The Cyber Canon, ditching the SOC 2, and the weekly enterprise news - Helen Patton - ESW #416
Ayman discusses the limitations and issues with SOC 2, explaining that it is not prescriptive and can give a false sense of security. He advises delaying SOC 2 until necessary and instead focusing on practical security measures like the Minimum Viable Secure Product (MVSP). He emphasizes the importance of designing security controls thoughtfully and not relying solely on compliance frameworks.
Transcript
Only Ayman's parts of this conversation are included, with the question before each answer for context.
Also joining us and speaking just now is the Dean of Data Science, the Knight of Neurodiversity, the Watcher of Data Center Waste, Jackie McGuire. Howdy. I got to get through these because we got a ton of co-hosts today. Also joining us- We showed up as a gang. Also joining us is the connoisseur of cloud security, our single origin co-host and resident coffee sommelier, Ayman Elsawah. How are you doing, Ayman?
Good, Adrian. How are you?
So I refilled the water in my espresso machine over here, but I did not bring any cups down.
Oh, just got to do it with your hand there.
It's just like, oh, sorry. Go ahead, Ayman.
It's just like how things are lost. There's always a degree of loss from in-person to remote, like video to like on the phone, right? With every degree of departure, something's lost, right? So the same thing with reading, like that's like kind of like firsthand knowledge, right? You read a book, you're going to just like all the little prepositions and all that kind of stuff that even a bold or italic, when the author uses that, it's emphasis. That's lost if you take it and digest it to AI and say, give me a summary, give me, so 25:26 So I think it's the same thing. We're not going to be able to get away from that.
An interesting bit of context I want to inject in here is I learned that SOC 2 comes from a CPA-like compliance firm, and it's often CPAs who are coming out and doing some of these audits.
Yeah, it's run by the AICPA. And it used to be, it used to be.
Sorry, continue, Ayman.
Yeah, so there's a few points to cover here. I just finished the SOC 2 just not too long ago. As a CISO, what I was worried about, I don't want a report to have any findings, right? So there's like three or four different levels of like... Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, AppSec, red team, threat modeling, 42:56 Well, let me step back. There's a couple of things. Let's talk about the problems with SOC 2, right? The author talks about a lot of things that are on point, right? Auditor qualities out of all over the place, right? I mean, like literally you could pay... A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, 43:36 The other thing is it's up to you to design the controls the way you want. So it's not prescriptive like PCI, like thou shall do this. It's up to you to design the controls whatever way you want. And there's five trust criteria for SOC 2. You don't have to do all five, only just the security one, which is fascinating. What really drives SOC 2 is sales, right? Like it's like 98, I mean, a lot of times that's what the fractional CISO business is just like, help us get through these questionnaires through SOC 2. 44:07 By the way, doing SOC 2 won't preclude you from doing questionnaires. You're still going to have to do them depending on the security team on the other side, right? For example, when I have to do, as part of your SOC 2, you have to do a vendor review. And so I go and pull the SOC 2 reports from Google and everybody else. I read them. I take a look and see if there's anything. I scan them. I see if there's anything glaring. And if there are, I try to dig into them. But the problem with it is that it gives you a false sense of security. 44:41 Oh, I'm SOC 2, so I'm secure. No, no, it's not true at all, right? But the good side of it, it's kind of like the gateway drug towards security, right? It gets people to do some things, albeit, like, unfortunately, it's sales driven. So, like, they just want to, like, check the box, right? They, you know, sales is not always interested in getting security done. So, I think he says, like, it's a security crutch. Sure. So those are some of the things that we'll talk to. 45:12 It's like a good housekeeping label. What's that?
It just feels like both sides agreed to lie to each other and they're fine with it. Yeah, have you ever worked in Wall Street? I'm hating, I'm not liking that's the comparison.
