9 ms·

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the co

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over months, and it's a pain. * The Drata agent is a pretty innocuous thing. It checks you have done things like turn on disk encryption, have updates enabled, and that the screen locks if you walk away. It does NOT monitor employee's activities. These kind of security checks are incredibly common and are required for certifications like ISO27001 and SOC2. SOC2 is not really optional for large enough b2b SaaS. * The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my understanding of their business model. It honestly sounds like bullshit to me! But if you have evidence that they do this, please let us know. * As a freelancer, whether you are required to install security monitoring software is definitely an open question. If you're delivering work separately and not connected to company systems, then ok. If you're basically just acting like any other employee, and connected to the company systems, then you will probably have to do this. Because otherwise they would fail SOC2 and managing your legal status as "Freelancer" vs "Employee" (for tax reasons??) is not worth not being certified.

ospzfmbbzr 5y ago
> Reply to parent Next client! This is potentially an indicator of a bad customer or management. My hardware = my software (not yours) end of discussion. Don't like it? Have fun finding someone better that will put up with your nonsense. Now if they provide a laptop with corp network access etc that is different. I'm a professional similar to yourself. 15 years as a consultant and freelancer.
- lucraft 5y ago
  I agree: a company asking developers to install security monitoring agents like this should also offer company laptops. Same with mobile phones, actually, for remote wipe profiles and location tracking and things. If they don't offer company hardware I don't think they can rightfully demand agents be installed. But if they do, and if you decline to use it then you have to accept agents on your own machine. Not sure what OPs situation is - but I'd think it very reasonable to go back and say "if you want to install this you have to provide me a laptop"
daneel_w 5y ago
> "The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". > Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my understanding of their business model. It honestly sounds like bullshit to me! But if you have evidence that they do this, please let us know." Do you have any evidence that they don't? If so, can you describe a few bits of your investigative process and how you reached the conclusion? For the sake of alleviating people's fears and to clear up the nonsense.
- kenrose 5y ago
  That’s not how burden of proof works. OP made a claim that Drata collects private employee info and resells it. That’s a large claim. It’s on OP to justify that position, not on the parent to rebut the opposite.
  - CoastalCoder 5y ago
    IIUC, "Burden of proof" (as a concept) is meaningful in fora where there are agreed-upon standards of evidence. E.g., a courtroom or a formal debate. My impression is that HN conversations are less regulated. Someone can make a claim, and each reader can decide how much merit it deserves, and if/how to discuss it further.
  - daneel_w 5y ago
    It is a large claim. I'd say there's a bit of burden on both sides as the parent called it out as nonsense. They're implying they know for a fact that it doesn't breach privacy/integrity.
  - matheusmoreira 5y ago
    Burden of proof doesn't really matter. If this company wants people to trust its software "agents", they should be making every effort to convince them. Free software goes a long way.
illud_tempus 5y ago
> The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". Do you have any evidence for this?? I read their Privacy Policy. They are quite explicit about what they plan to do to you. I raised the issue with them in an email (among 5 other issues). Their reply is in the header. Another issue I raised is that they expect me to accept undisclosed terms and conditions. That said. I have worked with computer security at an advanced level, including consulting, training, penetration testing, design/implementation of x-platform server agents for monitoring and alerting, design/implementation of firewall. Once I designed an implemented a system to deal with NATO secrets (not very sensitive secrets, but still secrets) for a military subcontractor in EU. My computer is relatively secure. I follow best practices - and more. A hostile agent would decrease the security on my network. That was my first thought when I got that awful email. Also, I don't get it why that need such a thing on my PC. I don't have credentials to production systems or production data. I am a software developer. I work with code and documentation. That's it. Anything I produce is reviewed by other developers and then tested independently by QA. I am careful to be a freelancer, and not an employee, for several reasons. It means that legally I'm my own boss. That feels good (I have a great boss!) It also make it unproblematic to work on open source projects, without getting into discussions about who owns the intellectual rights to that work.
- allo37 5y ago
  Unfortunately, "I know a lot about security, trust me bro" doesn't satisfy the compliance box-tickers, for better or worse. Maybe run it inside a VM?
  - deleted 5y ago
    [deleted]
- lucraft 5y ago
