Technology & Innovation

Cyber security: how a compliance mindset can prove dangerous

August 02, 2016

Global

August 02, 2016

Global
Jonathan Sander

Vice President of Product Strategy

Jonathan Sander is VP of Product Strategy for Lieberman Software. He is responsible for working with sales, marketing, product development and the channel to steer the direction of the company through corporate development and product management. Prior to Lieberman Software, Mr. Sander was STEALTHbits’s Strategy & Research Officer providing corporate and product direction. He worked extensively with all STEALTHbits’s clients and partners as an evangelist in every forum from customer meetings to conference stages. As part of Quest Software from 1999 through 2013, he worked with the security and ITSM portfolios. He helped launch Quest’s IAM solutions, directing all business development and product strategy efforts. Previous to that, Mr. Sander was a consultant at Platinum Technology focusing on the security, access control and SSO solutions. He graduated from Fordham University with a degree in Philosophy.  

 

How industries which introduce regulatory compliance are often viewed as prepared for cyber security issues that arise

When industries introduce regulatory compliance, it is often viewed as a sign of maturity showing that an industry is moving forward and taking quality assurance seriously.  This is now being applied in cyber security and the need for organisations to be “compliant” has kick-started an entire industry of consultancies, programmes and software to help achieve this. The quandary is that many companies feel that by simply meeting compliance guidelines alone, their exposure to data breaches and data assurance problems are mitigated. These guidelines are often not truly focused on security, but rather hone in on privacy, data assurance or business continuity and, therefore, won’t fully protect organizations.  This is evident when reviewing most of the major headline data breaches over the past few years, as the companies involved were fully compliant at the time of the breach.

Compliance does not equate to security

That is not to say that compliance doesn’t have its place. Just like a number of regulatory measures, the effort to meet compliance goals has improved many things in IT. In dealing with matters such as privacy and accounting, where improving and tightening up the process is necessary, compliance has been a true solution.

However, there are serious issues with treating IT security as a set of policies. They can all be captured in one scenario – security is a battle, not a concept.

Compliance is always a race to the bottom

When companies embody the mindset of compliance, often the biggest enemy in the situation is simply complacency. People sometimes handle data in an irresponsible way. When compliance is king, the regulation lays out what they must do and in turn settles the debate. In business, auditors cannot be ignored and therefore people have no qualms taking the extra steps to be compliant or else they face fines or other penalties. Compliance for these companies simply means they have done “enough”.

While this might sound like what security entails to the average executive, the difference lies in what happens when you handle data irresponsibly from a regulatory view. The auditor may notice months from the point of breach and slap the company with a fine; or the victim may be the consumer who may be harmed by the action. In these situations, neither is actively looking to exploit the company right then and there, although it could be detrimental to the company in terms of reputation, customer loyalty and litigation. These are generally “accepted risks” within organisations.

On the other hand, in security, we know cybercriminals seek the path of least resistance, effectively waiting to take advantage of an easy way into the company. They are actively looking to exploit companies and they make a lucrative career out of it.  There is no easy way to calculate the devastation that a major cyber attack could have on an organisation that does the bare minimum in security merely to pass an audit and meet compliance requirements.

Companies seeking to react to this reality simply cannot take a “compensating controls” approach that is the hallmark of compliance-based security. 

Risk calculations are often a false economy

Essentially, organizations perform implicit or explicit math about the financial risk of being non-compliant. The expediency of approaching security in an undesirable way may offer and optimize the best outcome according to profit-motivated calculations, regardless of best practice.

Taking shortcuts

 When organisations adopt a security by compliance approach, it does not allow executive the granularity they need to make quick decisions about cyber security.  This is critical since CEOs must act as cyber security leaders to ensure that the authorisation to act and deter attacks is never far from hand.

All too often, executives find themselves only interested in the regulations that may lead them to jail time and ignore the day-to-day actions of those dealing with security. However, this tick-box mentality to security only serves to further disconnect executives from potentially the biggest crisis of their careers – a cyber attack.  Instead, CEOs must understand the implications of a cyber security incident and be prepared to lead their companies through a major incident.

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week