In this episode of the HIPAA Vault Show, join us as we navigate through the competitive world of cloud computing, focusing on the “big three” providers: Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. This episode offers a comprehensive comparison of these industry giants, assessing their offerings across several critical dimensions: Infrastructure, Services, Cost, and Security. We will dissect the robust infrastructure each provider boasts, their unique and overlapping services, the cost-effectiveness of their solutions, and most importantly, how they stand up in terms of security—especially crucial in the healthcare sector for HIPAA compliance. Tune in to gain a clearer understanding of which cloud service provider might be the right fit for your application hosting needs, backed by expert analysis and the latest data.
Do you have any remaining questions, requests, or just want to chat with us? Email us at podcast@hipaavault.com!
Transcript:
Adam
Hello, and welcome to the hipaa vault show, where we discuss all things HIpaa compliance in the cloud. My name is Adam, and I’m joined by Gil Vidals. Hey, Gil.
Gil
Hey, Adam. Great to see you again, and welcome to Friday. All right, Adam, here’s a. Here’s a little. That last time you asked me a question about a movie, which I didn’t get right, it was a Mel Gibson movie. You gave me the plot and all these hints and I’m a big Mel Gibson fan, but I didn’t know the movie was ransom. I’m gonna have to watch again. Now, I got. Since you asked me a question, I’m going to ask you one. So we talked about the three big providers, AwS, Microsoft Azure and Google. Who would be the fourth one?
Adam
Alibaba.
Gil
That’s a great answer. Alibaba. Alibaba. You might be right. But I don’t think if. I think if we compared with Alibaba, if we widen the scope to, you know, international companies, Alibaba might actually be bigger than one of the top three. But I was thinking on the US side, I was thinking that the fourth one would either be Oracle or IBM. Oracle. IBM. And I think probably oracle. We could. We could google it here and share that with information.
Adam
But it’s Alibaba.
Gil
It is Alibaba. There you go. You knew it, man. Yeah. Wow, though, this meeting, this podcast will be interesting because we’re going to compare and talk about these three big ones, not Alibaba. And we’re going to try to decide, you know, give. Give the audience some.
Adam
Yeah, Alibaba, correction, work for HIPAA.
Gil
No, I don’t think so. No, because it’s in China. It’s not going to work. Not going to work.
Adam
So should we dive into it?
Gil
Yeah, let’s do it.
Adam
Okay, great. So we’re going to be comparing these big three cloud providers, not Alibaba, AWS, GCP and Azure. And we’re going to split the comparison into a few categories. I’ll just share my screen here. We’re going to start with infrastructure, global infrastructure. So AWS has 33 regions, which are comprised of 105 zones. So zones make up regions. So you could have five zones, which are essentially data centers spread out across a single region. And so they have 33 regions and 105 zones. Google platform have less region, more regions, 40 regions, and also more zones, 121 zones. And then Microsoft Azure is leading in terms of the footprint globally with 60 regions, but they have less zones than Google cloud. So it seems like they’re in more regions, but they don’t necessarily have as many data centers across all those regions.
Adam
So if we take it by zones, then Google cloud has the biggest footprint there.
Gil
Yeah, that’s a good way to look at it. I like this because we’re not talking about dollars or security, we’re just looking at the, like you said, the footprint. Where are they and how many data centers do they have? That’s a, that’s a good start. But they’re all three huge and they’re all three profitable. And that’s important, right. You want to find a profitable player because you don’t want to put your, necessarily your application, that you spent your blood equity or sweat equity as they say, an investment equity in a platform that might be bleeding money. You don’t want to do that. But they’re all profitable. Google was the one that became profitable the last, because I think they were the last one to enter the market. So that makes sense.
Adam
Yeah, I almost, I always thought like, you know, the way regions and zones are listed rather than countries, states, territories. It’s almost like this is the new way forward for the way that the world segments itself by regions and zones rather than countries, which I thought is interesting. It’s more about bandwidth and how fast the speed of light can travel across a cable. But what the land border is because you run a cable through a land border. So next is the number of services. Now what do we mean by services?
Gil
Sure. So the most fundamental service is that of a computer, a server, so you can get computer engine services. Oh, I want to rent so much CPU Ram on a system. That’s what most people understand. But keep in mind, these cloud providers have gone well beyond the typical just single virtual machine model. And they have services and function calls and API call. They have services galore that have nothing to do with paying for a small system that has cpu and ram. They have services for everything. And that’s the trend is to get away from the virtual machine doing everything there to just consuming services. And it’s. Guess it’s good to talk about that for a minute. Why would that be appealing? Why is that appealing? Rather than logging into the server and doing everything yourself?
