Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Private Cloud Compute SoC 3 audit reports

support.apple.com

Post reply on HN
Print view View original

21–30 of 61 posts

Re: Apple Private Cloud Compute SoC 3 audit reports

#21

Post by a-priori »

FinnKuhn wrote: post #11
Terretta wrote: post #10

Earlier quoted context omitted.

Importantly, anyone can get SOC2 (Type 1) by claiming some controls they figure they'll look at themselves. SOC2 (Type 2) in theory requires an audit that you're actually doing what you said you'd do in (Type 1). Both may also allow general lag time. Note that firms decide on their own which controls to include, meaning, they get to decide to include or exclude various controls, the audit is on only the ones they pic…

I think companies like Deel showed that SOC2 is more show than anything else. For context, this is how easy it is to get a SOC2: https://deepdelver.substack.com/p/delve-fake-compliance-as-a...

A SOC2's quality entirely depends on how much you trust the auditing firm.

Delve used an audit mill they paid to rubber-stamp the cookie-cutter and AI slop reports it authored. I hope it ends up in fraud charges.

But I wouldn't assume that's the case for all SOC2 reports. Any decent auditing firm should be far more rigorous.

Re: Apple Private Cloud Compute SoC 3 audit reports

#22

Post by FireBeyond »

bayesnet wrote: post #15
deepsun wrote: post #12

Earlier quoted context omitted.

> "look I can afford 50k" Oh no. Looks like you never went through SOC2. 1. No, it does not require 50k, an auditor can cost way less (10k? maybe even less). 2. But the process of preparing for the audit will take a lot of work securing your systems (and increasing reliability and privacy as well), as long as you take it seriously. Of course you can lie to the auditor, but it's up on you. And auditor -- they might lo…

That auditors are responsible for catching the lies of an audited company on penalty of being suspended is a position that the big audit firms would not agree with. They might agree that they are responsible for ensuring the material accuracy of accounts if fraud occurs, but even here EY has disclaimed responsibility if the fraud were sufficiently complex [0]. Indeed auditors lobbied very hard against being mandated…

> Admittedly this is on the "real" audit side and not the advisory/consulting side, which would be the ones to handle SOC I imagine, but nonetheless a position I find a bit absurd.

I mean, it's not like the supposed "Chinese wall" at the Big 4 has ever been accused of being "illusory" on multiple occasions.

Re: Apple Private Cloud Compute SoC 3 audit reports

#23

Post by paulryanrogers »

datakan wrote: post #20
paulryanrogers wrote: post #18

Earlier quoted context omitted.

Citation needed. This is not my experience at all, after participating in such efforts at three different companies.

I'll just cite my 30 years in IT/InfoSec. Believe it or not, I really don't give a damn. It's common knowledge int he field regardless of what your experience is.

Can you name the names of SOC auditors that are rubber stamping?

Or point me to some public critiques within the industry?

Re: Apple Private Cloud Compute SoC 3 audit reports

#24

Post by FinnKuhn »

paulryanrogers wrote: post #17
FinnKuhn wrote: post #11

Earlier quoted context omitted.

I think companies like Deel showed that SOC2 is more show than anything else. For context, this is how easy it is to get a SOC2: https://deepdelver.substack.com/p/delve-fake-compliance-as-a...

Hasn't Deel been run out of business though? IME SOC2 is still quite involved for any company, especially smaller ones without specialized security personnel.

Their website is still up, but I have a hunch you can find some other certificate mill that will give you a SOC2 certificate just as easily.

Re: Apple Private Cloud Compute SoC 3 audit reports

#25

Post by an0malous »

paulryanrogers wrote: post #23
datakan wrote: post #20

Earlier quoted context omitted.

I'll just cite my 30 years in IT/InfoSec. Believe it or not, I really don't give a damn. It's common knowledge int he field regardless of what your experience is.

Can you name the names of SOC auditors that are rubber stamping? Or point me to some public critiques within the industry?

Wasn’t that YC startup Delve doing exactly this?

https://www.iansresearch.com/resources/all-blogs/post/securi...

Re: Apple Private Cloud Compute SoC 3 audit reports

#26

Post by sethhochberg »

shye wrote: post #16
arkadiyt wrote: post #6

For anyone unaware, a SOC3 is just a SOC2 with the audit details removed - it includes a high level statement from the company (Apple) and from the auditor (EY), that's it. Also Apple certainly does invest heavily in security and privacy but SOC2's are so commoditized that it's like saying "look I can afford 50k", it's not particularly interesting

Last I chatted with some friends who were going through their first SOC2, they quoted a much lower number.

