Regulations and mandates - whether they're from the government and industry are important aspects of security within organizations. But there is more to the battle to include information in a Big Data world. Compliance should play a supporting role within a framework driven by risk assessment, ongoing monitoring and closed-loop remediation.
when work output make headlines. So what role should compliance and risk management Play Cf. for example, an organization's overall security equation?
The Downside of Compliance
Organizations that follow a box mentality as part of a compliance-driven approach to security only achieve point-in-time performance rather than improving the company's security posture, which is dynamic and changes over time. This has been proven time and again.
Recently, progressive businesses to become more proactive, risk-based approach to seek safety. The goal in a risk-based model to assess the effectiveness of an organization's IT security operations to maximize visibility into risk and compliance posture. The Holy Grail is to be in compliance, reduce risk and encourage security on an ongoing basis.
A number of factors that cause businesses the box approach to security and move to a risk-based model to reconsider. These include:
1) Federal Information Security Management Act (FISMA) of 2002.
2)Federal Risk and authority Management Program (FedRAMP).
3)Securities and Exchange Commission (SEC) Cyber lead.
4)Emerging Cyber legislation (eg, Cyber Intelligence sharing and Protection Act).
5)Presidential Executive Order on Cyber Security.
6)The Council of Europe Convention on Cybercrime.
Recently, progressive businesses to become more proactive, risk-based approach to seek safety. The goal in a risk-based model to assess the effectiveness of an organization's IT security operations to maximize visibility into risk and compliance posture. The Holy Grail is to be in compliance, reduce risk and encourage security on an ongoing basis.
A number of factors that cause businesses the box approach to security and move to a risk-based model to reconsider. These include:
1) Federal Information Security Management Act (FISMA) of 2002.
2)Federal Risk and authority Management Program (FedRAMP).
3)Securities and Exchange Commission (SEC) Cyber lead.
4)Emerging Cyber legislation (eg, Cyber Intelligence sharing and Protection Act).
5)Presidential Executive Order on Cyber Security.
6)The Council of Europe Convention on Cybercrime.
The Role of IT Security
It is generally believed that vulnerability management will reduce the risk of a data breach. But without problems in the context of the risk associated with them, organizations can misalign their remediation resources. Often they forget the most critical risks, while only a low-hanging fruit "to address.
It is not just a waste of money, but more importantly, it creates a longer window of opportunity for hackers critical vulnerability exploit. The ultimate goal is to shorten the window attackers to exploit a software bug. Therefore, vulnerability management complemented by a holistic, risk-based approach to security, which considers factors such as threats, reach the organization's compliance posture, and business impact.
If the threat can not reach the vulnerability, or the associated risk is reduced or eliminated.
It is not just a waste of money, but more importantly, it creates a longer window of opportunity for hackers critical vulnerability exploit. The ultimate goal is to shorten the window attackers to exploit a software bug. Therefore, vulnerability management complemented by a holistic, risk-based approach to security, which considers factors such as threats, reach the organization's compliance posture, and business impact.
If the threat can not reach the vulnerability, or the associated risk is reduced or eliminated.
Risk and Compliance: Security Bedfellows
An organization's compliance posture can play an important role to play IT security by identifying compensate controls that can be used to prevent threats from reaching their target.
According to the Verizon 2012 Data Breach Investigations Report, 97 percent of the 855 incidents in 2011 were avoidable through simple or intermediate controls. However, business impact is a critical factor in determining the actual risk. For example, problems that threaten critical business assets represent a much higher risk than that associated with less critical goals.
Since compliance posture is typically not tied to business critics of assets, it does not enable an organization to prioritize remediation efforts. A risk approach, focusing on security posture / compliance and business impact to increase operational efficiency, improve assessment accuracy, reduce attack surfaces, and improve investment decision-making.
There are three main components to the implementation of a risk-based approach to security.
According to the Verizon 2012 Data Breach Investigations Report, 97 percent of the 855 incidents in 2011 were avoidable through simple or intermediate controls. However, business impact is a critical factor in determining the actual risk. For example, problems that threaten critical business assets represent a much higher risk than that associated with less critical goals.
Since compliance posture is typically not tied to business critics of assets, it does not enable an organization to prioritize remediation efforts. A risk approach, focusing on security posture / compliance and business impact to increase operational efficiency, improve assessment accuracy, reduce attack surfaces, and improve investment decision-making.
There are three main components to the implementation of a risk-based approach to security.
Continuous Compliance
Continuous compliance include the reconciliation of the assets and automating data classification, adaptation of technical control, automation of compliance testing, deployment of assessment surveys, and automation of data consolidation.
Continued compliance, organizations can reduce overlap by using a common control framework to increase accuracy in data collection and data analysis, and reducing redundant and manual, labor-intensive effort by up to 75 percent.
Continued compliance, organizations can reduce overlap by using a common control framework to increase accuracy in data collection and data analysis, and reducing redundant and manual, labor-intensive effort by up to 75 percent.
Continuous Monitoring
Continuous monitoring implies an increased frequency of data assessments and required security data automation together and normalize data from a variety of sources such as security information and event management (SIEM), asset management, threat feeds, and vulnerability scanners.
In turn, organizations can reduce costs by unifying solutions, streamlining processes, creating situational awareness exploits and threats to expose in a timely manner, and the collection of historical trend data, which can help with the predictable security....
In turn, organizations can reduce costs by unifying solutions, streamlining processes, creating situational awareness exploits and threats to expose in a timely manner, and the collection of historical trend data, which can help with the predictable security....
No comments:
Post a Comment