[DrRobinson]

I agree calling it snake oil is a bit too much, because I know there are benefits.

As I mention elsewhere in the thread, I use encryption, but I don't consider it to be of high value compared to other security mitigations one can spend time on.

As mentioned in the blog post, setting up encryption isn't always easy and problem free though.

Regarding 1, disks are physically destroyed if they are inoperable. Thanks for sharing the list of potential problems, it's always interesting to see how other people think and what they worry about!

[pixl97]

>disks are physically destroyed if they are inoperable

'Supposed to be' is missing from this statement. We have seen many vendors over the years say 'we destroy disks' only to have a disk show up in the wild.

[bmcahren]

I'm equally interested to see what lengths people like yourself will go to when given the option!

Where is it you draw the line?

Do you bother with Spectre mitigations since Amazon policy is to deny service to those who would attack you?

Do you bother requiring authentication on your database since policy is to use a closed VPC?

Hell, we haven't seen any man in the middle attacks lately, let's just drop SSL because you know your customers are wired and trust the endpoint networks.

SSL is the best example subject to the same common failures (including expiration, key loss, downtime to initially deploy) as you describe disk encryption migrations.

Encrypting disks is mandatory and there is zero justification otherwise.

[DrRobinson]

> Do you bother with Spectre mitigations since Amazon policy is to deny service to those who would attack you?

I don't go out of my way to mitigate that, no. Have you seen any real attacks with this? They seem very rare and hard to execute, especially if you have someone specific in mind.

> Do you bother requiring authentication on your database since policy is to use a closed VPC?

Yes. Usually you have multiple services running in the same VPC, by using authentication you limit the potential impact if one service is hacked. Adding authentication to a database that previously had none is also very easy.

> Hell, we haven't seen any man in the middle attacks lately, let's just drop SSL because you know your customers are wired and trust the endpoint networks.

MITM attacks are quite common actually. Internally inside AWS (i.e. between instances) the benefit of TLS is maybe questionable, especially since traffic is encrypted between instances automatically (depending on the instance type).

> Encrypting disks is mandatory and there is zero justification otherwise.

I disagree that there is "zero justification otherwise." I've updated the blog post some and I'm interested to hear your thoughts about it. But in short, adding encryption to an unencrypted machine can take a lot of time and effort. Setting it up correctly from the start is usually easy, but it's not always whoever set it up initially did that. There are many things one can do to improve security, and most things will probably be more beneficial than re-encrypting disks.