Compliance vs Real Security
The cluster discusses how corporate security often prioritizes compliance checklists, certifications like SOC2, and tools like CrowdStrike for audits over actual effective security practices, labeling it as 'security theater' or 'cargo cult' security.
Activity Over Time
Top Contributors
Keywords
Sample Comments
They want us to be compliant, not secure:https://www.go350.com/posts/they-want-us-to-be-compliant-not...
Probably not. Security is full of the "We're Compliant" types (don't we have insurance for that?) and very few real technologists who know how to hack/break/abuse systems. Target was PCI compliant when their CC data was breached and exposed. There are many more examples of this. Check the box, get owned and no really cares. That needs to change.
Sounds like standard SOC2 cargo cult security.You're not secure until you spin around 5 times and say the magic incantation while documenting that you've done it for the audit.
This is what happens when security is treated like a checklist item instead of a core requirement
Security team in most of the corporates is just a bunch of checklists markers, so for zscaler, crowdstrike or whatever they’re doing for compliance and/or certification and you can’t say no to it because it’s the company policy and who know better than “security” team?
Seems like an outsourcing of compliance/security likely to avoid this exact thing
I'm honestly surprised that nobody b here has mentioned getting a compliance certificate like a SOC2. Within the US that's what's expected by these security teams. Take a look at Comply: https://github.com/strongdm/complyThat will get you your security policies and an overview of what your looking for. If you do decide to get certified make sure to how a vendor that does bot
Idk, I have done security audits for startups and small tech companies. They won't have a security engineer on staff and are "moving fast and breaking things". I've seen things much more misguided than this.
This has relatively little to do with actual security. It is compliance and certification theater for the most part. In many cases you can avoid it entirely by outsourcing caring about it to the customer. This isn’t always a bad thing; sometimes they understand and can deliver on their requirements much better than you can.
Compliance makes more than security?