  > I read their Privacy Policy. They are quite explicit about what they plan to do to you. OK, well, I've skimmed it and I can't see anything that suggests they are going to spy on our employees and sell the data to advertisers. I hate to drop it back on you but which passages make you think they do that? These things do often sound terrifying because things like "I'm going to use Google Analytics to see which parts of the product people aren't using so we can email them reminders" get turned into passages like "We will upload all your activity to a third-party advertising company for marketing purposes". > I have worked with computer security at an advanced level ... A hostile agent would decrease the security on my network. That was my first thought when I got that awful email. I believe you! 100%! But you are unusual, and without verification a control such as "All laptops should have screens that lock after 5 minutes" won't be followed by everyone. NOT EVEN CLOSE to everyone. > Also, I don't get it why that need such a thing on my PC. I don't have credentials to production systems or production data. I am a software developer. I work with code and documentation. That's it. Sure. Another commenter in the thread has said that because of that this isn't strictly required for SOC2. I'm sure they're right.. but I'm not sure I want anyone working on our codebase at all who doesn't have basic security settings set on on their laptop (Again, I know YOU do :) ) Back to the using your own computer thing again - this is why I think lots of companies say "You use our hardware for all company work but IF you really really want to do BYOD then you have to accept some of these agents". Not sure if that's the attitude at your firm, but that seems reasonable.
too_pricey 5y ago
You're completely right re Drata as a company (we use a different compliance vendor, but very similar setup re the agent). You're a bit off on whether this would fail a SOC2 audit, thankfully. As the OP said, they don't have access to production systems, which basically means you can treat that employee however you want from a SOC2 (and ISO, and most other control framework perspectives). The company OP is working for can state "We do not require these controls on contractors without production access" and that is totally fine for SOC2. Pushing back on the agent requirement is totally reasonable!
- lucraft 5y ago
  Do you think? I wasn't sure because although he doesn't have access to production systems a lot of controls are around access to the code, e.g. Github. But quite possibly you are right.
  - Vendan 5y ago
    I've been through SOC2 (sat in with auditors and walked them through pretty much all of our stuff around source code and testing and building things). SOC2 is very much a "do you have policies for x, y and z" and "are you actually implementing those policies", with a VERY HEAVY emphasis on "are you doing what you say you'll do". There's nothing that says "You must monitor any place your source code could exist", but there's plenty that says "You must have a policy for change management" and stuff like. And you'll get dinged hard if you have a policy that says "We monitor every device that has our source code on it" and then turn around and have contractors you don't monitor. That said, it's also completely trivial (on the auditor side) for them to say "Oh, we're changing this policy to 'We monitor devices with production access'". Good luck pushing for that to happen as a contractor, though...
    - tptacek 5y ago
      My understanding is that it's not completely trivial to make these kinds of policy changes once you get past your Type 1. This would be a nitpick except that it implies something important about how you should handle SOC2: don't be ambitious or expansive in your Type 1 audit, and leave yourself room to see what's going to work long term. This is something I've seen a lot of people mess up.
formerly_proven 5y ago
> Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. In other words, Drata is a CYAaaS. > The Drata agent is a pretty innocuous thing. It checks you have done things like turn on disk encryption, have updates enabled, and that the screen locks if you walk away. Guessing it is privileged and self-updating.
- cure 5y ago
  > Guessing it is privileged and self-updating. And closed source, of course. Must be totally free of bugs too, like all software.
  - nyir 5y ago
    At least it's using some OSS, like osquery, c.f. <https://cdn.drata.com/agent/osquery/queries.json https://cdn.drata.com/agent/osquery/queries.json>, so you can easily see quite a bit of what it's going to gather.
    - neonnomad 5y ago
      It is based on osquery and we are happy to share any information including our third party security validation of the agent with prospects/customers. Source: I am the Drata CISO
joekrill 5y ago
The underlying problem is they are asking you to trust Drata implicitly, sight-unseen, and give them unfettered access to their laptop. There is nothing preventing Drata from changing their minds and altering how their agent works or what it collects. Then there's the unintentional aspect. There is, of course, no guarantee their agent is bug-free. Data leaks and compromises happen all the time, by every facet of company (large, small, respected, hated, etc). This is really a huge risk IMO. If anything, it's being downplayed and far from "nonsense".
- lucraft 5y ago
  Grown-up companies doing SOC2 usually provide developers with hardware, and in that case the company is installing an agent from a vendor they have selected, onto their own computers. True, the grey area is slightly odd situations like this where the protagonist is a freelancer rather than an employee and presumably also the company isn't willing to provide hardware to them in that case?? Because they're a freelancer? Sounds like a case that isn't going to survive too long in any company that's getting serious about compliance and risks.
kriro 5y ago
Maybe I'm very naive here but does SOC2 explicitly require monitoring? Can't a contractor simply sign a form that says all relevant rules are followed on their end and thus if that's not the case, the company is off the hook? If active monitoring is really required than the only solution I see is one device/customer and thus as a freelancer I'd have to request said device be provided by the customer.
- lucraft 5y ago
  SOC2 auditors require evidence for controls being followed - repeated evidence over a long period of time. What's evidence? I can't remember the exact details but imagine something like ... a screenshot of the security page of the Settings app on macOS, taken by every employee, on every laptop, once a week. Or install the Drata Agent on all company laptops. Perhaps a form would be enough evidence that you wouldn't have to repeatedly collect it... but I doubt it. Because otherwise couldn't ALL employees just sign a form and that would be that? Auditors know that people don't actually follow the rules carefully even if they claim they are going to.
- hmahncke 5y ago
