A terrible way to jump into colocating your own stuff

Re:A terrible way to jump into colocating your own stuff by hedora on Monday September 23, 2024 @11:08AM (#41626997)

That’s unfortunate. I consider SoC 2 compliance as a negative indicator of security (I’ve been on the vendor side of it, and have seen it have significant negative impacts on security and reliability in multiple organizations).

Ideally, there’d be locked doors, and the data center wouldn’t be subsidizing performative checkboxing.

[ Parent | on HN ]

Re:A terrible way to jump into colocating your own stuff by wadadadad on Monday September 23, 2024 @06:13PM (#41631144)

I'm curious, can you tell us what the negative impacts you've seen are? Are there any audits that you can say are a positive indicator for security?

[ Parent | on HN ]

Re:A terrible way to jump into colocating your own stuff by agartner on Monday September 23, 2024 @06:32PM (#41631296)

Spending all their security time/budget on box checking rather than actual security.

I'd rather see open ended red team pentest reports.

[ Parent | on HN ]

Re:A terrible way to jump into colocating your own stuff by phil21 on Tuesday September 24, 2024 @09:49AM (#41636427)

Yep. My experience as well. Once a place starts doing useless box checking stuff like SOC2 it’s time to find a new job or switch vendors.

Positive indicators would be talking to employees and getting an idea of organizational clue level. There are no shortcuts here I’ve ever found beyond doing this sort of old fashioned “know your vendor” style work.

[ Parent | on HN ]

Re:A terrible way to jump into colocating your own stuff by ensignavenger on Tuesday September 24, 2024 @04:01PM (#41640305)

This is my complaint with "cyber insurance". Companies spending money on insurance premiums and checklists for the insurance company rather than spending money on security.

[ Parent | on HN ]