Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel > #119643

Re: Interest in ISO 27001 audit/certification for the Debian Project?

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Jonathan Kamens <jik@kamens.us> writes:

> Speaking as someone who has been in the driver's seat for multiple ISO
> 27001, SOC 2, and PCI DSS audits:
>
> ISO 27001 certification for Debian would, in my opinion, be mostly
> pointless and would not bring nearly enough benefit to justify the
> significant cost in money, time, and effort. Four reasons:
>
> 1) Debian's infosec practices are leaps and bounds above those of most
> entities that have ISO 27001 certification. Getting audited will not
> help Debian significantly improve or become significantly more secure.

Debian's handling of the archive crypto key could definitely be
improved, and I'd be surprised if available public documentation of
Debian's processes around this would live up to ISO 27001 scrutiny or
even Debian's preference to not hide things from our users.

I agree with you that ISO 27001 certications are often pointless, but I
would disagree that Debian would not be improved by further
documentation and transparency work.  There is little assurance that the
archive private key isn't leaked by unknown key holders, or it may even
be generated on proprietary compromised devices.

/Simon

Back to linux.debian.devel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Interest in ISO 27001 audit/certification for the Debian Project? Farruco <farruco@envs.net> - 2025-11-18 10:50 +0100
  Re: Interest in ISO 27001 audit/certification for the Debian Project? Jonathan Kamens <jik@kamens.us> - 2025-11-18 15:30 +0100
    Re: Interest in ISO 27001 audit/certification for the Debian Project? Simon Josefsson <simon@josefsson.org> - 2025-11-18 15:40 +0100
      Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-18 20:00 +0100
        Re: Interest in ISO 27001 audit/certification for the Debian Project? Simon Josefsson <simon@josefsson.org> - 2025-11-19 14:20 +0100
          Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-19 19:40 +0100
            Re: Interest in ISO 27001 audit/certification for the Debian Project? Simon Josefsson <simon@josefsson.org> - 2025-11-20 06:30 +0100
              Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-20 09:10 +0100
              Re: Interest in ISO 27001 audit/certification for the Debian Project? Holger Levsen <holger@layer-acht.org> - 2025-11-20 10:00 +0100
            Re: Interest in ISO 27001 audit/certification for the Debian Project? Tollef Fog Heen <tfheen@err.no> - 2025-11-22 22:20 +0100
              Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-22 22:50 +0100
                Re: Interest in ISO 27001 audit/certification for the Debian Project? Tollef Fog Heen <tfheen@err.no> - 2025-11-23 14:10 +0100
                Re: Interest in ISO 27001 audit/certification for the Debian Project? Jonathan Kamens <jik@kamens.us> - 2025-11-23 15:30 +0100
                Re: Interest in ISO 27001 audit/certification for the Debian Project? Jonathan Kamens <jik@kamens.us> - 2025-11-23 16:20 +0100
                Re: Interest in ISO 27001 audit/certification for the Debian Project? Colin Watson <cjwatson@debian.org> - 2025-11-23 16:20 +0100
  Re: Interest in ISO 27001 audit/certification for the Debian Project? Jeremy Stanley <fungi@yuggoth.org> - 2025-11-18 23:10 +0100
    Re: Interest in ISO 27001 audit/certification for the Debian Project? Farruco <farruco@envs.net> - 2025-11-19 17:30 +0100
      Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-19 20:20 +0100
  Re: Interest in ISO 27001 audit/certification for the Debian Project? Marc Haber <mh+debian-devel@zugschlus.de> - 2025-11-19 13:50 +0100
    Re: Interest in ISO 27001 audit/certification for the Debian Project? Salvo Tomaselli <tiposchi@tiscali.it> - 2025-11-19 14:10 +0100

csiph-web