Developer's Guide to SaaS Compliance
courier.com
courier.com
The thing it wouldn't mention is that very, very few companies actual care about complying with data security standards for the sake of keeping PII and sensitive data safe. They are more than happy to do the absolute minimum to pass an audit, and the absolute minimum is shockingly little.
What they really care about — and what lights a fire under them in the way that basic ethics and common sense apparently does not — is passing vendor security reviews.
Shout out to companies with very strict assessments, who actually pay attention and weed out companies with bad practices.
I believe fully in the importance of ethics and security that we as a society and we that work in tech should be honoring in full. It is disheartening to watch trusted companies utilize that -just enough- mentality to skim over the tops of audits. We have all seen what it looks like when companies operate from the absolute minimum and how dangerous and disrespectful that is for everyone- company and users included.
I'll be honest, this mentality bothers me. The point of independent audits and guidelines is to tell someone what the minimum bar is. If the minimum is 50, and the company goes from 20 to 50 in order to pass that audit, that's a good thing, not "doing just enough...to skim over the top." If you want to argue the minimum should be 75 instead, fine, but argue that the audit isn't good enough or that the guidelines are wrong, not that the companies are somehow unethical or immoral for spending more money than they need to in order to pass a vendor security review that is not going to award them any extra credit for effort.
I mean sure, maybe when it comes to smaller companies. But some of the companies with the biggest security blunders are those that have enough money that the security for their users information should be a major priority and those costs would barely impact their bottom line.
And also... Using this same train of argument couldn't we also just argue that the cost of security compliance shouldn't be this high to begin with so it's more accessible?
What would you estimate compliance at a Moderate baseline would be?
2. Assessment - 3PAO assessor will likely be 100K-200K. Most first time CSP's may require more than 1 assessment as the process is usually (1) Assess (2) Submit to FedRAMP PMO (3) they provide feedback (4) limited time to implement. If you cannot implement in sufficient time, you'll have to reassess. Note, unless you are AWS, Azure, Google, FedRAMP PMO may not prioritize you without sufficient customer support. As a result, your contract with your 3PAO may be expired. You'll need to bring them in again.
3. Documentation experts – There’s an art to generating the FedRAMP package. Engineers typically aren’t good at it, and it often requires one level of abstraction above internal technical documentation. Having technical writing experts that know how to communicate the security implementation without diverging too much is a skill set. You share the bear minimum to get compliance. As there’s business risk from sharing too much (sharing implementation details with a competitor or untrusted source). Also, the more technical details there are, the more audit questions often arise.
4. Control Implementation SME’s – Often time your engineers don’t know how to implement a required security control or don’t know what the compliance people really want. Many CSP’s hire a 3PAO assessor to advice you how to implement. This cannot be the same 3PAO assessor that audits you.
5. Conflict between product/feature value versus control implementation - Sometimes a value or feature of your product directly conflicts with a control requirement. A good example is a CMS PaaS (WP as a service or Drupal as a Service). Those CMS's often support user code or user code to spawn processes. The high baseline requires process whitelisting. Solving this problem while not destroying that feature can be difficult or expensive.
Adding 5% more friction on every step of development compounds a lot.
Management can ignore for a few years. Rebooting things isn't too hard. But then the issues that could be ignored can't be anymore. Eventually you get sold for the intellectual property or customer base.
Why does security and compliance frustrate "good developers"? Is it the extra steps required? Is it that it sometimes (often?) means that they don't get to work with bleeding edge/greenfield technology and feel left out?
This seems like the heart of the security issue, IMO. Sure, there are investors and managers who don't prioritize this work, and there are definitely concerns with the amount of investment it takes to accomplish ... but if a large majority of the engineering team were pushing for security and compliance as part of their normal routine in the same way they push for things like automation, would that solve some of other issues too?
We do B2B software. All of our customers (small community banks) have been incredible hard-asses regarding PII visibility. As they should be.
Even in cases where our customers use a "cloud" solution, it's with some niche 3rd party vendor that would never grant access to someone outside the secret club. Every one of our product installations is effectively an "on-prem" deal.
