4 ms·

Someone in a SOC2 meeting started making a fuss about us needing virus scanners on our Amazon Linux EC2 instances. I don’t think that got very far but… Just… St

• kstrauser 3y ago
  That’s absolutely a thing. It’s usually under the broader category of anti-malware. Why is the web server suddenly mining bitcoin? Edit: Source: have been through a few SOC 2 audits, enough to understand why they ask for most of the things in there. My personal thoughts on the matter aside, modern audits spend a lot more time on other malware than viruses.
  • doubled112 3y ago
    AWS will send you an alert because your machine is behaving unusually. No need for local protection! /s sort of
    • kstrauser 3y ago
      Seriously, that’s a legit plan. If you use GuardDuty, you can have it trigger EBS volume scans to look for malware if it sees strange behavior. I spun up an EC2 instance and ran an nmap port scan on another server and a bitcoin daemon. It caught both of those, triggered scans, and reported its findings. I’m heading down that road instead of running a traditional on-OS process.
      • doubled112 3y ago
        Yes, exactly, and you skip an agent. The agents take more resources than the services on some of my machines, which is lunacy if you ask me, but we have to check those audit boxes and the security team isn’t very capable…err…creative.
        • kstrauser 3y ago
          I was a platform engineer before I was officially a security engineer. I’m very protective of our happy little servers and try to find ways to avoid installing awfulness on them.
  • ckdarby 3y ago
    Thought the way you presented your source is a bit odd. For SOC2 you write the controls & policies. The audit is backwards looking to confirm you're adhering to what your company has said is policy.
    • kstrauser 3y ago
      Sure, but they also want to see that those policies you wrote and conform to meet a whole lot of bullet points.
• gonzo41 3y ago
  I have seen this done. It was funny to watch from afar.