Latest / DevQuestions with Tim Corey / 038 Is The Cloud Safe? Isn't My Data Safer Locally vs In Azure/AWS?

Transcript

038 Is The Cloud Safe? Isn't My Data Safer Locally vs In Azure/AWS? · DevQuestions with Tim Corey

• 0:00
  SPEAKER_00: Welcome to the Dev Questions Podcast with Tim Corey.
• 0:03
  SPEAKER_00: Join us each episode as we tackle the questions you are asking about a career in software development, understanding the industry, and new technology.
• 0:12
  SPEAKER_00: If you're just starting out or you want to grow stronger as a developer, this is the place to get your questions answered.
• 0:19
  SPEAKER_00: Now, here's your host, expert developer and online educator, Tim Corey.
• 0:24
  SPEAKER_01: Is the cloud safe?
• 0:26
  SPEAKER_01: Isn't my data safer locally versus in Azure or AWS?
• 0:31
  SPEAKER_01: This is a question that comes up usually in two different circumstances.
• 0:36
  SPEAKER_01: One is when you're working in a company and you've seen someone like me show off the cool things at Azure, and you go to your boss and say, Hey, want to do this, and your boss says, No.
• 0:47
  SPEAKER_01: We it's safer to do it in our own data center.
• 0:51
  SPEAKER_01: And so you come to me and say, Well, is that true, Tim?
• 0:54
  SPEAKER_01: And the other time is when I show off something cool in Azure and a person says, Don't ever use Azure, don't ever use AWS.
• 1:02
  SPEAKER_01: Uh, these aren't safe.
• 1:04
  SPEAKER_01: I can only ever do production in my server.
• 1:07
  SPEAKER_01: So it comes up a couple different ways, but it's an important question to answer because your data is important.
• 1:14
  SPEAKER_01: And knowing if your data is safe is really important because you have a duty to your customers to make sure that you guard and protect your data.
• 1:24
  SPEAKER_01: Now, the person who asked this question most recently, um, I'm sorry, I can't read your name.
• 1:29
  SPEAKER_01: It's in an oriental script of some kind.
• 1:33
  SPEAKER_01: It translated in Google to piece is a blessing, please cherish, which is cool.
• 1:38
  SPEAKER_01: Um, so if that's you, thank you for asking the question.
• 1:41
  SPEAKER_01: So the illustration I often use when talking about on-prem data centers versus in the cloud data centers.
• 1:51
  SPEAKER_01: When I say on-prem, I mean you own your own servers and you maintain them and and build them out locally.
• 1:58
  SPEAKER_01: And I've done both.
• 1:59
  SPEAKER_01: Okay, I've been an IT director, I've had servers in the server room where we maintain a server room and and do that work.
• 2:06
  SPEAKER_01: I've also done pretty much all cloud-based stuff at some jobs as well, where we didn't have any servers.
• 2:12
  SPEAKER_01: In fact, we didn't have a place to put servers, everything was cloud-based.
• 2:16
  SPEAKER_01: So I kind of see both sides of this, but the the illustration they often use is where do you store your money?
• 2:25
  SPEAKER_01: Do you put it in your mattress or do you put it in the bank?
• 2:29
  SPEAKER_01: And that's really what we're talking about.
• 2:31
  SPEAKER_01: We're talking about our data.
• 2:34
  SPEAKER_01: It used to be that the servers that were hosting websites were pretty poor.
• 2:42
  SPEAKER_01: Okay.
• 2:43
  SPEAKER_01: I remember um it used to be very easy to open up, you know, certain ports and look at, you know, put in the default username and password, and all of a sudden you're onto a web server that hosts 30, 40, 50, 60 different websites.
• 2:58
  SPEAKER_01: And that's not a good thing.
• 3:00
  SPEAKER_01: That's very unsecure, but that's not what we're talking about today.
• 3:05
  SPEAKER_01: What we're talking about today is the cloud.
• 3:08
  SPEAKER_01: And I'll talk specifically about Azure, but this applies to AWS, it applies to Google's cloud for whoever uses that, um, and so on.
• 3:18
  SPEAKER_01: But there's a big difference here between what you have in your server room, however big and impressive it is, and what you have in Azure.
• 3:30
  SPEAKER_01: So let's talk first about access control.
• 3:35
  SPEAKER_01: Who has access to your server room, to the room where you have all of your machines?
• 3:42
  SPEAKER_01: Well, when it comes to the cloud, very few people have access to it.
• 3:48
  SPEAKER_01: In fact, they work very, very hard to limit that.
• 3:51
  SPEAKER_01: You don't have the random janitor who you know is just wandering along and all of a sudden, you know, bumps the rack and and powers off your server.
• 3:59
  SPEAKER_01: That doesn't happen.