All of the logging information that we get to see is redacted for PII by the customer's instance before it leaves their secure context. This is a zero-tolerance policy too. We anonymize even the most generic facts and ensure our hashes are salted as specifically as feasible. There are some cases where this burns us (e.g. knowing that the SSN contained a non-numeric digit could be very helpful at troubleshooting time), but on the other hand everyone sleeps better at night knowing that PII is not leaking out into 3rd party buckets arbitrarily.
I would say that being very cautious about PII has opened up more opportunities for us. Our organization operates under the pretense that if any one of our customers were to become compromised by way of our product (or consultation per the product), we are instantly dead and put out of business. We don't sell ourselves exactly this way on sales calls, but we do make it clear that PII is the #1 concern in our minds. For us, it is analogous to safety on a construction site or nuclear power plant.
Uhhh does it? I'm pretty sure it does not explicitly stipulate this.
- Two-factor authentication (2FA) - Not stipulated - Access control for any accounts that store sensitive information - Access control policy is required - End-to-end encryption - Not stipulated - Training staff in data protection awareness, and a data privacy policy - Training policy is required
For the controls not stipulated in the standard (e.g. 2FA, E2E encryption), you may find you ultimately need them once you do an information risk assessment. As long as you explain clearly why the risk is not significant enough to require it or have good alternate controls, you won't get dinged by the auditor for not having these.
I've implemented ISO 27001 myself (solo dev founder, 6 person company, USD2mn SaaS). The divergence in quality of the implementation depends on whether the company is actually using IS027001/SOC2 as a tool to formally define, implement and monitor information security or finding the path of least resistance to accreditation.
If this is still something you want to pursue, hire experienced help. A majority of time spent in audits is figuring out what the auditors are looking for, and having someone experienced can save you a lot of headache.
Be aware that compliance is more than a one time thing, and during this process you will have created either an entirely new department, or at the very least multiple work-streams.
Regulatory capture and learned helplessness. The costs of compliance require deep pockets. When you look at what they actually do, then it's obvious it's just theater. You'll see so many comments on HN that persuade you that security and privacy are too complex for you to handle (learned helplessness). It doesn't matter if your org is 2000 people with entire departments focused on compliance. Security and privacy will always be somewhere out there on the horizon. A mythical thing that no one can obtain. Definitely not a sole developer working alone in their bedroom. So better not try.
Which is a bit crazy that this blog post is targeting "developers". As if developers care about any of this stuff. Executives at large corporations do. But those same developers working at that same company are off in agile land working on micromanaged tickets. They don't have a say in SOC. Not in whether it's worth it, not in how information is collected. Not even in how information is stored, in most cases. Because, again, SOC is top-down. Not bottom-up. The same executives pushing SOC are the same ones pushing Google Analytics. Theater.
When it does become a concern, I think this post [0] put out by Latacora (no affiliation) is a great starting guide, although it is bent towards SOC 2 compliance. All of the items they mention are concrete wins for the business from a compliance/security perspective. The process of implementing just a few can help you better realize if your business is going to be able to muster the time and effort needed to continually work towards these standards, or if the business value isn't there yet.
[0] https://latacora.micro.blog/2020/03/12/the-soc-starting.html
FWIW doesn't make sense to me for most 1-person SaaS: if you had 30k+ sitting around just for compliance, and presumably 5-10x for other stuff, why not just hire a 2nd person? Small team can make sense if explicitly targeting a.niche regulated space tho. Otherwise wait till beyond a 2 pizza team.
Note: I think it's an indictment of sw ecosystem that an earnest & diligent 1 person SaaS can't easily pass SOC2 style standards, or something equiv for the scale. SSO, RBAC, SIEM, IDS, default policies, etc -- like a SOC2-level heroku kit. Drata & Vanta are cool, but should shift further left.
Would be very difficult to write a complete guide - it's a long journey and accreditation requirements very specific to the business. Do you have specific questions or areas of concern in mind? Been thinking I could write a few blog posts about my experience.
And apparently it’s going quite well. No reason to think we won’t get certified. I don’t know whether to laugh.
Is this normal?
Just a note: some links are rendered wrong. The Markdown [ ] and ( ) are rendered, instead of an <a> tag.