Comments on: The cloud is a powder keg http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/ Sat, 20 Mar 2010 09:28:48 +0000 http://wordpress.org/?v=2.9.1 hourly 1 By: The cloud is a powder keg | Igniting Startups - nPost http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-3866 The cloud is a powder keg | Igniting Startups - nPost Fri, 09 Oct 2009 17:49:10 +0000 http://www.cdixon.org/?p=1310#comment-3866 [...] From cdixon.org [...] [...] From cdixon.org [...]

]]> By: kellan http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-5731 kellan Mon, 05 Oct 2009 17:33:30 +0000 http://www.cdixon.org/?p=1310#comment-5731 My mind immediately went to the money under the mattress metaphor as well. Banks have centralized the risk, and yet we still use them, for a combination of efficiency and security. In a world where everyone rolled their own security, home break ins would sky rocket. <br><br>And lets be clear, right now with technology startups 95% of them are in the hiding the money under the mattress stage. It's is only that much of the data is less liquid/desirable then money that has kept the relative rate of break in so low.<br><br>Security is something that you should never roll your own. You can get this by following best practices diligently, and ceaseless vigilance on your own hardware (I wonder if we could quantify "ceaseless" in terms of person/hour impact on a startup), or you can outsource it to the cloud. My mind immediately went to the money under the mattress metaphor as well. Banks have centralized the risk, and yet we still use them, for a combination of efficiency and security. In a world where everyone rolled their own security, home break ins would sky rocket.

And lets be clear, right now with technology startups 95% of them are in the hiding the money under the mattress stage. It's is only that much of the data is less liquid/desirable then money that has kept the relative rate of break in so low.

Security is something that you should never roll your own. You can get this by following best practices diligently, and ceaseless vigilance on your own hardware (I wonder if we could quantify “ceaseless” in terms of person/hour impact on a startup), or you can outsource it to the cloud.

]]> By: Prateek http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-5732 Prateek Mon, 05 Oct 2009 13:07:02 +0000 http://www.cdixon.org/?p=1310#comment-5732 Disclosure: I work for a SaaS project management tool called <a href="http://Remindo.com" rel="nofollow">Remindo.com</a>.<br><br>Being a SaaS provider myself, I agree with the Salesforce position that you can at best get better shotguns and better alarm bells, nevertheless dismissing security concerns seems like a bad idea to me. We have tried to fortify ourselves by using AWS and VeriSign SSL, this does ensure that there won't be data loss but frankly everyone knows that no security measure can be 100% failproof. And as far as internal threats(rogue employees etc) are concerned, its like asking bank employees why they won't steal money from your accounts. The business of the bank depends on the fact that it won't ever happen Disclosure: I work for a SaaS project management tool called Remindo.com.

Being a SaaS provider myself, I agree with the Salesforce position that you can at best get better shotguns and better alarm bells, nevertheless dismissing security concerns seems like a bad idea to me. We have tried to fortify ourselves by using AWS and VeriSign SSL, this does ensure that there won't be data loss but frankly everyone knows that no security measure can be 100% failproof. And as far as internal threats(rogue employees etc) are concerned, its like asking bank employees why they won't steal money from your accounts. The business of the bank depends on the fact that it won't ever happen

]]> By: kellan http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-3756 kellan Mon, 05 Oct 2009 10:33:30 +0000 http://www.cdixon.org/?p=1310#comment-3756 My mind immediately went to the money under the mattress metaphor as well. Banks have centralized the risk, and yet we still use them, for a combination of efficiency and security. In a world where everyone rolled their own security, home break ins would sky rocket. <br><br>And lets be clear, right now with technology startups 95% of them are in the hiding the money under the mattress stage. It's is only that much of the data is less liquid/desirable then money that has kept the relative rate of break in so low.<br><br>Security is something that you should never roll your own. You can get this by following best practices diligently, and ceaseless vigilance on your own hardware (I wonder if we could quantify "ceaseless" in terms of person/hour impact on a startup), or you can outsource it to the cloud. My mind immediately went to the money under the mattress metaphor as well. Banks have centralized the risk, and yet we still use them, for a combination of efficiency and security. In a world where everyone rolled their own security, home break ins would sky rocket.

And lets be clear, right now with technology startups 95% of them are in the hiding the money under the mattress stage. It's is only that much of the data is less liquid/desirable then money that has kept the relative rate of break in so low.

Security is something that you should never roll your own. You can get this by following best practices diligently, and ceaseless vigilance on your own hardware (I wonder if we could quantify “ceaseless” in terms of person/hour impact on a startup), or you can outsource it to the cloud.

