5 ms·

I wonder if this will be used in a more positive way than what most people would assume initially. There are tons of legal situations where confidentiality is

I wonder if this will be used in a more positive way than what most people would assume initially. There are tons of legal situations where confidentiality is absolutely necessary, for example when dealing with medical or legal records. I imagine Amazon's GovCloud might incorporate this as a potential cloud hosted chatting solution. With telemedicine and remote legal proceedings becoming more and more common, secure chatting while complying with HIPAA and confidentiality rules is going to be an important market.

kovek 5y ago
Some data we treat we care. Other data we do not. I wonder if that creates a different culture and risk than if we treated all data with care. What do you think?
- lukeschlather 5y ago
  In order to treat all data with care, you have to define what you mean by "care." In security we talk about the tradeoffs between integrity, confidentiality, and availability. In terms of integrity, the most careful treatment is to place many signed copies of the data publicly on the internet. This also is the most careful treatment for availability. Of course it is the least careful treatment for confidentiality. But no scheme with any care for confidentiality can match it for integrity and availability. Signal illustrates swinging far in the "confidentiality" direction - most messaging services don't forget anything you say, while Signal makes it rather hard for you to retain your messages, and also offers ways to delete them automatically. I find it unfortunate there are no secure, open messaging platforms that offer similar integrity/availability guarantees to services like Slack.
SkyPuncher 5y ago
Having implemented HIPAA compliant software, the technical requirements arent very difficult. If you're following developments beat practices, you have 99% of technical requirements covered. The challenge with HIPAA is building process and documentation that demonstrates compliance. It's particularly challenging at the edges of your engineering org where people tend to use tools that abstract the technical details.
- nijave 5y ago
  >If you're following developments beat practices Yeah, that tends to be where you run into issues...
  - deleted 5y ago
    [deleted]
- azinman2 5y ago
  It also requires you to actually think about these problems. As you said, it’s not necessarily hard to do, but if you’re a small startup all these best practices are usually shortcut to get product market fit. If you’re a health care startup, it really slows you down (but for good reason). It also creates criminal/financial reinforcement behind it, something not even Equifax has to be accountable to (which is insane).
- staticassertion 5y ago
  This is the case with all compliance, as far as my experience has shown. The technical controls are far second to the documentation and story telling.
- Aaronstotle 5y ago
  Exactly, as someone who recently helped finish a HITRUST (which focuses on HIPAA compliance) audit, the real work is in proving that the org has policies, procedures and actually follows them. Technical controls are the easy part. I've often dreamed of some type of way to streamline the policy --> process --> documentation pipeline.
deleted 5y ago
[deleted]

kovek 5y ago

Some data we treat we care. Other data we do not. I wonder if that creates a different culture and risk than if we treated all data with care. What do you think?

lukeschlather 5y ago
In order to treat all data with care, you have to define what you mean by "care." In security we talk about the tradeoffs between integrity, confidentiality, and availability. In terms of integrity, the most careful treatment is to place many signed copies of the data publicly on the internet. This also is the most careful treatment for availability. Of course it is the least careful treatment for confidentiality. But no scheme with any care for confidentiality can match it for integrity and availability. Signal illustrates swinging far in the "confidentiality" direction - most messaging services don't forget anything you say, while Signal makes it rather hard for you to retain your messages, and also offers ways to delete them automatically. I find it unfortunate there are no secure, open messaging platforms that offer similar integrity/availability guarantees to services like Slack.

SkyPuncher 5y ago

Having implemented HIPAA compliant software, the technical requirements arent very difficult. If you're following developments beat practices, you have 99% of technical requirements covered. The challenge with HIPAA is building process and documentation that demonstrates compliance. It's particularly challenging at the edges of your engineering org where people tend to use tools that abstract the technical details.

nijave 5y ago
>If you're following developments beat practices Yeah, that tends to be where you run into issues...
- deleted 5y ago
  [deleted]
azinman2 5y ago
It also requires you to actually think about these problems. As you said, it’s not necessarily hard to do, but if you’re a small startup all these best practices are usually shortcut to get product market fit. If you’re a health care startup, it really slows you down (but for good reason). It also creates criminal/financial reinforcement behind it, something not even Equifax has to be accountable to (which is insane).
staticassertion 5y ago
This is the case with all compliance, as far as my experience has shown. The technical controls are far second to the documentation and story telling.
Aaronstotle 5y ago
Exactly, as someone who recently helped finish a HITRUST (which focuses on HIPAA compliance) audit, the real work is in proving that the org has policies, procedures and actually follows them. Technical controls are the easy part. I've often dreamed of some type of way to streamline the policy --> process --> documentation pipeline.

deleted 5y ago

[deleted]