As much as I hate to admit it, I've done exactly that and passed the audit. Certainly says a lot about the auditors...

It's basically fizzbuzz. If you have a WAF, it proves you know how to add a WAF. Presumably even one you know how to configure when security needs change.

Compliance auditors are mostly there to underwrite posture, not actual risk.

Auditors pretty much only certify that you have told them you are doing what you are supposed to be doing. They are not logging in to your servers and verifying that an AWF is running in front of your web server. They are not probing your network from the outside to see if an AWF is blocking their activity.

Just as financial auditors are only confirming that your financial statements match what your accounting department tells them.

If you lie to your auditors, there's a good chance they won't catch it because that's not what they are looking for.

It's not a lie! The WAF is there, it's attached and it does absolutely nothing with unmatched performance and scalability. We tell the auditor this.

You can lie to these auditors, but you can't lie to pentesters. These people on the other hand are designed to probe your network from the outside.

I've audited a lot of networks for compliance, and we always actually check that the protections that are meant to be in place are in place. I don't think I've done an audit where I wasn't using nmap to some degree.

In my experience with SoX, the auditors are very junior fresh out of college. They check boxes and move on.

> Certainly says a lot about the auditors...

Security auditors are (quite literally) accountants.

It's gotta be my favorite AWS service for this reason alone. It's almost useless but that's a feature not a bug. They knew exactly their market.

It pairs well with the checkbox in S3 that you can tick to enable encryption with no other changes to your application.

Hey, if someone breaks into an AWS data center and steals some s3 drives, you're totally in the clear.

You'd think that, but I had an auditor that had guidance requesting confirmation of security cameras on the servers. They wanted to drive to the AWS data center to see the cameras. If the drives got stolen, you'd better make sure AWS shares that video with you.

Ok, but what if someone bypasses the cameras on your servers with looped footage? Did the auditor think about having security cameras on the security cameras?

Amateurs.

Have they never seen Speed?

Awesome! I feel so much better about using this to pass an audit.

Same, I was checking usernames to see if I recognized any as former co-workers where we had to do this.

I guess there's just a decent market for the product everyone trying to check that box, though.