3 ms·

We have had a lot of success using Inspec and for a while Chef compliance in validating the infrastructure elements remain compliant continually. For instance,

• bradknowles 7y ago
  Years back, I was brought in as a consultant for a large online provider of automated loan application systems to provide Chef automation for confirming that the CIS-CAT controls had been properly applied. This was for a firm that handled over 80% of all online loan applications, from all the major banks, insurance companies, credit unions, etc.... From the moment you typed in the first character of your name to when you hit the final submit button, everything was handled on their site, and proxied through to the customer systems via an iframe or other technology. I tried to convince them that they should have automated compliance testing and confirmation on a regular and frequent basis (like every thirty minutes), but they refused. They said it wasn't necessary according to their auditor, and they weren't going to open themselves up to additional risk by having the tool run too frequently. They had quarterly audits, and therefore they wanted the tool to only be run quarterly, and to only be kicked off manually at that. While us normal human beings might be convinced of the need and desire to always be protected, but banks and financial institutions don't think like that. For them, they only ever do the absolute minimum required by law, because anything more just creates more risk.