Re:OCR Software Dev Exposes 200k Customer Documents
by GhostVII on Wednesday August 29, 2018 @09:32PM
(#17873497)
The difference with computers in the "cloud" is that there is a much higher incentive to hack them since there is much more data on them, and hackers can be fairly confident that they will get valuable data in a hack. This is not the case with your personal computer. So if you are bad at security, I would argue that it is much safer (from a security point of view, at least) to store things on your own computer, since your mistakes are much less likely to be noticed.
Keeping your data on cloud introduces new attack vendors. It closes others.
If you're going to be an idiot[2][3], and host a production database which doesn't require any authentication on the cloud, I don't have much hope for your non-cloud-deployed security.
[1] For most reasonable definitions of every.
[2] I have had the dubious pleasure of working in a ~15 year-old software company where ~half of the machines were virus-infested (Mostly Conficker, but also some other shit that I forget. This was in 2012. If I recall correctly, we had one part-time IT guy for ~30 engineers. His job was ordering computer parts, and keeping e-mail working. The health of the dev machines was not his problem.) The SOP was to do all your work in a VM running Windows XP, and wipe it every few weeks, or whenever performance would grind to a halt - whichever came first. One of my tasks, a few months in, was to deal with the virus situation on the build server, so that we could 'securely' build the release, and sign it with the encryption key that only the VPs had access to.
[3] I have also had a chance to work in a company obsessed with security (Because of the nature of their products). One of my discoveries, a few months before I left, was that one of their products' updates were pushed via an insecure HTTP downloader. While I was there, nobody budgeted time to get it fixed.