How to Ace SOC2 in SaaS Scale Ups

So thank you, everyone. Today, I'm going to be talking about how to ace SOC 2 for SaaS scale-ups. Now, SaaS scale-ups are a different beast than, say, maybe your traditional on-prem company or even a smaller startup. So these are typical companies that are growing fast. I've worked with a variety of companies at different stages in SaaS. And I've seen the different growing pains that they've all went through. So I'm here to help guide you to do SOC 2. 0:36 And we're not going to go into everything. It's only a 30 minute conversation here. And I'm going to go into some highlights and leave some time for question and answer. So questions and answers are my favorite part. So please leave some questions in there and I'll check them about 10 minutes before we end. All right, great. So let's hop into it. So today we're going to, you know, just do a quick overview of SOC 2, understand some basics, some maxims. 1:07 I like to have some maxims just for people can understand, you know, the philosophy of a particular thing. In security, we have a lot of maxims, so that's just how it is. And then go over the meat of the conversation, you know, SOC 2 for SaaS and talk about some particulars. And then we'll leave some Q&A. All right, here we go. And it's 8am over here in California. So I'm still working my way through my coffee. 1:38 And so bear with me. All right. So a little about me. I've been doing cloud only since 2015. When I first discovered AWS, I was working on an incident actually. And it was just amazing. I was like, wow, this stuff is really cool. So I've been full on cloud since 2015. I've never looked back and not worked with any on-prem companies pretty much since then. I have a podcast. It's called Getting Into Infosec. 2:08 So it's kind of my way to contribute back to the community where I help catalog, sorry, catalog people's journeys into security so other people can be inspired and learn and motivated to get into the field because we need a lot of people in security. So come on through. I also wrote a book called Breaking In where if we sat down A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 2:55 So always good, always happy to talk about, you know, single origin coffee and things like that. And then the latest thing I'm working on is my newsletter. So I have a newsletter called Last Week is vCISO. So I function as a fractional CISO for startups. And so I share my lessons that I learned working with them, some reflections. It's a newsletter that's geared for people that don't have security in their title, but all walks of security are welcome. And I break down complex security topics in an easy to understand way. 3:30 So feel free to check all that out. These are companies I've worked with in the past. So, you know, both small companies and large companies. So I'm sure your company will fit somewhere in here as well. All right, so let's go into the basics of SOC 2. So SOC 2 has five trust criteria, okay? And they are, you know, security, confidentiality, availability, processing, integrity, and privacy. 4:00 So what does that mean? Well, the only required thing you need to do is security. The other four are optional. So really depends on what you're trying to do, what your customers and partners are asking of you from a requirements perspective. Sometimes it's easy to just tack on availability, for example, because you're already working and you're a SaaS company. So why not just set up a DR site and test that out? I mean, it's actually good practice anyway. 4:33 But these are the those are the five trust criterias. And then from there, you have two subtypes. So you have type one. So SOC 2 type one. Yeah, it's pretty confusing. But SOC 2 type one, which is a point in time review of your controls. OK, so, you know, it's basically, OK, do we have these controls in place now? OK, and that's when the auditor comes in, you know, they'll do their work and they see if you have these things in place. Type two means that you've had at least three months or more of those controls in place so have you had those have you had logging in place have you done you know your exercises your tabletop exercises or your backups or whatever it may be has everyone that's been onboarded through in those three months received training and done what they needed to do 5:23 So type two is a little more thorough. And some companies will do type one and type two. Other companies will just jump straight into type two. So it's, you know, it's really, there's so many ways to go about it. And that's actually one of the big things I'm going to talk about here is that SOC 2 is not so rigid, but we'll get that. And then, you know, it's not to be confused with SOC 1 and SOC 3. SOC 1 is like more of a financial thing. SOC 3 is actually like an extension of SOC 2 type 2. 5:58 It's like an abbreviated report that's, I guess, designed for like public review. And not to overwhelm you about like, you know, if I, you know, take three, I took three of the trust criterias in Sprinto and there's 84 controls. So, you know, these are 84 different things that are required for you to meet in order for you to meet, you know, those three criteria. So, you know, not everyone is like a small job, right? 6:29 They're all, you know, they have some, you know, it's a combination of policies. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 7:01 So, you know, that can be very overwhelming. And before companies like Sprinto came around, basically you'd bring an auditor, they would sit down with you and they would design the controls with you for your environment. But now companies like Sprinto have All you know, they've they've had the experience of different companies and have the designs, the controls already designed out of the box. So, yeah, you are welcome to use your spreadsheet, of course, but I think that would defeat the purpose of this talk. 7:34 So and so it's a combination of controls and processes. So, you know, do users have encryption on their laptops set up? Do they have screen timeouts? Do they have Are they receiving training? Things like that. And then processes where like, are you doing access user reviews? So, you know, is there a way to get approval when someone has new access and things like that? And so the big takeaway that I'd like you to have is that it's not black and white. 