Re:Our security auditor is an idiot. How do I give him the i...
by 6D794163636F756 on Monday June 19, 2023 @03:55PM
(#36395794)
I've been the internal poc for a soc2 before. The external auditors were all lawyers. As such what mattered was strict compliance with the wording of the standards. With them what we didn't say was nearly as important as what we di
The only “huh?” Moment I remember was when they asked me whether we used MFA, and then I proceeded to talk about how we have TOTP, WebAuthn, etc for our “2FA” as I happened to refer to it, and after talking for a minute about it, the auditor said, “just want to clarify, do you have any MFA configured”… at that point I realized how much they were just blindly marking checkboxes. So I just said “yes we do.”