whatinthenote

7 ms·

1.
by whatinthenote 6mo ago
It feels like I'm screaming into the void, but compliance work is bad is because people make it so. Willfully paying for a service that offers SOC 2 reports at 1/5th the usual rate and delivers them in days instead of months and d
2.
by whatinthenote 6mo ago
Doesn't seem like a problem with SOC 2 compliance, seems like a problem where a company appointed someone who is not suited to handle a SOC 2 project. As for the pre-filled stuff, that's what other SOC 2 companies mean when they t
3.
by whatinthenote 3y ago
Same people that thinks they can build an Uber/Lyft/Instagram competitor by themselves over the weekend.
4.
by whatinthenote 4y ago
As the Americans learned so painfully in Earth's final century, free flow of information is the only safeguard against tyranny. The once-chained people whose leaders at last lose their grip on information flow will soon burst with free
5.
by whatinthenote 4y ago
The source being a tweet from clear right wing nutcase. Not gonna waste my time looking through his tweets to learn that he thinks there are "election fraud" in AZ. I'm not a labor economist and know nothing about job reports
6.
by whatinthenote 4y ago
What's actual security? Looking for zero days? Malware research? Continuous red team? I think at the end of the day, SOC 2 aims to instill a basic level of organizational security so the company doesn't shoot itself in the foot. I
7.
by whatinthenote 4y ago
I don't deny that there are certainly companies that act in bad faith (say one thing in their SOC 2, but do another), but I don't consider it to be a fault of the SOC 2 process. Just bad companies. I wouldn't be surprised sai
8.
by whatinthenote 4y ago
I love it when nothing is documented and every process exists in someone's head.
9.
by whatinthenote 4y ago
Actually, the easiest thing is to find a better auditor. A SOC audit isn't like an IRS audit, you actually pay them to come in and audit. Not all are created equal and sometimes you get what you pay for.
10.
by whatinthenote 4y ago
I don't understand why people assume SOC 2 can cover every single possible scenario. Especially scenarios that have nothing to do with actual SOC 2 controls, but the result of lax security culture or bad actors. You can pass a driving
11.
by whatinthenote 4y ago
I'm trying hard to figure out what any of this has to do with SOC 2. Perhaps consider the phrase "Don't let perfect be the enemy of good". Okta had a shitty breach, but does that mean dropping SSO completely? What better
12.
by whatinthenote 4y ago
I think one thing that doesn't get covered enough is SOC 2's value in providing additional data for vendor security reviews. That poor CISO that have to work on SOC 2 is probably tasked with reviewing new vendors on a regular basi