Problems with disk encryption in AWS
I think the author and the commenters here are using two different threat models. A lot of people here are saying you should encrypt the disks because it’s best practice for security. Or because it protects against some specific, if implausible, scenario. They’re talking about theoretical security.<p>The author is saying the probability that it improves your security is so low that any time it takes away from other security related work is actually making your security worse. That’s a different threat model, and it’s probably the better way to approach security, and the author is probably correct - if he actually uses that saved time to improve security in other ways.<p>I have a question though, what are the laws that require encryption? I can think of HIPPA, SOC2 maybe? What about GDPR?