]]> By: Prateek http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-3750 Prateek Mon, 05 Oct 2009 06:07:02 +0000 http://www.cdixon.org/?p=1310#comment-3750 Disclosure: I work for a SaaS project management tool called <a href="http://Remindo.com" rel="nofollow">Remindo.com</a>.<br><br>Being a SaaS provider myself, I agree with the Salesforce position that you can at best get better shotguns and better alarm bells, nevertheless dismissing security concerns seems like a bad idea to me. We have tried to fortify ourselves by using AWS and VeriSign SSL, this does ensure that there won't be data loss but frankly everyone knows that no security measure can be 100% failproof. And as far as internal threats(rogue employees etc) are concerned, its like asking bank employees why they won't steal money from your accounts. The business of the bank depends on the fact that it won't ever happen Disclosure: I work for a SaaS project management tool called Remindo.com.

Being a SaaS provider myself, I agree with the Salesforce position that you can at best get better shotguns and better alarm bells, nevertheless dismissing security concerns seems like a bad idea to me. We have tried to fortify ourselves by using AWS and VeriSign SSL, this does ensure that there won't be data loss but frankly everyone knows that no security measure can be 100% failproof. And as far as internal threats(rogue employees etc) are concerned, its like asking bank employees why they won't steal money from your accounts. The business of the bank depends on the fact that it won't ever happen

]]> By: chris dixon http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-3730 chris dixon Sun, 04 Oct 2009 14:16:30 +0000 http://www.cdixon.org/?p=1310#comment-3730 This is why the attacker always has the advantage in security - all you need is one weak link for them to exploit. This is why the attacker always has the advantage in security – all you need is one weak link for them to exploit.

]]> By: chris dixon http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-3729 chris dixon Sun, 04 Oct 2009 14:15:42 +0000 http://www.cdixon.org/?p=1310#comment-3729 I agree your average SaaS vendor has better security than their average client. I'm just really doubt that outweighs the Sutton rule. Salesforce has one of the juiciest data sets in existence. They better guard that like Fort Knox. Their website says they use SSL and have a firewall. Not reassuring. I agree your average SaaS vendor has better security than their average client. I'm just really doubt that outweighs the Sutton rule. Salesforce has one of the juiciest data sets in existence. They better guard that like Fort Knox. Their website says they use SSL and have a firewall. Not reassuring.

]]> By: chris dixon http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-3728 chris dixon Sun, 04 Oct 2009 14:13:38 +0000 http://www.cdixon.org/?p=1310#comment-3728 Well, with SaaS you now have an additional point of attack - in addition to the SaaS datacenter you can still put a keyboard logger on the client machine to get data. I agree however that long term SaaS vendors will deal with this better. Hence my investment in a technology I think will help them. Well, with SaaS you now have an additional point of attack – in addition to the SaaS datacenter you can still put a keyboard logger on the client machine to get data. I agree however that long term SaaS vendors will deal with this better. Hence my investment in a technology I think will help them.

]]> By: Kevin http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-3726 Kevin Sun, 04 Oct 2009 13:54:33 +0000 http://www.cdixon.org/?p=1310#comment-3726 Along the same line of thinking... I wonder about the security of so-called "mash-up" apps. Let's say you have a HR SaaS app that mashes up with a payroll SaaS app that mashes up with Salesforce, etc. Is there the potential for one of these SaaS apps to be the weak link in the chain and allow access into the others? I don't know the answer, I'm just posing the question as these types of scenarios become more prevalent. Along the same line of thinking… I wonder about the security of so-called “mash-up” apps. Let's say you have a HR SaaS app that mashes up with a payroll SaaS app that mashes up with Salesforce, etc. Is there the potential for one of these SaaS apps to be the weak link in the chain and allow access into the others? I don't know the answer, I'm just posing the question as these types of scenarios become more prevalent.

]]> By: ShanaC http://cdixon.org/2009/10/03/the-cloud-is-a-powder-keg/comment-page-1/#comment-3722 ShanaC Sun, 04 Oct 2009 13:26:18 +0000 http://www.cdixon.org/?p=1310#comment-3722 Somehow I get the feeling from the Art of War that all you would have to do in a highly centralized system is draw the person out and then wiplash them with a lot of very indirect pinpoint attacks before hitting them with a full brunt.<br><br>If you are saying that cloud storage is better because now we are walled- even the mightiest stone walls are at peril to water over time. Somehow I get the feeling from the Art of War that all you would have to do in a highly centralized system is draw the person out and then wiplash them with a lot of very indirect pinpoint attacks before hitting them with a full brunt.

If you are saying that cloud storage is better because now we are walled- even the mightiest stone walls are at peril to water over time.

]]>