3 ms·

May I suggest something like "Enterprise Environment Integrity". How does the public know that the enterprise (i.e. google) it's dealing with is healthy? The p

May I suggest something like "Enterprise Environment Integrity". How does the public know that the enterprise (i.e. google) it's dealing with is healthy? The public should have an entity that will receive detailed attestation data to assess that. Failing the attestation will revoke business permit along with an announcement.

jacquesm 3y ago
> How does the public know that the enterprise (i.e. google) it's dealing with is healthy? Because they will pinky promise. I find it funny that for some reason companies get the benefit of the doubt when it comes to dealing with data in a responsible matter. Yes, it's possible that they do. But it is also possible that they don't and no matter what they say in public that's just words, it doesn't prove anything about what is really going on and that's before we get to honest mistakes. There is simply no way to be sure, all you know is that once you transmit data to any other host on the internet that it is quite literally out of your hands whether or not that data will one day show up elsewhere.
- mschuster91 3y ago
  > Because they will pinky promise. It goes a bit deeper than that. Many companies these days "choose" to get certified under a variety of standards (the most common one is ISO 27001), everyone who hasn't been completely ignorant is looking for or already got cybersecurity insurance and on top of that comes the entire GDPR saga. Basically, you got three levels of auditors that at least make sure the basics are covered, and on top of that come industry specific requirements such as TISAX [1], US SOX Act compliance or whatever AWS had to go through for GovCloud. [1] https://en.wikipedia.org/wiki/Trusted_Information_Security_Assessment_Exchange https://en.wikipedia.org/wiki/Trusted_Information_Security_A...
  - jacquesm 3y ago
    I'm well aware of those audits and the typical auditor output. Where to start... These audits check paper. They don't check what is actually going on, they will check that documentation is in place and that processes and various controls are in place and that periodic checks have been performed. They don't actually check any of the underlying tech. For instance: ISO27001 asks for 'regular pentests'. But it doesn't do anything to ensure that those pentests are of a good quality. There are plenty of 'check the box' automated pentest services that get you past that hurdle but that won't do much for your security. They might even give you a false sense of security. So yes, there are all kinds of audits. But like with everything else the devil is in the details and the quality of the work is very important (obviously!). Many companies treat these certifications like a 'license to operate'. You need to have them so then you do the absolute minimum required to satisfy the auditors rather than to see the certificate as a minimum level of proof required that you have your house in order and that your intent is to deal responsible with your data subjects (and customers) data. The latter is extremely rare.
    - mschuster91 3y ago
      Yeah, ISO 27001 is paper pushing, but TISAX audits can be pretty painful and detailed (I've been tangentially involved in one, but can't say more). I think insurances are the player to watch the most - they have actual leverage on their customers and really really want to avoid having to pay out for claims, so their demands start to get more and more intrusive, to the point where they can and do collide with stuff like employment laws (e.g. monitor all employee communications through a mandatory proxy service, even if the device is not on-prem).
      - jacquesm 3y ago
        So do TISAX auditors actually go into systems and check stuff or do they talk to people and look at documents?
        mschuster91 3y ago
        Not sure if I can answer that without violating some NDAs, but I think it's safe to say that it's actually worth being called an audit.
        jacquesm 3y ago
        Ok, I will do some reading then, thank you and no worries, I understand about the NDA but this being generic information I was hoping you could answer it. But I totally get that you would not take any risk with that.
charcircuit 3y ago
It doesn't matter to the public. Each site chooses what attestors it trusts and the site can keep track of how useful that signal is. If the signal turns out to be useless the site doesn't have to use it for anything or can stop collecting it.

jacquesm 3y ago

> How does the public know that the enterprise (i.e. google) it's dealing with is healthy? Because they will pinky promise. I find it funny that for some reason companies get the benefit of the doubt when it comes to dealing with data in a responsible matter. Yes, it's possible that they do. But it is also possible that they don't and no matter what they say in public that's just words, it doesn't prove anything about what is really going on and that's before we get to honest mistakes. There is simply no way to be sure, all you know is that once you transmit data to any other host on the internet that it is quite literally out of your hands whether or not that data will one day show up elsewhere.

mschuster91 3y ago
> Because they will pinky promise. It goes a bit deeper than that. Many companies these days "choose" to get certified under a variety of standards (the most common one is ISO 27001), everyone who hasn't been completely ignorant is looking for or already got cybersecurity insurance and on top of that comes the entire GDPR saga. Basically, you got three levels of auditors that at least make sure the basics are covered, and on top of that come industry specific requirements such as TISAX [1], US SOX Act compliance or whatever AWS had to go through for GovCloud. [1] https://en.wikipedia.org/wiki/Trusted_Information_Security_Assessment_Exchange https://en.wikipedia.org/wiki/Trusted_Information_Security_A...
- jacquesm 3y ago
  I'm well aware of those audits and the typical auditor output. Where to start... These audits check paper. They don't check what is actually going on, they will check that documentation is in place and that processes and various controls are in place and that periodic checks have been performed. They don't actually check any of the underlying tech. For instance: ISO27001 asks for 'regular pentests'. But it doesn't do anything to ensure that those pentests are of a good quality. There are plenty of 'check the box' automated pentest services that get you past that hurdle but that won't do much for your security. They might even give you a false sense of security. So yes, there are all kinds of audits. But like with everything else the devil is in the details and the quality of the work is very important (obviously!). Many companies treat these certifications like a 'license to operate'. You need to have them so then you do the absolute minimum required to satisfy the auditors rather than to see the certificate as a minimum level of proof required that you have your house in order and that your intent is to deal responsible with your data subjects (and customers) data. The latter is extremely rare.
  - mschuster91 3y ago
    Yeah, ISO 27001 is paper pushing, but TISAX audits can be pretty painful and detailed (I've been tangentially involved in one, but can't say more). I think insurances are the player to watch the most - they have actual leverage on their customers and really really want to avoid having to pay out for claims, so their demands start to get more and more intrusive, to the point where they can and do collide with stuff like employment laws (e.g. monitor all employee communications through a mandatory proxy service, even if the device is not on-prem).
    - jacquesm 3y ago
      So do TISAX auditors actually go into systems and check stuff or do they talk to people and look at documents?
      - mschuster91 3y ago
        Not sure if I can answer that without violating some NDAs, but I think it's safe to say that it's actually worth being called an audit.
        jacquesm 3y ago
        Ok, I will do some reading then, thank you and no worries, I understand about the NDA but this being generic information I was hoping you could answer it. But I totally get that you would not take any risk with that.

charcircuit 3y ago

It doesn't matter to the public. Each site chooses what attestors it trusts and the site can keep track of how useful that signal is. If the signal turns out to be useless the site doesn't have to use it for anything or can stop collecting it.