GitLab Security Department, 4 Oct 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: What does the Compliance Team Do?

Description

Devin Harris (Senior Security Analyst, Field Security - https://about.gitlab.com/handbook/engineering/security/#field-security) and Jennifer Blanco (Senior Security Analyst, Compliance - https://about.gitlab.com/handbook/engineering/security/#compliance) discuss what exactly the Compliance Team does at GitLab.

Jennifer mentions several key links which are here:
- https://about.gitlab.com/handbook/engineering/security/sec-controls.html
- https://about.gitlab.com/2019/05/07/choosing-a-compliance-framework/
- https://about.gitlab.com/2019/04/10/gitlab-security-tools-and-the-hipaa-risk-analysis/
- Slack: @sec-compliance-team

A

Devin: hi, I'm devin harris,, I'm a field security analyst here at gitlab.

A

Today, I'm talking to jennifer blanco. jennifer: hi, I'm jennifer blanco,, I'm a senior security analyst.

B

I'm the compliance team within the security organization.

A

Devin: cool well thanks for taking the time to talk to me today, jennifer. as you know,, we're trying.

A

To increase security awareness here at gitlab and I'd like to talk to you a.

A

Little bit about what the security compliance team does.

B

Jennifer:, of course, so we work with many teams here at gitlab, to carry out activities that really are a service, for our internal and external customers. So some things that are included are,.

B

Our security vendor reviews for procurement, services, filling out customer.

B

Questionnaires, and really just providing consultancy to teams on their compliance requirements.

B

Devin: awesome that sounds like a lot of fun.

A

Can you tell me a cool project that your team is currently working on or has recently finished or wrapped up?.

A

Jennifer: yea, we recently designed and now we're implementing a control.

B

Framework that will prepare gitlab for its first external audit and it'll.

B

Result in a report which is very important to our stakeholders, so it's.

B

For a ssae 16, soc2, type2 specifically, and the report will include a.

B

Description of the design of our organization's controls and also the.

B

Auditor will actually perform a test against those controls and include their.

B

Opinion within the report, so it's really important, especially to our customers.

B

Because they're often learning more through those reports, then you know.

B

Submitting their questionnaires because there's just questions they couldn't predict about our background. That's included in that report.

A

Devin: really cool,, and now that you mention it,, didn't we open-source, like do a blog on that framework?.

A

Jennifer: we do yeah,, we have a couple blogs actually out for that, so I'll make.

B

Sure to get that link, so you can have that.

A

Devin: cool yeah,, we'll link those in the video.

A

That was something that I saw before I came here,. I was pretty excited about that and then lastly, I know you mentioned that you guys do a lot of services when.

A

And how would somebody contact you?, jennifer: yeah,, so there's a few different ways to.

B

Contact us, a great way if you have questions about.

B

A process like one of the ones, I've mentioned,, you can contact us on slack. So.

B

The #security channel, if it's to actually kick off that request, we do that through.

B

Issues in gitlab and of course, if you have any questions at any time, feel free.

B

To contact us directly, but we also have a monthly office hours, open office hours for the team.

B

Devin: awesome and I'm assuming that's probably on the gitlab calendar events calendar?.

A

Jennifer: that it is devin: awesome well, thank you very much for your time today. It was really great talking to you and I'm sure a lot of people are going to find this useful jennifer:. Alright, thank you. Devin: thanks.