Compliance versus Security

As I alluded in my previous post, compliance versus security is a discussion all its own and here is my attempt to explain my thoughts.

Does compliance with regulation really make our information systems more secure?  The answer, like the answer to most of these sorts of questions, is it depends.  Merriam-Webster defines security as “measures taken to guard against espionage or sabotage, crime, attack, or escape [1].”  Clearly then, reducing exposure to risks like espionage, sabotage, criminal activity, or attack through the network improves security.  How do we, as consumers, either individually or as businesses, ensure the services we utilize are secure? 

One method is the use of agreed upon frameworks of controls that the systems can be measured against.  If the framework is complete and valid and the system is compliant, then we can be reasonably certain that the system is secure, at least against the known threats that the framework provides controls for.  Seems simple enough, right?  So, where do we go wrong?  To begin with, there are multiple problems with frameworks.

The first problem is the assumption of completeness.  In order for a framework of controls to be complete, it would need to account for every possible attack vector.  While most frameworks make a valiant attempt at accounting for every conceivable method of attack, we have learned time and again that the threat landscape is constantly evolving.  This means that while we may have accounted for every conceivable attack, there are many that we haven’t yet conceived of that hackers are already exploiting.

Related to this first problem is the second, namely that frameworks tend to be static, slow to change not only to threats but emerging technology.  These frameworks tend to be rooted in bureaucratic origins, with multiple, often competing factions fighting for sometimes short-sighted interests.  Their bureaucratic origins also tend to result in vague, legalistic, technocratic language that is open to multiple interpretations. 

The bureaucratic origins of many of these frameworks also brings with them potential penalties for non-compliance, since most of them have been developed as reactions to security and privacy breaches.  While avoidance of fines and penalties tends to be a strong motivator for corporate compliance, the motivation tends to stop at compliance, regardless of the actual level of security.  As a corollary, information security professionals often get caught up in the auditing of systems, ruling strictly on compliance without regard for actual security.

Does this mean that frameworks and compliance are without merit?  No, in fact they have an important place in information security.  One of the most difficult and time-consuming parts of developing security controls is determining the risk level, both before and after the control is applied.  Frameworks give us a method of reutilizing these sorts of calculations for common, well-understood threats.  Using compliance as a starting point, we can tailor the controls to the current level of risk.  The important thing to remember is that this needs to be our starting point, not our goal, and that a serious discussion about the level of risk needs to occur.

In this way, we can develop systems that are both compliant and reasonably secure.  The framework, as a starting point, gives us a common reference and starting point on which to build a discussion about security.  As security professionals, we must constantly adjust and tailor the controls to the current risks, avoiding the trap of merely being compliant.

References:

1. Merriam-Webster Online Dictionary.  http://www.merriam-webster.com/dictionary/security.  Accessed 4 May 2012.