  In principle, a company’s security policy could be to enforce security settings on employee computers with an agent like Drata, and contractually guarantee those same settings for contractors. The evidence during the audit would be the Drata report for employee computers and the signed contracts for the contractors.
thraxil 5y ago
I'm going to piggyback on your comment because it's one of the more reasonable and informed takes here. I'm currently in the middle of our company's first evaluation window for SOC2 Type 2. I'm not familiar with Drata, but at a surface-level, it sounds pretty similar to Vanta, who we use. OP says "The motivation is that my client badly want a SOC 2 certification", which sounds about right. If anyone isn't familiar with SOC2, it's generally not something that you start out wanting or caring about, but eventually you get some big potential customers and they tell your sales people that they can't sign the contract unless you can show them your SOC2 attestation. Then you scramble to figure out what it is and what you have to do to get it. Depending on how your business works, it's the kind of thing that can very quickly go from "we don't know what that is" to "the future of our company depends on this". If you're a small team without experience in the area, it's a total mess and hard to understand exactly what's required. Signing up with someone like Vanta or Drata to walk you through the process and provides a bunch of tools to tick boxes and get you through an audit with a minimal amount of manual work and ambiguity (though there will still be a lot of that). SOC2 tends to be very vague on actual technical controls and is more focused on the documentation of whatever controls you have set for yourself and gotten your auditor to agree are reasonable. You're going to have a very hard time getting most auditors to agree to something less strict than "devices that are used to access production systems or could otherwise touch sensitive data must have encrypted drives, be password protected, and kept up to date with security patches". If you have a traditional IT setup and provide hardware to all of your employees, you can probably generate some documentation showing how you enforce that policy. It's trickier in remote setups, BYOD environments, or with contractors/freelancers. Your two options are basically to have people install an agent like Dasta or Vanta's or to require them to upload screenshots of all the relevant settings on their devices somewhere on a regular basis (typically monthly), and then have an admin check them and sign off. That second approach isn't hard, but it tends to be very labour intensive and annoying as well as very easy for someone to forget and produce gaps/exceptions that then have to be explained to your auditor. In our case, we're a fully remote company and fully BYOD (you get a hardware stipend but we don't really have an IT department so we're not in a good position to manage peoples' devices for them; we do strongly encourage people to use separate devices for work and personal). We completely understand the reticence towards installing a 3rd party agent on their own machines, so we give our employees the option of using Vanta's agent or doing the monthly screenshot thing. Boy is the screenshot thing a pain in my butt and don't I wish everyone would just use the agent. In the future, it might push us to change our BYOD policy and instead supply managed devices (but I'm not crazy about that approach either for other reasons). One piece of feedback we've given Vanta at every opportunity (and I assume would apply to Dasta as well) is that we'd have a much easier time getting adoption of the agent among our developers if they'd make it open source so anyone with privacy concerns could audit it themselves. So far we haven't gotten any indications that they're moving in that direction. FWIW, reverse engineering and spying on the Vanta agent with eBPF and other tools to try to catch it doing something it shouldn't has become a bit of a side hobby of mine (it's mostly a wrapper around OSQuery and I've been able to log all the queries that it makes and not yet found anything nefarious, but absence of proof isn't proof of absence). IMO, it's completely reasonable for the OP, as a freelance contractor, to refuse to install an agent on their personal machine and instead provide screenshots/etc as evidence. They say "Just for the record: I don't have credentials to production systems, and I don't work with production data.". If that's really true, then that should be fine. We have freelancers who do certain things for us (eg, market research), and if they don't have access to production systems/data, it's very straightforward for us to classify them that way and exclude them from the various secure development controls. Though they may not fully understand the scope of "production systems", which could include things like Github repos which contain code that gets deployed to production (SOC2 auditors want to see that the whole development lifecycle is secure so a compromised developer laptop couldn't be used to push out a backdoor without leaving a very obvious trail).
spookthesunset 5y ago
> Because otherwise they would fail SOC2 and managing your legal status as "Freelancer" vs "Employee" (for tax reasons??) is not worth not being certified. It depends on the size of the company this person is working with. If it is large enough to be procuring Drata it means the people asking this dude to install the software is probably in a vastly different part of the company org structure as the teams our friend is working with. In addition, the "drata team" might not have yet considered their policy for contractors--in fact the "drata team" probably wouldn't even be the ones to draft a policy for that. It could be their legal teams who do that. The solution really depends on how much of a fuss the poster wants to make of it. Personally I would be working with my clients inside that org to figure out a way to make their IT & legal department happy. If the poster has a good open relationship with their client, they'll find some solution. Perhaps the client loans the poster a dev workstation or something (which I'm sure can be structured in a way that doesn't fail the "contractor vs employee" tests).
