3 ms·

It's not normal. Ask them if they and Drata are willing to be on the hook for all your potential bank breach in the future, as they are key-logging your online

by ww520 5y ago

It's not normal. Ask them if they and Drata are willing to be on the hook for all your potential bank breach in the future, as they are key-logging your online banking access. Ask them if they can put up a surety bond or insurance for any of your financial loss due to breach of privacy.

jevoten 5y ago
I believe reducing loss of privacy to only financial costs is the wrong approach. How will you quantify this cost when, for example, Drata runs some fancy ML algorithm on the gathered data, and starts offering employers a "unionization risk" score for new hires that they have intel on? What do you do when being without an evaluation by some spy company like Drata, since you're so privacy conscious, itself becomes a black mark for employers? Rights should not be thought of in terms of their financial cost.
- illud_tempus 5y ago
  > Rights should not be thought of in terms of their financial cost. Agree!
neonnomad 5y ago
The Drata agent is a lightweight osquery agent that is read only that reads things like - screen saver timeout, auto-updates turned on, is AV software installed, etc. We collect that data to show the device is compliant with the companies policies and the compliance frameworks they have agreed to. The company this person contracts with requires the agent be installed to monitor compliance for all devices, employee and contractor. Most companies these days require devices meet xyz requirements around patching, av/edr, etc. if they hold company data. It never "key logs" anything or collects any of that type of information. Our agent has been third party security validated and we are happy to share the report with any prospect/customer as well as the configuration. Source: Work for Drata as the CISO
- ww520 5y ago
  Does your software run as a Windows service? Is it installed as the System user or Local Admin user? Does it auto update over network? It’s just one update away from adding key logging. Put money on your claim. Put up a surety bond or insurance for users’ data breach. All the security audits won’t beat putting your own financial stake on the table.
- illud_tempus 5y ago
  How does the agent know what user it is monitoring? What other kinds of personal information does it process or collect, locally or in it's server endpoint? An external IP address is personal information. A UUID identifying a block device is personal information. A hostname is personal information. Anything in "/usr/home" is personal information.

by ww520 5y ago

jevoten 5y ago

I believe reducing loss of privacy to only financial costs is the wrong approach. How will you quantify this cost when, for example, Drata runs some fancy ML algorithm on the gathered data, and starts offering employers a "unionization risk" score for new hires that they have intel on? What do you do when being without an evaluation by some spy company like Drata, since you're so privacy conscious, itself becomes a black mark for employers? Rights should not be thought of in terms of their financial cost.

illud_tempus 5y ago
> Rights should not be thought of in terms of their financial cost. Agree!

neonnomad 5y ago

The Drata agent is a lightweight osquery agent that is read only that reads things like - screen saver timeout, auto-updates turned on, is AV software installed, etc. We collect that data to show the device is compliant with the companies policies and the compliance frameworks they have agreed to. The company this person contracts with requires the agent be installed to monitor compliance for all devices, employee and contractor. Most companies these days require devices meet xyz requirements around patching, av/edr, etc. if they hold company data. It never "key logs" anything or collects any of that type of information. Our agent has been third party security validated and we are happy to share the report with any prospect/customer as well as the configuration. Source: Work for Drata as the CISO

ww520 5y ago
Does your software run as a Windows service? Is it installed as the System user or Local Admin user? Does it auto update over network? It’s just one update away from adding key logging. Put money on your claim. Put up a surety bond or insurance for users’ data breach. All the security audits won’t beat putting your own financial stake on the table.
illud_tempus 5y ago
How does the agent know what user it is monitoring? What other kinds of personal information does it process or collect, locally or in it's server endpoint? An external IP address is personal information. A UUID identifying a block device is personal information. A hostname is personal information. Anything in "/usr/home" is personal information.