• 4:00
  SPEAKER_01: That's there's not that kind of access.
• 4:02
  SPEAKER_01: And in fact, Microsoft is even experimenting with, successfully experimenting with putting cloud data centers in a sealed container and dumping it in the ocean.
• 4:18
  SPEAKER_01: I mean, no one has access to it.
• 4:21
  SPEAKER_01: Um, they tried that off the coast of Scotland and it worked really well.
• 4:24
  SPEAKER_01: And they found that there's a lot of benefits to doing so.
• 4:27
  SPEAKER_01: Well, that means that zero access to your servers physically.
• 4:32
  SPEAKER_01: No one wanders into a sealed container below the ocean.
• 4:37
  SPEAKER_01: Okay, so access control is very limited in Azure.
• 4:42
  SPEAKER_01: I would say that it's almost certainly more limited than it is in your environment.
• 4:48
  SPEAKER_01: Okay, let's talk about environment control.
• 4:52
  SPEAKER_01: Servers operate best at a certain temperature, usually a pretty low temperature, not freezing cold, but a low temperature.
• 5:00
  SPEAKER_01: And they also have to think about things like humidity and what happens if you have a fire.
• 5:05
  SPEAKER_01: How do you suppress that fire in a way that doesn't destroy your servers?
• 5:10
  SPEAKER_01: All these things are pretty expensive solutions.
• 5:13
  SPEAKER_01: I remember having a server room and maintaining the right balance of air conditioning and humidity in that room was difficult because weather changes.
• 5:24
  SPEAKER_01: And so when it was hot, there was a different set of issues versus when it was cold.
• 5:30
  SPEAKER_01: And so that can be difficult to maintain.
• 5:32
  SPEAKER_01: And of course, the larger your your company is, the larger your server room is, the more they invest in those things.
• 5:40
  SPEAKER_01: But it's still a lot of work and a lot of work to get right.
• 5:44
  SPEAKER_01: And environment controls are important to get right.
• 5:49
  SPEAKER_01: Well, with a cloud, they get them right.
• 5:52
  SPEAKER_01: Okay, that's it's what they do, that they have a team of people that's focused on making sure the environment is correct and monitoring that.
• 6:02
  SPEAKER_01: It's not one person's job, it's a team of people, and they have a team of people to jump in if there's any issues.
• 6:11
  SPEAKER_01: When it comes to uh backups, so let's talk about power backups first.
• 6:16
  SPEAKER_01: Um redundant power, having the ability to have um you know the the server racks wired well so that they're a consistent power, not a fluctuating power for brownouts and things like that.
• 6:29
  SPEAKER_01: And then having great generators on site and battery backups.
• 6:32
  SPEAKER_01: And here's the here's the real kicker.
• 6:34
  SPEAKER_01: Uh, battery backups need to be tested, and the batteries need to be recycled and pulled out at certain intervals because they're not just they don't last forever.
• 6:46
  SPEAKER_01: Those are things that often get overlooked.
• 6:49
  SPEAKER_01: Well, that's really important to a cloud host, and it's something they focus on making sure is in place.
• 6:56
  SPEAKER_01: But then there's also data backups.
• 6:58
  SPEAKER_01: And when it comes to database backups or data backups, this is where cloud providers really shine because not only do they back up your data locally, they often or almost always, especially if you set it up right or ask the right services, they will back it up to a redundant location.
• 7:20
  SPEAKER_01: So um when I worked at one job, we had a data center in the um central time zone, and then we had another data center in the west coast.
• 7:30
  SPEAKER_01: And so the the central uh time zone servers would be backed up to the West Coast so that if there's a failure in the central time, the West Coast could pick up.
• 7:42
  SPEAKER_01: Do you have that at your job?
• 7:45
  SPEAKER_01: Do you have not only the backups, but do you have those backups stored in such a way that they're not with the same servers?
• 7:54
  SPEAKER_01: And do you so you have them off-site?
• 7:56
  SPEAKER_01: And not only do you have them, do you have them off-site, but do you have them in a different region of the country?
• 8:02
  SPEAKER_01: And do you test those backups and do you ensure they're they are quickly restorable?
• 8:08
  SPEAKER_01: That's a big deal, and being able to have that redundancy so that even you can have uh systems that are online continuously on both East Coast and West Coast or Central and West Coast, so that you have whatever uh area is closest to you, you access that instead.
• 8:26
  SPEAKER_01: So there's a lot of things like that you can do when you're using a cloud system versus trying to do it yourself.
• 8:34
  SPEAKER_01: And you can do that yourself, it takes a lot more work and a lot more energy.
• 8:39
  SPEAKER_01: Let's talk about network redundancies.
• 8:42
  SPEAKER_01: Uh, cloud providers don't have one uh internet host.
