381–390 of 506 posts
Another option would be you set up something like that for working with that client and install their agent on it.
There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…
>We do not share your personal information with third parties without your consent, except in the following circumstances or as described in this Privacy Policy: Affiliates. We may share your personal information with our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy. Service providers. We may share your personal information with third party companies and individuals…
Watch out for what all permissions that software agent has. Big firms when they issue their own hardware often install such agents that have ability to not just monitor activity, but also wipe out data or change user account credentials. I personally find it weird if the ask is to install such agent on BYOD (personal device), since not just the company data, but your personal data can also be wiped out remotely, or y…
Source: I am the Drata CISO
Earlier quoted context omitted.
It's trivial for software inside to VM to detect that. So, I'd expect any competent agent software to report that back to base. Whether or not the people monitoring the agent's output will care, is a different question. ;)
> It's trivial for software inside to VM to detect that QEMU can get you very far in masking the presence of a VM. If it can work around Nvidia's cash grab of not allowing consumer cards to be used in VMs, it should be able to deal with whatever bullshit spyware.
When doing so on VMware or KVM, things are extremely obvious. I haven't tried just plain QEMU though. :)
Earlier quoted context omitted.
One of the legal guidelines for whether or not someone is a contractor (vs an employee) is whether they provide their own tools. It’s not a hard rule. It’s just one of a number of tests. But contractors are generally expected to provide their own tools.
You could reasonably invoice an upfront tooling cost ("isolated development workstation to meet customer IT policy requirements. Apple Macbook Foo, $BIGNUM") If you want to be really cheeky, could get some value-added margin on it too, and as a bonus, AIUI it would be yours to keep after the engagement, rather than having to return hardware they've assigned to you. Might be tough to get past finance though, unless th…
If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…
I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…
Should we though? what you and the parent outline is a most sensible way of accommodating it while minimising invasion of privacy, however I question the underlying reasoning, and therefore whether or not we should encourage it. What perceived gains are to be had beyond merely box checking for accreditations? and in those cases why is it part of those accreditations, what is the intended effect? I can think of a few but they are all flawed or attempting to enforce something impossible:
1. Preventing leaking code/IP (But if you can't trust them they could just as easily take a picture of the screen, capture the HDMI, copy the drive, even log their own keyboard... there are always side channels unless you physically control the environment).
2. Preventing them from doing something malicious... But if they are writing code for you and they are untrustworthy, isn't it already game over?
3. Bean counting, monitoring time spent at keyboard etc - which we all know is not an accurate metric of productivity for cognitive work.
4. Similarly to #1 and #2, unintentional breach or security issues, i.e you trust the person but not their device or their ability to secure their own device - In which case spyware seems wholly inadequate to cope with this situation, if you are serious about this, you should be controlling the hardware and OS (which lots of orgs with highly sensitive info do).
In all these cases spyware is futile. Am I missing something?
Drata has a web application where you can upload evidences of the requirements. The agent just makes it easier. If you are not comfortable, it should not be a big issue. You can choose not to install it and upload a couple screenshots of requested settings (having disk encryption enabled, having a password manager installed etc) periodically. If the client forces it that is a little unreasonable because drata tracks…
My company is implementing this exact thing - and in general for company laptops I'd say it's not really too crazy (freelancers, contactors will most likely be given machines too if they need any level of access to our stuff/code). From what drata told our team - the agent is based on OSQuery, and just reports disk encryption, antivirus, screen lock, installed applications. Not sure what the other commenters in this…
Just out of interest - what happens if you have multiple clients who both want a Drata agent installed? Do you know how well it handles multiple servers?
Source: Drata CISO
Earlier quoted context omitted.
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.
Network segmentation with vlan is what I would do.
- $CORP devices are on a VLAN + Wifi that has access to the internet, but no other internal networks
- Internal network for file servers/printers and the like
- Personal device network, think laptops/phones/tablets that are mine, can reach internal network
- IoT network - Think sensors/robot vacuums/"smart devices"
- Guest network, for well visitors to my home
- AirPlay network, has all my Apple devices on it to allow for music to be airplay'ed to TV's/HomePods, can be reached from internal/personal/guest network
This is not something the average home user or consultant is going to setup/configure/manage and I don't expect it either.
The worry that the $CORP device will be abused to "validate the security of the network its connected to" is very much a possibility. Most corporations have no desire to do so, and endpoint protection is their primary goal, and they don't need to scan your home network to do so, it is all local to the device. It's about protecting the integrity of the device, not the rest of the network around it.
If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…
I would want a big compensation increase to deal with this. Like on the order of 2x my rate.