GitHub will require 2FA by the end of 2023

Re:GitHub will require 2FA by the end of 2023 by mbesto on Thursday May 05, 2022 @04:29PM (#31278039)

First, there is no requirement by SOC2 that says you "must use SSO for all applications". SOC2 talks about "logical access controls". For a team of 10, you would simply have a policy that states "any time a new developer comes on, they have to use MFA to access GitHub and this is enforced because we check the box in GH, blah blah" and "any time a developer leaves the company, we revoke all access, blah blah".

Also, if you're going to spend $20k+ on SOC2 because your clients require it, then spending the $20k on GitHub shouldn't be a problem because your clients should be paying for it (i.e. your ACV should be high enough to cover these things).

[ Parent | on HN ]

Re:GitHub will require 2FA by the end of 2023 by sebmellen on Thursday May 05, 2022 @06:48PM (#31279238)

Yes, but SSO makes writing those policies (across all apps) much simpler. I think it's too bad that SSO is so heavily taxed, because it's quite an elegant way to solve account provisioning.

Interesting site: https://sso.tax/

[ Parent | on HN ]

Re:GitHub will require 2FA by the end of 2023 by mbesto on Thursday May 05, 2022 @08:46PM (#31279919)

Understood.

> I think it's too bad that SSO is so heavily taxed

Honestly, most software (especially SaaS) is underpriced for the value it creates. SSO is just an easy way to bump clients into the "real" pricing of the software while still letting them try most/all of the core features.

[ Parent | on HN ]