A capable colleague passed on a request from their client. They want to know if the VM disks are encrypted at rest, if the keys are rotated periodically, and if there's a key retention procedure in place. Ironically, the client's VPS runs on Ubuntu 18.04, which has been out of updates for a year, and despite numerous notifications to upgrade, they believe it can wait. 😄
Some big client of theirs wants to be iso 9001 certified, which requires their suppliers to provide security guarantees.
Lawyers write boilerplate letters, send letters to all suppliers. And they contact their IT guys and ask the questions that were in the letter. About that Ubuntu 18.04 servers.
Add comment