#compliance - June 2023

@Erik Osterman (Cloud Posse) has joined the channel

@Ozzy Aluyi has joined the channel

@Jonathan Eunice has joined the channel

set the channel description: Discuss topics related to compliance.

set the channel description: Discuss topics related to compliance. See also #security.

Yesterday’s discussion on FedRAMP, compliance != security, and related topics was excellent. Good to know I’m not struggling with these things alone.

Little background on us: 3Play Media Inc. takes in audio and video and processes it with combination of AI (really, ML, but who’s counting when “AI” is the hot hype word) and human review/correction to produce captions, subtitles, transcripts, audio descriptions, and other accessibility enhancements. We are Cloud Posse graduates (i.e. now in production). Our cloud product, the 3Play Platform, passes SOC 2 and GAAS audits and pentest on our EKS infrastructure/estate. Another part of 3Play passes separate TPN (Motion Picture Association) audit more oriented to on-prem processing model. We are also HIPAA, GDPR, CCPA/CPRA, FERPA, and Microsoft SSPA compliant (but we don’t formally audit against those). We’re consistently looking to harden and lock down (partly for security, partly to meet ever-rising, ever-encroaching customer demands esp. from media, entertainment, finance, and government customers/prospects). Currently using OneTrust Certification Automation (great for past 2 years, but seems to have stalled after Tugboat was acquired). Looking to upgrade program to better align with NIST SP 800-53 and friends and/or ISO 27001 (in addition to SOC 2 and TPN). We’ve talked about doing FedRAMP and have been requested to meet several crazy-deep custom finance infosec/GRC frameworks. They feel above our current station/capabilities, but we’re edging that direction to prepare for a future deal for which the business says “okay, it’s now worth it to comply, get going!”

@Hao Wang has joined the channel

@Sean has joined the channel

@Jim Conner has joined the channel

Thanks for starting the channel. I’m required to meet nearly all the compliance/authorization types. (ISOs,SOCs,PCI,HiTrust,FedRAMP, …).

yeah, we do fedramp and ISO -- and one more iirc

I'm curious about how you folks, if you use RDBMS, manage the credential rotation requirements --

@Jeff May has joined the channel

@Fizz has joined the channel

@James has joined the channel

@Justin Erny has joined the channel

@Tom Atwood has joined the channel

@Alanis Swanepoel has joined the channel

Another Security/Compliance tool to consider. Early version of it.
Goal is to audit clusters against the “EKS Best Practices Guide (EBPG)“:
https://aws.amazon.com/blogs/containers/hardeneks-validating-best-practices-for-amazon-eks-clusters-programmatically/

@Hans D has joined the channel

@Soren Jensen has joined the channel

@Sam has joined the channel

@Marcin has joined the channel

(Continuing SIEM discussion from office-hours)
Another great tool for SIEM related activities is Falco.
https://falco.org/
https://github.com/falcosecurity/falco

It came from SysDig and is CNCF Incubation.

https://sweetops.slack.com/archives/CHDR1EWNA/p1687980845340909