BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Getting a gold star in compliance

Posted July 9, 2013    Mike Yaffe

gold-starYou know I realize that I’m getting older after I lived through “this is gonna be the big year for PKI (heard that for 4 straight years, and I’m still waiting)”, or “everyone will have a digital certificate on all their credit cards next year”, or “security and compliance are two different things.” As for that last one about compliance, I know that now as well as I know the 1986 Red Sox starting infield (Wade Boggs, Spike Owen Marty Barrett, and Billy Buckner…not going there right now) – but trust me there was time that SOX, HIPAA, and PCI were very new and their introduction cased a lot of major anxiety in the security industry. Would there actually be industry standardization, penalties and fines for non-compliance? Who would actually own that? Would you still get funding for specific security mandates and how often would the auditors come in to check on us? While these and other regulations did require certain types of information security to be implemented,  if it wasn’t mandated in the regulation itself,  a lot of times it didn’t get done or the project simply didn’t get funded.

If you could poll security professionals privately they would cop to the fact that these regulations were put in place as a platform for minimum operational security standards. They set a baseline, and once the minimum was done organizations were supposed to take the next step, but in reality that didn’t happen. Organizations were so wrapped around the check box axle that not much else really got done. Question, how many of you out there teach your kids to do ONLY the bare minimum and just do what you have to get by? We all want them to get that gold star and for our kids to be people who excel. So why should we settle for less than a gold star in our information security programs?

Recently I read that Gartner’s Anton Chuvakin said that some retailers are scanning MORE than the ¼ requirement for PCI.

Most of the security programs I see, people are trying really hard, but they are seriously understaffed and underfunded, and they are doing what they can when they can. I’d be surprised if most organizations are only doing scanning quarterly. I think security practitioners were hoping these rules and reg’s would be something more than they are. It appears that organizations are beginning to understand that the minimum is not going to cut it and rather they have to be vigilant. No one wants to be told what to do and when to do, and if more organizations or industries step up like retail, then gold stars for everyone.

Tags:
, , , , , , ,

Leave a Reply

Additional articles

pbps-customer-campaign-image

You Change Your Oil Regularly; Why Not Your Passwords?

Posted September 11, 2014    Chris Burd

There are many things in life that get changed regularly:  your car oil, toothbrush and hopefully, your bed sheets.  It’s rare that you give these things much thought – even when you forget to change them. But what if you’re forgetting something that can cost you millions of dollars if left unchanged for long periods…

Tags:
, , ,

On-Demand Webcast: The Little JPEG that Could (Hack Your Organization) with Marcus Murray

Posted September 10, 2014    Chris Burd

IT security has come a long way, but every once in a while you see something that makes you think otherwise. Every day, internal and external hackers breach and traverse “secure” environments, making you wonder just how easy it is for attackers to completely compromise your network. In a new on-demand BeyondTrust webcast, Marcus Murray,…

Tags:
, , , , ,

Retina Vulnerability Audits – September 2014 Patch Tuesday

Posted September 9, 2014    BeyondTrust Research Team

The following is a list of Retina vulnerability audits for this September 2014 Patch Tuesday: MS14-052 – Cumulative Security Update for Internet Explorer (2977629) 35141 – Microsoft Cumulative Security Update for Internet Explorer (2977629) 35142 – Microsoft Cumulative Security Update for Internet Explorer (2977629) – IE8/2003 35143 – Microsoft Cumulative Security Update for Internet Explorer (2977629) – IE8…