Consider these Risks when Developing Applications on the Cloud
Tags: discuss, aws, azure, serverless
Published: 2020-01-27 20:03:35

[Reposted from LinkedIn](https://www.linkedin.com/posts/thomasfuller_cloud-aws-cyberwarfare-activity-6627645898170081280-14XB) -- feel free to add your thoughts below, or on LinkedIn. And feel free to [send me an invitation to connect](https://www.linkedin.com/in/thomasfuller/), if you'd like to network.

Here are several risks that come with developing applications on the #cloud:

💰 Overspending due to over-provisioned or idle services [1, 2, 4].

🔗 Potential for vendor lock-in -- If you're not writing to a standardized API then you're tied in directly to the service provider so buyer beware [3]. Wootton in [9] seems to think this lock-in is not necessarily a problem with #AWS and I disagree with this since we're not just talking about code, we need to consider process and skills as well. Plus if one is writing directly to a specific vendor's web service API, they're locked in. Finally, some of the stickiest services are the ones you don't see.

📉 Potential for a conflict of interest [12*].

🔐 What if you've done your part but the vendor has a security vulnerability? [5, 6, 7, 8, 10, 11*]

💰 Cloud providers are potential #cyberwarfare targets, for ex. "[t]he Lloyd's/Air Worldwide study concludes that the complete failure of a top cloud services provider that extends for at least three days would cost the U.S. economy $15 billion." [10]

💰 Increases development complexity and #hiring cost by requiring cloud service platform provider expertise.

* Recommended reading.

🎯 Note that I am currently available for consulting engagements.

1.) ["Report: AWS Customers Overpay by $6.4 Billion Each Year"]( https://awsinsider.net/articles/2017/11/20/rightscale-aws-overpay-6-billion.aspx)
2.) ["Where Is the $10B in Waste in Public Cloud Costs?"](https://www.flexera.com/blog/cloud/2017/11/where-is-the-10b-in-waste-in-public-cloud-costs/)
3.) ["Game of Clouds: Lock-In Is Coming"](https://www.zdnet.com/article/game-of-clouds-lock-in-is-coming/)
4.) ["$14.1 Billion in Cloud Spending to be Wasted in 2019"](https://www.parkmycloud.com/blog/cloud-spending/)
5.) ["AWS Vulnerabilities and the Attacker’s Perspective"]( https://rhinosecuritylabs.com/cloud-security/aws-security-vulnerabilities-perspective/)
6.) ["Researchers demo cloud security issue with Amazon AWS attack"](https://www.computerworld.com/article/2499567/researchers-demo-cloud-security-issue-with-amazon-aws-attack.html)
7.) ["Researchers Find New Approach to Attacking Cloud Infrastructure"](https://www.darkreading.com/cloud/researchers-find-new-approach-to-attacking-cloud-infrastructure/d/d-id/1336327)
8.) ["Hunting the Public Cloud for Exposed Hosts and Misconfigurations](https://unit42.paloaltonetworks.com/hunting-the-public-cloud-for-exposed-hosts-and-misconfigurations/)
9.) ["Why Cloud Lock-In is a Myth: The Openness of AWS"](https://www.contino.io/insights/why-cloud-lock-in-is-a-myth-the-openness-of-aws)
10.) ["Bombing the Cloud: Why an Attack on Amazon, Microsoft, or Google Cloud Could Lead to 'Cybergeddon'"](https://www.inc.com/adam-levin/bombing-cloud-why-amazon-microsoft-google-cloud-should-be-classified-as-critical-infrastructure.html)
11.) ["Major US Companies Breached, Robbed, and Spied on by Chinese Hackers"](https://news.slashdot.org/story/19/12/31/1715210/major-us-companies-breached-robbed-and-spied-on-by-chinese-hackers)
12.) ["Is Google Facing a Backlash From Medical Record Vendors?"](https://science.slashdot.org/story/20/01/19/000214/is-google-facing-a-backlash-from-medical-record-vendors)