When industries introduce regulatory compliance, it is often viewed as a sign of maturity showing that an industry is moving forward and taking quality assurance seriously. This is now being applied in cyber security and the need for organisations to be “compliant” has kick-started an entire industry of consultancies, programmes and software to help achieve this. The quandary is that many companies feel that by simply meeting compliance guidelines alone, their exposure to data breaches and data assurance problems are mitigated. These guidelines are often not truly focused on security, but rather hone in on privacy, data assurance or business continuity and, therefore, won’t fully protect organizations. This is evident when reviewing most of the major headline data breaches over the past few years, as the companies involved were fully compliant at the time of the breach.
Compliance does not equate to security
That is not to say that compliance doesn’t have its place. Just like a number of regulatory measures, the effort to meet compliance goals has improved many things in IT. In dealing with matters such as privacy and accounting, where improving and tightening up the process is necessary, compliance has been a true solution.
However, there are serious issues with treating IT security as a set of policies. They can all be captured in one scenario – security is a battle, not a concept.
Compliance is always a race to the bottom
When companies embody the mindset of compliance, often the biggest enemy in the situation is simply complacency. People sometimes handle data in an irresponsible way. When compliance is king, the regulation lays out what they must do and in turn settles the debate. In business, auditors cannot be ignored and therefore people have no qualms taking the extra steps to be compliant or else they face fines or other penalties. Compliance for these companies simply means they have done “enough”.
While this might sound like what security entails to the average executive, the difference lies in what happens when you handle data irresponsibly from a regulatory view. The auditor may notice months from the point of breach and slap the company with a fine; or the victim may be the consumer who may be harmed by the action. In these situations, neither is actively looking to exploit the company right then and there, although it could be detrimental to the company in terms of reputation, customer loyalty and litigation. These are generally “accepted risks” within organisations.
On the other hand, in security, we know cybercriminals seek the path of least resistance, effectively waiting to take advantage of an easy way into the company. They are actively looking to exploit companies and they make a lucrative career out of it. There is no easy way to calculate the devastation that a major cyber attack could have on an organisation that does the bare minimum in security merely to pass an audit and meet compliance requirements.
Companies seeking to react to this reality simply cannot take a “compensating controls” approach that is the hallmark of compliance-based security.
Risk calculations are often a false economy
Essentially, organizations perform implicit or explicit math about the financial risk of being non-compliant. The expediency of approaching security in an undesirable way may offer and optimize the best outcome according to profit-motivated calculations, regardless of best practice.
Taking shortcuts
When organisations adopt a security by compliance approach, it does not allow executive the granularity they need to make quick decisions about cyber security. This is critical since CEOs must act as cyber security leaders to ensure that the authorisation to act and deter attacks is never far from hand.
All too often, executives find themselves only interested in the regulations that may lead them to jail time and ignore the day-to-day actions of those dealing with security. However, this tick-box mentality to security only serves to further disconnect executives from potentially the biggest crisis of their careers – a cyber attack. Instead, CEOs must understand the implications of a cyber security incident and be prepared to lead their companies through a major incident.
The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.