A recent interview I gave has turned up in a SearchCloudComputing.com column:

…GovCloud is an admission by Amazon that it cannot modify its entire cloud so it will isolate data and applications completely. Instead, it has to carve it up.

History shows us that most breaches come from out of scope, “isolated” systems that are not truly separate. The attackers enter through a back door, a system that’s connected to the backplane for emergency use only but gets them into the rest of the network. Could a contractor who is not a U.S. citizen get in under ITAR? Is Amazon hiring separate administrators to run GovCloud?

AWS itself admitted that the major outage of its Elastic Block Storage service in April happened because it did not have good separation of systems. Has it just created a false sense of separation between the GovCloud secure zone and the rest of AWS? It’s certainly given potential attackers something to look for.

I actually said Amazon chose not to modify its entire cloud. They probably had the option to make AWS secure enough to comply with ITAR but apparently it was not worth the expense, so they chose to reduce exposure to the compliance requirements through segmentation. The first thing that jumped into my mind is whether they will charge a premium to be in GovCloud — charge more money to guarantee that employees are U.S. citizens. Otherwise, who in the U.S. wouldn’t want to move all their workloads into GovCloud?