BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Getting a gold star in compliance

Post by Mike Yaffe July 9, 2013

gold-starYou know I realize that I’m getting older after I lived through “this is gonna be the big year for PKI (heard that for 4 straight years, and I’m still waiting)”, or “everyone will have a digital certificate on all their credit cards next year”, or “security and compliance are two different things.” As for that last one about compliance, I know that now as well as I know the 1986 Red Sox starting infield (Wade Boggs, Spike Owen Marty Barrett, and Billy Buckner…not going there right now) – but trust me there was time that SOX, HIPAA, and PCI were very new and their introduction cased a lot of major anxiety in the security industry. Would there actually be industry standardization, penalties and fines for non-compliance? Who would actually own that? Would you still get funding for specific security mandates and how often would the auditors come in to check on us? While these and other regulations did require certain types of information security to be implemented,  if it wasn’t mandated in the regulation itself,  a lot of times it didn’t get done or the project simply didn’t get funded.

If you could poll security professionals privately they would cop to the fact that these regulations were put in place as a platform for minimum operational security standards. They set a baseline, and once the minimum was done organizations were supposed to take the next step, but in reality that didn’t happen. Organizations were so wrapped around the check box axle that not much else really got done. Question, how many of you out there teach your kids to do ONLY the bare minimum and just do what you have to get by? We all want them to get that gold star and for our kids to be people who excel. So why should we settle for less than a gold star in our information security programs?

Recently I read that Gartner’s Anton Chuvakin said that some retailers are scanning MORE than the ¼ requirement for PCI.

Most of the security programs I see, people are trying really hard, but they are seriously understaffed and underfunded, and they are doing what they can when they can. I’d be surprised if most organizations are only doing scanning quarterly. I think security practitioners were hoping these rules and reg’s would be something more than they are. It appears that organizations are beginning to understand that the minimum is not going to cut it and rather they have to be vigilant. No one wants to be told what to do and when to do, and if more organizations or industries step up like retail, then gold stars for everyone.

Tags:
, , , , , , ,

Leave a Reply

Additional articles

April VEF Participant Wins a Apple iPad mini

Every month we host our Vulnerability Expert Forum (VEF) webinar. This is a time where our experts share valuable insight regarding new vulnerabilities that are discovered and the actions that need to be taken as a result. It’s a quick way to get up to speed on current potential risks to your organization and a way to…

Post by Qui Cao April 24, 2014
smart rules manager for vulnerabilities - v2

A New Way of Looking at Vulnerabilities in Your Environment

Assets, users, vulnerabilities and exploits; all are common themes in my posts on BeyondInsight. With BeyondInsight v5.1, we unveiled a new way to view exploitable assets. Sure, most vulnerability management solutions link vulnerability data to exploit information, allowing tools like NeXpose and QualysGuard to list an asset, its vulnerabilities, and any related exploits. BeyondInsight does…

Post by Morey Haber April 23, 2014
Tags:
, , , , ,
smart rules manager for vulnerabilities

Staying on Top of the Latest Vulnerabilities with BeyondInsight v5.1

It’s no secret that dozens of new OS and application vulnerabilities are revealed every day. Staying on top of these new exposures normally requires paying for services or subscribing to multiple RSS feeds. BeyondInsight 5.1 provides customers with another option: a built-in, customizable vulnerability alerting system that delivers up-to-date information on the latest vulnerabilities in…

Post by Morey Haber April 21, 2014
Tags:
, , , , , ,