Comments on: BS Filtering for CISOs: Vendors and Third Parties http://daveshackleford.com/?p=192 Musings on Security & Other Stuff Wed, 08 Sep 2010 10:33:27 -0700 http://wordpress.org/?v=2.9.2 hourly 1 By: admin http://daveshackleford.com/?p=192&cpage=1#comment-133 admin Tue, 09 Jun 2009 02:23:21 +0000 http://daveshackleford.com/?p=192#comment-133 Good points, Mr. D. Good points, Mr. D.

]]> By: James DeLuccia IV http://daveshackleford.com/?p=192&cpage=1#comment-131 James DeLuccia IV Sun, 07 Jun 2009 22:59:35 +0000 http://daveshackleford.com/?p=192#comment-131 Dave, Great points - though I would embellish the first two bullets a bit to avoid being tricked by their IT Staff through "shock and awe". - SAS 70 are based on management determined controls, so to depend on them YOU must verify the controls being audited (i.e., don't accept the Executive Cover Letter, but require review of the actual control tests). Second to make a SAS 70 Type II useful - verify the scope of the audit includes your concerns. (this leads me to bullet #2). - Audit results are great - beware of SCOPE. Most organizations will try to secure data carefully, but when 3rd party validations occur they are restricted to specific types of control checks that are designed to prevent specific types of risks. Unless your data falls under those "specifics" you need to look beyond the standards advertised. Other thoughts? James DeLuccia IV Dave,

Great points – though I would embellish the first two bullets a bit to avoid being tricked by their IT Staff through “shock and awe”.
- SAS 70 are based on management determined controls, so to depend on them YOU must verify the controls being audited (i.e., don’t accept the Executive Cover Letter, but require review of the actual control tests). Second to make a SAS 70 Type II useful – verify the scope of the audit includes your concerns. (this leads me to bullet #2).

- Audit results are great – beware of SCOPE. Most organizations will try to secure data carefully, but when 3rd party validations occur they are restricted to specific types of control checks that are designed to prevent specific types of risks. Unless your data falls under those “specifics” you need to look beyond the standards advertised.

Other thoughts?

James DeLuccia IV

]]>