02
Nov
09

More On Compliance

Main Entry: com•pli•ance
Pronunciation: \kəm-‘plī-ən(t)s\
Function: noun
Date: circa 1630

1 a : the act or process of complying to a desire, demand, proposal, or regimen or to coercion

I just saw another whiner on the Web stating that compliance does not mean you are secure.  Based on the aforementioned definition from Webster’s, anyone taking the position that compliance has nothing to do with security should get out of the business.  So, where are these people going wrong?  In my opinion, they are confusing the assessment of compliance with the act of complying.

An assessment only makes sure that, at a given point of time, your security policies, standards and procedures are being adhered to by your personnel.  But compliance is more than just doing things right at a point in time or only when you are being assessed.  Security is a 24×7 occupation, so you can never let up.  Therefore, compliance is one of the most important aspects of your security posture.

Compliance starts with the appropriate security policies, standards and procedures.  If you are not following security best practices that are appropriate for your organization from a recognized source such as NIST, SANS or similar, then all of your compliance will not matter because your security policies, standards and procedures are flawed and/or incomplete.  So the first order of business is getting the appropriate security best practices put in place.

The next necessary step is training your personnel to ensure their compliance with your security policies, standards and procedures.  Security training and awareness of your organization means that they have an understanding of the security risks that are present in today’s computing environments and also understand the reasons for your security policies, standards and procedures.  It is the rationale of security policies, standards and procedures that most organizations miss and why training seems to provide limited results.  It is very hard to get people to comply with security policies, standards and procedures if you are not completely explaining them.  Without a full explanation, your personnel will likely ignore them as meaningless or pointless.  You can have all of the latest, greatest technological security solutions in the world, but if your personnel are not complying with your security best practices, all of that technology is worthless.

You also need to do monitoring of your personnel’s compliance with your policies, standards and procedures.  Unfortunately, anything less than 100% compliance means that you have gaps in your security.  Some of those gaps may be small and/or covered by other security elements.  But some of those gaps may be huge and put your entire organization at risk.  It is these huge gaps that need immediate attention and personnel retraining to ensure that they get closed quickly and do not occur again.  It is the act of closing the loop that makes security successful.  If you are not correcting mistakes or improving your security policies, standards and procedures, you will be doomed to failure.

And finally, security is not perfect.  Success in security is minimizing risk, not getting rid of it.  Risk will always exist because getting rid of it in most cases is too expensive and/or time consuming.  Compliance with your security policies, standards and procedures is one of the keys to that success.  If you are not enforcing compliance, then your success will be very limited.

So there is my two cents worth on compliance.  If you still believe that compliance is not security, think again.  And if you still think compliance is meaningless, then you better find a new occupation because security will eat you alive.  As a person in the security profession, it is all about compliance with security policies, standards and procedures.  And that, my friends, means that compliance equals security.

Advertisements

0 Responses to “More On Compliance”



  1. Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


Announcements

If you are posting a comment, be patient, as the comments will not be published until they are approved.

If your organization has a PCI opportunity, is in need of assistance with a PCI issue or if you would like the PCI Guru to speak at your meeting, you can contact the PCI Guru at pciguru AT gmail DOT com.

I do allow vendors to post potential solutions in response to issues that I bring up in posts. However, the PCI Guru does not endorse any specific products, so "Caveat Emptor" - let the buyer beware. Also, if I feel that the response is too "sales-ee", I reserve the right to edit or not even authorize the response.

Calendar

November 2009
M T W T F S S
« Oct   Dec »
 1
2345678
9101112131415
16171819202122
23242526272829
30  

Enter your email address to subscribe to the PCI Guru blog and receive notifications of new posts by email.

Join 1,884 other followers


%d bloggers like this: