DrewDilloNet

There is always a lot of finger-pointing at compliance mandates and their application. They are not, as their critics often cite, “real” security. Real security is an abstract land where authentication is an ever-evolving heuristic dance, internal networks are impenetrable walls of malevolent retribution, every atomic element is encrypted within a FIPS Level 4 module and is only visible to users who absolutely need to see it that particular second, and only exists in the mind of ubergeeks and cryptography professors.

In the real world, the data being so rigorously protected in the above scenario becomes either so locked down as to become completely unusable or the staff required to maintain this level of security is so large as to drive a company into the ground. All this in the name of protecting the information assets that drive business.

On the other end of the spectrum isn’t compliance, it’s business. In business land every piece of information is available when needed, calculations and different views of information can be pulled from hundreds of millions of sources instantly, and your level of efficiency is a product you can sell. Business land built up some meager defenses, maybe even raised a militia, but they are instantly bowled over at the slightest hindrance of business.

This one isn’t hypothetical, it’s where most companies are:

Why would I protect a customer’s confidential information? It might take seconds out of my response time. Maybe I’ll put controls around this piece of information, after all, if a competitor got everyone’s email addresses they might steal all my customers!

That was the state of information security in the 90s, that’s the state of Data Protection in the late 00s. Bare minimum, protect the business as long as you don’t even slightly impact the business.

Now, this isn’t anything new. Risk Management is an old discipline and many attempts have been made to tie security risk management to ROI. ROSI has long been a byword among security architects, but the numbers always come out too high to be credible, even when true.

From the vendor perspective, every security company wades into this quagmire thinking, “We can do this, we can be the company that makes the case for security.” They put together 10 fear slides to scare the bejeebus out of the customer, slap on an architecture diagram and lose the prospect in the first five minutes. That is not to say the fear approach always fails, but the vast majority of the time, one little vendor can’t bridge the divide between security and business.

Businessland’s laissez-faire attitude toward security is destructive though, eventually another entity has to step in with regulation. Regulation has three goals:

1. Helping we little guys — rare
2. Protecting a bigger fish in the pond — do-as-I-say-not-as-I-do regulation
3. Preventing legal action that could burden the legal system or cause a massive industry collapse

Regulatory compliance isn’t security. It’s insurance against the wildest reaches of negligence. It’s justice for those security architects that can’t seem to convince the CFO that the sky is falling.

Give us your tired, your huddled IT security masses, yearning to segment their networks…

Compliance isn’t security in the same way that the local police department isn’t security. It’s a baseline intended to prevent chaos. And compliance done right is a baseline for building out a higher level of overall security.

As a vendor, this is a completely different conversation. Compliance is a business driver, so budget flows for compliance in ways it never will for security fear sales. And, beyond cynical business concerns, compliance gives vendors the opportunity to actually help a customer by making a real tactical impact on the bottom line. There’s also a chance here to be emissaries for Securityland, knocking down some of the fear that security is going to bring business to a halt. But that’s a topic for another time.

And all of this is not to say compliance is perfect. Compliance mandates sometimes adopt baffling requirements from Securityland.

Is a brute force collision against a significantly-random AES256 key really the most likely attack vector?

But if applied correctly, and I will call out PCI DSS in particular, they go a long way toward business-proofing a company’s security posture.

If I were to put forth one complaint about compliance, it would be the method of application. Auditing of compliance varies between auditing companies and even among team leads at the same company. I have worked with customers whose auditors say that they need to see source code on all data protection products to verify secure key transmission and storage and other companies where simply buying a data protection product earned the organization a one year pass.

The blame of uneven compliance application doesn’t fall solely to the QSAs, Businessland asserts itself again in selection of auditors. One popular auditing company in the US has had trouble overseas, where they are seen as being too strict. I won’t pretend to know the answer of how best to audit the auditors, ideally this is built into the regulation itself, either being more prescriptive or adding a periodic check on audit results.

Compliance is an easy target for blame, especially when you’re in a CNN moment breach, but you don’t get very far blaming the police for the theft of your unlocked car. Use the regulations, use the business case of compliance, use the auditors findings, use vendors who understand security, business, and compliance, and build toward real data protection. IT risk management may never catch on at the c-level, but compliance is an easy and achievable baseline for limiting risk and doing so with business owners’ buy-in.