Thursday, May 14, 2020

Does Compliance Inhibit Cybersecurity

Finalizing the list required input from the broader community. At CompTIA’s Communities and Councils Forum in March, the attendees of the EmTech community meeting deliberated further, adding personal experiences to better define short- and long-term potential. After discussing all the evidence, the community cast their votes, and the 2019 Top 10 Emerging Technology list was set.

The new list represents many different aspects of emerging technology. Internet of things (IoT) and artificial intelligence (AI) have perhaps the greatest potential to blend technology initiatives with business objectives. 5G and blockchain are enabling technologies that could launch a brand new wave of applications. Robotics, 3D printing and drones are currently niche domains that are finding broader use cases.

I was lucky enough to have a very, very engaged audience. In fact, the discussion lasted long after my initial talk when I spoke with several folks at the CompTIA booth about a topic that I had mentioned quickly during my presentation.

I brought up the concept of compliance in a rather snide way. It’s one of the truisms in cybersecurity for people to take a bit of a dim view of compliance-based approaches. The general wisdom is that even though an organization might be, say, Payment Card Industry Data Security Standard (PCI) compliant, Health Insurance Portability and Accountability Act (HIPAA) compliant or even General Data Protection Regulation (GDPR) compliant, that organization can still get majorly hacked.

After all, compliant organizations have been hacked: Marriott, Equifax, British Airways, Managed Health Services of Indiana, Dunkin’ Donuts and many others were all compliant to various standards when they got hacked. The logic among some cybersecurity pros is that compliance can actually cause more harm than good.

I basically stated this idea, quoting a pen tester I know from MasterCard, who told me at RSA San Francisco 2019 that “the compliance industry has a lot to answer for.” Even though he ended his sentence with a preposition, I thought his statement was worth repeating. Quite a few folks at CyberUK agreed; I saw quite a few nodding heads.
More Info: jobs that require a+ certification

No comments:

Post a Comment