OT: Cloud Computing security issues

[Bill Campbell]

On Thu, Aug 12, 2010, Richard Kreiss wrote:
>I am sure some of you have already seen this but thought for those that
>haven't, it would be enlightening
>
>Jurisdiction and the Cloud
>Moving data to the cloud could cause some law enforcement headaches.

Headaches for ``law'' enforcement may be a good thing.  Google
``three felonies a day'' or read some of William Grigg's articles
on Lew Rockwell.com see how far the U.S. has gotten from the Rule
of Law:

	http://www.lewrockwell.com/grigg/grigg-w142.html

	http://www.lewrockwell.com/grigg/grigg-arch.html

On the other hand, I have serious reservations about cloud
computing in general for several reasons relating to reliability,
security, and control.

The most recent experience I had was a week or so ago when were
experimenting with a CentOS 5.x system on Godaddy that was to be
used as a border MX server doing initial spam and anti-virus
checking before forwarding clean messages to one or more SMTP
servers via secure connections for delivery.

The first problem I ran into was that godaddy didn't permit
outgoing SMTP on port 25, and their support people didn't
understand that this was basic to operations, saying something
like ``use http, smtp is an obsolete protocol''.  We never could
find anybody in their ``support'' department with a clue.  Of
course there are ways around the delivery problems, but not
around the communications problems in meatspace.

After getting everything configured to my liking so the cloude
machine was virtually identical in software to our regular
systems, there was a severe performance problem.  Simply typing
``ls -l /root'' took a while.  Stopping and restarting postfix
took almost a minute.

The final straw was when I got an alert here saying that the
machine seemed to be off-line, and found that godaddy had
rebooted the system, and done a ``chmod -x'' on several server
programs *WITHOUT CONTACTING US*!!!  This rendered most of our
software, including the security and testing systems unusable.
They said finally that they thought our system was causing a high
load on the server hosting it.

Fortunately we weren't using this system for real work because of
the performance problems, but imagine what would happen to a
business if running mission-critical applications in the cloud.

Entrusting mission-critical applications to a third party that
may prove incompetent, arbitrary, or just plain go out of
buxiness without warning seems to me be a Really Bad Idea(tm).

Bill
-- 
INTERNET:   bill at celestial.com  Bill Campbell; Celestial Software LLC
URL: http://www.celestial.com/  PO Box 820; 6641 E. Mercer Way
Voice:          (206) 236-1676  Mercer Island, WA 98040-0820
Fax:            (206) 232-9186  Skype: jwccsllc (206) 855-5792

The tyrant who impoverishes the citizens is obliged to make war
in order to keep his subjects occupied and impose on them the
permanent need of a chief. -- Aristotle