[ncc-services-wg] New on RIPE Labs: RIPE NCC and the Cloud - Let’s Start Again

>> From a technical stand point, I think the most important thing for
>> "cloud" is to choose interoperable solutions so that migration from
>> one cloud to another is possible, or at least as easy as possible.
>> Including on-prem-clouds.

After reading the new article and the comments I find it disturbing that 
the area of cyber-security is almost totally ignored.

In the original RIPE article it stated "Organisations like AWS offer 
infrastructure at a global scale, along with mature security,..." as 
well as "The primary goal of our cloud strategy is to ensure 
availability, security,... "

RIPE has done an admirable job of protecting its assets - specifically 
the DB.  Moving to the cloud means RIPE will now allow the cloud 
provider to do that function for them.

But in the era where more and more organizations are placing their 
assets in the cloud, if I were a state sponsored cyber attack team - 
where would I invest my time and effort in trying to breach security? 
One by one companies or 3 big global cloud providers?  If you think I am 
making this up, see my references below.  Yes, cloud providers invest 
heavily in security but the breaches that worry me are the ones they 
don't know about yet and that don't appear in the press.

When bank robber Willie Sutton was asked "why do you rob banks?" he 
answered "because that is where the money is".  If we move RIPE 
functions to the cloud don't be surprised 3-4 years from now when 
objects suddenly get changed and no one can understand just how that 
happened.

-Hank

References:
https://techmonitor.ai/techonology/cloud/aws-servers-hacked-rootkit-in-the-cloud
https://www.bankinfosecurity.com/crypto-keys-stolen-from-amazon-cloud-a-8581
https://www.washingtonpost.com/national-security/russia-hack-microsoft-cloud/2020/12/24/dbfaa9c6-4590-11eb-975c-d17b8815a66d_story.html
https://securityaffairs.co/wordpress/101015/data-breach/cloud-db-exposes-200m-americans.html