Thanks for the clarification, in that case the text is indeed really weak. Does that system work in practice, or are companies just claiming they are HIPAA compliant with close to no actual auditing mechanism?

▲

giaour 17 minutes ago | parent | next [-]

It's been a few years since I worked in this space, but HIPAA doesn't really work under the same kind of legal framework. Oversimplifying here, but basically HIPAA defines what constitutes personal health information, how such information may be used, and establishes monetary penalties for improper use and unauthorized disclosure. The law doesn't have any certification standard, no more than the prohibition on stealing cars does.

Maybe there's some kind of third party certification system to support signing information sharing agreements ("BAAs") with other health information systems. I worked at CMS on first-party stuff so I'm not really familiar with how it works in the private sector.

▲

tptacek 5 hours ago | parent | prev [-]

You get that the technical controls in SOC2 are also extremely weak, right?

▲

dgellow 4 hours ago | parent [-]

Sure, yes. The way I understand SOC2 relies on the auditors to set the effective standard. So it really depends who audited you

▲

tptacek 4 hours ago | parent [-]

SOC2 auditors are accountants. A SOC2 auditor verifies only that you're doing what you say what you're doing.

▲

kevin_nisbet 3 hours ago | parent | next [-]

And the way they verify you are doing what you say you are doing is by asking you to provide evidence, which is usually pretty easy to demonstrate that a policy was followed once or twice, a lot harder for them to pick up consistency issues or exceptions.

▲

dgellow 4 hours ago | parent | prev [-]

Obviously, yes

▲

akerl_ 4 hours ago | parent [-]

A SOC auditor who tells you that you can’t use an nmap scan to meet SOC2 obligations is a bad SOC auditor, because they’re attempting to enforce a constraint on you that SOC2 does not.

But the far more likely thing is that a medium SOC auditor, upon being told “we do our vulnerability scanning with nmap”, would say “I haven’t heard of nmap. You should use Tenable,” and if you’re letting SOC auditor drive your engineering you’d make a mistake and accidentally think that meant you needed to change your answer for SOC2 and go buy Tenable licenses.

	▲	dgellow 4 hours ago \| parent [-]
		The whole thread drifted way too far from a very mild push back I had regarding the claim « any automated process that can plausibly be described as instrumental in finding some kind of vulnerability is a "vulnerability scan" ». My experience is that no, SOC2 auditors won’t consider literally any automated process of that sort as compliant. Which in no way implies the auditors are forcing you to use a licensed tool or driving your engineering. I will stop that thread here, I don’t think that exchange is productive