• 8:47
  SPEAKER_01: So, you know, when I worked at um a university, we had one main internet host, and that was our local telephone company, gave us a fiber optic line, and we we paid for a set amount of bandwidth, and it's pretty high.
• 9:02
  SPEAKER_01: But then we also had a a separate provider that was not a lot of bandwidth and it wasn't as great a connection, but it was from a different company, it's actually a cable company.
• 9:14
  SPEAKER_01: That way we could kind of fail over if there was an issue, but that failover was kind of like the limp through until a main line came back up, which we had to do.
• 9:25
  SPEAKER_01: That's typically what happens is you have one main source and one kind of, it's okay, but it works backup system.
• 9:34
  SPEAKER_01: That's not what cloud providers have.
• 9:37
  SPEAKER_01: They have direct, typically, they put their buildings close to the internet providers for multiple internet providers, usually two at least, where they're physically positioning their data centers close to the provider, and they're having two different, entirely different providers coming in in two different areas of the building with two different systems.
• 10:03
  SPEAKER_01: Because if one goes down, they want to make sure they have access to the other one and it's as good a quality as the primary so that they can continue to operate even in a massive outage from one provider.
• 10:17
  SPEAKER_01: Do you locate your data center physically close to your internet service providers?
• 10:24
  SPEAKER_01: And do you have two major ones?
• 10:25
  SPEAKER_01: Okay, that's the next question.
• 10:28
  SPEAKER_01: Um intrusion detection and prevention.
• 10:31
  SPEAKER_01: There's whole teams of people, engineers dedicated to preventing intrusion into the data centers.
• 10:40
  SPEAKER_01: There's teams of people who are constantly 24 hours a day monitoring and defending against attacks in the data center.
• 10:49
  SPEAKER_01: How big is your team that's just focused on intrusion protection and defense?
• 10:54
  SPEAKER_01: Okay.
• 10:55
  SPEAKER_01: Let's talk about software.
• 10:57
  SPEAKER_01: Um, Windows has patches that come out often.
• 11:01
  SPEAKER_01: Uh, security patches come out on uh Tuesdays typically, and you need to make sure that you evaluate those patches and apply them if there's a problem or if the patch fixes a security bug at least.
• 11:15
  SPEAKER_01: But then there's also featured patches as well, and that takes a lot of testing to get right.
• 11:22
  SPEAKER_01: Are you current?
• 11:24
  SPEAKER_01: Are you how much do you test your patches?
• 11:26
  SPEAKER_01: Because sometimes patches don't work and you have to roll back.
• 11:30
  SPEAKER_01: And do you test that process?
• 11:32
  SPEAKER_01: And how do you roll those out successfully?
• 11:36
  SPEAKER_01: These are all things that cloud providers do for you.
• 11:39
  SPEAKER_01: They're just done.
• 11:40
  SPEAKER_01: That's just part of the service that you get.
• 11:42
  SPEAKER_01: The same thing is true if you get, for example, an Azure SQL Server.
• 11:46
  SPEAKER_01: So an Azure SQL Server is different than a SQL Server that you install on a virtual machine because an Azure SQL Server is maintained by Microsoft.
• 11:56
  SPEAKER_01: So do you configure, how do you uh read up and configure your SQL Server to make sure that you optimize it for security, for speed, and make sure that all the settings are right?
• 12:10
  SPEAKER_01: Do you have a team of experts that built SQL that knows SQL that manage that, or do you just have your database administrator also do that?
• 12:21
  SPEAKER_01: That's the kind of thing that the cloud providers provide that you might not get locally.
• 12:27
  SPEAKER_01: So what this comes down to is the cloud providers have teams of people dedicated to the security, to the safety, and to the accessibility of your data.
• 12:42
  SPEAKER_01: And they ensure that your data is protected and can be given to you as having as much uptime as possible.
• 12:54
  SPEAKER_01: Now we've all heard about major outages from the different cloud providers.
• 12:59
  SPEAKER_01: Um there was uh an outage with Azure, oh goodness, is a it was a few months ago, I believe, where they had a data center go down for a little bit.
• 13:07
  SPEAKER_01: And it wasn't fully down, it was just partially down.
• 13:10
  SPEAKER_01: But um the after action report from this turns out that they had redundant internet providers and they had redundant fiber lines, and the one fiber line was cut.
• 13:22
  SPEAKER_01: No problem.
• 13:23
  SPEAKER_01: Data center is still up, no big deal.
• 13:25
  SPEAKER_01: But when they sent somebody out, the not Microsoft, but the the company to fix the fiber lines, they uh cut the wrong fiber line to fix it.
• 13:34
  SPEAKER_01: And so they cut the backup line.
