5 ms·

Personal ancecdote: Our backend was exposed using a cloudflare tunnel (we call cloudflare, they expose it with security scanning, etc.) Auditor wants to see fi

Personal ancecdote: Our backend was exposed using a cloudflare tunnel (we call cloudflare, they expose it with security scanning, etc.) Auditor wants to see firewall rules on our IP addresses, except we don't have IP addresses, we were small enough that the default Azure general shared outbound network worked. (Think CGNAT). No amount of explaining this would check the box. Solution: add a public IP to our prod env, unassigned to anything, with firewall rules. Audit passed.

bombcar 3y ago
This kind of compliance happens time and time again all throughout any regulated industry.
exabrial 3y ago
Facing a similar issue once, I gave them cloudflare’s ips and that seemed sufficient.
- ocdtrekkie 3y ago
  Other side of the problem: I've seen a vendor which moved their infrastructure to Cloudflare ask us to whitelist Cloudflare's entire set of IPs on our security platform. They were politely told no. (Telling people no politely is a significant portion of IT operations, as it happens.)
sgtnoodle 3y ago
Couldn't you just give them an empty rule set? Like, make it a nice official looking report. I had to certify a low speed vehicle using a government test procedure. It called for all test equipment to be calibrated within the last year. I had built some of the equipment myself specifically for the test, though. I measured the relevant performance characteristics in a thermal chamber (oscillator drift was the only possible source of error), documented it on a piece of paper to stick in the office filing cabinet, and printed some "Calibrated on xx/xx/xxxx" stickers.
- dharmab 3y ago
  A purely hypothetical and fictional story: A programmer once complied with a requirement to produce a firewall policy by creating an allowlist policy that was effectively, 0.0.0.0/0 but with addresses such as the following removed: - 100.64.0.0/10 - 192.0.0.0/24 - 192.88.99.0/24 - 192.0.2.0/24 - 198.51.100.0/24 - 203.0.113.0/24 - 233.252.0.0/24 The significance of these networks is left as a punchline for the reader.
  - autoexecdotbat 3y ago
    https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml https://www.iana.org/assignments/iana-ipv4-special-registry/... What is 233.252.0 0/24 reserved for? I don't immediately recognize it and didn't see it on the iana special registry.
    - anotherhue 3y ago
      https://chat.openai.com/share/7f51c5f6-5193-4f7a-9c4b-7c44647cc095 https://chat.openai.com/share/7f51c5f6-5193-4f7a-9c4b-7c4464...
      - dharmab 3y ago
        GPT is wrong here - or at least, doesn't provide the complete picture
    - dharmab 3y ago
      https://datatracker.ietf.org/doc/html/rfc5771#section-9.2 https://datatracker.ietf.org/doc/html/rfc5771#section-9.2 > The first /24 in this range, 233.252.0.0/24, is assigned as "MCAST- TEST-NET" for use in documentation and example code. 233.252.0.0/24 SHOULD be used in conjunction with the [RFC2606] domain names example.com or example.net in vendor and protocol documentation. Addresses within 233.252.0.0/24 MUST NOT appear on the public Internet.
      - 3y ago
sgtnoodle 3y ago
Another one. We once had to get a solar car inspected by the state for registration. They needed to hook up a tube to the exhaust for an emissions test. We just pointed them to the battery's cooling exhaust. Another solar car, a police officer just came out to inspect it like a "kit car". He asked, "It has 4 wheels, right?" And we were like, "yeah for sure, if you count the steering wheel." And he went ahead and checked the box.
dharmab 3y ago
At a large tech company, we were planning to offer a certain service to the US government. In order to comply with FedRAMP, we added some extra proxies to the infrastructure running the Gov workloads so that they would have the dedicated IP addresses required for compliance.
jiggawatts 3y ago
My favourite is the nineteen meetings it took to convince a security team to approve the use of unencrypted HTTP for the certificate revocation list endpoint. No amount of RFC references, live demos of “see, www.google.com does it with HTTP also” would tick the checkbox. “We have a security standard, sir.” over and over, for months.

bombcar 3y ago

This kind of compliance happens time and time again all throughout any regulated industry.

exabrial 3y ago

Facing a similar issue once, I gave them cloudflare’s ips and that seemed sufficient.

ocdtrekkie 3y ago
Other side of the problem: I've seen a vendor which moved their infrastructure to Cloudflare ask us to whitelist Cloudflare's entire set of IPs on our security platform. They were politely told no. (Telling people no politely is a significant portion of IT operations, as it happens.)

sgtnoodle 3y ago

Couldn't you just give them an empty rule set? Like, make it a nice official looking report. I had to certify a low speed vehicle using a government test procedure. It called for all test equipment to be calibrated within the last year. I had built some of the equipment myself specifically for the test, though. I measured the relevant performance characteristics in a thermal chamber (oscillator drift was the only possible source of error), documented it on a piece of paper to stick in the office filing cabinet, and printed some "Calibrated on xx/xx/xxxx" stickers.

dharmab 3y ago
A purely hypothetical and fictional story: A programmer once complied with a requirement to produce a firewall policy by creating an allowlist policy that was effectively, 0.0.0.0/0 but with addresses such as the following removed: - 100.64.0.0/10 - 192.0.0.0/24 - 192.88.99.0/24 - 192.0.2.0/24 - 198.51.100.0/24 - 203.0.113.0/24 - 233.252.0.0/24 The significance of these networks is left as a punchline for the reader.
- autoexecdotbat 3y ago
  https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml https://www.iana.org/assignments/iana-ipv4-special-registry/... What is 233.252.0 0/24 reserved for? I don't immediately recognize it and didn't see it on the iana special registry.
  - anotherhue 3y ago
    https://chat.openai.com/share/7f51c5f6-5193-4f7a-9c4b-7c44647cc095 https://chat.openai.com/share/7f51c5f6-5193-4f7a-9c4b-7c4464...
    - dharmab 3y ago
      GPT is wrong here - or at least, doesn't provide the complete picture
  - dharmab 3y ago
    https://datatracker.ietf.org/doc/html/rfc5771#section-9.2 https://datatracker.ietf.org/doc/html/rfc5771#section-9.2 > The first /24 in this range, 233.252.0.0/24, is assigned as "MCAST- TEST-NET" for use in documentation and example code. 233.252.0.0/24 SHOULD be used in conjunction with the [RFC2606] domain names example.com or example.net in vendor and protocol documentation. Addresses within 233.252.0.0/24 MUST NOT appear on the public Internet.
    - 3y ago

sgtnoodle 3y ago

Another one. We once had to get a solar car inspected by the state for registration. They needed to hook up a tube to the exhaust for an emissions test. We just pointed them to the battery's cooling exhaust. Another solar car, a police officer just came out to inspect it like a "kit car". He asked, "It has 4 wheels, right?" And we were like, "yeah for sure, if you count the steering wheel." And he went ahead and checked the box.

dharmab 3y ago

At a large tech company, we were planning to offer a certain service to the US government. In order to comply with FedRAMP, we added some extra proxies to the infrastructure running the Gov workloads so that they would have the dedicated IP addresses required for compliance.

jiggawatts 3y ago

My favourite is the nineteen meetings it took to convince a security team to approve the use of unencrypted HTTP for the certificate revocation list endpoint. No amount of RFC references, live demos of “see, www.google.com does it with HTTP also” would tick the checkbox. “We have a security standard, sir.” over and over, for months.