mindslight 5y ago
> Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my understanding of their business model. It honestly sounds like bullshit to me! But if you have evidence that they do this, please let us know. Unless their agent is Free Software, the reasonable end-user assumption is that they are doing malicious things. As we've seen time and time again, it's inevitable - either now, or in the future, they will come up with some bright idea for more features that involve being directly user-hostile. Your company may rely on their legal contract assurances, but I as an individual cannot. My minimum policy for running sketchy binary blobs is in a VM on another machine. If you're adopting this type of software, it's incumbent upon you to make your corporate policy one of supplying computing equipment for everyone who is expected to run it. And also accept that employees will physically damage microphones and webcams to stop your supplied machines from acting as surveillance bugs of their personal dwellings.
- tptacek 5y ago
  This is just a way of saying that every mid-to-large-sized company in the world is doing malicious things, because all of them depend on closed-source agent software of one kind or another. And you might be right about that! Certainly, the industry has not taken the threat of agent-based management tools seriously enough. But what the hell is your point? This is about as practical an argument as "the only reasonable software for your company to run is free software". Even if it were true, it's so far outside of industry norms that you might as well be asking them to ship all their products on BeOS.
  - mindslight 5y ago
    My comment was not about what is reasonable for companies to run. In fact, I implied that it is reasonable for companies to run proprietary agents, because they have contracts and legal remedy through the courts if the products turn out to be malicious spyware. My judgement is confined to what is reasonable for individuals to be asked to run in their own operating environments. Individuals lack recourse through the courts, barring some watershed law like a US GDPR with a provision for adequate liquidated damages. I also pointed out a straightforward path if a company still wants their contractors/employees to run unaccountable proprietary crapware on the devices used to do work - purchase dedicated devices for contractors/employees to use for work, rather than expecting to get exclusive software installed on shared equipment. Coupled with an appropriate home network set up, this provides complete compartmentalization, assuming any sensors can be disabled. (deliberate employee-hostile software, eg employee activity trackers, is out of the scope of this comment)
matheusmoreira 5y ago
> The Drata agent is a pretty innocuous thing. Can anyone even verify that? Is it open source? Last time I allowed one of these "agents" into my computer, I discovered it was running in kernel mode and intercepting every single network connection.
Gareth321 5y ago
>We do not share your personal information with third parties without your consent, except in the following circumstances or as described in this Privacy Policy: Affiliates. We may share your personal information with our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy. Service providers. We may share your personal information with third party companies and individuals that provide services on our behalf or help us operate the Service (such as customer support, hosting, analytics, email delivery, marketing, and database management services). These third parties may use your personal information only as directed or authorized by us and in a manner consistent with this Privacy Policy, and are prohibited from using or disclosing your information for any other purpose. Partners. We may sometimes share your personal information with partners or enable partners to collect information directly via our Service. Professional advisors. We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us. For compliance, fraud prevention and safety. We may share your personal information for the compliance, fraud prevention and safety purposes described above. Business transfers. We may sell, transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution. That is in their privacy policy (https://drata.com/privacy https://drata.com/privacy). They go into even more detail about the advertising they serve to you based on the information they collect. They suggest a drawn-out method to opt out of their advertising tracking. Honestly, this alone would rule out Drata for any similar project I was considering. How in the world is it acceptable for a security and compliance tool to gather and store personal data for the purposes of marketing?? With all due respect, how did you miss this???
- dalai 5y ago
  The first paragraph says that it is the privacy policy with respect to the website. Why do you think it covers the data collected by the agent?
  - neonnomad 5y ago
Hizonner 5y ago
You in fact have no idea how "innocuous" the Drata agent is. You know only what Drata tells you. It would be grossly irresponsible for a contractor to rely on one client's assurances about what a third party told them its software did, and expose other clients' data to errors or abuse by that third party. Or their own personal data, for that matter.
xtracto 5y ago
Right, I setup SOC2 compliance processes for a small startup, and we didn't have money to buy all those fancy automation programs. We managed ourselves with recurring JIRA tickets and screenshots taken by personnel. I think the only service we had to pay was for security awareness training, and it was a site that provided security awareness videos..
- tptacek 5y ago
  This is what a lot of companies do for SOC2. There's a cottage industry of consultants and product vendors selling companies on the idea that SOC2 is difficult and needs bespoke automation, but plenty of companies get by with just Jira. For that matter: you probably didn't need to spend money on security awareness videos.
  - xtracto 5y ago
    Ya, i bought knowbe4 because we also needed it for PCI compliance, and it made things easier for the IT/Sec team. But you are right. All those ceryification companies are a mafia.

