Comment by Kalium | Hacker News Reader

Comment by Kalium | Hacker News Reader

Parent Full thread

If you have a way to automatically handle all the auditing that goes into evaluating all the not-strictly-technical controls that are part of SOC and PCI-DSS and similar, a lot of people will be very interested.

Based on this list, how would you automatically validate that vulnerability reports are handled in a reasonable timeframe? How would you do self-serve validation for incident handling timelines? How do you quickly and easily automate assessments of subprocessor data handling?

Quick, easy, strong, self-service, automated accreditation is a wonderful goal! It's critically important to make this stuff as easy as possible because there are features to ship and customer needs to meet. Security must be a baseline for everyone, and achievable by everyone, or else it's just a way for big companies to squeeze out small ones It just might be worth considering carefully that there may be systems at hand that blend humans and computers. It may perhaps be possible that information security could be more than just an engineering problem.

If I may propose a different framing? Information security is primarily a human endeavor. It is mostly about how humans and systems made of humans behave. Information security is about process. Some parts of it can be partially handled by computers, but most of it is deeply not susceptible to automation.

The SOC audit isn't really doing any meaningful technical evaluation. You're not going to get any engineering benefit from it.

In my experience, the auditors themselves aren't really going to provide much value in terms of an evaluation.

It was a little like having a Physics teacher ask each student to write their own final exam... and then take it. The teacher opined on the number of questions being asked but that was about it. All they are doing is recording your questions and your answers and certifying that you were indeed the person that took that test.

That being said.. I do think you can learn a lot going through the experience of a SOC II. You force yourself to drown out the noisy world a bit and think really critically and thoroughly about security. You need to learn how to articulate security to the entire company, to clients, etc. And you need to back this up with data... not hand waves.

SOC II was a pain... but a good learning experience too.

It verifies you have answers to the questions asked. "Has your GDPR data deletion process met its 30-day requirement?" means you (1) have this process, (2) are evaluating this process continually, (3) on correctness and timeliness. What could be more important than verifiability of correct processes?

I agree that living up to standards, and specifically the engineering / operations efforts improvements to do them, is valuable.

However, it's not hard to imagine automated flows for verifying this. In this case, specifying endpoints and providing automation scripts for doing GPDR flows takes care of most of it.

A lot of these are converging on the same check boxes, so get rid of the people and $ aspect. A team should be able to put together COTS OSS, run on a cheapo cloud, and test as part of CI/CD . We need to reach the point properly configured RoR/Django on docker + some sidecars (ELK, autotls, ..) can do that.

I agree with humans and process, just from a shift-left perspective , the specific ones that have become typical no longer need people.

Take a look at how AWS/Azure Marketplace programs and supporting vendors are using certified components and automation in multiple layers to get rid of most of the craft. It's possible.

People does make sense for parts, but we need to cut that part down by a ton I effort and $. I might feel better about the third party thing if the NSA started, as part of their cyber def responsibility, to provide free annual audits upon request (assuming heavy automation as per above) . We should be pushing to enable one-man shops to do this stuff, even if that makes tighter happy paths for how they build and run. Vendors can compete to make their stuff easy to add to that happy path and value add beyond the regulatory lockin.

Reply on news.ycombinator.com