4 ms·

> SOC2 is pretty heavy duty to achieve and to maintain. LOL, no. I've gone through SOC2, and it's not hard at all to achieve. SOC2 is basically just about (1)

by necubi 6y ago

> SOC2 is pretty heavy duty to achieve and to maintain. LOL, no. I've gone through SOC2, and it's not hard at all to achieve. SOC2 is basically just about (1) documenting controls and (2) following them. You have a lot of leeway with your auditor on what those controls entail (and remember, you choose and pay your auditor, so there's also a huge conflict of interest here). We did have to do a yearly security audit, but it's foolish to think that will catch all issues, and it relies a lot on the company being helpful and open with their auditor. You also a lot of leeway in arguing down issue severity. We got SOC2 certified because many companies require that their vendors have it, but I personally think it has little to no value, and I would not trust a company any more because they've gone through it.

KajMagnus 6y ago
The auditors, were they IT security professionals (if so, about how many years experience?), or accountants, or mixed, or something else? Were there any requirements about pentesting one's company somehow? Did they look at source code?
- suifbwish 6y ago
  Auditors looking at source code.. Are you serious? From that question alone I can tell you know nothing about these audits.
  - KajMagnus 6y ago
    Actually there are auditors who look at source code — "code audits", https://en.wikipedia.org/wiki/Code_audit https://en.wikipedia.org/wiki/Code_audit And there's a job role called "Source Code Auditor". Question was if GGP's SOC2 case involved any such source code audits or not. Now, having read https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html (linked from a nearby comment, https://news.ycombinator.com/item?id=25489586 https://news.ycombinator.com/item?id=25489586), seems SOC2 does not include those types of audits. Could still be nice to hear directly from GGP @necubi though. ("yearly security audit"?)
    - suifbwish 6y ago
      I agree it should be a thing but having been part of a few code audits which were just part of normal company acquisition processes, I know that it takes months to audit the code base of even a moderate sized web application unless it uses a framework whose libraries can be eliminated through md5checks against the originals

by necubi 6y ago

KajMagnus 6y ago

The auditors, were they IT security professionals (if so, about how many years experience?), or accountants, or mixed, or something else? Were there any requirements about pentesting one's company somehow? Did they look at source code?

suifbwish 6y ago
Auditors looking at source code.. Are you serious? From that question alone I can tell you know nothing about these audits.
- KajMagnus 6y ago
  Actually there are auditors who look at source code — "code audits", https://en.wikipedia.org/wiki/Code_audit https://en.wikipedia.org/wiki/Code_audit And there's a job role called "Source Code Auditor". Question was if GGP's SOC2 case involved any such source code audits or not. Now, having read https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html (linked from a nearby comment, https://news.ycombinator.com/item?id=25489586 https://news.ycombinator.com/item?id=25489586), seems SOC2 does not include those types of audits. Could still be nice to hear directly from GGP @necubi though. ("yearly security audit"?)
  - suifbwish 6y ago
    I agree it should be a thing but having been part of a few code audits which were just part of normal company acquisition processes, I know that it takes months to audit the code base of even a moderate sized web application unless it uses a framework whose libraries can be eliminated through md5checks against the originals