Full compliance should never be confused with robust security. One does not beget the other and, at times, changes called for by compliance rules can have a detrimental effect on an enterprise's overall security posture.
NEWSLETTERS
SUBSCRIBE TO CIO
Are you involved in setting the direction for your company's IT budget or strategy?
Apply today for a FREE subscription to CIO Magazine!
» Subscription Services
» Reprints
Reader Feedback
Regulations Are Just a Security Distraction
READER FEEDBACK
Cass Thu, 2008-07-03 11:36
It's remarkable that this article doesn't mention "risk" until, passingly, in the last sentence--but it's also indicative of the problem described by the article.
Managerial decisions about what risk to accept and why are the Rosetta Stone that let companies, for the most part, limit the scope of compliance activities to activities that really matter to the business.
Management can, of course, defend decisions to omit a control based on risk assessment and tolerance. Even PCI, whatever teeth it stil has, permits compensating controls, which may be defended on the basis of risk and operational profile.
Complaints about compliance scope are tiresome and, more often than not, just a poor excuse for failing to actually manage risk to the business.
Benjamin Wright Thu, 2008-07-03 13:22
Jack: Sometimes regulations and standards distract from larger industry-wide issues. The PCI, for example, focuses all attention on merchants securing payment card data. On an industry-wide basis, strong merchant security is hard to achieve. The PCI saga distracts us from re-engineering the whole credit card system. The banks designed (and aggressively promoted) a system that made credit card data valuable to thieves. Then, as an afterthought, the banks imposed the PCI on the merchants. As society complains about how sluggish merchants are at catching up with the PCI, we should demand that banks change their system and render card data less useful to hackers. --Ben http://hack-igations.blogspot.com/2008/03/ftc-treats-tjx-unfairly.html
Post new comment
RELATED SOLUTIONS
There's a lot of buzz about Windows 7 out there. Each month in our webcast series, listen to analysts and customers discuss how Windows 7 and the Windows Optimized Desktop is impacting large companies around the world. Learn how they evaluated Windows 7, including the cost of deployment, deployment strategies, and tangible benefits.
Sponsored by Microsoft
Listen to on-demand Recordings »
Service Level Management Best Practices Life Cycle Overview - Improve Service Levels
Best practices for Service Level Management (SLM) is a process for consistently meeting customer requirements and delivering on IT's promises. See the steps required to ensure high-quality SLM.
Sponsored by Compuware
Read this White Paper »
Keeping Your Members Safe from Online Scams and Predators
In order to keep fraudsters out, romance sites must deploy effective solutions that look at information independent of what is supplied by users. A device fingerprinting solution such as iovation ReputationManager™ provides unique insight into the computers being used to create multiple accounts and exposes hidden device-account relationships that identity-based fraud solutions often miss.
Sponsored by iovation
Read this White Paper »
Resource Alerts
Get instant email notifications by topic when white papers, webcasts, and case studies are added to our library.
Global Warming Research Exposed After Hack
Silicon Valley Abuzz About Tech Video That Lets You Command a Computer With Gestures
Two Approaches to NFC Battle for French Hearts and Mobiles
Palm Pixi Smartphones Now Just $25
FCC: Internet Program for Deaf Cheated Out of Millions
Judge Sets Schedule for Google Book Search Case
Twitter Geotagging: What You Need to Know
Twitter Turns on Geolocation Functionality
Some Nook E-Readers Won't Make it for the Holidays Either
Google's Chrome OS Hits BitTorrent
WHITE PAPERS
FEATURED SPONSORS
SPONSORED LINKS
| CIO MARKETPLACE | buy a link |
Software License control, Windows XP/2000 Upgrades
Use your Intranet to manage Software Licenses, plan for Windows XP/2000 upgrades, do Security Audits and more. Click to try and ask for our white paper - PC Management for the Internet Age.
UNIX and Linux Performance Tuning SimplifiedSarCheck is a performance analysis and tuning tool for most UNIX & Linux operating systems. It produces recommendations with full explanations, and both supporting graphs and tables. Get the most from your hardware by keeping your systems tuned.
.NET Developer Wanted - Boston - Local CandidatesAIR provides sophisticated analytical tools and software systems to help companies manage that risk. We are seeking a Sr .NET Developer with 8-10 yrs exp in .Net & OO development. ASP.NET, VB.NET skills required. Annual bonus - Apply Now
Get More from Your Oracle DatabaseDBAs are constantly challenged to increase performance and keep costs down. This paper discusses the industry best-practice Wait-Event analysis and how Confio has combined this with their Resource Mapping Methodology to optimize DB performance.
THE IDG NETWORK
© 1994 - 2009 CXO Media Inc.