Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Why Are Security Pros Blasé About Compliance?
Oldest First  |  Newest First  |  Threaded View
Page 1 / 3   >   >>
Alison_Diana
Alison_Diana,
 User Rank: Moderator
8/28/2014 | 2:28:06 PM
More Details Please
I'd love to know more about who responded to the studies. Focusing as I do on healthcare, many organizations don't have CSOs or CISOs, meaning there's no specific executive responsible for overseeing the overall security realm. That means they don't have a top-level exec partnerhing with chief counsel (inhouse or contract) -- and that means governance and compliance get shunted on to the CEO, COO, or other exec who has a gazillion other things going on. Since compliance involves a whole lot more than technology, it's important that ownership extends to someone who oversees security as a whole, not just tech.
RyanSepe
RyanSepe,
 User Rank: Ninja
8/28/2014 | 3:19:25 PM
Regulators
I just commented about this in a previous article. As you say in the article, many corporations just strive to be compliant. This is setting the bar very low and definitely doesn't ensure data saftey which has been delineated by the recent breaches. 

What needs to happen is that higher compliance and security measures need to become standards. If this is set as the minimal requirement than organizations will follow shortly behind. Its unfortunate, but unless stringent repercussions are in place. In seems that frivolous corporate America will continue to cut corners.

**Above is a generalized statement. Does not apply to all organizations.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
8/29/2014 | 8:07:25 AM
Re: Regulators
There is a definitely a disconnect between being compliant enough to meet a low regulatory bar and being compliant to a regulation to improve an organization's'security profile. But @RyanSepe, do you think its an enforcement problem? In other words, will companies take better precautions if they know the penalties (outside of the cost of a breach) will be tougher?
Cybdiver
Cybdiver,
 User Rank: Apprentice
8/29/2014 | 8:36:28 AM
Re: More Details Please
A perfect answer in my opinion.  The lack of technical understanding and support at the top levels of managment are usually the source of lack of compliance. 

Unfortuantly while they tout how much they want to be in compliance they forget the human factor is part of the securtiy too and fail to enforce the very rules of compliance required.  Getting a computer to cooperate is easy,  getting the board of directors and C level officers to follow rules is another trick.
aws0513
aws0513,
 User Rank: Ninja
8/29/2014 | 8:39:42 AM
The culture of the organization.
In my IT security experiences, the level of attention to compliance by the security team was directly affected by the amount of management emphasis on the need for security and security compliance.

I am all about security compliance.  As a matter of fact, I tend to focus on not just compliance, but operationalization of compliance.  The establishment of policies and standards is first, followed closely by procedures and processes.  But it is the persistent utilization of those procedures and processes that really make security programs effective.

I also use compliance as a stick when I need to convince system owners and management that a certain control solution is necessary.  Often, it is the only stick I have.

The problem has commonly been that some organizational management still sees security as just overhead.  Security rarely contributes to the bottom line unless the organization business is security.  I have been in situations where the marketing team had more respect for the security aspects of the business than the corporate management.

The lax attitude by management directly affects the security team.  Even if a security team is ambitious about compliance, they quickly lose any motivation when running into a wall of management that falls asleep during discussions about security.  This demotivation is also augmented when management is slow to assist in obtaining resources to implement necessary controls to meet compliance.  It is the classic "why should I even try anymore" attitude that eventually defines the compliance culture of the security team and the entire organization.

It all comes down to the corporate culture established by the top management team.  If they consider security to be integral to their entire operations, then compliance will be much more evident in the security team plans and activities.
Alison_Diana
Alison_Diana,
 User Rank: Moderator
8/29/2014 | 9:02:41 AM
Re: The culture of the organization.
You are right on the money. I remember when HIPAA first came out, and security and compliance experts were excited that they finally had a stick to wave. Well, they didn't -- because nothing happened when companies were not compliant with HIPAA. Now the government is finally taking action against organizations that aren't HIPAA-compliant, they do have something to back up their cautionary words; in the case of smaller organizations, which are equally culpable, a $100K fine can be make or break. But in the case of a huge multi-million dollar operation, that fine may be cheaper than actually being compliant. Unless the culture demands compliance and is committed to security, governance, and security -- and that has to come from the top.
François Amigorena
François Amigorena,
 User Rank: Author
8/29/2014 | 9:04:20 AM
Re: Regulators
Thanks for your comment. I agree, it's always tempting to cut corners and perhaps we do need more stringent standards. Technology that can help organisations meet those standards more easily has a part to play too though.
François Amigorena
François Amigorena,
 User Rank: Author
8/29/2014 | 9:05:31 AM
Re: More Details Please
Hi Alison, thanks for your comment. The sample was designed to be representative across industries, and a total of 57 out of the 500 identified as being in healthcare. You're quite right though, too often these issues are left to be dealt with by individuals with 100 other things on their plate. But even when there is a CISO the CEOs and COOs have to take some responsibility and ownership; as you say technology alone can't solve the problem so you do need commitment from the very top.
DarkReadingTim
DarkReadingTim,
 User Rank: Strategist
8/29/2014 | 9:55:33 AM
Re: More Details Please
I'm not sure I agree that security pros are blase' about compliance. In many organizations, it's compliance, not security, that drives budget/funding for many security-related projects. CEOs understand that they must prove compliance in order to operate in their industries, so they sometimes are willing to part with budget for compliance in a way that they won't do for security alone. In those cases, compliance becomes the driver for a security project, because there is budget there.

I think your two examples represent the extremes of compliance. SOX requires security but offers almost no specifics on how to achieve it. PCI, on the other hand, requires that enterprises meet more than 100 specific requirements, and even mandates the use of specific technologies such as WAFs. Security professionals may feel ambivalent about SOX, primarily because there is not much direction for them to work with. PCI, conversely, means implementing specific controls before the auditor arrives.
François Amigorena
François Amigorena,
 User Rank: Author
8/29/2014 | 11:11:12 AM
Re: The culture of the organization.
Thanks for your comment. I absolutely agree. Management must set an example and it's interesting to hear about your experience where that has far from been the case. I know that security teams can often have difficulty explaining the necessity of meeting certain security measures, and of course it's hard to get the message across when it's not something that affects the organisation's bottom line.

Really, management should be getting a big red warning sign that this should really matter to them, as top level executives at huge businesses are losing their jobs as a result of security related issues. 
Page 1 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file