The Tech Herald

NCSAM: Compliance vs. Security – Tell us where you stand

by Steve Ragan - Oct 5 2010, 20:40

When it comes to protecting your organization’s assets, such as Intellectual Property, data (customer or employee), and the actual equipment that houses all of it, which is the focus, compliance or security? Should you keep them equal or separate? Does one not equal the other?

This National Cyber Security Awareness Month topic is aimed at starting a discussion. Please leave your thoughts below, or email security@thetechherald.com to share your opinions.

According to the Verizon Payment Card Industry Compliance Report, investigators found that breached organizations are 50 percent less likely to be PCI compliant and that only 22 percent of organizations were PCI compliant at the time of their initial examination.

In short, Verizon says that these findings indicate that PCI compliance can help prevent data breaches.

Our Take:

PCI, or any given compliance measure for that matter, including all of the steps needed to obtain it, are only the building blocks to a solid security program. Just because an organization can obtain compliance for a given regulation does not mean they are secure. Compliance today cannot equal security tomorrow. Things change entirely too fast for that to happen.

In truth, compliance and security should be equal, and when plans are developed for them, they need to be a critical part of the organization’s business and growth strategy. Also, when considering compliance and security, a measure of risk assessment is mandatory. If you don’t know what it is you need to protect first and foremost, then there is no need to bother with either.

Often compliance and security come from the same department, so equality should be a given. Sadly, as is the case with many business plans, security and compliance come after the fact, and are implemented based on regulatory fear or cost alone.

For the record, we agree with the conclusions and recommendations from the Verizon report, as seen on page 25 in this PDF, and our stance on compliance vs. security aligns with them on many points.

What we’d like to know is if you agree with our thoughts, as well as those from Verizon, and read your opinions on them.

Are security and compliance things to be kept separate? If so, is this because they are simply different, or because it depends on the organization? Are they equal? If you think so, why?

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

NBA All-Star LeBron James Teams with Kia

NBA All-Star LeBron James has signed a deal with Kia to be the company’s first luxury ambass...

Classic Car Buying Guide: Hillman Super Minx

What to look for when buying a Classic Car: We use The Hillman Super Minx as an example What...

A Guy Let His Wife Loose With A Sharpie On His Car. What She Did Will Blow Your Mind.

This guy let his wife loose with a sharpie on his Nissan Skyline R33 GTR — and the result is...

2015 Nissan Armada Prices

Nissan has released pricing details for the 2015 Nissan Armada in the US. The 2015 Nissan Ar...

Aquaplaning Danger Highlighted in Video

This UK video highlights the dangers of aquaplaning. When you drive your car over some sitti...