8:08 It's pretty much 50 shades of gray. So SOC 2 has a lot of malleability. Even when you have a lot of the tools that are out there to help you manage SOC 2, there's still a lot of questions. Working with COOs and CTOs, they often have a lot of other specific questions like, do I need to have letterhead in my policy? Or you know what, like... No, you don't. But that's why I'm here. I'm here to help, you know, guide you through. And the folks at Sprint are really supportive in that as well. 8:42 And then SOC 2 is not necessarily a certification. It's a report on your controls. So there's a lot of, you know, misnomer, like I'm getting my SOC 2 certificate. It's not a certificate. It's a report. So at the end of the day, you get a report from an auditor that has reviewed your controls and that's the report. You could share, you know, the whole report or parts of the report with your customers and things like that. I obviously recommend that you only share with NDA and, you know, don't share necessarily the whole report right from the get-go. 9:13 So, and also another misnomer is that just because you have AWS or Azure or GCP means that you're already compliant. That is such a misnomer. I still hear this now. That's not the case. These companies give you the infrastructure. They've taken care of the base set of infrastructure. It's up to you to put those controls in place. It's like someone saying, oh, this car is safe. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 10:04 And then, you know, there's also some things, you know, compliance is not necessarily security. So just because you've met a SOC 2 standard doesn't mean you should rest easy. There are some things you can do to improve your security. I recommend, you know, always staying aware. I think one of the... The biggest downfalls in the security sphere is when a security leader gets complacent in their security. So you want to really always be on top of your security and improve. 10:36 I know you're a startup and you're trying to grow and things like that, but let's not forget about our security. And even still, like even with SOC 2, if you do SOC 2 type 2, sometimes a lot of people, they just rest after doing that. It's like, no, you have to keep in maintaining it. So it's a journey. It's a long marathon that you have to maintain, even at the minimum of SOC 2 controls. All right, so that's been a lot of talking. So I'm going to hop into organizational maturity. 11:08 So one of the things that's really interesting when you're doing SOC 2 is depending on where your organization is in organizational maturity, it's going to impact that a lot. So let's talk about that. So for example, I've seen scale-ups that, so, you know, your people ops, right? Your people ops is gonna be a big one that's gonna be affected, right? How are they doing onboarding and offboarding? As you're a growing company, a growing scale-up company, one of the things I see often is the PeopleOps team are still doing things the old way. 11:49 They're using spreadsheets. They're just sending out manual emails for onboarding, offboarding, and checking for the I-9s and all the particular documents, receiving driver's license and passports via email or saving it on a Google Drive. Talk on information security covering CISO, vCISO, fractional CISO, zero trust, non-repudiation, infosec, AppSec, DevSecOps, SOC 2, ISO 27001, NIST, FedRAMP, GDPR, HIPAA, PCI DSS, MFA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, 12:26 So, you know, sometimes I see a Google form, you know, for a manager being filled out, you know, oh, do you have a new employee coming on? They'll fill out this Google form. Like what? So, You're going to have to improve your onboarding, offboarding. You want to have some sort of automation. Training is going to be a thing. So if you as a people ops manager were thinking about getting an LMS, then work with your security team on incorporating some security content in there. 12:58 So some companies have an LMS. Learning management system is what an LMS is. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 13:31 How is that being tracked? Are they getting extra access? How is the access privilege being managed? So when someone changes jobs, how's that going to be? I'm going to talk about IT a little later, but that's something important to understand. All right, we're doing good on time. So the next thing to talk about, and again, remember, if you have any questions, please drop the questions in whatever channel you're in. So awesome. Thanks so much. 14:06 So supply chain risks. This is a big one. So you're a SaaS scale up. You're using a million tools to run your company. And I remember in 2021, I think every single one of my clients had like an incident every month. So every month I was working on an incident because some, you know, DevSecOps vendor or whatever got a breach and we had to like, you know, 14:36 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. So what's important is, yeah, thank you. So find out what your critical vendors are, right? So it's really important to understand who your critical vendors are. If this vendor went down, let's just talk availability for now, for a second. 15:06 If they're not available, are you gonna be able to function, right? Do you have a backup? What's their SLA? All those kinds of things. These are things to think about. If they have an incident, are they prepared to run an incident? Do they have a security person in charge? Even a fractional security person, it's better than no one. A lot of times, no one is in charge of security. Security falls onto the VP of engineering or something like that. 15:46 Yeah, so, you know, it's really like, you know, your mileage may vary. Review their contractual obligations. So involve your legal team, find out what their contractual obligations are from a security perspective. All the things that your partners and your customers are requiring you to do and your cybersecurity insurance is requiring you to do, Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 16:18 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Find out what their incident response program is do they have the right email to notify you if there's an incident right a lot of times a lot of times a notification goes to the email on record of like the admin who signed up for the service so if i go sign up for a service 16:55 And now the whole company is using the service, but like I signed up for a long time ago. A lot of times the founder signed up for it and it's going to their email. I swear this happens all the time. The founder's email is the email on record and the founder's busy. They're not going to see it, you know, whatever. And then the incident notification goes to their email. Oh, by the way, there's an incident. You need to, you know, do something immediately, da, da, da, da, da. And that email does not get seen. So make sure the notification for any incidents is the right person. 17:27 Create a Google group if you have to for the main email for notifications. If the vendor is a more mature vendor, they'll have a separate email for billing, a separate email for incidents and security and technical and things like that. But a lot of times you'll find the software that the founder used and now this company with 300, 500 employees is using this critical software.

