3 ms·

I'd also prefer to see these standards go away. I haven't seen any proof they are providing meaningful security at any company I've been at and several of them

I'd also prefer to see these standards go away. I haven't seen any proof they are providing meaningful security at any company I've been at and several of them have had massive hacks despite being SOC2 on paper. They also eat up InfoSec time instead of being productive on meaningful stuff like "Hey, are patching everything?" Most of these compliance just seem like barber licenses. A way for existing entities entrench themselves.

jacobr1 2y ago
Vanta/Drata and other are starting to build solutions that are somewhere in-between checkbox compliance and real security. To the extent they integrate with your cloud providers and security tools, they can validate you have secure settings, active monitoring, and have remediated the things that have been flagged in a timely manner. Doesn't mean you are secure, but does ensure some baseline tablestakes.
- neilv 2y ago
  > To the extent they integrate with your cloud providers and security tools, What happens when Vanta/Drata are compromised? A mass-exploit of their customers?
  - jacobr1 2y ago
    They are goldmine of enumerated attack surface. But it would likely require some kind of secondary exploit of the identified vulns. The API connections are generally scoped to read-only access of security settings. Though it wouldn't surprise me if there was some way to get lateral movement from the access these tools have to monitor an environment.
    - stackskipton 2y ago
      At $LastCompany, someone gave them Contributor (Create/Read/Update/Delete) access to Azure because it was easier than scoping to 5 roles they required. I wouldn't be shocked if we were not only ones. Edit: Their software should really check and refuse to work if someone does that but obviously Vanta doesn't care. They can begin scanning and billing.
      - bandrami 2y ago
        It's what's annoying about NIST and DFARS: you can be fully compliant despite having made stupid decisions as long as you have documented that you are in fact making this stupid decision.
      - christinac 2y ago
        Vanta cofounder/CEO here. Thanks for the feedback. What we should probably do is take the credential, start scanning, and then nag them with a failing test about overly-permissive roles. Our own role is an easy check because we know what to expect, but there's other best practices here we can check for (and in some cases do, though not 100% comprehensively across all clouds.)
        stackskipton 2y ago
        Glad one of many things is getting fixed.
nurple 2y ago
Here here. The only thing SOC2 has done in my opinion is to create a multibillion dollar business that mainly just drains resources from companies that may not have them, with no guarantees you're actually secure. This usually devolves into security theatre where the CISO and underlings are putting in tools that drown teams with so much noise it's hard to detect the signal. The people running these programs rarely understand the security space well enough to even tell you what a lot of the hits even mean, which ramps up disdain and division between the groups. This is arguably more detrimental to security as the scanners give execs/management a false sense of security while the noise makes it incredibly difficult to run a holistic security strategy.
- sillysaurusx 2y ago
  (It’s "hear hear," since you want people to hear it. Honestly I have no idea whether to say something or not. But I’d want to know, so, just in case it’s helpful.)
  - nurple 2y ago
    Crap, I always get that wrong. Thanks for the reminder! ETA: like I told my kids, if we don't police each other, the LLMs will never learn. ;)
- Alexsky2 2y ago
  I agree that regulatory compliance and industries around that can often be theater and it creates regulatory barriers that inhibit startups and competition generally but there must be some method of oversight to ensure that people can trust a system or company without needing to see the internals. For example, we trust our food is healthy because the firm that made it is authorized to do so by the FDA as they comply with the rules established by those regulators. Obviously there are flaws, loopholes, etc, and obviously software is different than health but to an extent we want some guarantees from an externally trusted actor. What is needed in the current SOC2 world that might solve some of the issues you outlined without getting rid of it, or the idea of it, entirely?
  - 2y ago
badgersnake 2y ago
SOC2 is akin to a protection racket.

jacobr1 2y ago

Vanta/Drata and other are starting to build solutions that are somewhere in-between checkbox compliance and real security. To the extent they integrate with your cloud providers and security tools, they can validate you have secure settings, active monitoring, and have remediated the things that have been flagged in a timely manner. Doesn't mean you are secure, but does ensure some baseline tablestakes.

neilv 2y ago
> To the extent they integrate with your cloud providers and security tools, What happens when Vanta/Drata are compromised? A mass-exploit of their customers?
- jacobr1 2y ago
  They are goldmine of enumerated attack surface. But it would likely require some kind of secondary exploit of the identified vulns. The API connections are generally scoped to read-only access of security settings. Though it wouldn't surprise me if there was some way to get lateral movement from the access these tools have to monitor an environment.
  - stackskipton 2y ago
    At $LastCompany, someone gave them Contributor (Create/Read/Update/Delete) access to Azure because it was easier than scoping to 5 roles they required. I wouldn't be shocked if we were not only ones. Edit: Their software should really check and refuse to work if someone does that but obviously Vanta doesn't care. They can begin scanning and billing.
    - bandrami 2y ago
      It's what's annoying about NIST and DFARS: you can be fully compliant despite having made stupid decisions as long as you have documented that you are in fact making this stupid decision.
    - christinac 2y ago
      Vanta cofounder/CEO here. Thanks for the feedback. What we should probably do is take the credential, start scanning, and then nag them with a failing test about overly-permissive roles. Our own role is an easy check because we know what to expect, but there's other best practices here we can check for (and in some cases do, though not 100% comprehensively across all clouds.)
      - stackskipton 2y ago
        Glad one of many things is getting fixed.

nurple 2y ago

Here here. The only thing SOC2 has done in my opinion is to create a multibillion dollar business that mainly just drains resources from companies that may not have them, with no guarantees you're actually secure. This usually devolves into security theatre where the CISO and underlings are putting in tools that drown teams with so much noise it's hard to detect the signal. The people running these programs rarely understand the security space well enough to even tell you what a lot of the hits even mean, which ramps up disdain and division between the groups. This is arguably more detrimental to security as the scanners give execs/management a false sense of security while the noise makes it incredibly difficult to run a holistic security strategy.

sillysaurusx 2y ago
(It’s "hear hear," since you want people to hear it. Honestly I have no idea whether to say something or not. But I’d want to know, so, just in case it’s helpful.)
- nurple 2y ago
  Crap, I always get that wrong. Thanks for the reminder! ETA: like I told my kids, if we don't police each other, the LLMs will never learn. ;)
Alexsky2 2y ago
I agree that regulatory compliance and industries around that can often be theater and it creates regulatory barriers that inhibit startups and competition generally but there must be some method of oversight to ensure that people can trust a system or company without needing to see the internals. For example, we trust our food is healthy because the firm that made it is authorized to do so by the FDA as they comply with the rules established by those regulators. Obviously there are flaws, loopholes, etc, and obviously software is different than health but to an extent we want some guarantees from an externally trusted actor. What is needed in the current SOC2 world that might solve some of the issues you outlined without getting rid of it, or the idea of it, entirely?
- 2y ago

badgersnake 2y ago

SOC2 is akin to a protection racket.