Yeah, it's just a lot of, maybe a little bit of laziness, a little bit of complacency, a little bit of, I mean, like, when I'm running security and I'm going to use a third party, I don't care. You give me SOC 2, ISO, you could give me all the badges and stuff in the world. I don't care. I'm going to get on a call with your engineering team and we're going to go through your stuff. They're like, nobody's ever done that before. I'm like, yeah, well, because people are not doing their job. So like, you know, don't criticize me for like, but we're SOC 2. 47:32 I'm like, I don't care. I don't care if you're SOC 2, ISO, SOC 3, 10. I don't care. Like, seriously. So that's, I mean, that's the security team's job is to
Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec,
Here's exactly what I tell clients. So clients come to you all the time, should we do SOC 2? I mean, I even sell some of the software that helps you get there, right? But you could do it on a spreadsheet if you're like a maniac, that's fine too, it's up to you. But like, I mean, yeah. But here's what I tell people, do SOC 2, wait until you have to do it, right? Because again, what's driving it is sales. And in the meantime, here's a bunch of things to actually get you secure. Like, I literally, I'm like, listen, what do you want? 48:35 Do you want a compliance and sales or do you want to be secure? And they're not always mutually exclusive, right? I do paint it out. But for a small company, it's a lot of work. You know, you have these features you want to ship and then you have the SOC 2 distraction. A lot of companies just, oh, let's just do SOC 2. It's not like something you buy and turn it on. You're going to have to do like some documentation, turn on a bunch of things. So unless you have a deadline from a client and i walk them through it i'm like one of the negotiation tactics is like okay the way you know you have when you have to do SOC 2 is when a client refuses to sign until you have SOC 2. and when you get to that point you say okay can we promise that we'll be SOC 2 in six months or upon renewal right and then once that happens then go ahead and turn on the SOC 2 or go for the whole thing because whatever
Yeah. And the more of this we get done along the way before then, the less expensive it's going to be to get there, and the faster we're going to be able to close that deal. And I think that's like, if you can tie what you're trying to do with security to the revenue you're trying to generate, that always gives you a little bit more traction. So, you know, yes, don't do it till you have to, but as a security leader, use it to threaten people.
So we've tried that we've tried that and until there's an actual deadline like nobody cares about perspective money they'll just they'll just they'll just take their time right because i'm not the engineering manager i can't go and like turn on key management whatever it is that's the controls designed to do blob storage whatever it may be Yeah, like it were just various things. You'd be surprised. And then funny, what's really funny is between all the vendors, everybody has your own interpretation of what needs to be on. 50:51 And that's the worst part of it. So like, that's where I kind of like come in and I'm like, you know what? We don't really need this. We have this here. So don't turn on this. And that's where sometimes these things become a waste of time. And you need an expert not to like sell myself here, but like, it's good to have someone. No, I'm serious. Like.
Need an Ayman.
Just don't wait. I don't like, I hate, I hate seeing people waste time. And, and you know what? If you want to be secure, go ahead and check out the MBSP. If people had to do the MBSP, I'm all for that. Do the MVSP, Minimum Viable Secure Product, and that'll get you way further than SOC 2. Believe enough, you could have SOC 2, but not meet a lot of those criteria in there.
What is MVSP?
MVSP.dev, so it's Minimum Viable Secure Product. A bunch of, I think, FANG folks or whatnot got together and put together what they thought would be a secure product.
Oh, okay. Very cool. I was not aware of this.
Yeah, it's lovely. It's great. I'm like, just go with it. It has a checklist and everything.
Yeah, yeah. And it seemed like a small thing, you know, it was something to do with access controls or something like shared logins or something like that. And... Yeah, and it's one of those things that it's only as good as what you do with it.
At least it was there. I mean, I had one company, I didn't work with them, but I had one company say, okay, can we just do all these things for SOC 2, pass the audit, and just turn it off later? I'm like, no, please don't do that.
That was created by CPAs and CPAs make their money checking boxes so like if it was created by somebody that actually had a vested interest in him and like what's pursuing companies to ask for them is a CPA too right because there's a CPA on the other side going oh well you know in order to issue this insurance or like to green light your financials or you know whatever it is you really need to be getting SOC 2s and it's just this circular
Yeah. Graphic cycle. Didn't we talk about, I think we were talking about a different podcast, how like VCs or they're not invested to like actually solve security problems. Yeah.
