Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Why Are Security Pros Blasé About Compliance?
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
Alison_Diana
50%
50%
Alison_Diana,
 User Rank: Moderator
8/29/2014 | 11:40:18 AM
Re: The culture of the organization.
Not to be nasty or mean, but it's good to hear some executives are losing their jobs because organizations aren't meeting security or compliance goals or needs. As I say, I don't want to be horrible about this, but sometimes the impetus for change is putting a person's name and personal responsibility (as in their job, jail time, or a personal fine -- not a corporate fine that can be passed off to taxpayers or consumers) onto a failure to comply. Only then, perhaps, will compliance expand across most, if not all, organizations. Really, executives should worry. After all, their information is at risk in other companies, if not their own!
François Amigorena
100%
0%
François Amigorena,
 User Rank: Author
8/29/2014 | 11:11:40 AM
Re: The culture of the organization.
Actually HIPAA is another case in point. I hadn't highlighted it in the article as the sample size was too small to really call it significant, but of the relatively small sample of IT decision makers in healthcare I mentioned earlier just over 50% didn't know whether they were compliant with HIPAA. Interesting to hear your experiences about the motivations as to why organisations aren't paying attention to it. As @aws5013 says, if there's no obvious or immediate financial implication then often the board level struggle see it as a priority. Hopefully that is changing.
François Amigorena
50%
50%
François Amigorena,
 User Rank: Author
8/29/2014 | 11:11:12 AM
Re: The culture of the organization.
Thanks for your comment. I absolutely agree. Management must set an example and it's interesting to hear about your experience where that has far from been the case. I know that security teams can often have difficulty explaining the necessity of meeting certain security measures, and of course it's hard to get the message across when it's not something that affects the organisation's bottom line.

Really, management should be getting a big red warning sign that this should really matter to them, as top level executives at huge businesses are losing their jobs as a result of security related issues. 
DarkReadingTim
50%
50%
DarkReadingTim,
 User Rank: Strategist
8/29/2014 | 9:55:33 AM
Re: More Details Please
I'm not sure I agree that security pros are blase' about compliance. In many organizations, it's compliance, not security, that drives budget/funding for many security-related projects. CEOs understand that they must prove compliance in order to operate in their industries, so they sometimes are willing to part with budget for compliance in a way that they won't do for security alone. In those cases, compliance becomes the driver for a security project, because there is budget there.

I think your two examples represent the extremes of compliance. SOX requires security but offers almost no specifics on how to achieve it. PCI, on the other hand, requires that enterprises meet more than 100 specific requirements, and even mandates the use of specific technologies such as WAFs. Security professionals may feel ambivalent about SOX, primarily because there is not much direction for them to work with. PCI, conversely, means implementing specific controls before the auditor arrives.
François Amigorena
50%
50%
François Amigorena,
 User Rank: Author
8/29/2014 | 9:05:31 AM
Re: More Details Please
Hi Alison, thanks for your comment. The sample was designed to be representative across industries, and a total of 57 out of the 500 identified as being in healthcare. You're quite right though, too often these issues are left to be dealt with by individuals with 100 other things on their plate. But even when there is a CISO the CEOs and COOs have to take some responsibility and ownership; as you say technology alone can't solve the problem so you do need commitment from the very top.
François Amigorena
50%
50%
François Amigorena,
 User Rank: Author
8/29/2014 | 9:04:20 AM
Re: Regulators
Thanks for your comment. I agree, it's always tempting to cut corners and perhaps we do need more stringent standards. Technology that can help organisations meet those standards more easily has a part to play too though.
Alison_Diana
50%
50%
Alison_Diana,
 User Rank: Moderator
8/29/2014 | 9:02:41 AM
Re: The culture of the organization.
You are right on the money. I remember when HIPAA first came out, and security and compliance experts were excited that they finally had a stick to wave. Well, they didn't -- because nothing happened when companies were not compliant with HIPAA. Now the government is finally taking action against organizations that aren't HIPAA-compliant, they do have something to back up their cautionary words; in the case of smaller organizations, which are equally culpable, a $100K fine can be make or break. But in the case of a huge multi-million dollar operation, that fine may be cheaper than actually being compliant. Unless the culture demands compliance and is committed to security, governance, and security -- and that has to come from the top.
aws0513
50%
50%
aws0513,
 User Rank: Ninja
8/29/2014 | 8:39:42 AM
The culture of the organization.
In my IT security experiences, the level of attention to compliance by the security team was directly affected by the amount of management emphasis on the need for security and security compliance.

I am all about security compliance.  As a matter of fact, I tend to focus on not just compliance, but operationalization of compliance.  The establishment of policies and standards is first, followed closely by procedures and processes.  But it is the persistent utilization of those procedures and processes that really make security programs effective.

I also use compliance as a stick when I need to convince system owners and management that a certain control solution is necessary.  Often, it is the only stick I have.

The problem has commonly been that some organizational management still sees security as just overhead.  Security rarely contributes to the bottom line unless the organization business is security.  I have been in situations where the marketing team had more respect for the security aspects of the business than the corporate management.

The lax attitude by management directly affects the security team.  Even if a security team is ambitious about compliance, they quickly lose any motivation when running into a wall of management that falls asleep during discussions about security.  This demotivation is also augmented when management is slow to assist in obtaining resources to implement necessary controls to meet compliance.  It is the classic "why should I even try anymore" attitude that eventually defines the compliance culture of the security team and the entire organization.

It all comes down to the corporate culture established by the top management team.  If they consider security to be integral to their entire operations, then compliance will be much more evident in the security team plans and activities.
Cybdiver
50%
50%
Cybdiver,
 User Rank: Apprentice
8/29/2014 | 8:36:28 AM
Re: More Details Please
A perfect answer in my opinion.  The lack of technical understanding and support at the top levels of managment are usually the source of lack of compliance. 

Unfortuantly while they tout how much they want to be in compliance they forget the human factor is part of the securtiy too and fail to enforce the very rules of compliance required.  Getting a computer to cooperate is easy,  getting the board of directors and C level officers to follow rules is another trick.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
8/29/2014 | 8:07:25 AM
Re: Regulators
There is a definitely a disconnect between being compliant enough to meet a low regulatory bar and being compliant to a regulation to improve an organization's'security profile. But @RyanSepe, do you think its an enforcement problem? In other words, will companies take better precautions if they know the penalties (outside of the cost of a breach) will be tougher?
<<   <   Page 2 / 3   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/7/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
'Unkillable' Android Malware App Continues to Infect Devices Worldwide
Jai Vijayan, Contributing Writer,  4/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18375
PUBLISHED: 2020-04-10
The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console.
CVE-2019-18376
PUBLISHED: 2020-04-10
A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) user's web browser history or a network device that intercepts/logs traffic to MC, to obtain CSRF tokens and use them to perform CSRF attacks against MC.
CVE-2019-7305
PUBLISHED: 2020-04-10
Information Exposure vulnerability in eXtplorer makes the /usr/ and /etc/extplorer/ system directories world-accessible over HTTP. Introduced in the Makefile patch file debian/patches/debian-changes-2.1.0b6+dfsg-1 or debian/patches/adds-a-makefile.patch, this can lead to data leakage, information di...
CVE-2020-8832
PUBLISHED: 2020-04-10
The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 (&quot;The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.&quot;) was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacke...
CVE-2020-1633
PUBLISHED: 2020-04-09
Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4, crafted NDPv6 packets could transit a Junos device configured as a Broadband Network Gateway (BNG) and reach the EVPN leaf node, causing a stale MAC address entry. This could cause legitimate traffic to be discarded, lea...