Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

8/29/2014
02:07 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
50%
50%

Why Are Security Pros Blas About Compliance?

A survey of 500 IT and security decision makers in the UK and US shows that a majority are in the dark about regulatory requirements for their business organization.

Regulatory compliance is often seen as an oppressive demand on an organization, something that must be adhered to because, well, it just has to be, rather than because it benefits the business.

For some IT and security professionals, it's tempting to view the importance of complying with regulatory rules on how to secure data as secondary to their own security measures. You know how to secure your organization's data better than a government agency, right?

The truth is that many regulation sets have very specific requirements around how data is stored and secured, making them very much a consideration for IT. In the US, the Sarbanes-Oxley Act (SOX) and Payment Card Industry Data Security Standards (PCI DSS) are a case in point.

SOX compliant? Not sure…
A recent IS Decisions survey of 500 IT decision makers in the UK and US sheds some light on the fact that a majority of IT professionals are in the dark about whether there even are regulatory requirements for their organization. A full 57% of respondents in the US "don't know" whether they are compliant with SOX or not.

SOX, as you probably know, applies to public companies and as such is designed to ensure the accuracy of financial data and combat fraudulent activity. It is quite specific about addressing one of the greatest security challenges, particularly for large organizations: insider threats.

Most US organizations are not publicly listed, so perhaps IT teams can be excused for not being sure about their SOX compliance. But firstly, SOX must be considered -- this is federal law. Though it doesn't apply if your business is not publicly listed, some awareness of its implications can't hurt.

Moreover, the sheer number of internal security breaches occurring in US businesses every day -- our research told us the number is more than 2,500 -- indicates that businesses of every size and financial status could benefit from being aware of these regulations and how they can protect sensitive data.

PCI: widely applicable, broadly ignored
On the other hand, PCI DSS applies to a far greater majority of businesses. The international regulatory standard around the storing, processing, and protection of credit card information applies to all businesses that take card payments, which is most businesses. Yet two-thirds of IT professionals are not sure if they are compliant or not, according to our research.

Despite the fact that the breach-stricken Target appears to have been approved as PCI compliant by the security firm Trustwave, a lawsuit filed against the two organizations claimed that the retailer was not entirely adherent to regulations. Though Target passed compliance testing in September 2012, according to the complaint, the auditors did notice some warning signs at the time, including a lack of network segmentation between card data and the rest of the corporate network. This suggests that, even though Target passed muster, compliance may easily have dropped off in the time before the breach occurred.

Though the lawsuit has now been dropped, the revelations and the fact that the huge breach of cardholder data occurred indicates that PCI compliance is not just a regulatory burden. It's not even a business "must." It's a minimum requirement. Further, it is not a requirement that must be met when the auditors are around; it must be an always-adhered-to standard. Yet two-thirds of IT professionals told us they don't even know if they're meeting those requirements.

Technology is just part of the solution
Like many of the aspects of tackling internal security, achieving compliance with regulations like SOX and PCI can seem insurmountable. Internal security and the related issue of insider threats has to be approached from a cultural perspective, with fundamental changes made to user education and attitudes.

We have seen that the results of failing to meet regulatory standards in examples like the Target case, and we know that the internal security breaches that these regulations are designed to combat are occurring on an astoundingly regular basis. What will it take for security teams to show less indifference toward compliance? Let's chat about that in the comments.

François Amigorena is founder and CEO of IS Decisions, a provider of infrastructure and security management software solutions for Microsoft Windows and Active Directory. IS Decisions offers solutions for user access control, file auditing, server and desktop ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Alison_Diana
100%
0%
Alison_Diana,
User Rank: Moderator
8/28/2014 | 2:28:06 PM
More Details Please
I'd love to know more about who responded to the studies. Focusing as I do on healthcare, many organizations don't have CSOs or CISOs, meaning there's no specific executive responsible for overseeing the overall security realm. That means they don't have a top-level exec partnerhing with chief counsel (inhouse or contract) -- and that means governance and compliance get shunted on to the CEO, COO, or other exec who has a gazillion other things going on. Since compliance involves a whole lot more than technology, it's important that ownership extends to someone who oversees security as a whole, not just tech.
Cybdiver
50%
50%
Cybdiver,
User Rank: Apprentice
8/29/2014 | 8:36:28 AM
Re: More Details Please
A perfect answer in my opinion.  The lack of technical understanding and support at the top levels of managment are usually the source of lack of compliance. 