The details people gloss over when throwing SOC 2 or whatever other audit costs around are the complexity of the system being audited, the chosen criteria to audit (AICPA defines 5 families of criteria... Security is one, but you can optionally add Processing Integrity, Confidentiality, etc etc) and the reputation of the auditor.

A security-only audit for a small company with a narrow product focus can indeed be very inexpensive. A full SOC 2 examination for a large organization with a mix of legacy and modern systems by a name-recognizable public accounting firm can be many hundreds of thousands of dollars, or more if you need a Big 4 firm.

In my opinion, there's not much value to the "cheap" audits... If you're doing enterprise sales to a certain kind of client, your partners who demand an audit are going to want a reputable auditor or they're just going to put you through their own in-depth procurement due diligence regardless. The segment of the industry where a SOC 2 attestation is mandatory to participate but where any random auditor will do feels pretty narrow.

Re: Apple Private Cloud Compute SoC 3 audit reports

#27

Post by FinnKuhn »

a-priori wrote: post #21
FinnKuhn wrote: post #11

Earlier quoted context omitted.

I think companies like Deel showed that SOC2 is more show than anything else. For context, this is how easy it is to get a SOC2: https://deepdelver.substack.com/p/delve-fake-compliance-as-a...

A SOC2's quality entirely depends on how much you trust the auditing firm. Delve used an audit mill they paid to rubber-stamp the cookie-cutter and AI slop reports it authored. I hope it ends up in fraud charges. But I wouldn't assume that's the case for all SOC2 reports. Any decent auditing firm should be far more rigorous.

These audits for Apple were done by EY.

As a German I remember that they were banned from doing certain audits in Germany until earlier this year due to their involvement in the wirecard scandal. So at least my personal believe that their audits are done rigorously is nonexistent.

https://edition.cnn.com/2023/04/03/business/wirecard-ey-ban-...

Re: Apple Private Cloud Compute SoC 3 audit reports

#28

Post by tptacek »

a-priori wrote: post #21
FinnKuhn wrote: post #11

Earlier quoted context omitted.

I think companies like Deel showed that SOC2 is more show than anything else. For context, this is how easy it is to get a SOC2: https://deepdelver.substack.com/p/delve-fake-compliance-as-a...

A SOC2's quality entirely depends on how much you trust the auditing firm. Delve used an audit mill they paid to rubber-stamp the cookie-cutter and AI slop reports it authored. I hope it ends up in fraud charges. But I wouldn't assume that's the case for all SOC2 reports. Any decent auditing firm should be far more rigorous.

Not really. The more expensive the auditor, the more they'll work with you to craft something that will avoid exceptions. There's no real "rigor" involved in SOC2! The "audit" here is in audit in the accounting sense: "do your records square up?". SOC2 auditors are generally not technical people.

Re: Apple Private Cloud Compute SoC 3 audit reports

#29

Post by tptacek »

shye wrote: post #16
arkadiyt wrote: post #6

For anyone unaware, a SOC3 is just a SOC2 with the audit details removed - it includes a high level statement from the company (Apple) and from the auditor (EY), that's it. Also Apple certainly does invest heavily in security and privacy but SOC2's are so commoditized that it's like saying "look I can afford 50k", it's not particularly interesting

Last I chatted with some friends who were going through their first SOC2, they quoted a much lower number.

You can get a SOC2 done for mid to mid-high thousands.

Re: Apple Private Cloud Compute SoC 3 audit reports

#30

Post by tptacek »

paulryanrogers wrote: post #18
datakan wrote: post #9

Earlier quoted context omitted.

Everyone lies on SOC2. Auditors don't understand the technologies and just take peoples word for it. It's a shit practice

Citation needed. This is not my experience at all, after participating in such efforts at three different companies.

I wouldn't put it the way they did but they're directionally sane about this. I would worry a lot more about someone repping their SOC2 as important or meaningful than I would worry about someone who was cynical about SOC2.

(I don't mean Apple; Apple spends more on security than almost any firm in the world.)

https://fly.io/blog/soc2-the-screenshots-will-continue-until...

Post reply on HN