Thread: How Secure Are CRMs and VPS Hosting for Storing Sensitive Data?

<<snipped>>

Well, it depends on your definitions of "sensitive" and "proper measures" but in general I would say this claim is not really true.

Securing really sensitive data (like bank account passwords, cryptocurrency wallets, national secrets etc) is surprisingly hard. The Edward Snowden disclosures and the ongoing "Salt Typhoon" issues show that state actors can snoop on pretty much any electronic device at any time, logging keystrokes or acting as a "man in the middle". Protection for most people comes from simply not being important enough or wealthy enough to be worth that effort.

"Proper measures" for really sensitive data would therefore most likely include an air gap or cold storage - i.e., not connecting to the internet at all. I don't think that's what the OP is talking about. However they do seem to be talking about greater than usual precautions because they say security is "top priority". If that's because significant financial or legal liability is involved I would urge them to consider greater than usual precautions, including things like pentesting, audits and insurance.

At events like Pwn2Own the starting point is a system set up with "proper measures" and the expectation is that multiple vulnerabilities will be discovered within hours.