You know I realize that I’m getting older after I lived through “this is gonna be the big year for PKI (heard that for 4 straight years, and I’m still waiting)”, or “everyone will have a digital certificate on all their credit cards next year”, or “security and compliance are two different things.” As for that last one about compliance, I know that now as well as I know the 1986 Red Sox starting infield (Wade Boggs, Spike Owen Marty Barrett, and Billy Buckner…not going there right now) – but trust me there was time that SOX, HIPAA, and PCI were very new and their introduction cased a lot of major anxiety in the security industry. Would there actually be industry standardization, penalties and fines for non-compliance? Who would actually own that? Would you still get funding for specific security mandates and how often would the auditors come in to check on us? While these and other regulations did require certain types of information security to be implemented, if it wasn't mandated in the regulation itself, a lot of times it didn't get done or the project simply didn't get funded.
If you could poll security professionals privately they would cop to the fact that these regulations were put in place as a platform for minimum operational security standards. They set a baseline, and once the minimum was done organizations were supposed to take the next step, but in reality that didn't happen. Organizations were so wrapped around the check box axle that not much else really got done. Question, how many of you out there teach your kids to do ONLY the bare minimum and just do what you have to get by? We all want them to get that gold star and for our kids to be people who excel. So why should we settle for less than a gold star in our information security programs?
Recently I read that Gartner’s Anton Chuvakin said that some retailers are scanning MORE than the ¼ requirement for PCI.
Most of the security programs I see, people are trying really hard, but they are seriously understaffed and underfunded, and they are doing what they can when they can. I’d be surprised if most organizations are only doing scanning quarterly. I think security practitioners were hoping these rules and reg’s would be something more than they are. It appears that organizations are beginning to understand that the minimum is not going to cut it and rather they have to be vigilant. No one wants to be told what to do and when to do, and if more organizations or industries step up like retail, then gold stars for everyone.
