Storj Town Hall - November 14, 2024

[jammerdan]

@Dominick

One of the key sticking points in a distributed storage network is the concept of “control” specifically “control over the nodes” as nodes are defined in “Components of the system”. We have some creative ideas about passing this requirement with public nodes but have received some pushback from auditors/consultants in the research phase.

It seems @stuberman has some experience in this field and might be able to add something useful.

Discussion on Commercial Storage Node Operator Program

Passing a SOC2 audit (typically needed every year) requires each entity, let’s say Storj in this case, to prove their processes are secure. It is not enough to use encryption. How do they manage keys? Where are the vulnerabilities? Is there code tested prior to release? Is their system penetration tested annually by a competent 3rd party? Do they do background checks on their employees? Do they publish, internally, an org chart and keep it up to date? (And many other controls which require evid…