BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Getting a gold star in compliance

Posted July 9, 2013    Mike Yaffe

gold-starYou know I realize that I’m getting older after I lived through “this is gonna be the big year for PKI (heard that for 4 straight years, and I’m still waiting)”, or “everyone will have a digital certificate on all their credit cards next year”, or “security and compliance are two different things.” As for that last one about compliance, I know that now as well as I know the 1986 Red Sox starting infield (Wade Boggs, Spike Owen Marty Barrett, and Billy Buckner…not going there right now) – but trust me there was time that SOX, HIPAA, and PCI were very new and their introduction cased a lot of major anxiety in the security industry. Would there actually be industry standardization, penalties and fines for non-compliance? Who would actually own that? Would you still get funding for specific security mandates and how often would the auditors come in to check on us? While these and other regulations did require certain types of information security to be implemented,  if it wasn’t mandated in the regulation itself,  a lot of times it didn’t get done or the project simply didn’t get funded.

If you could poll security professionals privately they would cop to the fact that these regulations were put in place as a platform for minimum operational security standards. They set a baseline, and once the minimum was done organizations were supposed to take the next step, but in reality that didn’t happen. Organizations were so wrapped around the check box axle that not much else really got done. Question, how many of you out there teach your kids to do ONLY the bare minimum and just do what you have to get by? We all want them to get that gold star and for our kids to be people who excel. So why should we settle for less than a gold star in our information security programs?

Recently I read that Gartner’s Anton Chuvakin said that some retailers are scanning MORE than the ¼ requirement for PCI.

Most of the security programs I see, people are trying really hard, but they are seriously understaffed and underfunded, and they are doing what they can when they can. I’d be surprised if most organizations are only doing scanning quarterly. I think security practitioners were hoping these rules and reg’s would be something more than they are. It appears that organizations are beginning to understand that the minimum is not going to cut it and rather they have to be vigilant. No one wants to be told what to do and when to do, and if more organizations or industries step up like retail, then gold stars for everyone.

Tags:
, , , , , , ,

Leave a Reply

Additional articles

Sudo_logo

Don’t Create a Different sudoers File for Each System

Posted May 20, 2015    Randy Franklin Smith

What if you have multiple Linux and/or Unix systems? Sudo management can become onerous and unwieldy if you try to manage a different sudoers file on each system. The good news is that sudo supports multiple systems.

password-safety

What Does Microsoft Local Administrator Password Solution Really Do?

Posted May 19, 2015    Morey Haber

LAPS is a feature that allows the randomization of local administrator accounts across the domain. Although it would seem that this capability overlaps with features in BeyondTrust’s PowerBroker Password Safe (PBPS), the reality is it is more suited for simple use cases such as changing the local Windows admin account and not much more.

Tags:
, ,
webinar_ondemand

On Demand Webinar: Securing Windows Server with Security Compliance Manager

Posted May 14, 2015    BeyondTrust Software

On Demand Webinar: Security Expert Russell Smith, explains how to use Microsoft’s free Security Compliance Manager (SCM) tool to create and deploy your own security baselines, including user and computer authentication settings.

Tags:
, ,