Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel > #119673

Re: Interest in ISO 27001 audit/certification for the Debian Project?

Show all headers | View raw

]] Russ Allbery 

> Simon Josefsson <simon@josefsson.org> writes:

>> That pattern applies to Ubuntu, although I guess ISO 27001 on its own
>> may not have been the biggest motivation there.  Still, the end result
>> is that Ubuntu has ISO 27k and Debian hasn't.

Ubuntu doesn't have it, though. Canonical's ISMS is ISO27001 certified.
There's no mention of Ubuntu in the press release.

[...]

> Certification compliance is not something I would ever work on without
> being paid, personally. It is not enjoyable or fun; it's a job whose only
> real benefit is the paycheck you get for doing it. That's of course just
> my personal opinion; maybe someone out there finds filling out ISO 27001
> paperwork a great way to spend a lazy Saturday afternoon.

I'm obviously not going to tell you what you enjoy or not, but I think
that's a poor (but sadly quite common) way of doing compliance
work. Compliance work should be like running make check – it's a way of
testing that your procedures are actually as expected and provide
verification that the security properties you put into the system still
hold.  If it's compliance for compliance's sake, it'll be thrown out the
window at the first opportunity.

All that said, I don't think we should be doing 27001, SOC2 or
similar. We're not aligned in how we work and doing an audit including
audit trails and such is completely infeasible, even if we were able to
explain it to an auditor.  As an example, and as someone who holds some
keys in Debian (such as the cert used to sign uploads to MS for shim
signatures), I'd not be particularly interested in spending time proving
documenting or proving to an auditor what my security controls for that
key particular is.

Cheers,
-- 
Tollef Fog Heen
UNIX is user friendly, it's just picky about who its friends are

Back to linux.debian.devel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Interest in ISO 27001 audit/certification for the Debian Project? Farruco <farruco@envs.net> - 2025-11-18 10:50 +0100
  Re: Interest in ISO 27001 audit/certification for the Debian Project? Jonathan Kamens <jik@kamens.us> - 2025-11-18 15:30 +0100
    Re: Interest in ISO 27001 audit/certification for the Debian Project? Simon Josefsson <simon@josefsson.org> - 2025-11-18 15:40 +0100
      Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-18 20:00 +0100
        Re: Interest in ISO 27001 audit/certification for the Debian Project? Simon Josefsson <simon@josefsson.org> - 2025-11-19 14:20 +0100
          Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-19 19:40 +0100
            Re: Interest in ISO 27001 audit/certification for the Debian Project? Simon Josefsson <simon@josefsson.org> - 2025-11-20 06:30 +0100
              Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-20 09:10 +0100
              Re: Interest in ISO 27001 audit/certification for the Debian Project? Holger Levsen <holger@layer-acht.org> - 2025-11-20 10:00 +0100
            Re: Interest in ISO 27001 audit/certification for the Debian Project? Tollef Fog Heen <tfheen@err.no> - 2025-11-22 22:20 +0100
              Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-22 22:50 +0100
                Re: Interest in ISO 27001 audit/certification for the Debian Project? Tollef Fog Heen <tfheen@err.no> - 2025-11-23 14:10 +0100
                Re: Interest in ISO 27001 audit/certification for the Debian Project? Jonathan Kamens <jik@kamens.us> - 2025-11-23 15:30 +0100
                Re: Interest in ISO 27001 audit/certification for the Debian Project? Jonathan Kamens <jik@kamens.us> - 2025-11-23 16:20 +0100
                Re: Interest in ISO 27001 audit/certification for the Debian Project? Colin Watson <cjwatson@debian.org> - 2025-11-23 16:20 +0100
  Re: Interest in ISO 27001 audit/certification for the Debian Project? Jeremy Stanley <fungi@yuggoth.org> - 2025-11-18 23:10 +0100
    Re: Interest in ISO 27001 audit/certification for the Debian Project? Farruco <farruco@envs.net> - 2025-11-19 17:30 +0100
      Re: Interest in ISO 27001 audit/certification for the Debian Project? Russ Allbery <rra@debian.org> - 2025-11-19 20:20 +0100
  Re: Interest in ISO 27001 audit/certification for the Debian Project? Marc Haber <mh+debian-devel@zugschlus.de> - 2025-11-19 13:50 +0100
    Re: Interest in ISO 27001 audit/certification for the Debian Project? Salvo Tomaselli <tiposchi@tiscali.it> - 2025-11-19 14:10 +0100

csiph-web