SOC 2 Compliance

SOC 2 is an auditing procedure that ensures your service providers securely manage your data to protect the interests of your organization and the privacy of its clients. For security-conscious businesses, SOC 2 compliance is a minimal requirement when considering a SaaS provider.

Notes about SOC 2:

• Developed by America Institute of CPAs (AICPA).
• Defined cirteria for managing customer data based on 5 "trust service principles" - security, availability, processing integrity, confidentiality and privacy.
• SOC 2 reports are unique to each organization (Vs PCI DSS which is rigid requirements)
• Type I describes if a vendors system and design is suitable to meet relevant trust principles.
• Type II describes the operational effectiveness of vendor systems.

Links:

• https://www.aicpa.org/cpe-learning/course/soc-2r-report-walkthrough
  

An Easier Way to Multi cloud, Multi account Cloud Compliance (and Demo)

 

Compliance professionals understand the challenges of auditing modern cloud environments that span multiple accounts and multiple cloud providers.

Tools:

• OSQuery - https://osquery.io/
  
• CloudQuery - https://hub.cloudquery.io/
  

Leveraging OSQuery for Compliance - A Recovering Auditor’s Perspective

 

OSquery, developed by Facebook, is well known among DevSecOps practitioners as a great low-level operating system monitoring tool for endpoints and servers. In part 2 of our 3-part series on automating compliance, SANS Associate instructor AJ Yawn will discuss how compliance professionals can leverage OSQuery to collect technically accurate evidence for security audits in an efficient and streamlined manner.

See the previous blog post about QSquery here.

Using OSQuery for Security Compliance

Osquery, a tool initially developed by Facebook, is an opensource tool that queries an operating system as if it were a relational database. It leverage SQL-like queries to gather Operating System information for performance, security, compliance audit analysis.

Links:

• https://www.uptycs.com/blog/3-useful-ways-osquery-can-help-with-security-compliance
• https://www.uptycs.com/blog/osquery-what-it-is-how-it-works-and-how-to-use-it
• https://www.sans.org/webcasts/leveraging-osquery-for-compliance/
• https://www.sans.org/webcasts/an-easier-way-to-multi-cloud-multi-account-cloud-compliance/
  
• https://www.sans.org/blog/why-automation-compliance-cloud-part-1/
• https://zercurity.medium.com/building-atop-osquery-compliance-monitoring-threat-hunting-and-auditing-dec2d3da4911
• https://zercurity.medium.com/what-is-osquery-ea90270d10de
• https://kifarunix.com/install-osquery-on-ubuntu/
  

Microsoft IT Compliance Management Guide

This is a new solution accelerator publichsed by Microsoft to help shifting IT governance, risk, and compliance (GRC) efforts from people to technology. It aims to help IT people to understand better on how to address GRC with an IT management framework implemented.

Click here for the IT Compliance Management Guide.

Published: October 29, 2008

About This Solution Accelerator

The IT Compliance Management Guide can help you shift your governance, risk, and compliance (GRC) efforts from people to technology. This Accelerator helps you better understand how an IT management framework can help you implement controls to address GRC requirements that apply to your organization. In addition, you can use its configuration guidance to help efficiently address your organization's GRC objectives.

The IT Compliance Management Guide is a Microsoft Operations Framework (MOF) 4.0 companion guide that is based on the Regulatory Compliance Planning Guide. It addresses GRC authority document requirements.

The IT Compliance Management Resources workbook provides an extensive inventory of GRC–related configuration and management guidance organized by Microsoft products.

"This guide contains the information that will enable IT professionals to have an informed discussion with their GRC subject matter experts, including legal and audit personnel. The overview of the audit process and descriptions of general GRC terminology and control concepts will allow IT professionals to be an active participant in these discussions. The associated workbook provides a comprehensive list of Microsoft resources that address GRC planning and product configuration topics relevant to IT professionals.