08092409160 Security Assessments

** Friday, August 9, 2024**

** 9:16 AM**

** Class:** NP (last export Aug 9, 2024)
** Scope:** Any kind of computer security audit, web or internal network or otherwise.

SOC 2 (System and Organization Controls 2)

• Assessment of organization’s controls on data security, availability, integrity, and privacy.
• Two types of reports:
  • Type 1 - Point in time assessment, scoped only to the design of controls. Are the controls appropriately designed?
  • Type 2 - Covers a specific period of time, includes auditing design and actual effectiveness of controls. (Typically 6 months to 1 year timeframe. Audit actually takes 1-2 months.)
• Assessment is based on the five Trust Services Criteria:
  1. Security - Protect against unauthorized access/disclosure.
  2. Availability - Reliable operation and use.
  3. Processing integrity - System processing is complete, valid, accurate, and timely.
  4. Confidentiality - Information is protected from disclosure.
  5. Privacy - Personal information safeguarded against access/disclosure.

Note: Only security is required—the other criteria depend on the specific system/customer needs.

• Part of a suite of assessments provided by AICPA (Certified Public Accountants, weird).
  • SOC 1 is focused on financial reporting.
  • SOC 2 is on data/IT, but this report type is for confidential visibility only. (WP Engine gave Mainstay their SOC 2 Type 2 report.)
  • SOC 3 is like a summary of SOC 2 Type II, providing assurance on the controls but without the detailed information.
• Does a SOC 2 Type 2 report expire?
  • No, it is technically valid forever, but customers will typically want periodically updated reports, e.g., annually. Most companies plan for annual SOC 2 audits.
• Time and cost investment:
  • Time - Could take 6 months to get a compliance program ready, and then need 6 months to a year of data, so may need to plan 1.5 years ahead of a contract that requires SOC 2 compliance.
  • Cost - Small/midsize companies can expect ~$20,000 and larger organizations $30,000 to $100,000.

ISO 27001

• Standard for information security management systems:
  • Risk management - What are the risks and how are they mitigated?
  • Monitoring, measurement, analysis & evaluation - How is the effectiveness of the system evaluated?
  • Improvement - How are nonconformities evaluated and corrected?

FedRAMP (Federal Risk and Authorization Management Program)

• US federal government program for cloud product security assessments. (e.g., for infrastructure, platform, and software as a service type offerings)
• ‘FISMA for the cloud’
• Any cloud services that hold federal data must be FedRAMP authorized.
• Assessments performed by third-party assessment organizations which are accredited.

FISMA (Federal Information Security Management Act of 2002)

• Framework for information security management.
• Required for all federal IT systems.