Hacker-Approved Security and Flash Memory for the Cloud

By Matthew Dublin

On the cloud security front — probably one of the hottest topics of Cloud Expo 2011 — cloud hosting companies like Firehost are beginning to focus on HIPAA compliance. I had a chance to speak with Bruce MacFadyen, the COO of Firehost, who said they have already racked up a number of life sciences research and health care institute customers. One is the National Breast Cancer Foundation, which switched over to hosting its site on FireHost and immediately saw a 15 percent decrease in Web traffic. It turns out that this decrease was actually due to a drop in malicious activity on the site at the application layer.

Last October, the biostatistics center at Johns Hopkins University and the department of surgery at Duke University School of Medicine selected FireHost to host special projects within their health care divisions that involved confidential patient and research data. And medical desktop and mobile software developer cGate Health also adopted FireHost to help them maintain HIPAA and HITECH Acts compliance while sending and receiving massive quantities of patient test result data in electronic medical records.

According to MacFadyen, the real challenge with public clouds is that many use open-source hypervisor software — the software layer on a cloud that allows users to create virtualized compute instances — which is obviously open for attack by hackers who have ready access to the code. To be clear, this is only a problem with public clouds and not a private cloud that one could rent on Amazon wherein you're reserving dedicated hardware that only your cloud will be hosted on.

For what it's worth Kevin Mitnick, one of the most famous hackers in history, selected Firehost to host his website back in 2009.

Boasting big name customers including everybody from Facebook to the Lawrence Livermore National Laboratory, Fusion-IO’s Victor Brisebois made a case for NAND flash memory as the hardware of choice for hosting a cloud and maximizing virtualization in the data center. Fusion-IO, which is the first vendor to release a PCI-compatible NAND flash memory board, offers customers several different configurations of their “ioDrives” — PCIe cards kitted out with solid-state flash memory with up to 5.12TB of storage.

last year, LLNL replaced roughly 137 racks with hard drives with just two Fusion-IO flash servers for its Hyperion Data Intensive Testbed.

Brisebois said to think of NAND flash memory in this context: as very cheap RAM that can be used for hosting acceleration. The basic pitch for Fusion-IO’s solution is that it can be employed to completely replace the Storage Area Network, or SANs, piece of a network architecture — SANs are dedicated storage networks used to make disk arrays or tape libraries accessible to other servers. This means that users can dump an entire database on one NAND flash card and eliminate networking latency or host a private cloud using a fraction of the physical space and power of a traditional network architecture.


"According to MacFadyen, the

"According to MacFadyen, the real challenge with public clouds is that many use open-source hypervisor software — the software layer on a cloud that allows users to create virtualized compute instances — which is obviously open for attack by hackers who have ready access to the code."

Hoo-boy. When folks claim superior security thanks to speshul seekrit code you should be very, very suspicious. Just google on "closed source security" for any number of studies that shoot this line of reasoning full of holes.