Unfortuantly while they tout how much they want to be in compliance they forget the human factor is part of the securtiy too and fail to enforce the very rules of compliance required.  Getting a computer to cooperate is easy,  getting the board of directors and C level officers to follow rules is another trick.
Franois Amigorena
50%
50%
Franois Amigorena,
User Rank: Author
8/29/2014 | 9:05:31 AM
Re: More Details Please
Hi Alison, thanks for your comment. The sample was designed to be representative across industries, and a total of 57 out of the 500 identified as being in healthcare. You're quite right though, too often these issues are left to be dealt with by individuals with 100 other things on their plate. But even when there is a CISO the CEOs and COOs have to take some responsibility and ownership; as you say technology alone can't solve the problem so you do need commitment from the very top.
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
8/29/2014 | 9:55:33 AM
Re: More Details Please
I'm not sure I agree that security pros are blase' about compliance. In many organizations, it's compliance, not security, that drives budget/funding for many security-related projects. CEOs understand that they must prove compliance in order to operate in their industries, so they sometimes are willing to part with budget for compliance in a way that they won't do for security alone. In those cases, compliance becomes the driver for a security project, because there is budget there.

I think your two examples represent the extremes of compliance. SOX requires security but offers almost no specifics on how to achieve it. PCI, on the other hand, requires that enterprises meet more than 100 specific requirements, and even mandates the use of specific technologies such as WAFs. Security professionals may feel ambivalent about SOX, primarily because there is not much direction for them to work with. PCI, conversely, means implementing specific controls before the auditor arrives.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
8/29/2014 | 12:42:24 PM
Re: More Details Please
I agree, Tim; security pros are not necessarily blase' about compliance. in fact, I'm sure that the vast majority of them take compliance and security very seriously. In my opinion, the biggest challenge they face can be summed up in this scenario:

Executive: Are all the boxes checked?

Security: Yes

Executive: Then we are done.

Security: But there is so much more that we should do to enhance security!

Executive: We are compliant, and that's all we are required to do. We have other priorities.

How many of you have experienced this, or something similar? I know I have, and in more than one instance. The really sad thing about all this whole compliance/security thing is that if an organization cultivates a culture that includes secure practices in all aspects of its business, they will be compliant. When I examine the requirements of standards like PCI-DSS and the security and privacy sections of HIPAA, I cannot help but note that these are simply known security practices - none of them are novel ideas! Furthermore, if a CEO or CIO or any other C-level person does not promote this type of culture, then I submit that that executive does not have the best security interests of the organization at heart, and by extention, place their organizations in jeopardy. I admit that most C level executives are not security or even tech savvy, but in today's connected environment, they must wake up and smell the coffee.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/29/2014 | 2:42:35 PM
Re: More Details Please
@GonzSTL, I have brought this fact to the surface countless times and agree with you whole heartedly. This is why the need for a CISO/CSO is so important. They need to be the drivers of forcing policy, improving standards, and things of that nature to the VP's and Execs. 
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
8/29/2014 | 2:52:17 PM
Re: More Details Please
In my experience it boils down to money.  We have spent all of this money to become compliant, why would we want to spend more on a line item that does not add to the bottom line.  Executives must be educated to the value of security and not just the necissity of it.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
8/29/2014 | 3:56:38 PM
Re: More Details Please
Years ago, the hot topic was to align IT objectives to the goals of an organization. That remains true today, but in addition, security must also align with the goals of the organization. This is more difficult a task because most effects of security are so intangible. In reality, security aligns with IT goals, which in turn align with organizational goals. It really boils down to communicationg security objectives not just in way fit that is for executive consumption, but also to show how security itself aligns and supports organizational goals. To be fair, this is not a one sided task because in order to succeed, executive management must be receptive to the message. Again, in today's connected sociery, with the almost daily news of breaches, executives must listen.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/28/2014 | 3:19:25 PM
Regulators
I just commented about this in a previous article. As you say in the article, many corporations just strive to be compliant. This is setting the bar very low and definitely doesn't ensure data saftey which has been delineated by the recent breaches. 

What needs to happen is that higher compliance and security measures need to become standards. If this is set as the minimal requirement than organizations will follow shortly behind. Its unfortunate, but unless stringent repercussions are in place. In seems that frivolous corporate America will continue to cut corners.

