Teleport 16: Advancing Infrastructure Defense in Depth with Device Trust, MFA, and VNET
Jul 25
Virtual
Register Today
Teleport logoTry For Free

SOC 2 compliance for cloud infrastructure access

Easily implement access controls and enforce security policies required to ace your SOC 2 audit.

Get Started
Hero section illustration
Background image
Logo for NASDAQLogo for Moody'sLogo for HPLogo for IBM

What is SOC 2 Type II compliance?

SOC 2 (Service Organization Control 2) Type II is a widely recognized auditing standard that focuses on a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy. Achieving SOC 2 Type II compliance for cloud infrastructure requires a comprehensive approach that includes implementing various controls, processes, and policies. The following checklist provides a simple preview as you embark upon your SOC 2 compliance journey:

  1. Define Security Policies: Establish clear and comprehensive security policies that cover areas such as access control, data protection, incident response, and change management.
  2. Implement Access Controls: Set up strong access controls to ensure that only authorized individuals have access to the cloud compute infrastructure and DevOps team infrastructure. This includes implementing strong authentication mechanisms, role-based access controls, and monitoring access logs.
  3. Implement Security Controls: Implement the necessary security controls defined by the FedRAMP Moderate or High baselines, such as encryption, access controls, auditing, and incident response.
  4. Monitor and Log Activities: Implement robust monitoring and logging mechanisms to track activities within the infrastructure. This includes monitoring for suspicious behavior, logging system events, and retaining logs for a specified duration.
  5. Perform Regular Risk Assessments: Conduct periodic risk assessments to identify and address potential vulnerabilities and risks within the infrastructure. This includes performing vulnerability scans, penetration testing, and code reviews.
  6. Conduct Employee Training: Provide regular training and awareness programs to educate employees on security best practices, policies, and procedures.

Achieve SOC 2 Type II Compliance

With Teleport's Open Infrastructure Access Platform

Automated Provisioning

Reduce overhead with Teleport's infrastructure auto-discovery and SSO integration for automated onboarding and offboarding of employees.

Robust Security Controls

Go beyond the minimum requirements with Teleport's built-in security controls, including multi-factor authentication, role-based access controls, and session recording.

Audit & Accountability

Continuously monitor with Teleport's audit log and session recording capabilities, providing a complete record of all user activity.

Try Teleport today

In the cloud, self-hosted, or open source.
View developer docs

Get Started
pam

Teleport Features for SOC 2 Type II Controls

SOC 2 Type II ControlHow Teleport Helps Compliance

CC6.1 - Restricts Logical Access

Logical access to information assets, including hardware, data (at-rest, during processing, or in transmission), software, administrative authorities, mobile devices, output, and offline system components is restricted through the use of access control software and rule sets.

Teleport Enterprise supports robust Role-based Access Controls (RBAC) to:

  • Control which SSH nodes a user can or cannot access.
  • Control cluster level configuration (session recording, configuration, etc.)
  • Control which UNIX logins a user is allowed to use when logging into a server.

CC6.1 - Identifies and Authenticates Users

Persons, infrastructure, and software are identified and authenticated prior to accessing information assets, whether locally or remotely.

Provide role-based access controls (RBAC) using short-lived certificates and your existing identity management service. Connecting locally or remotely is just as easy.

CC6.1 - Considers Network Segmentation

Network segmentation permits unrelated portions of the entity's information system to be isolated from each other.

Teleport enables Beyond Corp, Zero Trust network segmentation

Connect to nodes behind firewalls or create reverse tunnels to a proxy server

CC6.1 - Manages Points of Access

Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed.

Label Nodes to inventory and create rules

Create Labels from AWS Tags

Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time.

CC6.1 - Restricts Access to Information Assets

Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets.

Teleport uses Certificates to grant access and create access control rules

CC6.1 - Manages Identification and Authentication

Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software.

Teleport makes setting policies for SSH requirements easy since it works in the cloud and on premise with the same authentication security standards.

CC6.1 - Manages Credentials for Infrastructure and Software

New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use.

Invite nodes to your cluster with short lived tokens

CC6.1 - Uses Encryption to Protect Data

The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk.

Teleport Audit logs can use DynamoDB encryption at rest.

CC6.1 - Protects Encryption Keys

Processes are in place to protect encryption keys during generation, storage, use, and destruction.

Teleport acts as a Certificate Authority to issue SSH and x509 user certificates that are signed by the CA and are (by default) short-lived.

CC6.2 - Controls Access Credentials to Protected Assets

Information asset access credentials are created based on an authorization from the system's asset owner or authorized custodian.

Request Approval from the command line

Build Approval Workflows

Use Plugins to send approvals to tools like Slack or Jira

CC6.2 - Removes Access to Protected Assets When Appropriate

Processes are in place to remove credential access when an individual no longer requires such access.

Teleport issues temporary credentials based on an employees role and are revoked upon job change, termination or end of a maintenance window

CC6.2 - Reviews Appropriateness of Access Credentials

The appropriateness of access credentials is reviewed on a periodic basis for unnecessary and inappropriate individuals with credentials.

Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time.

CC6.3 - Creates or Modifies Access to Protected Information Assets

Processes are in place to create or modify access to protected information assets based on authorization from the asset's owner.

Build Approval Workflows to get authorization from asset owners.

CC6.3 - Removes Access to Protected Information Assets

Processes are in place to remove access to protected information assets when an individual no longer requires access.

Teleport uses temporary credentials and can be integrated with your version control system or even your HR system to revoke access with the Workflow API

CC6.3 - Uses Role-Based Access Controls

Role-based access control is utilized to support segregation of incompatible functions.

Role based access control ("RBAC") allows Teleport administrators to grant granular access permissions to users.

CC6.3 - Reviews Access Roles and Rules

The appropriateness of access roles and access rules is reviewed on a periodic basis for unnecessary and inappropriate individuals with access and access rules are modified as appropriate.

Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time.

CC6.6 - Restricts Access

The types of activities that can occur through a communication channel (for example, FTP site, router port) are restricted.

Teleport makes it easy to restrict access to common ports like 21, 22 and instead have users tunnel to the server using Teleport. Teleport uses the following default ports.

CC6.6 - Protects Identification and Authentication Credentials

Identification and authentication credentials are protected during transmission outside system boundaries.

Yes, Teleport protects credentials outside your network allowing for Zero Trust network architecture

CC6.6 - Requires Additional Authentication or Credentials

Additional authentication information or credentials are required when accessing the system from outside its boundaries.

Yes, Teleport can manage MFA with TOTP or U2F Standards or connect to your Identity Provider using SAML, OAUTH or OIDC

CC6.6 - Implements Boundary Protection Systems

Boundary protection systems (for example, firewalls, demilitarized zones, and intrusion detection systems) are implemented to protect external access points from attempts and unauthorized access and are monitored to detect such attempts.

Teleport offers a trusted clusters concept to manage trust across arbitrary infrastructure boundaries.

CC6.7 - Uses Encryption Technologies or Secure Communication Channels to Protect Data

Encryption technologies or secured communication channels are used to protect transmission of data and other communications beyond connectivity access points.

Teleport has strong encryption including a FedRAMP compliant FIPS mode

CC7.2 - Implements Detection Policies, Procedures, and Tools

Processes are in place to detect changes to software and configuration parameters that may be indicative of unauthorized or malicious software.

Teleport creates detailed SSH Audit Logs with Metadata

Use Enhanced Session Recording to catch malicious program execution

CC7.2 - Designs Detection Measures

Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers; (2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software.

Use Enhanced Session Recording to catch malicious program execution, capture TCP connections and log programs accessing files on the system the should not be accessing.

CC7.3 - Communicates and Reviews Detected Security Events

Detected security events are communicated to and reviewed by the individuals responsible for the management of the security program and actions are taken, if necessary.

Use Session recording to replay and review suspicious sessions.

CC7.3 - Develops and Implements Procedures to Analyze Security Incidents

Procedures are in place to analyze security incidents and determine system impact.

Analyze detailed logs and replay recorded sessions to determine impact. See exactly what files were accessed during an incident.

CC7.4 - Contains Security Incidents

Procedures are in place to contain security incidents that actively threaten entity objectives.

Use Teleport to quickly revoke access and contain an active incident.

Use Shared Sessions so Multiple On-Call Engineers can collaborate and fight fires together.

CC7.4 - Ends Threats Posed by Security Incidents

Procedures are in place to mitigate the effects of ongoing security incidents.

Use Teleport to quickly revoke access and contain an active incident.

CC7.4 - Obtains Understanding of Nature of Incident and Determines Containment Strategy

An understanding of the nature (for example, the method by which the incident occurred and the affected system resources) and severity of the security incident is obtained to determine the appropriate containment strategy, including (1) a determination of the appropriate response time frame, and (2) the determination and execution of the containment approach.

Use Teleport's Session Recording and Replay along with logs to understand what actions led to an incident.

CC7.4 - Evaluates the Effectiveness of Incident Response

The design of incident-response activities is evaluated for effectiveness on a periodic basis.

Use audit logs and session recordings to find pain points in your incident response plan and improve effectiveness.

CC7.4 - Periodically Evaluates Incidents

Periodically, management reviews incidents related to security, availability, processing integrity, confidentiality, and privacy and identifies the need for system changes based on incident patterns and root causes.

Use Session recording and audit logs to find patterns that lead to incidents

CC7.5 - Determines Root Cause of the Event

The root cause of the event is determined.

Use Session recording and audit logs to find root cause.

CC7.5 - Improves Response and Recovery Procedures

Lessons learned are analyzed and the incident-response plan and recovery procedures are improved.

Replay Session recordings at your 'after action review' or postmortem meetings

Try Teleport today

In the cloud, self-hosted, or open source.
View developer docs

Get Started
pam