Announcing the New AWS Secret Region(aws.amazon.com)
aws.amazon.com
Announcing the New AWS Secret Region
https://aws.amazon.com/blogs/publicsector/announcing-the-new-aws-secret-region/
92 comments
Does anyone know what sort of price premium AWS charge for their secret regions over their public commercial regions?
They're not charging per GB of S3 or whatever. It's likely a fixed(ish) priced contract that basically covers their cost of building a complete region. So the pricing doesn't really compare.
Basically, AWS is all public cloud, none of this private cloud nonsense... until you come along with a $600MM check and then you can have a private region all to yourself!
Basically, AWS is all public cloud, none of this private cloud nonsense... until you come along with a $600MM check and then you can have a private region all to yourself!
Someone's still got to pay the energy bill and for new servers to account for growth.
I don't see why they would throw at their current billing model for something else.
I don't see why they would throw at their current billing model for something else.
Cue in the "Dammit! We are not supposed to talk about it" jokes
When I first saw the headline, I thought it had something to do with secrets management, for, like, ssh keys... Why would they need an entire region for that?
I thought it was going to be like East or West, but We're Not Telling You Where. :)
Security. No better separation, than physical.
Hopefully it prevents S3 buckets from being set to public.
The new S3 console/flow sets to private by default - so some progress there, all jokes aside.
S3 has always been private by default. But too many people open it up to the world for convenience.
Yes, but now Amazon will show them orange alerts if they do that!
I've argued this before around here - I believe it's a platform provider's responsibility for the most part to secure data, and less so the responsibility of the developer or user. Amazon should go much further and make it hard to open-up the data to the public, at least for certain categories of buckets.
So for instance some buckets should always be public by default, and some should always be encrypted and private by default. That should make intelligence agencies' choice easier, because I would imagine even if it's "harder" to process the data from an encrypted bucket, they would still prefer that option to the always public bucket.
And maybe both categories could still be configured to either be private or public, respectively, but the account owners should have to really go out of their way to make those changes. So most shouldn't bother, and just use the defaults for each category of buckets.
I've argued this before around here - I believe it's a platform provider's responsibility for the most part to secure data, and less so the responsibility of the developer or user. Amazon should go much further and make it hard to open-up the data to the public, at least for certain categories of buckets.
So for instance some buckets should always be public by default, and some should always be encrypted and private by default. That should make intelligence agencies' choice easier, because I would imagine even if it's "harder" to process the data from an encrypted bucket, they would still prefer that option to the always public bucket.
And maybe both categories could still be configured to either be private or public, respectively, but the account owners should have to really go out of their way to make those changes. So most shouldn't bother, and just use the defaults for each category of buckets.
>I believe it's a platform provider's responsibility for the most part to secure data, and less so the responsibility of the developer or user
I would say that is going too far, or maybe I'd say it differently. If a certain problem becomes very frequent relative to it's severity, the problem is a design bug and not just user error. The provider isn't responsible for every mistake, but they are responsible for designing with mistakes in mind.
I would say that is going too far, or maybe I'd say it differently. If a certain problem becomes very frequent relative to it's severity, the problem is a design bug and not just user error. The provider isn't responsible for every mistake, but they are responsible for designing with mistakes in mind.
If your design allows insecure setups without users understanding the risks in full, I think that's on the providers and not the user. If the user understands the risks fully, then it's on the user.
I think we are way far away from users fully understanding the risks, and we're still mostly dealing with people not realizing they're vulnerable. So I put this primarily on the provider.
I think we are way far away from users fully understanding the risks, and we're still mostly dealing with people not realizing they're vulnerable. So I put this primarily on the provider.
And it only took the Pentagon exposing its main surveillance operation to get Amazon to make that change. Progress.
I wonder what other improvements we'll see when CIA's surveillance or drone strike data is also exposed to the public by a similar fuckup? Fully homomorphic encryption?
I wonder what other improvements we'll see when CIA's surveillance or drone strike data is also exposed to the public by a similar fuckup? Fully homomorphic encryption?
It goes one step better, it isn’t even connected to the Internet!
