JaiLu The SOC2 Starting Seven (from)
First: for us, SOC2 is about sales. You will run into people with other ideas of what SOC2 is about. Example: “SOC2 will help you get your security house in order and build a foundation for security engineering”. No. Go outside, turn around three times, and spit. Compliance is a byproduct of security engineering. Good security engineering has little to do with compliance. And SOC2 is not particularly good. So keep the concepts separate.
— from
😉
Suite à cela, j’ai lu l’article Wikipédia sur System and Organization Controls.
This is not an instruction guide for getting SOC2-certified. Though: that guide would be mercifully short: “find $15,000, talk to your friends who have gotten certified, get referred to the credible auditor that treated your friends the best, and offer them the money, perhaps taped to the boom box playing Peter Gabriel you hold aloft outside their offices”.
— from
😉
If there is one thing to understand about SOC2 audits, it’s: SOC2 is about documentation, not reality.
— from
🙈
Puis ils vous remettront un questionnaire de 52 000 lignes appelé Liste de demandes d’informations (IRL), basé d’une manière occulte sur ce que vous leur avez dit que vous faisiez. Vous le remplirez. Vous aurez quelques réunions, puis vous leur enverrez un chèque. Le nom de votre entreprise figurera sur un rapport.
— from
🙈
PRs, Protected Branches, and CI/CD
Enable Protected Branches for your master/deployment branches in Github. Set up a CI system and run all your deploys through it. Require reviews for PRs that merge to production. Make your CI run some tests; it probably doesn’t much matter to your auditor which tests.
We probably didn’t even need to tell you this. It’s how most professional engineering shops already run. But if you’re a 3-person team, get it set up now and you won’t have to worry about it when your team sprawls and new process is a nightmare to establish.
— from
J’implémente systématiquement ce workflow dès que je travaille en équipe. Cependant, je me demande à partir de combien de développeurs cela devient réellement pertinent. Avant de lire cet article, je pensais que cela valait la peine à partir de trois développeurs.
À noter que ma motivation première de mise en place de ce workflow n’est pas la sécurité, mais la fluidité de développement en équipe et d’éviter les bugs.
Centralized Logging
Sign up for or set up a centralized logging service. It doesn’t matter which. Pipe all your logs to it. Set up some alerts – again, at this stage, it doesn’t matter which; you just want to build up the muscle.
— from
Pour cela, j’utilise Grafana avec Loki branché sur un Object Storage.
The AWS console is evil. Avoid the AWS console.
Instead, deploy everything with Terraform (or whatever the cool kids are using, but it’s probably still just Terraform). Obviously, keep your Terraform configs in Github.
C’est aussi l’une de mes premières motivations pour utiliser Terraform ! 😊
JaiDécouvert Munki, MicroDMD, NanoMDM qui sont des MDM.
Web Application Firewalls: Most SOC2’d firms don’t use them, and most WAFs don’t work at all.
— from
🙂
Endpoint Protection and AV: You have MDM and macOS/Windows full complement of security features and a way to force them enabled, you’re covered. AV software is a nightmare; avoid it while you can.
— from
🙂