Hacker News Reader

Comment by Ozzie_osman | Hacker News Reader

I know this is presented as a sort of ridiculous "government bureaucracy" story, but anecdotally, a non-trivial chunk of the security/compliance industry is built on compliance over security. Not all, of course, but enough that I think it's a big problem.

I've literally had auditors ask me whether I'm actually interested in security or whether I just need the sign-off ("collect dust in a corner").

Not that this is unique to security. Similar things definitely happen with accounting or any industry where you pay the people who audit you (and probably even ones where you don't but the auditors still have an interest in not pissing you off, eg a government entity where officials may want to work for your company some day).

View on HN

I have worked with a large healthcare firm at two different agencies now who outsources compliance checks to overseas teams. There is nothing but a lengthy checklist to move through and if you do not meet the standards of the checklist, you fail.

There is no critical thought or evaluation of each step; it’s a simple pass/fail. Example would be “are your drives encrypted at rest?” It doesn’t matter if you’re in a SOC3 facility, located 25 feet below street level in 8 foot thick concrete walls and your files are distributed in pieces across millions of drives throughout the data center. Nope. The drives must be encrypted at rest. Pass. Fail.

Sigh.

> SOC3 facility, located 25 feet below street level in 8 foot thick concrete walls

One of objectives for encryption at rest is shredding. The drives may not remain in the secure facility after the end of life.

> your files are distributed in pieces across millions of drives throughout the data center

Distributing data could actually secure it if individual pieces are meaningless.

Shredding happens on site but your point would stand otherwise.

"The files on my drive are encrypted using the UTF-8 algorithm".

"UTF-8 is not in the list of approved algorithms. You failed to meet your compliance requirement."

"We have changed the algorithm to the approved ISO-8859-1 algorithm"

You seem to have a problem with the standard that says SOC3 facilities should have encrypted hard drives, not the auditor who is actually trying to enforce that standard. You take it up with SOC3, not the auditor. :-)

You're also assuming the auditors are familiar with all sorts of technology and security mumbo-jumbo. In my experience, they typically are not - their skillset is to "audit", not make sense of latest 10000 rounds of mybestcrypto.

Today they may be auditing a SOC3 facility, tomorrow it'll be a car manufacturing plant. The only "source of truth" is the standard they carry, and any deviation has to be noted. It is as simple as that!

I do take issue with audits that do not require critical thought; you are correct. The audit itself could be (and in this case is) self contradictory, which can be dangerous.

> You take it up with SOC3, not the auditor.

But that's the problem. There is no viable mechanism for doing this. Even if you somehow actually succeeded in convincing them to change the checklist, it would be next year's checklist, or the one ten years from now, not the one you have to establish "compliance" with right now in order to get the bureaucratic sign off, and thereby implement the spurious requirement.

Two things that I am aware of: (a) All standards provide a "comment period". Along with contact details for those standard bodies, there is a viable mechanism to some extent. (b) Standards are broad, which makes the language a bit abstract, and this can be a problem. However, they also include "compensating controls", which are typically used as a wedge to avoid a compliance failure.

I have had great success with several auditors with a polite conversation trying to help them map their goals to our controls. Yes, you will always meet an auditor or two who won't accept anything but the written word of the standard. Like any other industry, there are smart and dumb auditors. :-)

> You seem to have a problem with the standard that says SOC3 facilities should have encrypted hard drives, not the auditor who is actually trying to enforce that standard.

Isn't that exactly what the article says? That auditors are looking for compliance, not security?

Had auditors actually surprised that I wanted to fix the issues they’d found, they were under the impression we were going to shelve the report.

Reply on news.ycombinator.com