So yeah, I think I covered most of the topics there. So I think that's something to understand. Supply chain is just something, you know, it's really important. All right. Optimizing SOC 2 for SaaS. Let's talk about IT maturity. IT is the biggest hurdle. One of the biggest hurdles after policies and processes. 18:28 I've seen IT... Sorry, I've seen IT... So long story short, basically, no one wants to handle IT. IT is that like group that just keeps getting shuffled off to different orgs. The COO might have it one day, then he or she passes it on to the CFO, people ops. It's gone everywhere. So in my opinion, I welcome IT. So I think IT has a good alignment with security. 19:02 So, you know, I'll take the IT folks. You guys can come with me. Because IT is like the forefront of security. They're the front lines. So I think this is the last topic. So, you know, IT is the biggest impact to users, right? Getting them to change their behavior or like, you know, install something on their machine, it's a big deal. So, you know, I've seen this done wrong a lot of times and then it makes users upset. 19:33 It makes them, oh, why do we have to do this? And for security, and then they get upset at security. And then eventually the company hires a real security person and they're like, You know, and they're like, why did you do that? Like, I don't know. And so then the security person has to undo all that stuff. It's just a mess. So, you know, do you have a dedicated IT staff? I've seen companies with hundreds of employees with no dedicated IT person at all. You know, IT is run by like some program manager or project manager somewhere. It's like, I'm like, really? 20:06 So make sure you have IT staff. If you have outsource IT, which is very popular, and it's good that you have some sort of IT, keep in mind, That is going to cost you extra. To get them to do SOC 2, it might cost you extra. So just take a look at your contract, find out, hey, we're trying to do SOC 2. Is this supported in our contract in SLA? Is this going to cost extra? Like, here are all the things we need to do. We need to roll out this software too. To all the devices, we need to make sure that these basic controls are set up like hard disk encryption and things like that. 20:41 Are you going to be able to do that or not? Even user access reviews, things like that. So make sure to take a close look and account for that if you're going to endeavor down the SOC 2 path and you don't have your own IT person. Yeah, that's pretty much it. I think communicating is really important. So another thing is single sign-on. So I am a fan of single sign-on because it just makes my life easier. 21:15 It's going to make your user's life easier. It's going to make your admin's life easier. It's going to make gathering evidence super easy. It's going to make access reviews really straightforward. It'll give you just general better security. One thing on access reviews though, you know, a lot of tools like Sprinto will have access review functionality built in. So you could leverage that as well. But it's not going to give you the depth as like single sign-on would, right? Single sign-on means that the user logs in one place and they have access to all these different apps. 21:51 When they're off-boarded, you just disable their access in one place and then they lose access to all the other apps. The downside, the really, really, really big downside is it's going to be costly. It costs more. So that's just a fact of life. In fact, there's a website called SSO.tax that someone I know created. It tracks all the companies that charge extra for using SSO license. So not only you have to pay for the SSO software yourself, but when you use an app that supports SSO, sometimes you have to upgrade to their higher version. 22:25 So, you know, just an example. This is just, I mean, there's so many controls tied to access control in doing SOC 2. This is just like three of them right here. But there's, you know, at least like eight categories. Don't quote me on that. It was kind of late when I put this together. But there are several areas where access control is a thing. It's really huge. And, you know, if you're a SaaS company, identity is the new perimeter now. 22:55 You know, it's been like that. I've been saying that for five years now. So identity is really crucial. All right, let's wrap it up. Oh, one last thing, DevSecOps, just a quick note. You know, if you're a SaaS, you know, you have to have some good DevSecOps. Here's just some really quick recommendations. Obviously, you have to have pull requests that require approval. A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 23:40 If you just document what that mechanism is, the author will be totally fine with it. It's totally fine. Again, SOC 2 is very flexible. It's not super black and white. As long as you have documentation, a process for it, and you're following it, that's great. That's awesome. So just a thing on that. So a really quick summary. SOC 2 is not black and white. It's 50 shades of gray. 24:11 It's going to force some organizational maturity in non-technical departments like people ops, legal and operations. And IT hygiene is really going to be like a big hurdle after, you know, your policies and your basics. So thank you so much. I'd love to open it to Q&A.

