There seems to be a size of org where the risk of using a centralized cloud auth{n,z}-as-a-service vendor is not a net benefit to security. It's a net positive for small orgs, but a net negative for any of the trillion dollar market cap tech companies, but where is the line?
Conversation
This Tweet was deleted by the Tweet author. Learn more
Replying to
My sense (which I'm trying to qualify in some more rational way) is that it's too risky to use an IDaaS vendor that isn't the major cloud running all of your production infra anyway. Even if equally secure, you have doubled your risk of full compromise (e.g. analogous to RAID-0).
1
6
Cloud platforms are risky in the same way. They're such a massive single point of failure for serious security vulnerabilities. GCP does a far better job at security than almost anyone else would do themselves but it doesn't change that it's such a massive SPOF to depend on.
1
1
AWS and Azure definitely aren't as good at security. They've been very lucky things haven't gone far worse. They depend too much on external security researchers finding problems and reporting them. People have a lot of faith in their customer support not to give account access.
1
2
Google at least has their Advanced Protection Program feature to make that harder. It's why we use them as a domain registrar. I have a lot more faith in GCP security than the other cloud platforms too but that's not saying a lot. Would not put particularly sensitive stuff on it.
Not convinced immense complexity of AWS/Azure/GCP makes security easier to handle than managing server hardware. I don't believe AWS/Azure/GCP lowers costs in general either. There are far simpler, far cheaper cloud platforms where it definitely does, but those are so expensive.
1
3
I think the value of cloud infra providers is a totally separate debate (and good one for some orgs to have). But a lot of orgs are already firmly entrenched in using them, so it seems like using the same cloud infra provider for IDaaS doesn't materially increase risks.
1