to disconnect
mains power.
Intel's main competitor AMD has incorporated the equivalent AMD Secure
Technology (formally called Platform Security Processor) in virtually all of
its post-2013 CPUs.
Ylian Saint-Hilaire, principal Engineer working on remote management software
including hardware manageability:
Hardware wise nothing changed, it’s just even harder for the actual owner of the hardware to use the legitimate management features while presumably easier for whoever could illegitimately abuse them.
I mean, you are already in US-based cloud, so if NSA is interested, they will just request information directly, no backdoors needed.
(This is a good test for your security team, btw: if they say anything other that "we do nothing", you know its all security theater)
Ironically, the data we're securing is because of US government requirements. So if the government wants to spy on itself, who are we to say?
you wouldn’t be cynical if you didn’t care, or felt able to do anything about it.