4 ms·

Vanta/Drata and other are starting to build solutions that are somewhere in-between checkbox compliance and real security. To the extent they integrate with you

Vanta/Drata and other are starting to build solutions that are somewhere in-between checkbox compliance and real security. To the extent they integrate with your cloud providers and security tools, they can validate you have secure settings, active monitoring, and have remediated the things that have been flagged in a timely manner. Doesn't mean you are secure, but does ensure some baseline tablestakes.

neilv 2y ago
> To the extent they integrate with your cloud providers and security tools, What happens when Vanta/Drata are compromised? A mass-exploit of their customers?
- jacobr1 2y ago
  They are goldmine of enumerated attack surface. But it would likely require some kind of secondary exploit of the identified vulns. The API connections are generally scoped to read-only access of security settings. Though it wouldn't surprise me if there was some way to get lateral movement from the access these tools have to monitor an environment.
  - stackskipton 2y ago
    At $LastCompany, someone gave them Contributor (Create/Read/Update/Delete) access to Azure because it was easier than scoping to 5 roles they required. I wouldn't be shocked if we were not only ones. Edit: Their software should really check and refuse to work if someone does that but obviously Vanta doesn't care. They can begin scanning and billing.
    - bandrami 2y ago
      It's what's annoying about NIST and DFARS: you can be fully compliant despite having made stupid decisions as long as you have documented that you are in fact making this stupid decision.
    - christinac 2y ago
      Vanta cofounder/CEO here. Thanks for the feedback. What we should probably do is take the credential, start scanning, and then nag them with a failing test about overly-permissive roles. Our own role is an easy check because we know what to expect, but there's other best practices here we can check for (and in some cases do, though not 100% comprehensively across all clouds.)
      - stackskipton 2y ago
        Glad one of many things is getting fixed.

neilv 2y ago

> To the extent they integrate with your cloud providers and security tools, What happens when Vanta/Drata are compromised? A mass-exploit of their customers?

jacobr1 2y ago
They are goldmine of enumerated attack surface. But it would likely require some kind of secondary exploit of the identified vulns. The API connections are generally scoped to read-only access of security settings. Though it wouldn't surprise me if there was some way to get lateral movement from the access these tools have to monitor an environment.
- stackskipton 2y ago
  At $LastCompany, someone gave them Contributor (Create/Read/Update/Delete) access to Azure because it was easier than scoping to 5 roles they required. I wouldn't be shocked if we were not only ones. Edit: Their software should really check and refuse to work if someone does that but obviously Vanta doesn't care. They can begin scanning and billing.
  - bandrami 2y ago
    It's what's annoying about NIST and DFARS: you can be fully compliant despite having made stupid decisions as long as you have documented that you are in fact making this stupid decision.
  - christinac 2y ago
    Vanta cofounder/CEO here. Thanks for the feedback. What we should probably do is take the credential, start scanning, and then nag them with a failing test about overly-permissive roles. Our own role is an easy check because we know what to expect, but there's other best practices here we can check for (and in some cases do, though not 100% comprehensively across all clouds.)
    - stackskipton 2y ago
      Glad one of many things is getting fixed.