[deleted]
Will it be locatable by latency (roughly) or is that not the point?
Additionally, if I was doing secret things I'd really think it was not a great idea to put that into a data centre marked "Definitely where I keep all of my secrets".
Additionally, if I was doing secret things I'd really think it was not a great idea to put that into a data centre marked "Definitely where I keep all of my secrets".
Sounds like this is an expansion of this: https://www.theatlantic.com/technology/archive/2014/07/the-d...
to non-Intelligence Community users. You'll still need US Government Secret Clearance though.
to non-Intelligence Community users. You'll still need US Government Secret Clearance though.
[deleted]
We are pleased to announce the new AWS Secret Region. The AWS Secret Region can operate workloads up to the Secret U.S. security classification level. The AWS Secret Region is readily available to the U.S. Intelligence Community (IC) through the IC’s Commercial Cloud Services (C2S) contract with AWS.
Usually when I post a quote from the article to shed light on what it's actually talking about it is appreciated. What's different about this time that causes a bunch of downvotes?
As long as there is only one Secret region, you can have reliability or you can have classified data, but not both.
If your secret region goes down the data just got more secret.
Somehow I can see this being an actual argument in government bids, and contracting officers gobbling it up...
Someone posted above that there already was one before and this is the second: https://www.theatlantic.com/technology/archive/2014/07/the-d...
First region is top secret. So technically data in the existing region could be moved to the new region, but not vice versa.
As long as they have multiple zones you can get the reliability ~ huge natural disaster that may affect other regions anyway.
A region is a cluster of typically three distinct data centers and this could have the three D.C.'s distributed geographically in a model specifically designed to provide both.
It doesn't say anywhere that this is a geographically distinct region.
It would have to have at least physically separate data centers, that's kind of the whole point of having this in the first place.
region != zone
Is this part of Govcloud? Unfortunately Govcloud doesn't support a handful of AWS services, it would be nice if this was more complete
It's not, though it's related. Govcloud only supports up to "Controlled Unclassified Information." This can handle Secret and Top Secret. I'd expect it to be even further restricted in terms of supported services.
What's the point of announcing it publicly?
If they didn't nobody would know about it. It's not like Amazon has a big list of email addresses of people who have Secret data that they might want to put on the cloud. Even if they did have a list of government people like that, most of the people interested in this service are contractors who don't officially work for the government.
The government doesn't work like those spy movies where everybody knows everything the instant it happens. It's more like a big bloated corporation with thousands of subcontractors and generally lousy communication all around.
The government doesn't work like those spy movies where everybody knows everything the instant it happens. It's more like a big bloated corporation with thousands of subcontractors and generally lousy communication all around.
There’s hardly anyone in tech with a clearance in dc who didn’t know this was coming. They’re recruiting like crazy for it.
Just because it's called AWS "Secret", it doesn't mean it has to be a secret :)
Secrecy as a Service.
More like Compartmentalization, Compliance, and Control as a Service
Investors?
What's the point of hiding it's existence? (Security by obscurity doesn't work).
It's actually a giant honeypot.
Contractors.
I spent a lot of time on gov cloud console at a couple of jobs. It's very limited. At the time they didn't have lambda.
What does it mean for something to be an "air-gapped commercial cloud"?
The "Top Secret" cloud is not connected to the Internet.
Which obviously can't be true or it would be inaccessible and thus utterly useless.
Why? It can still be connected to SIPRnet or JWICS.
Or customers can get a Direct Connect from their existing facilities into the region. I presume the USG has plenty of fiber straight into these new datacenters and I'm not sure why Amazon wouldn't allow Direct Connect.
As someone else mentioned, perhaps this will get contractors to stop using public S3 buckets to share data.
Or customers can get a Direct Connect from their existing facilities into the region. I presume the USG has plenty of fiber straight into these new datacenters and I'm not sure why Amazon wouldn't allow Direct Connect.
As someone else mentioned, perhaps this will get contractors to stop using public S3 buckets to share data.
That’s not “air gapped” if it’s connected to another government network.
It's air-gapped from the Internet.