Gil
Well, the answer is already buried in the question, why would you want to do it yourself? You’re busy, you don’t have time to become an expert and everything. So you let the provider give you the services that you need and you’re not responsible for maintaining them or setting them up or upgrading them, patching them, backing them up. In the computer world, everything’s about upgrading and maintaining and there’s a ton of maintenance and upgrades to do. And so if you could get that off your back, you can become a better functioning organization because your resources are going to developing your product, not to maintaining the servers and the services. So that’s why this is a big deal.
Adam
Yeah. So yeah, services are really important part of the comparison here. And it looks like AWS have just over 200 services available while Google Cloud have just over 100. So AWS has almost double the number of services. And then Microsoft Azure blows both of them out of the water with over 600 services. My initial thoughts on this are with Microsoft’s licenses and the different software that they develop, them being primarily a software development company, that makes sense because they’re developing software as a huge part of their business model. So they probably would have the first integration with that software and their data centers.
Gil
Yeah, that’s a good way to explain it. I hadn’t thought about it that way. But you’re right, they have services for all of their office suite. For example, you can consume Microsoft Excel as a service instead of downloading, installing on your computer, you just go to the cloud and consume it there. So yeah, I can see why it makes sense that they have so many services compared to relative to Amazon. Now Amazon started off as a retail store, online retail store. Google started as a search engine, an advertising network, and then Microsoft started off as a software business. All three started in completely different areas. What’s interesting is why do they all have massive data centers? And the answer is because they became the number one in the world in their sector.
Gil
And to become number one in their sector, they had to have massive computer power to the tune of millions of systems and data centers. I mean, it’s unbelievable. And then once they get to that scale, they all said to themselves, well, why don’t we just rent our services out to the public because we’ve already built it all and we don’t, you know, they don’t consume all the resources they build, so they have excess and that’s how they all got into it. But Amazon was the first one that did it. Yeah.
Adam
Prime mover advantage.
Gil
Yeah, yeah.
Adam
Which, which I think plays in also to Google catching up on the services front. And it has done so. And we’re looking to look into what those services are and what the names of them are in different clouds. So I’m not going to go through all of them, but for example, with virtual machines. So what you mentioned about with the servers there, Gil, so for example, the Linux virtual machine server. The name of that service in AWS is EC two elastic compute cloud, whereas in Google Cloud it’s called compute engine and in Microsoft Azure it’s called virtual machines. And so this will probably help users and listeners. When you’re exploring whether you want to create a machine within AWS or GCP or Microsoft, you can go and search for that specific virtual machine there.
Adam
But yeah, there’s a bunch of them for containers, serverless functions, anything here to note? Gil, the I know that we primarily, I mean, we have presence as a managed security provider in AWS and Google Cloud and Microsoft Azure, but I know that our main efforts are within Google Cloud. So what from these services here do you like most about Google Cloud?
Gil
It’s noteworthy to mention that they are the ones that invented, say, kubernetes for example, container row. I see, well, kubernetes was invented by Google. They’re the ones who started it and then the other public clouds adopted it. So I, years ago when I saw that Google was the inventor, the innovator, that’s not to say WS and Microsoft have innovated, they’ve all innovated. But in terms of the rate of innovation, like who’s innovating faster? It was Google, clearly. So I decided to focus mainly on Google Cloud. And the other advantage of Google is the price because they’re behind in terms of dollars, not innovation, but in terms of dollars and revenue share or market share. Google has lowered their pricing considerably. So that to me that was back when I was looking at all these providers.
Gil
We didn’t have the staff to have to learn everything, to learn all three platforms. So we decided to focus on Google. If Google is the innovator and they’re charging less, it kind of made sense. That was the one that we chose, even though they weren’t the market leader. Most people, most companies were using and continue to use AWS, but it does cost more money and one can make an argument that they’re less innovative than Google. And I don’t know, security is the other area, but I know we’ll get.
Adam
Into that later on that just validate what you said a little bit when it comes to up to date pricing. I did. A couple of days ago I went into each one of these cloud providers. They offer public calculators that you can go and check what service you want to use before you start using it, so you can find out what the pricing is. And I checked. What I did was I took an example of a very common request which is a dedicated Linux virtual machine with two cpu, eight gigs of ram and 30 gigs of disk space. And AWS came out as the most expensive, $78.95. Azure came out as the second most expensive, $73.95. So just below AWS. And then by far the best value was Google Cloud with $51.92. So that’s as of April 2024.
Gil
Yeah, I keep, the audience should keep in mind that your mileage will vary because if you are a big company you’ll get some major discounts that.
Adam
Yeah, this is for no commitment whatsoever.
Gil
Yeah, yeah, this is just starting. But anyway, it’s, the point is well taken here. This is a relative difference. So if you, even if you are a big company and say, well, I’m going to get a big discount from AWS, well you’d also get a big discount from Google and a big discount from Microsoft. So the relative difference is still going to be about the same.
Adam
Yeah, absolutely. And I would encourage you to just check out the, just Google Cloud calculator, AWS price calculator, Microsoft Azure calculator, and you can go in and look at the service you want and compare them as well or reach out to us and we can help hip hop if you want. You have some questions about cloud providers. Okay. And then the final, last but not least section of the comparison is the security and compliance section. So all these providers do have robust security and compliance policies and procedures in place. Compliance certifications include various ISOs, GDPR compliance, HIPAA compliance, which we deal in a lot, SoC, PCI, DSS, Fedramp for government. So that is pretty much a standard and a given across the different cloud providers.
Adam
One thing I thought of note with Google is that they offer encryption at rest and in transit by default. I mean we’ve talked about encryption at rest and in transit in previous episodes a lot. But could you explain that a little bit and what it means by default compared to the other providers?
Gil
Yeah, I think most people get an idea what encryption is, but the encryption is used in different scenarios. So when you turn off a system, you power it off, you unplug it. Is the system encrypted in its resting state that’s called encryption at rest. And then the other one is in transit would mean if you’re sending data to and from, would it be encrypted? And that’s called in transport. Then there’s another one called encryption in use, but the Google does that by default. So you don’t have to plug, you don’t have to request it or enable that feature. That’s just the way it works natively. In fact, I don’t think you could undo it even if you wanted to. And there’s no disadvantage to it. That doesn’t slow it down or cause any issues with the application.
Gil
It’s just a good measure to have encrypted. Now with AWS and Microsoft, according to this table here, you’ve got to enable that feature and explicitly say, I’m going to use this feature.
Adam
Yeah, yeah, that’s something that, you know, we get questions from customers that have got, let’s say, their development environments in AWS, but they’re hosting the main environment for HIPAA compliance with Hipervault and they’ll reach out and say, hey, how much extra do I have to pay you to encrypt things at rest? And they’ve got a great answer for them. Everything that we host is encrypted at rest and transit by DeFi because we’re with Google. So that’s, yeah, that’s a important factor. And then in terms of the threat detection and response, just the last point touch on the Amazon has AWS shield for DDoS protection and Amazon inspector for security assessments. And then Google cloud has security command center and Google safe browsing. And the equivalent in Microsoft Azure is Azure Sentinel and Azure Security center.
Adam
So they all have these seams and ways to manage the security. Would that be an appropriate way to define a seam Gil or it’s a.
Gil
Security incident and event monitor. There are a lot of tools that claim to be Siemes. And I think the security overall for these three providers is good security. I mean, in general, it’s at the highest level. And this is one of the reasons to use the cloud because if think about it, if your company, even a company of modest size, say you’re $100 million a year company, do you really think that your 100 million dollar company is going to be able to keep up with all the changing technology and pay for it all and maintain it and invent new stuff like these guys? The answer is clearly no. You’re not going to be able to keep up with that. Even if you do for a while, eventually you’re going to lose your lead team members and you’re going to fall apart.
Gil
And so we might as well put our assets in these clouds providers because they’re the ones offering the best security. Now, if you wanted to compare security between the cloud providers and get really nuanced, find out which one has the best security that we should save for another podcast, I think, to where we go through and really get down to compare Google Zero trust model with the model that AWS and Azure offer. That would be very interesting and maybe some of our audience would enjoy that because maybe they’re in the middle of deciding, hey, I have my healthcare app, I need to provide a public cloud. Which one do I choose? And that security is obviously a very important one. So going through that security models would be very useful.
Adam
Yeah, I agree. I think in particular we could talk a lot about the identity and access management portion of this in a future episode. I’d like to encourage you, if you’re listening or watching, to reach out to us. If you have experience implementing, migrating, maybe to one of these cloud providers or multiple of these cloud providers, reach out with your experience. Let us know which one you found to best for your needs and why. And if you haven’t yet and you would like to move to a cloud provider and worried about the security and how that would go and take place, reach out to us through hipervolt.com or email us podcast.com and we’d be happy to answer any of your questions. So that’s it for today.
Gil
Just stay safe and stay dry.
Adam
All right, we will try. Thank you for watching. Thank you for listening. Until next time, thanks. Stopping by.