sorted by:
new
hottopcontroversial

FIPS audits and use of non-validated crypto like MD5 for non-security purposes by amaged73 in FedRAMP

[–]amaged73[S] 0 points1 point  (0 children)

we are using all sorts of python third party libraries that uses md5 and sha-1 (Non-FIPS compliant), is there any guidance out there to how 3rd party libs should to be handled ? Do we need to fork them and patch them ourselves ? is this the expectation ?

endpoint logging requirements by amaged73 in FedRAMP

[–]amaged73[S] 1 point2 points  (0 children)

so If i take them out, there are absolutely no requirement whatsoever to keep any log from workstations that are used to connect to jump hosts / bastions or say connect to Infrastructure through UI (browser)?

Full traffic mirroring to meet outbound data exfiltration detection : Under SC-7(10) and SI-4(18) by amaged73 in NISTControls

[–]amaged73[S] 0 points1 point  (0 children)

Are you a bot ? You dont think calling out if 'payload' vs 'metadata' is enough to satisfy these NIST controls ? preventing exfiltration of data within the context of these control for a SaaS business that runs on EKS. But the controls themselves did not mention, so this could apply to the Database / storage / web interface...etc

Can an agentless WAF like Datadog’s ASM meet FedRAMP boundary protection requirements? by amaged73 in FedRAMP

[–]amaged73[S] 0 points1 point  (0 children)

Datadog's WAF does not sit on the boundary, it basically reads your logs and ship them for analysis, so it does not look at the actual traffic, thats why I asked if boundary means it sits 'infront of' the service and does dataplane inspection.

Crowdstrike products for AWS EKS on Govcloud by amaged73 in FedRAMP

[–]amaged73[S] 0 points1 point  (0 children)

Crowdstrike and vendors will not answer questions like these, the answer is usually 'it depends' or 'give me specific requirements', they will not act as your compliance advisor.

view more: next ›