6 ms·

At this point the big companies probably need to submit to some external audits to really get trust back.

shereadsthenews 7y ago
I've worked on wipeout compliance at Google and IMHO there's no possibility that an outside auditor would ever be able to understand those systems to such an extent that they would discover a flaw in them that wasn't previously known to the many engineers who work full-time on wipeout. The systems are just too complex. One does not simply `find -type f /google` to figure out what data is available.
- hdfbdtbcdg 7y ago
  Part of the point of the audit would be to demonstrate that you take it as seriously as you say you do. Not so much to check the fine details.
  - shereadsthenews 7y ago
    I don't personally put any value in those kinds of audits but Google has those. For example they have outside auditors for SOC and ISO 27018 and whatnot. Some dipshit from Ernst and Young swears that Google has such internal controls and processes.
  - scarface74 7y ago
    In other words, it would be the same type of theater that most companies engage in. I know plenty of companies with "strict security standards" administered by the infrastructure department so they can pass an audit or some other type of security compliance. But most security breaches happen because of badly written software that the "compliance department" never reviews and they wouldn't know what to look for if they did. Developers could have: sql = "Select * from Foo Where FirstName = '" + firstname + "'"; All over their code and no one in "compliance" would be any the wiser.
    - eitally 7y ago
      This isn't necessarily true. At my previous company we had a serious finding (DoD audit) as a result of poorly written software. The finding was discovered by running one of our standard internal reports and looking at who touched what, when, and where. Pretty straightforward, and although the fix was in code, the discovery didn't require any technical analysis.
      - scarface74 7y ago
        Without going into confidential information, how could a report that didn’t analyze the code find possible sql injection attacks or over posting vulnerabilities?
- greendestiny_re 7y ago
  Saying that systems are too complex to be audited is a horrifying statement that reveals an environment ripe for abuse.
  - shereadsthenews 7y ago
    That’s not what I meant. Outside auditors are the dumbest people on the planet and all they are prepared to understand is that you deployed Norton Deletemaster Enterprise Edition or whatever. Trying to explain to them that you’ve got a mathematical proof of why the backups are unreadable is a big waste of everybody’s time. I’ve been in that meeting and it’s worse than death. Still, the audits exist and the reports are public.
- eigenvector 7y ago
  I disagree. Compliance enforcement of complex systems is not done by sending in a team of engineers to reverse engineer the whole thing. What you do is require the regulated corporation to maintain auditable evidence of its compliance in a specific format, then do routine auditing of the evidence. You only do a true deep dive into their systems if the routine audit shows non-compliance or potential fraud.

I've worked on wipeout compliance at Google and IMHO there's no possibility that an outside auditor would ever be able to understand those systems to such an extent that they would discover a flaw in them that wasn't previously known to the many engineers who work full-time on wipeout. The systems are just too complex. One does not simply `find -type f /google` to figure out what data is available.

hdfbdtbcdg 7y ago
Part of the point of the audit would be to demonstrate that you take it as seriously as you say you do. Not so much to check the fine details.
- shereadsthenews 7y ago
  I don't personally put any value in those kinds of audits but Google has those. For example they have outside auditors for SOC and ISO 27018 and whatnot. Some dipshit from Ernst and Young swears that Google has such internal controls and processes.
- scarface74 7y ago
  In other words, it would be the same type of theater that most companies engage in. I know plenty of companies with "strict security standards" administered by the infrastructure department so they can pass an audit or some other type of security compliance. But most security breaches happen because of badly written software that the "compliance department" never reviews and they wouldn't know what to look for if they did. Developers could have: sql = "Select * from Foo Where FirstName = '" + firstname + "'"; All over their code and no one in "compliance" would be any the wiser.
  - eitally 7y ago
    This isn't necessarily true. At my previous company we had a serious finding (DoD audit) as a result of poorly written software. The finding was discovered by running one of our standard internal reports and looking at who touched what, when, and where. Pretty straightforward, and although the fix was in code, the discovery didn't require any technical analysis.
    - scarface74 7y ago
      Without going into confidential information, how could a report that didn’t analyze the code find possible sql injection attacks or over posting vulnerabilities?
greendestiny_re 7y ago
Saying that systems are too complex to be audited is a horrifying statement that reveals an environment ripe for abuse.
- shereadsthenews 7y ago
  That’s not what I meant. Outside auditors are the dumbest people on the planet and all they are prepared to understand is that you deployed Norton Deletemaster Enterprise Edition or whatever. Trying to explain to them that you’ve got a mathematical proof of why the backups are unreadable is a big waste of everybody’s time. I’ve been in that meeting and it’s worse than death. Still, the audits exist and the reports are public.
eigenvector 7y ago
I disagree. Compliance enforcement of complex systems is not done by sending in a team of engineers to reverse engineer the whole thing. What you do is require the regulated corporation to maintain auditable evidence of its compliance in a specific format, then do routine auditing of the evidence. You only do a true deep dive into their systems if the routine audit shows non-compliance or potential fraud.