The Pragmatic Auditor's Blog

Another day and another set of Google Alerts on SAS 70.   Most links are press releases saying that a service provider has been SAS 70 certified, SAS 70 secured or some other mischaracterization of what SAS 70 was actually intended to do. Other links are blog posts blasting these same marketers (and indirectly the CPAs) about how a SAS 70 is insufficient and not prescriptive enough to be a basis for comparison of security controls.

For several years, I ran the product lines for one of the largest managed security service providers in the world.  I was ALWAYS being asked about security controls, whether it was before, during, or after the negotiation of a large global outsourcing contract.

So from my perspective, I would equate this dialogue to the following:

My wife: Doug have you had your H1N1 shot?
My response: I get an annual physical.

Sure a physical is a good thing to have, but it didn’t answer her question. The same thing happens here when customers and prospects ask questions about what controls are in place only to be provided with an answer that the controls (which aren’t stated) have been audited.  Another good thing to have done but does not answer to the question.

So here’s a novel idea…. how about tell them?  Better yet, how about a white paper? Now before the security professionals start throwing  tomatoes my way for suggesting more marketing involvement in security assurance, hear me out.

• The problem is that most providers are not talking about what they are doing to protect their customers’ data.  Instead they are citing audit reports, which are generally restricted in nature to use by customers and their auditors.
• In this day of cloud computing (and paranoia), security features are key product features.
• Service providers, your audit reports should serve to validate what you are already telling people you do, not become your source of information sharing.  They should be your response when a customer says “prove it” not “show me.”

The following are some examples found online:

• GotoMyPC.com – Paranoid about GoToMyPC could do in the wrong hands?  Citrix published a 9 page white paper on all of the security features and also what the user’s responsibilities are.
• WebEx Security – Cisco provides an overview of controls in place but also guidance on how WebEx users can be more careful.
• Switch and Data – S&D provides a good listing of available security, physical, and environmental controls.
• Rackspace – A concise but descriptive 1 page overview of security controls.  (Rackspace has many other whitepapers on security as well).

While I think these are a good start, it is clear that that sharing information about security is not common-place (and often taboo) for service providers.  This is not rocket science, its marketing 101 where you promote the features and functionality that your customers care about and we know they care about security and reliability.  Despite what your CISO may say, you can actually can share information about security controls without naming platforms, versions, IP addresses, and other data which could get put to use by the wrong persons.

So how about a mid-year resolution to tell your customers more about how you secure their data?

This is also why I am an active participant with Chris Hoff and the cloudaudit.org group.  We are not trying to create new standards but create an automated mechanism (via open APIs) to share security and control data with the people that need it to make decisions.  While the data doesn’t come from the audit firms, the providers certainly have the opportunity to prove what they are doing through SAS 70 audits, PCI validation, ISO certification, and other independent means.

In a world of “show me don’t tell me” a little tell me could go a long way here.