4 ms·
As is the case with SOC2, the "vulnerability scan" requirement here is likely to be meaningless; any automated process that can plausibly be described as instru
by tptacek 6mo ago
As is the case with SOC2, the "vulnerability scan" requirement here is likely to be meaningless; any automated process that can plausibly be described as instrumental in finding some kind of vulnerability is a "vulnerability scan", so all you have to do is run nmap.
- dgellow 6mo agoIf it is like SOC2 I would expect respected auditors to reject that
- morpheuskafka 6mo agoBut there are no auditors required for HIPAA. Only the government (HHS OCR) itself can enforce the standards.
- dgellow 6mo agoThanks for the clarification, in that case the text is indeed really weak. Does that system work in practice, or are companies just claiming they are HIPAA compliant with close to no actual auditing mechanism?
- tptacek 6mo agoYou get that the technical controls in SOC2 are also extremely weak, right?
- dgellow 6mo agoSure, yes. The way I understand SOC2 relies on the auditors to set the effective standard. So it really depends who audited you
- tptacek 6mo agoSOC2 auditors are accountants. A SOC2 auditor verifies only that you're doing what you say what you're doing.
- dgellow 6mo agoObviously, yes
- akerl_ 6mo agoA SOC auditor who tells you that you can’t use an nmap scan to meet SOC2 obligations is a bad SOC auditor, because they’re attempting to enforce a constraint on you that SOC2 does not. But the far more likely thing is that a medium SOC auditor, upon being told “we do our vulnerability scanning with nmap”, would say “I haven’t heard of nmap. You should use Tenable,” and if you’re letting SOC auditor drive your engineering you’d make a mistake and accidentally think that meant you needed to change your answer for SOC2 and go buy Tenable licenses.
- dgellow 6mo agoThe whole thread drifted way too far from a very mild push back I had regarding the claim « any automated process that can plausibly be described as instrumental in finding some kind of vulnerability is a "vulnerability scan" ». My experience is that no, SOC2 auditors won’t consider literally any automated process of that sort as compliant. Which in no way implies the auditors are forcing you to use a licensed tool or driving your engineering. I will stop that thread here, I don’t think that exchange is productive
- kevin_nisbet 6mo agoAnd the way they verify you are doing what you say you are doing is by asking you to provide evidence, which is usually pretty easy to demonstrate that a policy was followed once or twice, a lot harder for them to pick up consistency issues or exceptions.
- giaour 5mo agoIt's been a few years since I worked in this space, but HIPAA doesn't really work under the same kind of legal framework. Oversimplifying here, but basically HIPAA defines what constitutes personal health information, how such information may be used, and establishes monetary penalties for improper use and unauthorized disclosure. The law doesn't have any certification standard, no more than the prohibition on stealing cars does. Maybe there's some kind of third party certification system to support signing information sharing agreements ("BAAs") with other health information systems. I worked at CMS on first-party stuff so I'm not really familiar with how it works in the private sector.
- tptacek 6mo agoNo? Like, wildly no? This is a big part of why you pay for the most respected auditors.
- dgellow 6mo agoI guess we had different experiences. The ones I interacted with were ok and wouldn’t have accepted a simple nmap here
- tptacek 6mo agoI'm not being snarky when I say that not getting your automated vulnerability scan, whatever it might have been, past your SOC2 auditors is a skills issue. SOC2 audits are not technical and the vulnerability scan control in SOC2 is categorically not meaningful. Cloudflare wrote a whole post about this.
- dgellow 6mo agoFWIW I agree that SOC2 for automated vulnerability scans has a really low bar and isn’t too meaningful. At no point did I defend SOC2 here. The bar I’ve seen is above “just an nmap”, which is pretty bad standard IMHO. You seem to be reading way too much in my comments
- tptacek 6mo agoI brought up nmap. You said you'd expect respected SOC2 auditors to reject it. I don't just think that's not true, I know it not to be true.
- dgellow 6mo agoI know, that’s already established. I already acknowledged we had different experiences. I have no idea what you’re pushing for at that point
- 6mo ago
- john_strinlai 6mo agothey have comment/request for information sessions for HIPAA rule proposals, which your input would be valued.
- tptacek 6mo agoI don't think the rule would be better with more detailed vulnerability scanning requirements! All these things inexorably become races to the bottom.
- sonofhans 5mo agoYes, exactly, the rules are intentionally broad and vague. You can wave paper at most of them and technically succeed. And then when you release accidentally PHI for the first time and your bullshit comes to light, your chickens will come home to roost. Doing a good job on compliance is less about security and more about staying out of jail.
- akerl_ 5mo agoThe ideal flow here is: 1. Do good security and operations. 2. Overlap the minimum subset of your existing good security and operations as evidence for whatever compliance regimes help you get paid. 3. Get paid. Nobody is suggesting that you bullshit the auditors. They’re suggesting not letting the auditors accidentally trick you into letting step 2 get in front of step 1.
- jasonlotito 6mo ago> so all you have to do is run nmap. This is ignorance at best. No one who has ever actually had to do SOC2 compliance legitimately has just run nmap and been done with that.
- john_strinlai 6mo ago>No one who has ever actually had to do SOC2 compliance while i find tptacek's opinions very strong on the subject, you would be extremely mistaken to think those opinions were formed without experience
- jasonlotito 5mo agoYep, see that now. I'll try less next time.
- tptacek 6mo agohttps://blog.cloudflare.com/introducing-flan-scan/ https://blog.cloudflare.com/introducing-flan-scan/
- jasonlotito 5mo agoYou're right. I'm wrong. Cloudflare continues to prove it's a shit service, too.
- tptacek 5mo agoThey're 100% right, substantively, about how they're satisfying their SOC2 control requirement here. I'd be alarmed and skeptical of any security practice that was led by compliance requirements.
- kasey_junk 5mo agoI have direct experience telling a soc2 auditor that the approval control for installing applications on “endpoints” was a message to a slack channel that was assumed approved. To satisfy the audit they looked at an app that was installed on a laptop that was not part of our base image from the previous 6 months and a screenshot of the message where the user “asked” to install it. You can literally get a soc auditor to write up whatever you want as a control and if they don’t explain that and encourage it you should find a new auditor.