Can you repeat that again?

Oh, yeah, you could say that. But, you know, as part of doing proper SSO, you have to have, I mean, I have a whole SSO guide. You have to have really good MFA. You're not using SMS for MFA. You have contextual awareness. So one big benefit of SSO is that you have context awareness. So you're logging in from, let's say, New Jersey, and then all of a sudden your credentials are used 5,000 miles away in like Iceland. Let's just say Iceland. 25:34 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, red team, threat modeling, Enterprise Security Weekly, Security Cafe, The not having SSO, what really usually happens is you have people that are no longer with the company that have access to your software. 26:08 So I guess you have to weigh the risk, but SSO can be locked down really well, so.

Oh yeah, there's a whole bunch. So background checks, if you're using a background check software, that'll plug right into Sprinto. And every time you do a background check on an employee, they pass the background check, that is automatically sent to Sprinto. Training is another one. Let's see, through automation. Yeah, pull requests. So making sure that every pull request is approved. Talk on information security covering CISO, vCISO, fractional CISO, zero trust, non-repudiation, infosec, AppSec, DevSecOps, SOC 2, ISO 27001, NIST, FedRAMP, GDPR, HIPAA, PCI DSS, MFA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, HIPAA, PCI DSS, MFA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, HIPAA, PCI DSS, MFA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, HIPAA, PCI DSS, MFA, SSO, IAM, OAuth, phishing, ransomware, pentest, 27:20 Oh, gap is an accounting term. So I happen to know accounting stuff because I run a business. The gap thing is completely separate of SOC 2. That's an accounting thing.

Yes, yes, exactly. I love how that's stated. If you're going down the SOC 2 journey, there's basically 80-20 rule that I've seen from a security perspective lately, especially lately with budgets being cut. 80% of the folks are doing security because they're being forced to do it by their clients and their partners saying, are you SOC 2? It's like, if you don't do SOC 2, then we're not going to do the business. 28:19 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, No one wants to spend time on security, but at the end of the day, if you're going to lose business because you're not SOC 2 compliant, that's really why it's being done. So that's typically what it is these days. It's good to be proactive. And I think from my perspective as a security leader, I need to communicate what the risk is of not doing security now and trying to do it later. 28:53 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.

Scoping is really important. Yes, scoping is a great thing. I wanted to have a whole section on scoping. You know basically you know if you're doing it for the first time you want to scope is going to determine everything so if you have three different products and but only one product is sold for enterprises right and then the enterprises are the one asking for SOC 2 like if that's what it is then just do SOC 2 for that one product you want to scope as 30:19 I don't want to say as low as possible, but you want to scope appropriately to meet your needs, especially if this is still new to you, right? So if there's only one product that's being requested or that's being sold to enterprises, and enterprises are the only ones that are asking for SOC 2, then there you go. That's your answer. Only deal with that one product. And that helps in segmenting out your environment. Hopefully you have your product not... Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware,