The SOC2 Starting Seven
This is a fantastic article overall. As someone who has now gone through SOC 2 twice (first at Dropbox as an IC, now at Fleetsmith as cofounder&#x2F;CSO, the only part I disagree with is the advice re: MDM.<p>If you want to make SOC 2 easy, you should choose us (fleetsmith.com) over the competition.<p>There are some specific things SOC 2 cares about with regard to laptops. The ones that can take effort are:<p>- User to device inventory attribution (&quot;give me a list of all your Macs and which employees they belong to&quot;)<p>- FileVault enforcement, with automatic (and secure) escrow of the recovery keys<p>- Enforcement of some kind of AntiVirus (either the native stuff built in to macOS, or deployment of a third party solution like MalwareBytes)<p>Each of those 3 items are very time-intensive efforts with competing products. With Fleetsmith, each of them are quite literally (not marketing hype) a few clicks.<p>We&#x27;re also the leader in terms of security. If you&#x27;re interested in the intersection of MDM and security research, check out the following:<p>&quot;Hacking a Brand New Mac Remotely, Right Out of the Box&quot; — Article summarizing research presented at Black Hat 2018.<p><a href="https:&#x2F;&#x2F;www.wired.com&#x2F;story&#x2F;mac-remote-hack-wifi-enterprise&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.wired.com&#x2F;story&#x2F;mac-remote-hack-wifi-enterprise&#x2F;</a><p>--<p>A Deep Dive into macOS MDM (and how it can be compromised) — 61 page whitepaper related to Black Hat research.<p><a href="https:&#x2F;&#x2F;i.blackhat.com&#x2F;us-18&#x2F;Thu-August-9&#x2F;us-18-Endahl-A-Deep-Dive-Into-macOS-MDM-And-How-It-Can-Be-Compromised-wp.pdf" rel="nofollow">https:&#x2F;&#x2F;i.blackhat.com&#x2F;us-18&#x2F;Thu-August-9&#x2F;us-18-Endahl-A-Dee...</a><p>--<p>On DEP, MDM, device identity, and authentication — Blog post on the security of the device enrollment process. Includes Fleetsmith’s secure device enrollment implementation, in hopes that other vendors in the space will adopt it.<p><a href="https:&#x2F;&#x2F;medium.com&#x2F;fleetsmith&#x2F;on-dep-mdm-device-identity-and-authentication-82c9b78cb9c2" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;fleetsmith&#x2F;on-dep-mdm-device-identity-and...</a><p>--<p>An Enterprise Security Roadmap for macOS — Detailed blog post on improvements that Apple should make to macOS and MDM, and why. Includes a detailed list of over 50+ bug reports&#x2F;feature requests.<p><a href="https:&#x2F;&#x2F;blog.fleetsmith.com&#x2F;macos-enterprise-security-roadmap&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.fleetsmith.com&#x2F;macos-enterprise-security-roadma...</a><p>If anyone is interested in chatting about any of this stuff (the product or the security side) I&#x27;m on Twitter at @jesseendahl and on the MacAdmins Slack (macadmins.org) at @jesse.