We all Security folks face various regulatory compliance requirements in our lives be it SOX, PCI, HIPAA, GLBA etc. & we feel that by implementing security controls that are written in these compliances will solve our issues.
But is it so? I don't think so...The controls mentioned in the compliance requirements only guide us on how to keep our Organization data safe & morover they are updated either quarterly,semi-annually or annually. Whereas hackers, crackers are finding new attacks daily or should I say every second.
Also, I feel some of the organizations treat security as a 'Necessary Evil' just to comply to Compliance requirements. Instead of implementing full fledged solutions they implement low cost solutions that will help them pass the regulatory audits. But I feel this approach is wrong, look at what happened to Sony whose Playstation site was hacked & they lost their precious customer data consisting of credit cards & PII (Personally identifiable Information) & they lost their credibility in the market.
Security world, I believe is a totally different world than the Compliance World. Although Security organization should align with compliance Organization, it should go beyond that & suggest more robust solutions & try to convince the management about its necessity. Organizations management will be only convinced if they see
1. Monetory loss to the Organization
2. Loss of Brand Value
3. Loss of critical Information
4. Risk of legal law suites & offcourse
5. Compliance to Regulatory requirements
These are the key drivers for any organizations that will drive them to implement robust security solutions instead of just focussing on passing their yearly audits.
Also, we as Security professionals need to align the solution to meet business requirements that would not be as a hindrance in the business.
