News for hackers. Stuff that matters.

A comment on Web Developer Security Checklist. Parent comment

Re:Web Developer Security Checklist by nkozyra on Tuesday May 16, 2017 @08:06AM (#14348903)
Every potential threat should be considered, but weighed against likelihood when prioritizing.

Sometimes you make cost/benefit consolations. 100% airtight would be great, but 100% airtight doesn't actually exist. Most organizations with finite resources have to make risk/reward decisions when there are as many threats as there are with web development.

[ Parent | on HN ]
Re:Web Developer Security Checklist by spydum on Tuesday May 16, 2017 @08:32AM (#14349025)
The cost for encryption at rest is single digit percentages these days.

I push for encryption at rest on ANY cloud provider storage for one main reason: I have no control over their disk disposal or reuse mechanisms. They can claim they wipe the data, but I have no way to test that reliably.

As for disk encryption plus FS encryption, keep in mind in AWS or Azure, it's possible for a misconfigured IAM or SPN to leak access to the disk blob.. If it was encrypted with a key separately, the risk is mitigated. Again, it's just too easy to implement on almost every cloud provider thes days.

[ Parent | on HN ]