**Above is a generalized statement. Does not apply to all organizations.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/29/2014 | 8:07:25 AM
Re: Regulators
There is a definitely a disconnect between being compliant enough to meet a low regulatory bar and being compliant to a regulation to improve an organization's'security profile. But @RyanSepe, do you think its an enforcement problem? In other words, will companies take better precautions if they know the penalties (outside of the cost of a breach) will be tougher?
Franois Amigorena
50%
50%
Franois Amigorena,
User Rank: Author
8/29/2014 | 9:04:20 AM
Re: Regulators
Thanks for your comment. I agree, it's always tempting to cut corners and perhaps we do need more stringent standards. Technology that can help organisations meet those standards more easily has a part to play too though.
aws0513
50%
50%
aws0513,
User Rank: Ninja
8/29/2014 | 8:39:42 AM
The culture of the organization.
In my IT security experiences, the level of attention to compliance by the security team was directly affected by the amount of management emphasis on the need for security and security compliance.

I am all about security compliance.  As a matter of fact, I tend to focus on not just compliance, but operationalization of compliance.  The establishment of policies and standards is first, followed closely by procedures and processes.  But it is the persistent utilization of those procedures and processes that really make security programs effective.

I also use compliance as a stick when I need to convince system owners and management that a certain control solution is necessary.  Often, it is the only stick I have.

The problem has commonly been that some organizational management still sees security as just overhead.  Security rarely contributes to the bottom line unless the organization business is security.  I have been in situations where the marketing team had more respect for the security aspects of the business than the corporate management.

The lax attitude by management directly affects the security team.  Even if a security team is ambitious about compliance, they quickly lose any motivation when running into a wall of management that falls asleep during discussions about security.  This demotivation is also augmented when management is slow to assist in obtaining resources to implement necessary controls to meet compliance.  It is the classic "why should I even try anymore" attitude that eventually defines the compliance culture of the security team and the entire organization.

It all comes down to the corporate culture established by the top management team.  If they consider security to be integral to their entire operations, then compliance will be much more evident in the security team plans and activities.
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
8/29/2014 | 9:02:41 AM
Re: The culture of the organization.
You are right on the money. I remember when HIPAA first came out, and security and compliance experts were excited that they finally had a stick to wave. Well, they didn't -- because nothing happened when companies were not compliant with HIPAA. Now the government is finally taking action against organizations that aren't HIPAA-compliant, they do have something to back up their cautionary words; in the case of smaller organizations, which are equally culpable, a $100K fine can be make or break. But in the case of a huge multi-million dollar operation, that fine may be cheaper than actually being compliant. Unless the culture demands compliance and is committed to security, governance, and security -- and that has to come from the top.
Franois Amigorena
100%
0%
Franois Amigorena,
User Rank: Author
8/29/2014 | 11:11:40 AM
Re: The culture of the organization.
Actually HIPAA is another case in point. I hadn't highlighted it in the article as the sample size was too small to really call it significant, but of the relatively small sample of IT decision makers in healthcare I mentioned earlier just over 50% didn't know whether they were compliant with HIPAA. Interesting to hear your experiences about the motivations as to why organisations aren't paying attention to it. As @aws5013 says, if there's no obvious or immediate financial implication then often the board level struggle see it as a priority. Hopefully that is changing.
Ed Telders
50%
50%
Ed Telders,
User Rank: Apprentice
8/29/2014 | 1:14:38 PM
Re: The culture of the organization.
Actually PCI DSS is a standard and not a regulation at all.  In some ways though, it has bigger impacts.  This standard is a requirement because of contractual agreements your organization has agreed to for card processing.  There are a few jurisdictions that have mandated PCI compliance to conduct business but they are only a few.  Compliance with PCI is a business and contractual issue.  They have the impact of fines, sanctions, and public disclosure of PCI compliance status. 

All good, still needs to be done, but let's be clear this is not a regulation. 
gwavajeff
50%
50%
gwavajeff,
User Rank: Apprentice
9/8/2014 | 1:49:07 PM
Re: The culture of the organization.
I know you were focused on a couple specific compliance regs. I wanted to point out that there are a number of other compliance regulations of which many organizations are not aware. Most notably Federal Rules of Civil Procedure (FRCP).  The FRCP requires companies to archive their electronic communications, which most assume is email, but has now expanded to mobile device messages (SMS/MMS), instant messaging, as well as employee's social media messages. 

Regulatory and investigation litigations have more than doubled in the last year. According to ESG almost half of businesses surveyed had an eDiscovery request in the last 12-months, and Gartner expects that to be around 75% by the end of the year. 

The Norton Rose Fulbright Annual Litigation Trends Survey found that regulatory litigations and investigations are the largest increase on concern for respondends in the last year, and regulatory litigation over the last year has more than doubled. 

