Compliance & Security: A Race to the Bottom?
Kevin talks about a pervasive industry problem - being compliant according to your auditor and their checklist, but still being highly vulnerable. One of the common faults in compliance is senior level managers who don’t really know enough end up classing systems as outside the targeted population that must be compliant when the servers really should be part of the population that gets audited.
Compliance has been a buzzword in the cyber security industry for quite some time now. Many organizations have dedicated teams with the sole purpose of ensuring that their systems are in compliance with industry-regarded best practices, standards, and guidelines. We race toward compliance not fully understanding to what extent it impacts our overall security posture. Along this race many fail to realize that compliance doesn’t necessarily lead to systems being more secure.
We’ve seen from Target and others that you can be in compliance with industry-regarded best practices, standards, and guidelines, and still be compromised. Compliance doesn’t always lead to tighter security controls; often it’s a checklist to ensure that at the least, minimum security practices are being followed and implemented. As long as you can provide and produce artifacts or documentation, and be able to speak intelligently with some understanding of risk management, you can zip through the compliance process with flying colors. As an industry, we have to move past checklists, and doing “just enough” to provide the necessary security protection commensurate to protect sensitive data.
In the federal government the first thing people want to know is…has the system been C&A’d (certification and accreditation process)? This is the formal process of evaluating, testing, and examining security controls for an information system against a federal standard or industry mandated best practice. Having led and participated on many C&A teams, I became extremely frustrated with this checklist or checkbox approach. Oftentimes the teams would be comprised of individuals with very limited technical knowledge and system experience conducting the compliance review. This leads to information systems passing the compliance tests, but failing majorly from a security protection perspective.