ospzfmbbzr 5y ago

> Reply to parent Next client! This is potentially an indicator of a bad customer or management. My hardware = my software (not yours) end of discussion. Don't like it? Have fun finding someone better that will put up with your nonsense. Now if they provide a laptop with corp network access etc that is different. I'm a professional similar to yourself. 15 years as a consultant and freelancer.

lucraft 5y ago
I agree: a company asking developers to install security monitoring agents like this should also offer company laptops. Same with mobile phones, actually, for remote wipe profiles and location tracking and things. If they don't offer company hardware I don't think they can rightfully demand agents be installed. But if they do, and if you decline to use it then you have to accept agents on your own machine. Not sure what OPs situation is - but I'd think it very reasonable to go back and say "if you want to install this you have to provide me a laptop"

daneel_w 5y ago

> "The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". > Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my understanding of their business model. It honestly sounds like bullshit to me! But if you have evidence that they do this, please let us know." Do you have any evidence that they don't? If so, can you describe a few bits of your investigative process and how you reached the conclusion? For the sake of alleviating people's fears and to clear up the nonsense.

kenrose 5y ago
That’s not how burden of proof works. OP made a claim that Drata collects private employee info and resells it. That’s a large claim. It’s on OP to justify that position, not on the parent to rebut the opposite.
- CoastalCoder 5y ago
  IIUC, "Burden of proof" (as a concept) is meaningful in fora where there are agreed-upon standards of evidence. E.g., a courtroom or a formal debate. My impression is that HN conversations are less regulated. Someone can make a claim, and each reader can decide how much merit it deserves, and if/how to discuss it further.
- daneel_w 5y ago
  It is a large claim. I'd say there's a bit of burden on both sides as the parent called it out as nonsense. They're implying they know for a fact that it doesn't breach privacy/integrity.
- matheusmoreira 5y ago
  Burden of proof doesn't really matter. If this company wants people to trust its software "agents", they should be making every effort to convince them. Free software goes a long way.

illud_tempus 5y ago

> The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". Do you have any evidence for this?? I read their Privacy Policy. They are quite explicit about what they plan to do to you. I raised the issue with them in an email (among 5 other issues). Their reply is in the header. Another issue I raised is that they expect me to accept undisclosed terms and conditions. That said. I have worked with computer security at an advanced level, including consulting, training, penetration testing, design/implementation of x-platform server agents for monitoring and alerting, design/implementation of firewall. Once I designed an implemented a system to deal with NATO secrets (not very sensitive secrets, but still secrets) for a military subcontractor in EU. My computer is relatively secure. I follow best practices - and more. A hostile agent would decrease the security on my network. That was my first thought when I got that awful email. Also, I don't get it why that need such a thing on my PC. I don't have credentials to production systems or production data. I am a software developer. I work with code and documentation. That's it. Anything I produce is reviewed by other developers and then tested independently by QA. I am careful to be a freelancer, and not an employee, for several reasons. It means that legally I'm my own boss. That feels good (I have a great boss!) It also make it unproblematic to work on open source projects, without getting into discussions about who owns the intellectual rights to that work.

allo37 5y ago
Unfortunately, "I know a lot about security, trust me bro" doesn't satisfy the compliance box-tickers, for better or worse. Maybe run it inside a VM?
- deleted 5y ago
  [deleted]
lucraft 5y ago
> I read their Privacy Policy. They are quite explicit about what they plan to do to you. OK, well, I've skimmed it and I can't see anything that suggests they are going to spy on our employees and sell the data to advertisers. I hate to drop it back on you but which passages make you think they do that? These things do often sound terrifying because things like "I'm going to use Google Analytics to see which parts of the product people aren't using so we can email them reminders" get turned into passages like "We will upload all your activity to a third-party advertising company for marketing purposes". > I have worked with computer security at an advanced level ... A hostile agent would decrease the security on my network. That was my first thought when I got that awful email. I believe you! 100%! But you are unusual, and without verification a control such as "All laptops should have screens that lock after 5 minutes" won't be followed by everyone. NOT EVEN CLOSE to everyone. > Also, I don't get it why that need such a thing on my PC. I don't have credentials to production systems or production data. I am a software developer. I work with code and documentation. That's it. Sure. Another commenter in the thread has said that because of that this isn't strictly required for SOC2. I'm sure they're right.. but I'm not sure I want anyone working on our codebase at all who doesn't have basic security settings set on on their laptop (Again, I know YOU do :) ) Back to the using your own computer thing again - this is why I think lots of companies say "You use our hardware for all company work but IF you really really want to do BYOD then you have to accept some of these agents". Not sure if that's the attitude at your firm, but that seems reasonable.

too_pricey 5y ago

You're completely right re Drata as a company (we use a different compliance vendor, but very similar setup re the agent). You're a bit off on whether this would fail a SOC2 audit, thankfully. As the OP said, they don't have access to production systems, which basically means you can treat that employee however you want from a SOC2 (and ISO, and most other control framework perspectives). The company OP is working for can state "We do not require these controls on contractors without production access" and that is totally fine for SOC2. Pushing back on the agent requirement is totally reasonable!

lucraft 5y ago
Do you think? I wasn't sure because although he doesn't have access to production systems a lot of controls are around access to the code, e.g. Github. But quite possibly you are right.
- Vendan 5y ago
  I've been through SOC2 (sat in with auditors and walked them through pretty much all of our stuff around source code and testing and building things). SOC2 is very much a "do you have policies for x, y and z" and "are you actually implementing those policies", with a VERY HEAVY emphasis on "are you doing what you say you'll do". There's nothing that says "You must monitor any place your source code could exist", but there's plenty that says "You must have a policy for change management" and stuff like. And you'll get dinged hard if you have a policy that says "We monitor every device that has our source code on it" and then turn around and have contractors you don't monitor. That said, it's also completely trivial (on the auditor side) for them to say "Oh, we're changing this policy to 'We monitor devices with production access'". Good luck pushing for that to happen as a contractor, though...
  - tptacek 5y ago
    My understanding is that it's not completely trivial to make these kinds of policy changes once you get past your Type 1. This would be a nitpick except that it implies something important about how you should handle SOC2: don't be ambitious or expansive in your Type 1 audit, and leave yourself room to see what's going to work long term. This is something I've seen a lot of people mess up.

formerly_proven 5y ago

> Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. In other words, Drata is a CYAaaS. > The Drata agent is a pretty innocuous thing. It checks you have done things like turn on disk encryption, have updates enabled, and that the screen locks if you walk away. Guessing it is privileged and self-updating.

cure 5y ago
> Guessing it is privileged and self-updating. And closed source, of course. Must be totally free of bugs too, like all software.
- nyir 5y ago
  At least it's using some OSS, like osquery, c.f. <https://cdn.drata.com/agent/osquery/queries.json https://cdn.drata.com/agent/osquery/queries.json>, so you can easily see quite a bit of what it's going to gather.
  - neonnomad 5y ago
    It is based on osquery and we are happy to share any information including our third party security validation of the agent with prospects/customers. Source: I am the Drata CISO

joekrill 5y ago

The underlying problem is they are asking you to trust Drata implicitly, sight-unseen, and give them unfettered access to their laptop. There is nothing preventing Drata from changing their minds and altering how their agent works or what it collects. Then there's the unintentional aspect. There is, of course, no guarantee their agent is bug-free. Data leaks and compromises happen all the time, by every facet of company (large, small, respected, hated, etc). This is really a huge risk IMO. If anything, it's being downplayed and far from "nonsense".

lucraft 5y ago
Grown-up companies doing SOC2 usually provide developers with hardware, and in that case the company is installing an agent from a vendor they have selected, onto their own computers. True, the grey area is slightly odd situations like this where the protagonist is a freelancer rather than an employee and presumably also the company isn't willing to provide hardware to them in that case?? Because they're a freelancer? Sounds like a case that isn't going to survive too long in any company that's getting serious about compliance and risks.

kriro 5y ago

Maybe I'm very naive here but does SOC2 explicitly require monitoring? Can't a contractor simply sign a form that says all relevant rules are followed on their end and thus if that's not the case, the company is off the hook? If active monitoring is really required than the only solution I see is one device/customer and thus as a freelancer I'd have to request said device be provided by the customer.

lucraft 5y ago
SOC2 auditors require evidence for controls being followed - repeated evidence over a long period of time. What's evidence? I can't remember the exact details but imagine something like ... a screenshot of the security page of the Settings app on macOS, taken by every employee, on every laptop, once a week. Or install the Drata Agent on all company laptops. Perhaps a form would be enough evidence that you wouldn't have to repeatedly collect it... but I doubt it. Because otherwise couldn't ALL employees just sign a form and that would be that? Auditors know that people don't actually follow the rules carefully even if they claim they are going to.
hmahncke 5y ago
In principle, a company’s security policy could be to enforce security settings on employee computers with an agent like Drata, and contractually guarantee those same settings for contractors. The evidence during the audit would be the Drata report for employee computers and the signed contracts for the contractors.

thraxil 5y ago

I'm going to piggyback on your comment because it's one of the more reasonable and informed takes here. I'm currently in the middle of our company's first evaluation window for SOC2 Type 2. I'm not familiar with Drata, but at a surface-level, it sounds pretty similar to Vanta, who we use. OP says "The motivation is that my client badly want a SOC 2 certification", which sounds about right. If anyone isn't familiar with SOC2, it's generally not something that you start out wanting or caring about, but eventually you get some big potential customers and they tell your sales people that they can't sign the contract unless you can show them your SOC2 attestation. Then you scramble to figure out what it is and what you have to do to get it. Depending on how your business works, it's the kind of thing that can very quickly go from "we don't know what that is" to "the future of our company depends on this". If you're a small team without experience in the area, it's a total mess and hard to understand exactly what's required. Signing up with someone like Vanta or Drata to walk you through the process and provides a bunch of tools to tick boxes and get you through an audit with a minimal amount of manual work and ambiguity (though there will still be a lot of that). SOC2 tends to be very vague on actual technical controls and is more focused on the documentation of whatever controls you have set for yourself and gotten your auditor to agree are reasonable. You're going to have a very hard time getting most auditors to agree to something less strict than "devices that are used to access production systems or could otherwise touch sensitive data must have encrypted drives, be password protected, and kept up to date with security patches". If you have a traditional IT setup and provide hardware to all of your employees, you can probably generate some documentation showing how you enforce that policy. It's trickier in remote setups, BYOD environments, or with contractors/freelancers. Your two options are basically to have people install an agent like Dasta or Vanta's or to require them to upload screenshots of all the relevant settings on their devices somewhere on a regular basis (typically monthly), and then have an admin check them and sign off. That second approach isn't hard, but it tends to be very labour intensive and annoying as well as very easy for someone to forget and produce gaps/exceptions that then have to be explained to your auditor. In our case, we're a fully remote company and fully BYOD (you get a hardware stipend but we don't really have an IT department so we're not in a good position to manage peoples' devices for them; we do strongly encourage people to use separate devices for work and personal). We completely understand the reticence towards installing a 3rd party agent on their own machines, so we give our employees the option of using Vanta's agent or doing the monthly screenshot thing. Boy is the screenshot thing a pain in my butt and don't I wish everyone would just use the agent. In the future, it might push us to change our BYOD policy and instead supply managed devices (but I'm not crazy about that approach either for other reasons). One piece of feedback we've given Vanta at every opportunity (and I assume would apply to Dasta as well) is that we'd have a much easier time getting adoption of the agent among our developers if they'd make it open source so anyone with privacy concerns could audit it themselves. So far we haven't gotten any indications that they're moving in that direction. FWIW, reverse engineering and spying on the Vanta agent with eBPF and other tools to try to catch it doing something it shouldn't has become a bit of a side hobby of mine (it's mostly a wrapper around OSQuery and I've been able to log all the queries that it makes and not yet found anything nefarious, but absence of proof isn't proof of absence). IMO, it's completely reasonable for the OP, as a freelance contractor, to refuse to install an agent on their personal machine and instead provide screenshots/etc as evidence. They say "Just for the record: I don't have credentials to production systems, and I don't work with production data.". If that's really true, then that should be fine. We have freelancers who do certain things for us (eg, market research), and if they don't have access to production systems/data, it's very straightforward for us to classify them that way and exclude them from the various secure development controls. Though they may not fully understand the scope of "production systems", which could include things like Github repos which contain code that gets deployed to production (SOC2 auditors want to see that the whole development lifecycle is secure so a compromised developer laptop couldn't be used to push out a backdoor without leaving a very obvious trail).

spookthesunset 5y ago

> Because otherwise they would fail SOC2 and managing your legal status as "Freelancer" vs "Employee" (for tax reasons??) is not worth not being certified. It depends on the size of the company this person is working with. If it is large enough to be procuring Drata it means the people asking this dude to install the software is probably in a vastly different part of the company org structure as the teams our friend is working with. In addition, the "drata team" might not have yet considered their policy for contractors--in fact the "drata team" probably wouldn't even be the ones to draft a policy for that. It could be their legal teams who do that. The solution really depends on how much of a fuss the poster wants to make of it. Personally I would be working with my clients inside that org to figure out a way to make their IT & legal department happy. If the poster has a good open relationship with their client, they'll find some solution. Perhaps the client loans the poster a dev workstation or something (which I'm sure can be structured in a way that doesn't fail the "contractor vs employee" tests).

