The Tech Herald

NCSAM: Compliance vs. Security – Tell us where you stand

by Steve Ragan - Oct 5 2010, 20:40

When it comes to protecting your organization’s assets, such as Intellectual Property, data (customer or employee), and the actual equipment that houses all of it, which is the focus, compliance or security? Should you keep them equal or separate? Does one not equal the other?

This National Cyber Security Awareness Month topic is aimed at starting a discussion. Please leave your thoughts below, or email [email protected] to share your opinions.

According to the Verizon Payment Card Industry Compliance Report, investigators found that breached organizations are 50 percent less likely to be PCI compliant and that only 22 percent of organizations were PCI compliant at the time of their initial examination.

In short, Verizon says that these findings indicate that PCI compliance can help prevent data breaches.

Our Take:

PCI, or any given compliance measure for that matter, including all of the steps needed to obtain it, are only the building blocks to a solid security program. Just because an organization can obtain compliance for a given regulation does not mean they are secure. Compliance today cannot equal security tomorrow. Things change entirely too fast for that to happen.

In truth, compliance and security should be equal, and when plans are developed for them, they need to be a critical part of the organization’s business and growth strategy. Also, when considering compliance and security, a measure of risk assessment is mandatory. If you don’t know what it is you need to protect first and foremost, then there is no need to bother with either.

Often compliance and security come from the same department, so equality should be a given. Sadly, as is the case with many business plans, security and compliance come after the fact, and are implemented based on regulatory fear or cost alone.

For the record, we agree with the conclusions and recommendations from the Verizon report, as seen on page 25 in this PDF, and our stance on compliance vs. security aligns with them on many points.

What we’d like to know is if you agree with our thoughts, as well as those from Verizon, and read your opinions on them.

Are security and compliance things to be kept separate? If so, is this because they are simply different, or because it depends on the organization? Are they equal? If you think so, why?

Around the Web

Comment on this Story

comments powered by Disqus


Formula E ‘FanBoost’ Voting Opens For Second Race Of Season

Voting for the FanBoost part of the next FIA Formula E race is now open — where fans can vot...

300 Miles From One Gallon And No, That’s Not A Typo

Imagine you’re in a bar and a guy walks up and asks if you’d be interested in buying a car t...

2015 Nissan Pathfinder Prices and Specs

Nissan has announced pricing and specs for the 2015 Nissan Pathfinder. The SUV, which is on ...

Miami ePrix Circuit Revealed

The FIA Formula E Championship has revealed the layout for the Miami ePrix circuit. Formula ...

Two DeLoreans And A Replica Jaguar C Type On Scottish Classic Car Run

The Kirkintilloch & District Classic Vehicle Club’s annual run to Glencoe in Scotland is...