The term “air gap” does not directly imply anything to do with the Internet (doesn’t exclude it, but it applies more generally than specific networks). Yes, IC uses it to signify high/low networks, but the original usage of the term was to indicate a machine with no direct connection to the outside world. The theory being (since proven wrong), you can’t exfiltrate data remotely from a device not connected to a network.
What if it’s submerged in coolant?
JWICS/SIPR/NSAnet/etc. are air gapped in that terminals are not allowed to be dual homed to any other network or to each other.
Yes, I know the inteligence community uses this definition of air gap to signify the barrier between high/low networks, but I kinda feel it misses the point of the term. If it is networked to the outside world, even securely, I feel it kinda misses the point of the “air gap” connotation (aka requiring a “sneaker net” to get data in / out). I’m likely being pedantic though, so I upvoted you as you at least gave a good response unlike others.
It’s useful insofar as it’s connected to itself, allowing individuals and companies to share data and compute with one-another, where data can ingress/egress manually but travel the network between VPCs automatically.
It might also mean that the cloud is connected to networks that are not, themselves, Internet-routed. For example, users of the Secret region might have leased lines connecting airgapped computers in their own facilities directly to the DC for ingress/egress.
It might also mean that the network is connected to a “different Internet”, like MILNET.
It might also mean that the cloud is connected to networks that are not, themselves, Internet-routed. For example, users of the Secret region might have leased lines connecting airgapped computers in their own facilities directly to the DC for ingress/egress.
It might also mean that the network is connected to a “different Internet”, like MILNET.
inaccessible for whom? the public internet isn't the only (inter)network that exists.
They likely connect via encrypted leased lines.
It's probably connected only to the us government secret network (I forget the acronym) and not the public internet.
The contracted top secret cloud is connected to JWICS. JWICS and SIPRnet (the secret counterpart) are both government internets (but are not the Internet with a capital I).
They have a robot constantly hot-swapping disks between racks maybe?
I know of two government approved methods for data transfers for closed networks, one of which is pretty close. You basically have two servers connected to the same disk array, and they take turns mounting it to move files onto/off it. There is of course scanning and logging and such involved.
The other (unidirectional) method is a fibre pair connection that does not physically connect the TX with the RX in one direction, and there is some bumblefuckery that pushes the data through.
Of course classified data is only transferred from networks with lower classification to networks with higher classification, never the other way.
The other (unidirectional) method is a fibre pair connection that does not physically connect the TX with the RX in one direction, and there is some bumblefuckery that pushes the data through.
Of course classified data is only transferred from networks with lower classification to networks with higher classification, never the other way.
See Raytheon “High Speed Guard” description:
PDF: https://www.raytheon.com/capabilities/rtnwcm/groups/gallery/...
From PR:
Raytheon Trusted Computer Solutions (RTCS), a wholly owned subsidiary of Raytheon Company (NYSE: RTN), today announced that its High Speed Guard (HSG) big data transfer solution has received Cross Domain System Authorization and Authority to Operate for Secret and Below Interoperability (SABI).
This allows government customers to connect to networks classified at secret and below, and enables them to start the SABI site test and evaluation toward full system accreditation.
Raytheon's HSG solution is a commercial-off-the-shelf product that enables the rapid transfer of all types of data across multiple networks at different classification levels. With the industry's fastest bi-directional transfer rates of any guard technology and proven sustained transfer rates of more than nine gigabits per second, HSG is ideally suited for large-scale deployments that require rapid, automated data transfer.
PDF: https://www.raytheon.com/capabilities/rtnwcm/groups/gallery/...
From PR:
Raytheon Trusted Computer Solutions (RTCS), a wholly owned subsidiary of Raytheon Company (NYSE: RTN), today announced that its High Speed Guard (HSG) big data transfer solution has received Cross Domain System Authorization and Authority to Operate for Secret and Below Interoperability (SABI).
This allows government customers to connect to networks classified at secret and below, and enables them to start the SABI site test and evaluation toward full system accreditation.