mindslight 5y ago

> Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my understanding of their business model. It honestly sounds like bullshit to me! But if you have evidence that they do this, please let us know. Unless their agent is Free Software, the reasonable end-user assumption is that they are doing malicious things. As we've seen time and time again, it's inevitable - either now, or in the future, they will come up with some bright idea for more features that involve being directly user-hostile. Your company may rely on their legal contract assurances, but I as an individual cannot. My minimum policy for running sketchy binary blobs is in a VM on another machine. If you're adopting this type of software, it's incumbent upon you to make your corporate policy one of supplying computing equipment for everyone who is expected to run it. And also accept that employees will physically damage microphones and webcams to stop your supplied machines from acting as surveillance bugs of their personal dwellings.

tptacek 5y ago
This is just a way of saying that every mid-to-large-sized company in the world is doing malicious things, because all of them depend on closed-source agent software of one kind or another. And you might be right about that! Certainly, the industry has not taken the threat of agent-based management tools seriously enough. But what the hell is your point? This is about as practical an argument as "the only reasonable software for your company to run is free software". Even if it were true, it's so far outside of industry norms that you might as well be asking them to ship all their products on BeOS.
- mindslight 5y ago
  My comment was not about what is reasonable for companies to run. In fact, I implied that it is reasonable for companies to run proprietary agents, because they have contracts and legal remedy through the courts if the products turn out to be malicious spyware. My judgement is confined to what is reasonable for individuals to be asked to run in their own operating environments. Individuals lack recourse through the courts, barring some watershed law like a US GDPR with a provision for adequate liquidated damages. I also pointed out a straightforward path if a company still wants their contractors/employees to run unaccountable proprietary crapware on the devices used to do work - purchase dedicated devices for contractors/employees to use for work, rather than expecting to get exclusive software installed on shared equipment. Coupled with an appropriate home network set up, this provides complete compartmentalization, assuming any sensors can be disabled. (deliberate employee-hostile software, eg employee activity trackers, is out of the scope of this comment)

matheusmoreira 5y ago

> The Drata agent is a pretty innocuous thing. Can anyone even verify that? Is it open source? Last time I allowed one of these "agents" into my computer, I discovered it was running in kernel mode and intercepting every single network connection.

Gareth321 5y ago

>We do not share your personal information with third parties without your consent, except in the following circumstances or as described in this Privacy Policy: Affiliates. We may share your personal information with our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy. Service providers. We may share your personal information with third party companies and individuals that provide services on our behalf or help us operate the Service (such as customer support, hosting, analytics, email delivery, marketing, and database management services). These third parties may use your personal information only as directed or authorized by us and in a manner consistent with this Privacy Policy, and are prohibited from using or disclosing your information for any other purpose. Partners. We may sometimes share your personal information with partners or enable partners to collect information directly via our Service. Professional advisors. We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us. For compliance, fraud prevention and safety. We may share your personal information for the compliance, fraud prevention and safety purposes described above. Business transfers. We may sell, transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution. That is in their privacy policy (https://drata.com/privacy https://drata.com/privacy). They go into even more detail about the advertising they serve to you based on the information they collect. They suggest a drawn-out method to opt out of their advertising tracking. Honestly, this alone would rule out Drata for any similar project I was considering. How in the world is it acceptable for a security and compliance tool to gather and store personal data for the purposes of marketing?? With all due respect, how did you miss this???

dalai 5y ago
The first paragraph says that it is the privacy policy with respect to the website. Why do you think it covers the data collected by the agent?
- neonnomad 5y ago

Hizonner 5y ago

You in fact have no idea how "innocuous" the Drata agent is. You know only what Drata tells you. It would be grossly irresponsible for a contractor to rely on one client's assurances about what a third party told them its software did, and expose other clients' data to errors or abuse by that third party. Or their own personal data, for that matter.

xtracto 5y ago

Right, I setup SOC2 compliance processes for a small startup, and we didn't have money to buy all those fancy automation programs. We managed ourselves with recurring JIRA tickets and screenshots taken by personnel. I think the only service we had to pay was for security awareness training, and it was a site that provided security awareness videos..

tptacek 5y ago
This is what a lot of companies do for SOC2. There's a cottage industry of consultants and product vendors selling companies on the idea that SOC2 is difficult and needs bespoke automation, but plenty of companies get by with just Jira. For that matter: you probably didn't need to spend money on security awareness videos.
- xtracto 5y ago
  Ya, i bought knowbe4 because we also needed it for PCI compliance, and it made things easier for the IT/Sec team. But you are right. All those ceryification companies are a mafia.