Hacker News Reader

Comment by jacobr1 | Hacker News Reader

Vanta/Drata and other are starting to build solutions that are somewhere in-between checkbox compliance and real security. To the extent they integrate with your cloud providers and security tools, they can validate you have secure settings, active monitoring, and have remediated the things that have been flagged in a timely manner. Doesn't mean you are secure, but does ensure some baseline tablestakes.

View on HN

> To the extent they integrate with your cloud providers and security tools,

What happens when Vanta/Drata are compromised?

A mass-exploit of their customers?

They are goldmine of enumerated attack surface. But it would likely require some kind of secondary exploit of the identified vulns. The API connections are generally scoped to read-only access of security settings. Though it wouldn't surprise me if there was some way to get lateral movement from the access these tools have to monitor an environment.

At $LastCompany, someone gave them Contributor (Create/Read/Update/Delete) access to Azure because it was easier than scoping to 5 roles they required. I wouldn't be shocked if we were not only ones.

Edit: Their software should really check and refuse to work if someone does that but obviously Vanta doesn't care. They can begin scanning and billing.

It's what's annoying about NIST and DFARS: you can be fully compliant despite having made stupid decisions as long as you have documented that you are in fact making this stupid decision.

Vanta cofounder/CEO here.

Thanks for the feedback. What we should probably do is take the credential, start scanning, and then nag them with a failing test about overly-permissive roles. Our own role is an easy check because we know what to expect, but there's other best practices here we can check for (and in some cases do, though not 100% comprehensively across all clouds.)

Glad one of many things is getting fixed.

Reply on news.ycombinator.com