2

We have a tactical red team in-house. For the company compliance audit (SOC 2 and/or ISO 27001), we are forced to install the compliance check agent. With almost all the malware and hacking tools, how can we exclude or propose to the auditor not to mark them as noncompliant?

4
  • 3
    Did you talk to the auditor?
    – nvoigt
    Oct 2, 2021 at 9:04
  • @nvoigt I want to know how the community suggest, not to just to negotiate with the auditor to ignore the attack box.
    – Toan Ha
    Oct 2, 2021 at 9:27
  • 1
    Is your attack box secure in the first place?
    – fraxinus
    Oct 2, 2021 at 9:50
  • 3
    We are not the auditor. You need to talk to them not a completely irrelevant community with whom you do not need to work with.
    – schroeder
    Oct 3, 2021 at 13:59

3 Answers 3

2

It should be possible to convince the auditor not to apply all of the usual security controls to a testing/attack system (especially ones that will stop it working effectively). They may still want monitoring through (even if they just ignore some of the alerts from it).

But if you want them to exclude it from those controls, as well as explaining why you want them to do that, you need to justify how you're going to manage the risk. These types of systems (especially if you're running something like Kali) are not really designed to be secure of of the box, and can have significant security issues. They also often have access to very privileged information (including sensitive files, passwords and hashes, domain admin credentials, etc).

So if you have a system that you know (or suspect) isn't very secure, and also contains a lot of highly sensitive data, and you're asking your security auditor not to apply the usual security controls, then you need to give them a good explanation of why those controls aren't necessary, and what kind of compensating controls you're going to implement instead.

4
  • 2
    +1, and I'd mirror what other commenters say: this is something best solved by a conversation with the auditor, rather than trying to look for technical solutions ahead of the auditor showing up.
    – Polynomial
    Oct 2, 2021 at 14:15
  • Gotcha. Can you clarify what a good explanation should include?
    – Toan Ha
    Oct 2, 2021 at 16:30
  • @ToanHa the answer is full of good explanations ...
    – schroeder
    Oct 3, 2021 at 14:01
  • @ToanHa for each control you don't want to apply, you should explain how you'll address the underlying issue that the control is trying to address. For example, if you don't want AV software, explain how you'll prevent the system being infected with malware. If you don't want logs going to the SIEM/SOC, explain how you'll monitor the box and identity a compromise. If you don't want individual user accounts, explain how you'll provide accountability. If you don't want to patch the box, explain how you'll manage the risk of outdated software versions.
    – Gh0stFish
    Oct 3, 2021 at 16:14
1

You simply need to ask them since they know the scope, depth, and goal of the audit and what exceptions might apply.

Dear auditor,

We have systems that are intentionally non-compliant and even include malicious tools for the purposes of security testing of the company and to ensure technical compliance. These systems are known, well-documented and have a clear and approved business reason to exist.

How would you like to handle these systems for your audit, since they, too, need to be audited and their risk controls assessed according to their own standard, which will be different from all other company systems?

0
0

You/Your Business Unit need to sign a risk acceptance letter agreeing to accept the risk of the the attack box being vulnerable and lead to a possible exploit of your complete environment.

As long as there is a business justification and a risk waiver the auditors should not have an issue with it.

1
  • 1
    You can accept the risk, yet the assets would still be marked as non-compliant and would show up on a report. For instance a SOC2 qualified finding (which can be a big problem). Simply accepting the risk does not deal with that problem.
    – schroeder
    Mar 14, 2022 at 9:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .