- “Cloud First”: To move federal agencies to the cloud, the government created a program known as FedRAMP, whose job was to ensure the security of new technology.
- Security Breakdown: ProPublica found that FedRAMP authorized a Microsoft product called GCC High to handle sensitive government data, despite years of concerns about its security.
- Potential Conflict of Interest: The government relies, in part, on third-party firms to vet cloud technology, but those firms are hired and paid by the company being assessed.
CLOUD is such a fucking rip off!! Anyone with any sense can see that.
My favorite part of Amazon’s Web Service is AWS Outposts.
BWAHAHAHAHAHAHA
They will put the AWS cloud in your data center.
You will rent AWS servers and the rack they sit in. You will administer them, power and cool them, handle all the connectivity to the servers and you get to run all the software…
It is such a fucking rip off.
I found out that Azure DevOps can be hosted in this same manner. You pay a license fee to host and maintain it yourself.
I was shocked. Lmao.
This is because DevOps is the updated version of Visual Studio Team Foundation Server. You have always been able to self host it because that used to be the only option.
I only found out because a colleague spent an entire day maintaining the server we host it on. The notion of having to pay to do all the BS operative work around using that shitty platform is so silly to me. If anything it feels like Microsoft should pay us.
I see the approach of Outposts, just don’t know if I agree with it. Part of the point is it lets you have a dedicated, isolated, on-premise platform without the need to train existing engineers/admins on a secondary technology like Nutanix, ProxMox, etc.
So your calculus should include the cost to rent vs dedicated head count (and let me tell you, companies fucking hate headcount).
Now all that being said, I have yet to see a situation where it really is more cost effective, especially due to the things you mentioned.
You mean “private cloud”, right? No one who can afford outpost will be putting this in their server closet. It’ll go in the datacenter.
“Private cloud” has always been a synonym for “on-premise”. I’ve managed Datacenter infrastructure for decades and always referred to it to on-premise before private cloud even became a term. It basically is referring to Datacenter space you own or rent vs another company’s servers and DCs.
Hell, I’ve worked in companies where they had Datacenter space in the same building as their office (and not small either, one was 32 racks, another was almost 200). So that very much was “on-premise”
The whole point of “cloud” was to eliminate data centers.
If there was a low latency need for a private cloud, of course you put it as close as possible.
They do that because there are some things that you can’t put in the cloud, like HIPAA protected data. It’s absolutely a rip off, but that was their solution.
You absolutely can store HIPAA data in the cloud.
Latency is one of the big selling points for Outposts. They have customers wanting to control industrial equipment from their cloud resources, but the nearest AWS region is too far away to provide the low latency connectivity they need. With Outposts, they get the cloud, but with on-prem network latency.
Actual rule: The HIPAA Security Rule focuses on safeguarding electronic protected health information (ePHI) held or maintained by regulated entities. The ePHI that a regulated entity creates, receives, maintains, or transmits must be protected against reasonably anticipated threats, hazards, and impermissible uses and/or disclosures. This publication provides practical guidance and resources that can be used by regulated entities of all sizes to safeguard ePHI and better understand the security concepts discussed in the HIPAA Security Rule.
So at what point can a lawyer say that all the cloud breaches violate the “reasonably anticipated” rule?
There is no certification process in place for using a cloud to store HIPAA data. It even says that on the page that you linked. Legally, any organization that used this service would be opening themselves to further liability under HIPAA.
Tell that to literally every hospital, medical provider, and insurer in the United States.
They’re all using AWS, and OneDrive.
That’s news to me. Every time to vendor tries to get me to switch to their cloud product I tell them to get lost. I’m not willingly handing over patient data to these clowns, I’ve seen how bad they are at security.
I am a software developer who does custom EMR software specifically because the places I work for can’t use the cloud. But okay I will try…
can you site the part of HIPAA that says that?
There’s no certification for HIPAA defined in law.
No I can’t cite something that doesn’t exist. I literally just said there isn’t one… so I am not sure what your point is.
What legal violation? Because the law says nothing about that.
what the law does allow, is data storage with a BAA.
What?!? The entire purpose of HIPAA is to put liability on misuse of data. At this point, I have no fucking clue what your point is.
Yes, but you talked about how cloud storage vs on prem is a violation.
Put up or shut up.
Also see my edit about a BAA
Fun fact, the law actually does not lay out a single technical “must do”.
But rather establish liabilities and defines miss use. Which is NOT the same as proper use.