Don't Confuse Compliance with Security

What do some of the world’s most premier data breaches—Target in 2013, Heartland Payment Systems in 2009, Anthem in 2015—have in common?

In these examples (and so many more), the companies had actually met compliance requirements before the breach occurred. Whether it was PCI DSS or HIPAA, one thing became clear in the aftermath—regulatory compliance did not equate to data security.

With the cost of cybercrime eclipsing $600 billion in 2017, you’d think that business leaders would see the compliance-security gap and shore up their defenses. And yet, business and IT leaders continue to fall into the same trap—believing that regulatory compliance is the sign of a strong cybersecurity.

While compliance and security certainly work together, it’s more important than ever not to confuse the two.

The Line Between Compliance and Security

The process to achieve compliance for various industry regulations is notoriously costly and time consuming. It’s not as if IT leaders are just arbitrarily checking boxes to say that data in transit is encrypted and that the proper security controls are in place. Proving you’re compliant is much more complicated.

As a result, it’s easy to fall into the trap of thinking that once you’ve achieved compliance, all that time, money, and effort also results in strong security. Except that’s not the case.

When trying to understand where the line is between compliance and security, there are two key points to keep in mind:

• Compliance Offers Guidelines: In most cases, compliance requirements act as high-level guidelines for taking a proper approach to data governance and risk management. These guidelines aren’t prescriptions for data security, but a set of minimum expectations.
• Security Isn’t Static: Verizon research found that 45% of companies that achieved PCI DSS compliance required remediation for gaps just months later. Too often, compliance is treated as a one-and-done requirement. If that’s the case, you risk leaving gaping holes in your data security strategy.

Business leaders must recognize that while regulatory compliance sets them on the right path to risk management and governance, there’s much more involved in staving off security incidents.

Rather than focusing on killing two birds with one compliant stone, there are four main components that add robust security to a compliant organization.

4 Keys to Balancing Security and Compliance

There’s a common “set-it-and-forget-it” mindset relating to security in small to mid-sized businesses that drives this compliance-security trap. You don’t always have the enterprise-level resources necessary for a defense-in-depth strategy that goes far beyond high-level compliance requirements.

However, if you want to avoid becoming another compliant victim of a data breach, there are four areas of data protection you must address:

• Network Security: Compliance guidelines won’t detail the exact tools and solutions necessary for a strong security posture. It’s no longer enough to just have a firewall in place on the perimeter of your network. Now, intrusion prevention systems (IPS), intrusion detection systems (IDS), threat analytics, and more are all necessary for protecting your organization. Without a more advanced backbone of security systems, you risk passing audits but overlooking key vulnerabilities.
• Endpoint Security: As cyber threats rise in both volume and sophistication, it’s no longer enough to rely on antivirus solutions and focus all security efforts on the perimeter of your network. Actively monitoring behavioral events at the endpoint level and monitoring lateral network activity have quickly become the new standards in cybersecurity.
• Backup and Disaster Recovery: Business continuity is a key aspect of both compliance and security. Attackers are always finding new ways to circumvent advanced cybersecurity solutions, which means disruption and potential breaches are possibilities no matter what. Having a comprehensive incident response plan and business continuity strategy will keep you both compliant and secure.
• Organizational Awareness: Every year, various reports indicate that human error is the main cause of data breaches. None of your compliance certifications or advanced security solutions will matter if an unsuspecting employee clicks a malicious link and lets an attacker directly to the center of your network. Investing in employee training, ongoing vulnerability testing, and regular penetration testing will keep you on top of potential gaps in your security strategy.

When you start to understand what it takes to balance compliance and security, your next steps can seem overwhelming. And unfortunately, the threat landscape is constantly changing, making life difficult not just when maintaining compliance, but also when staying ahead of attackers.

Don’t let a compliance certification lull you into a false sense of cybersecurity complacency. You might save money by cutting corners in the short term. But one data breach has the potential to cripple a business of any size.

Rather than waiting for a data breach to actually occur before you take action, consider the benefits of a managed security provider to help you proactively mitigate vulnerabilities and maintain compliance.

Leave your set-it-and-forget-it security mindset behind. Check out our free whitepaper and learn why so many businesses are shifting to managed SIEM and managed detection and response (MDR).