No, absolutely. It's to build a business that makes money. If that also happens to solve some security problems, wonderful. But it's not a requirement. All right, that's all we have time for this segment here. And yeah, so to summarize, hire Ayman, don't waste time and use mvsp.dev.
Don't hire me. Just do it. Just secure your stuff, man. Just secure your stuff.
So it is yeah I can't imagine being 60 and losing a job right you know like ageism is a is a thing you know like it can't be easy at 62 like I got three years to go who's gonna hire me right like you almost have to go independent are not gonna get jobs they're not so one is essentially retired the other I have a feeling I haven't spoken directly to her yet but gonna retire or start her own consulting company for the next three years or whatever the case may be
I mean, it really begs the question on the future of work. And then also, like, for some people, they don't need to retire. Like, I'm sorry, they shouldn't retire, right? Like, for some people, like, they'll just, it'll be a different kind of work in the future, right? And also now with things, I mean, basically what I'm trying to say is the time of going to a company, working 20, 30 years, getting a pension, that's gone. That's been gone, right? My parents' generation is the last one. 1:02:38 They're sitting on a pension. It's great. But I always think, what is future going to be like for me? And this is more like a personal, what's just taking care of yourself. And it's harder here in America versus, say, in other countries where there's more of an infrastructure. The same thing with starting a business, right? When you start a business, you don't have to worry about health insurance and stuff because it's already taken care of. Here, I mean, most people, just like you said, Katie, they keep the job because of the health insurance, right? 1:03:10 I mean, like...
Almost always comes back to that.
Yeah. So, you know, what I'm trying to say is we're going to have to diversify our incomes, right? Like figure out like side hustles, all this kind of stuff, like to basically survive in the future or live in a really low cost country.
I'm pretty sure most of us on this call have some opinions on what that means.
Why are some kids' foods can't be sold in Europe, but they're sold here?
Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.
Well, you got a video. You got Defcon Blackout. That's another opportunity for you.
And I think it is a liability. And I think people need to recognize some of that stuff as a liability. You know, there are a lot of kind of shady practices that go on. And they're not just on the business side. Like these people in their personal lives, you know, you learn just a little bit about their personal lives and you're like, oh, okay. Like you're happy to cheat and lie to a customer and do it in your personal life as well.
I don't think the audience knows what we're talking about. Did we say what the story was?
Yeah, well, it's just a badge on the website. Like, we can't look at it.
Can we get the SOC 2 report? Let's get the SOC 2 report.
Oh, yeah.
If anybody out there has a SOC 2 report.
Okay, sure. Yeah. Yeah. Good to challenge me on that. Sure.
I'm curious what their partners, I mean, they list a lot of big name companies that are like, they're integrated with.
So that was something that was kind of surprising is McDonald's didn't have any kind of vulnerability disclosure program, any easy way to report this. So the researchers just had to randomly start emailing people and like hitting them up on LinkedIn, which is never good. I'm curious. So a lot of lessons learned here.
No, you know how a company responds, I think shows a lot, you know, that we should, good point, give credit to that. Yeah, I think so.
Yeah.
I am curious, though, like, you know, was all this like, actually, like humans that put this, these commits? Or, you know, was it AI? Because I'm curious, you know, like, depending on how that answer goes, like, is it better off doing one or the other? Like, so I mean, I've been doing a lot of vibe coding lately. And this probably could have been prevented with like the right prompt and right AI. But
Speaking of amen, amen. Wow, that was smooth. Never heard that before. What is going on with AI acquisitions here? Because this is like, I've only yesterday learned about the reverse acqui-hire. And like, this is weird. It tells us what's going on here with cognition and windsurf and
Yeah, you know, Jackie might know more about the technical, like, I still want to dig into the money part, like how that was possible. You know, TLDR, like, all the employees of a company got screwed because the founders wanted to, you know, just left them behind. But it was a lot of drama. Yeah, Jackie, I think you have a better, you did, I think you went into a lot deeper than I did.