Here are a few more compliance regulations for those that are interested:

Financial Industries Regulations
  • FINRA, SEC, MiFID and FSA government rules
  • Dodd-Frank Act (which requires that you produce communications within 72 hours of an auditor request)

Governmental Entities Regulations
  • The Freedom of Information Act, "Sunshine Laws" (vary from state to state)

Education Institution Regulations
  • Family Education Rights and Privacy Act (FERPA)

Healthcare Facility Regulations
  • HIPAA, HITECH

 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/8/2014 | 3:31:25 PM
Re: The culture of the organization.
Who enforces there regulations @gwavajeff and do they have any teeth?
gwavajeff
50%
50%
gwavajeff,
User Rank: Apprentice
9/8/2014 | 4:00:04 PM
Re: The culture of the organization.
The entities involved in the investigations and litigations are varied, but the top three were the Department of Justice (DOJ), the Securities and Exchange Commission (SEC), and the Environmental Protection Agency (EPA).

Healthcare, technology/communications, and energy companies were the prime target of the DOJ. Surprisingly, energy companies were two times more likely than financial services to be the primary target of the SEC. Energy companies were also the target of the EPA, with manufacturing also having been a heavy target.

Rounding out the top ten list of agencies targeting businesses in regulatory investigations was the State Attorney General, Occupational Safety and Health Administration (OSHA), Financial Industry Regulatory Authority (FINRA), the Internal Revenue Service (IRS), the US Attorney's Office, the Food and Drug Administration (FDA), and the State District or County Attorney. 

I have a whole post about the issue on our blog, with links to the surveys I mentioned, and go into more, but I not trying to be spammy. First half of username dot com slash blog
GonzSTL
100%
0%
GonzSTL,
User Rank: Ninja
9/8/2014 | 4:30:06 PM
Re: The culture of the organization.
I think enforcement is as follows:

HIPAA - Office of Civil Rights, Department of Health and Human Services
HITECH - Office of Civil Rights, Department of Health and Human Services
FERPA - Family Policy Compliance Office, Department of Education
FOIA  - Federal Court, Department of Justice (states have similar regulations)
Dodd-Frank - Securities and Exchange Commission
FINRA - FINRA (check a ruling by the Court of Appeals for the Second Circuit)
FRCP - Federal Court, Department of Justice
MiFID - European Union Countries
aws0513
50%
50%
aws0513,
User Rank: Ninja
9/9/2014 | 10:48:07 AM
Re: The culture of the organization.
Those are some of the big regulatory players for sure.

If there were anything to add, specifically in the US, it would be state laws or regulations.
More and more I am running into situations where states have established statutory requirements for the protection and handling of specific categories of data that may exceed or augments some of the regulatory directives you listed.

So many fingers in the regulatory security jar. 

Not complaining...  any regulatory requirement from any angle helps in the effort to gain resources and support for security controls that are necessary.  But the complexity of bringing all of the requirements together and addressed accordingly can be daunting at times.
Franois Amigorena
50%
50%
Franois Amigorena,
User Rank: Author
8/29/2014 | 11:11:12 AM
Re: The culture of the organization.
Thanks for your comment. I absolutely agree. Management must set an example and it's interesting to hear about your experience where that has far from been the case. I know that security teams can often have difficulty explaining the necessity of meeting certain security measures, and of course it's hard to get the message across when it's not something that affects the organisation's bottom line.

Really, management should be getting a big red warning sign that this should really matter to them, as top level executives at huge businesses are losing their jobs as a result of security related issues. 
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
8/29/2014 | 11:40:18 AM
Re: The culture of the organization.
Not to be nasty or mean, but it's good to hear some executives are losing their jobs because organizations aren't meeting security or compliance goals or needs. As I say, I don't want to be horrible about this, but sometimes the impetus for change is putting a person's name and personal responsibility (as in their job, jail time, or a personal fine -- not a corporate fine that can be passed off to taxpayers or consumers) onto a failure to comply. Only then, perhaps, will compliance expand across most, if not all, organizations. Really, executives should worry. After all, their information is at risk in other companies, if not their own!
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15113
PUBLISHED: 2019-08-16
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
CVE-2019-15114
PUBLISHED: 2019-08-16
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
CVE-2019-15115
PUBLISHED: 2019-08-16
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
CVE-2019-15116
PUBLISHED: 2019-08-16
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
CVE-2017-18547
PUBLISHED: 2019-08-16
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.