2 ms·

We are in the 'lucky' position that ISO 27001 is now simply a legal requirement because we offer a healthcare SaaS-product in the Netherlands (ISO 27001 is requ

We are in the 'lucky' position that ISO 27001 is now simply a legal requirement because we offer a healthcare SaaS-product in the Netherlands (ISO 27001 is required via its Dutch NEN 7510/12/13 bastard child that is). For a small company (less than twenty employees) it really is a lot of work. It brings some benefits in that it forces you to have your documentation and certain processes in order, but man… getting audited drains you. It depends a lot on the auditor you get, but from all the stuff I do for my job, this yearly event feels like the biggest waste of time. It's just that without it we would be out of business.

robertlagrant 5y ago
Same story here. Health tech in the UK. It's a pretty arduous process, but given our engineering team was already hot on security (and probably haven't been unlucky with auditors) we haven't had problems in practice.
tgv 5y ago
We’re also certified for similar reasons. It did bring information security more in the focus of upper management, so that’s a plus. I for the time for backup encryption, getting rid of outdated servers (fuck Arch Linux, really), and everyone now has a monitored laptop, and got a info sec training.
- sam_lowry_ 5y ago
  You could have organized your processes around ArchLinux instead of battling it, really. A living, dynamically developed software will benefit a lot from ArchLinux rolling releases. Once your software becomes an ossified cash cow, moving it to RedHat makes more sense.
  - tgv 5y ago
    I'm sure that someone with enough knowledge of Arch Linux could have set it up properly, but I inherited multiple servers with three different distros (and the Ubuntu ones were on different versions). One of these was Arch Linux. It hadn't been updated in a long time, and the update simply failed. Once I got past that, it was going to break something (can't remember, but most likely the Python version). A little while later, it couldn't update anymore, because some file or package was no longer accessible. With Ubuntu (or Debian), you can at least install a new version even if some intermediate release is no longer downloadable. It's been a headache without any benefits from my point of view. By all means, run it on your personal servers, but it's an operational risk for an organization.

robertlagrant 5y ago

Same story here. Health tech in the UK. It's a pretty arduous process, but given our engineering team was already hot on security (and probably haven't been unlucky with auditors) we haven't had problems in practice.

tgv 5y ago

We’re also certified for similar reasons. It did bring information security more in the focus of upper management, so that’s a plus. I for the time for backup encryption, getting rid of outdated servers (fuck Arch Linux, really), and everyone now has a monitored laptop, and got a info sec training.

sam_lowry_ 5y ago
You could have organized your processes around ArchLinux instead of battling it, really. A living, dynamically developed software will benefit a lot from ArchLinux rolling releases. Once your software becomes an ossified cash cow, moving it to RedHat makes more sense.
- tgv 5y ago
  I'm sure that someone with enough knowledge of Arch Linux could have set it up properly, but I inherited multiple servers with three different distros (and the Ubuntu ones were on different versions). One of these was Arch Linux. It hadn't been updated in a long time, and the update simply failed. Once I got past that, it was going to break something (can't remember, but most likely the Python version). A little while later, it couldn't update anymore, because some file or package was no longer accessible. With Ubuntu (or Debian), you can at least install a new version even if some intermediate release is no longer downloadable. It's been a headache without any benefits from my point of view. By all means, run it on your personal servers, but it's an operational risk for an organization.