It doesn't have to, and that's the whole purpose I was reading about this. The whole reason for just poaching the heads of the company and getting the license is they don't have to go through any of that because they're not acquiring the company. They're just hiring some people. Wow. That's the whole reason for the reverse acqui-hire is to avoid any scrutiny.
So does that mean regulations?
Yeah, yeah.
What I love is this spoof that, you know, these people did on X. I don't know if you posted that one, but these two founders did a spoof of the whole thing. You know, it's all like, all this is over like an IDEs, open source IDEs that like people... Anybody could copy, so it's just fascinating.
Yeah, like a lot of it's open source anyway, right?
Kind of screams like bubble, but I don't know.
Yeah. Yeah. Yeah. Honestly, it just doesn't make a whole lot of sense. Like we CISO many companies privately getting more money than they would have gotten by going public without all the handcuffs that you have by going public and all the scrutiny from shareholders and stuff like that. So, yeah, I think the landscape's just it's you're not incentivized to go public anymore.
But it begs the question that one article you mentioned maybe about a month or two ago that talks about like the VC and like kind of like this song and dance is not sustainable so.
Yeah somebody just sent me a interesting video today about collateralized debt obligations which is something that I worked with quite a bit when I worked in Wall Street but just kind of how these private equity companies are kind of buying up all these little companies and having them take on insane amounts of debt and like
What's the collateral? 2008, huh? It's the company.
Yeah, I'm curious about this.
Oh, is that apparent? I'm sorry. It is.
Your eyebrows have subtitles.
Yeah, yeah, yeah. I didn't mean counterpoint, but like, so there's two parts. One, there's a funny anecdote I just thought of. I remember George Jetson and he'd come home from work. He's like, I had to press the button five times today. Like, is that the future of work, right? So, but in all seriousness, to your point, Katie, it's moving things forward, like faster. Like just, I just finally got into the vibe coding thing on Friday. I lost sleep. I, you know, it's like, it's like back to when I was scripting and coding before. 1:38:34 But like, I don't have to deal with the Python errors or like the environment. Like it just does the troubleshooting for me. It's just magic. And here's where it actually helped my job just this week. I'm trying to find all the Google file shares that are shared publicly, right? And Google's workspace admin sucks. It's just really bad, slow. So I found an open source project, forked it, I had Claude help me, you know, get up to speed to it. I used it. And I'm like, this could be better. 1:39:06 Started updating it. Hey, Claude, do this, do this. And now I have a beautiful thing that I can find everybody's shared files. Give me links. Pretty soon I'll have it send people emails. Like, I just did that in like a few hours, right? I don't have to go buy a tool. So the limit, I think the limit What a lot of people are saying is our limitation is going to be our imagination, right? That's just, that's going to be our limit.
Nobody drives a standard anymore. That doesn't mean that we would say that people who can't drive standards, like it just, it's one of those things that I'm like, do I think people who can't drive manuals or pansies? Yes, I absolutely do. Do I think that's probably a really stupid and unrealistic opinion that I only take because I know how? Yes. And I feel like that's how AI is getting.
I actually said that in my article, Jackie, so high five, virtual high five.
As somebody who used to back up into things, we should use it.
So the thing you're probably not allowed to use.
That's what enhanced means. It just uses the in-car camera to show your face. And Intune integration and Microsoft 365 Copilot. Intune? So Intune inventories are now going to have people's personal cars in them. I do not understand that.
Are you going to MDM your car?
The only thing I can think is that so douchey CEOs can take Teams meetings from their Mercedes and then their security teams can secure the corporate license of Teams that's on the, I don't know. Yeah.
Or maybe to publish. Oh, maybe it's just to provision the Mercedes car. Yeah.
To provision the apps? Yeah.
Maybe push the app to there.