Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //


12:48 PM

7 Routes To Reducing The Compliance 'Tax'

Complying with security standards and regulations is a cost of doing business, but through smart practices that cost doesn't have to be so high

Sometimes that myriad of security regulatory requirements can appear to enterprises as a burdensome compliance tax on the business. The checklists, baselines, standards and rules at play continue to add up and without a strategy in place, it might seem like the cost of complying outweighs the consequences of ignoring them. However, meaningful adherence to the spirit of the laws -- actually improving the risk posture of the organization -- brings a lot of business returns beyond the satisfaction of auditors

"Compliance mandates have been introduced to force businesses to think about security and privacy rather than risk the personal data of their customers and value of their shareholders," says Adam Ely, COO of Bluebox, former head of security and compliance at TiVo and former CISO of the Heroku business unit at Salesforce. "In reality, the cost of compliance is a cost of doing business and one that should have been realized all along."

As for that compliance tax, it doesn't necessarily have to be as expensive as some believe it to be. There are a number of strategies, tools and practices that can greatly reduce associated costs. But before tackling those, remember to look up and see the forest for the trees. Information security professionals can be a bit myopic in how they view compliance, looking at it strictly as a technical issue, says Tim Erlin, director of security and risk strategy for nCircle.

"But it's a business problem," he says. "Businesses can avoid compliance requirements with cost-driven strategies, in the same ways they reduce their corporate tax burden. One example of this kind of strategy is the decision to avoid PCI compliance by outsourcing credit card processing so you don't actually store any credit card data."

1. Think Top-Down Vs. Bottom-Up
Organizations that view compliance as a function of risk management activities rather than the other way around tend to better keep their compliance costs in check, experts agree.

In a lot of cases, a top-down approach can help organizations reduce costs by as much as 25 to 45 percent, says A.N. Ananth, CEO of EventTracker.

"Use a top-down, risk-based approach instead of an overly detailed, bottom-up assessment," says Ananth, citing two recent releases by the Public Company Accounting Oversight Board (PCAOB) as a good place to look for proof on why and how it works. "The PCAOB has identified the primary drivers of cost to be the scope of the internal control audit and the amount of management testing being performed."

In simplest terms, many describe this as a "test-once, comply-to-many" approach, says Torsten George, vice president of worldwide marketing, products and support for risk management firm Agiliance, who believes that instituting security controls and then cross-mapping them to individual mandates is the most efficient approach.

"This allows IT staff to document compliance to multiple regulations and mandates using fewer steps and resources," he says.

[Are you measuring all of your compliance ROI? See 5 Hidden Benefits of IT Compliance Programs.]

Key to cross-mapping is the institution of quality security metrics. Repeatable and understandable means for measuring security performance will greatly streamline the audit process, Erlin says.

"Compliance is about audits, and audits are about measurement. If you're already have a security program in place, there's a good chance you're close to being compliant but you have to articulate this to an auditor," he says. "If you're regularly measuring your security performance you're way ahead of the game."

Not only could a top-down approach offer compliance cost-savings, but it also stands to drive ROI from security activities

"The flip-side to regulatory pressures on security preparedness being a tax is that those companies that are prepared will have a competitive advantage," says Gant Redmon, general counsel and vice president of business development for Co3 Systems. "The companies that possess the tools and competence to know what security measure they have in place, benchmark their security preparedness, and have incident response procedures in place will experience regulations as validation of their efforts."

2. Continuous Monitoring With A Caveat
Continuous monitoring has quickly gained steam as a tool deployed to improve the dexterity of risk management and compliance activities. But continuous monitoring alone won't necessarily guarantee cost savings on the compliance front, says Yo Delmar, vice president of GRC solutions at MetricStream.

Without some sort of centralized platform to synthesize information from those feeds and correlate them to policies, standards, configuration baselines and regulations, the benefits won't be realized.

"Continuous controls monitoring can dramatically reduce the burden of compliance for information security if and only if IT GRC platforms also map to regulatory requirements," she says.

3. Use Data Classification To Your Advantage
You don't want to put a $200 fence around a $5 asset, but in the same vein it doesn't make sense to put a $5 fence around a $2,000 asset, says Caroline Wong, director of regional product management for risk and compliance at Symantec. Without data classification, though, it is difficult to make financial value-based judgments on where to invest.

"Businesses should manage security and compliance like any other aspect of the business, the investment has to make sense for the business," Wong says. "It all comes down to proper data classification -- assess which assets are important to the company and protect them accordingly."

4. Examine Security Tools With Circumspection
Often the burden of security and compliance is wrapped up in how much expertise is needed to run the controls put in place and what kind of performance hits those controls will place on IT infrastructure. Organizations should not just be looking at how much tools cost, but also what kind of expenses they'll incur once deployed.

"Organizations typically focus on the capital expenditure but underestimate cost of ongoing administration and/or change management," says Oliver Wai, product manager for Barracuda Networks, explaining that complex tools are not always the best option. "Select a solution that is flexible and easy to administer. In fact, complex solutions are often riskier solutions due to misconfiguration by administrators."

Similarly, organizations should be seeking controls with performance requirements that match the organization's capability to meet them.

"Often organizations are wildly optimistic in projecting traffic requirements or performance needs," he says. "Analyze the network or application performance before selecting a solution."

Next Page: Automate And Embed

1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Kurt Johnson
Kurt Johnson,
User Rank: Strategist
2/12/2013 | 9:44:55 PM
re: 7 Routes To Reducing The Compliance 'Tax'
We agree with and would recommend that businesses analyze potential risk associated with user access on a continuous basis to determine whether the right people have the right access to the right information and resources, and are doing the right things with that access.

This gives businesses the insight needed to uncover deeply embedded policy violations or improper access, and take action to remediate before failing an audit or falling victim to a security breach. The continuous monitoring also enables more of a security focus, rather than a scheduled audit event.- By looking at this information continuously, the organization can be better prepared to respond to auditors without it being an all-hands effort come audit time.
- Kurt Johnson, Courion
Cybersecurity Industry: It's Time to Stop the Victim Blame Game
Jessica Smith, Senior Vice President, The Crypsis Group,  2/25/2020
5 Ways to Up Your Threat Management Game
Wayne Reynolds, Advisory CISO, Kudelski Security,  2/26/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-28
A denial of service issue was addressed with improved input validation.
PUBLISHED: 2020-02-28
The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux.
PUBLISHED: 2020-02-28
OpenVPN Connect on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.
PUBLISHED: 2020-02-28
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux...
PUBLISHED: 2020-02-27
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.