Raytheon's HSG solution is a commercial-off-the-shelf product that enables the rapid transfer of all types of data across multiple networks at different classification levels. With the industry's fastest bi-directional transfer rates of any guard technology and proven sustained transfer rates of more than nine gigabits per second, HSG is ideally suited for large-scale deployments that require rapid, automated data transfer.
> bumblefuckery
That is precisely how I would describe the Tenix and/or FOX-IT data pump implementations. It's amazing what people can manage to get away with even at EAL-7+.
That is precisely how I would describe the Tenix and/or FOX-IT data pump implementations. It's amazing what people can manage to get away with even at EAL-7+.
Fun fact: many desktop printers can hit 3kbps in V40L QR codes (biggest + lowest ECC).
(Estimated at approx 10ppm by 20KiB per code.)
For the security conscious on a budget, printing QR codes to scan to a networked machine can be a way to get information off an otherwise air-gapped machine, with easy introspection and auditing. (This came up in the context of offline signing of Bitcoin transactions with a "warm" wallet -- digital, but airgapped from the "hot" wallets.)
(Estimated at approx 10ppm by 20KiB per code.)
For the security conscious on a budget, printing QR codes to scan to a networked machine can be a way to get information off an otherwise air-gapped machine, with easy introspection and auditing. (This came up in the context of offline signing of Bitcoin transactions with a "warm" wallet -- digital, but airgapped from the "hot" wallets.)
Now all of your e-mails and private data don't have to be carried all the way around the world back to Bluffdale, they can simply be dumped into AWS!
Article says that this is the first cloud provider certified for these workloads, but I believe both Microsoft Azure and Amazon AWS began negotiating these contracts around the same time.
Microsoft announced their version a few weeks ago[1]. I wonder if Google will follow shortly?
[1] https://azure.microsoft.com/en-us/blog/announcing-new-azure-...
Microsoft announced their version a few weeks ago[1]. I wonder if Google will follow shortly?
[1] https://azure.microsoft.com/en-us/blog/announcing-new-azure-...
Microsoft's announcement has a lot "will". Amazon's has a lot of "is".
Where the "is" should be generally understood as "is[1]"
[1] but in such a poorly tested, underbaked fashion you probably shouldn't bother for a few years
[1] but in such a poorly tested, underbaked fashion you probably shouldn't bother for a few years
I see someone's experienced in AWS product rollout.
Yeah, I worked on an AWS product launch for a product that was not ready to go live, and we ended up trying to dog-food a bunch of other AWS services that were also not ready to be live. It was honestly pretty shocking.
Thanks. This is the sort of experience-based comment that I read Hacker News for.
https://aws.amazon.com/compliance/fedramp/
https://azure.microsoft.com/en-us/blog/azure-government-exte...
https://azure.microsoft.com/en-us/blog/azure-government-exte...
From the azure post you link:
> authorized for use with up to High Impact level data
That's not "Secret" or "Top secret"
AWS govcloud has existed for HI for ages; this announcement is specifically for "Secret" classified data.
> authorized for use with up to High Impact level data
That's not "Secret" or "Top secret"
AWS govcloud has existed for HI for ages; this announcement is specifically for "Secret" classified data.
You misunderstand. The reasons you mention were the reasons I posted those links.
FedRAMP has multiple levels. Don't conflate the FedRAMP authorizations solely with marketing terms.
FedRAMP has multiple levels. Don't conflate the FedRAMP authorizations solely with marketing terms.
Anyone use this feature ? Also where is this region located ? ( Washington DC ?)
From the headline I was actually expecting a ‘mystery trip’ region, cut price but you don’t find out where till you start using it.
Right like its actually AWS Atlantis-West.
AWS is a 3-letter agency from now on :)
"With the new AWS Secret Region, we are bringing the same tools and workflows that are already available for Top Secret workloads to customers with Secret datasets and workloads."
Does this mean they already had an AWS "Top Secret" Region?
Does this mean they already had an AWS "Top Secret" Region?
Yes. It's called C2S.
Can't they get the NSA to rent them some of their spare capacity from the CNCI? Or is this because they trust Amazon to have actually solved the hard problems?
https://en.wikipedia.org/wiki/Utah_Data_Center