• 13:36
  SPEAKER_01: So now they're both down, and that still wasn't a complete outage, but caused some problems that caused some cascading issues.
• 13:44
  SPEAKER_01: And those cascading issues cause other issues, and they figured out those problems and they resolved those problems so that it wouldn't be a problem going forward.
• 13:53
  SPEAKER_01: They learned from that and they made improvements to their data centers, and even so, their downtime wasn't that serious.
• 14:01
  SPEAKER_01: They have a really good track record for uptime and they track it and they're responsible for it.
• 14:08
  SPEAKER_01: And in fact, they pay penalties when they miss those windows.
• 14:12
  SPEAKER_01: So that's what your cloud provider gives to you.
• 14:15
  SPEAKER_01: Your cloud provider gives you bank level security for your data.
• 14:22
  SPEAKER_01: On the other hand, typically what I see from on-prem server installations is you don't have a qualified team of individuals for all these different areas.
• 14:35
  SPEAKER_01: In fact, typically what happens is the company figures out that they can get by with one SQL Server administrator.
• 14:43
  SPEAKER_01: And that administrator can probably do some networking stuff too.
• 14:46
  SPEAKER_01: And before you know it, that person is so vital that, you know, we just don't have time to send you to conferences and really it's an expense anyway.
• 14:55
  SPEAKER_01: So we're just gonna, you know, keep you working because we don't have time for all that learning stuff.
• 15:00
  SPEAKER_01: So the new stuff kind of passes them by as they keep their head down trying to keep the lights on.
• 15:06
  SPEAKER_01: That's not safe.
• 15:09
  SPEAKER_01: And no one wants to spend thousands and thousands of dollars on training and spend tens of thousands and hundreds of thousands of dollars on whole teams of individuals for all these different areas, and yet that's really what you need in order to do it right.
• 15:25
  SPEAKER_01: Because if if I was going to rob somewhere and I decided to, you know, pick anywhere in the world to rob, I wouldn't rob Fort Knox.
• 15:39
  SPEAKER_01: I would probably rob your house because your house probably isn't totally secure.
• 15:44
  SPEAKER_01: Yeah, maybe you have an alarm system, maybe you have a dog, you know, but that's one thing to overcome.
• 15:52
  SPEAKER_01: There's a lot more than one thing to overcome when it comes to Fort Knox.
• 15:55
  SPEAKER_01: Okay.
• 15:56
  SPEAKER_01: Um, that's a little more difficult to get through.
• 16:00
  SPEAKER_01: And that's kind of what we're talking about now when we talk about cloud providers versus on-prem providers, is you can spend an awful lot of money on security for your on-premises uh installation, and it's still probably not gonna be as secure as the cloud.
• 16:17
  SPEAKER_01: And you're probably gonna be as redundant as the cloud, and you're probably gonna be have your backups as secure and as tested as the cloud, and you're probably not gonna have the monitoring you need for intrusion protection and prevention, and you're probably not gonna have as good of environmental controls as you should, or access controls as you should, and those are all weaknesses.
• 16:42
  SPEAKER_01: And when it comes to exploiting somebody, it's easier to exploit someone who has obvious weaknesses versus someone who doesn't have obvious weaknesses.
• 16:53
  SPEAKER_01: So that's why when people come to me and say on-premises is more secure, I really push back hard on that.
• 17:02
  SPEAKER_01: This is not a case where um it depends, is the answer, which is a typical answer for most situations.
• 17:10
  SPEAKER_01: This is one where you have to prove to me why on-premises is more secure, because by default, it's not.
• 17:18
  SPEAKER_01: By default, on-premises is less secure than the cloud is.
• 17:24
  SPEAKER_01: You have to spend an awful lot of money and time to get your on-premise data storage and retention and protection to be as secure as it is in the cloud.
• 17:35
  SPEAKER_01: Now, I hope you found this episode helpful.
• 17:37
  SPEAKER_01: I'd appreciate it if you would share it on your social networks.
• 17:42
  SPEAKER_01: Thanks for listening.
• 17:43
  SPEAKER_01: As always, I am Tim Corey.
• 17:45
  SPEAKER_00: Thank you for joining us for this episode of Dev Questions.
• 17:48
  SPEAKER_00: Tim is committed to making it easier for you to become a developer.
• 17:51
  SPEAKER_00: If you would like to help make more content like this possible, please like, subscribe, rate, and share Dev Questions.
• 17:59
  SPEAKER_00: You can also send your questions to questions at IamTimcore.com.
• 18:04
  SPEAKER_00: Until next time, remember, you are too smart and your time too valuable to waste it making all the mistakes Tim did.
• 18:11
  SPEAKER_00: When you're ready to learn to think and code like a professional developer, head over to imtimcore.com and enroll in a course.