Latest / CYBR.Signal / Regulations vs Standards: a.k.a Necessity vs Fundamental

Transcript

Regulations vs Standards: a.k.a Necessity vs Fundamental · CYBR.Signal

• 0:00
  SPEAKER_00: Hello everybody, happy Cyber Sunday.
• 0:02
  SPEAKER_00: Michael Farnum here.
• 0:03
  SPEAKER_00: Happy Labor Day coming up tomorrow.
• 0:05
  SPEAKER_00: Hope you're enjoying your long weekend.
• 0:07
  SPEAKER_00: Want to talk about a little bit more kind of a philosophical point.
• 0:12
  SPEAKER_00: I've done that a couple of times here.
• 0:14
  SPEAKER_00: Um a few cyber Sundays ago, I talked about how there was a necessary or a necessity, I guess a fundamental of cybersecurity programs, which is asset management.
• 0:26
  SPEAKER_00: And that's starting to finally come together along with technology.
• 0:30
  SPEAKER_00: So there's some new technologies out there that do asset management really well and give you all of the sources of truth and roll them up into one source of truth and help you get a hold of that.
• 0:40
  SPEAKER_00: Very fundamental to a cybersecurity program.
• 0:42
  SPEAKER_00: You have to know what you have in order to secure what you have.
• 0:46
  SPEAKER_00: So that's great.
• 0:47
  SPEAKER_00: And that I've been talking to security executives about that.
• 0:51
  SPEAKER_00: How do you get some of those necessities done?
• 0:55
  SPEAKER_00: And one of the things, though, on this one, I want to make sure we have a distinction, and maybe it's a distinction that doesn't make a lot of difference in how you approach things.
• 1:05
  SPEAKER_00: I don't know.
• 1:06
  SPEAKER_00: But I've heard people say that a fundamental of your security program is compliance.
• 1:13
  SPEAKER_00: And what they mean by compliance when they say that is compliance to a regulation that somebody has put in place, or a standard that is enforceable, such as PCI DSS.
• 1:28
  SPEAKER_00: So HIPAA is a regulation.
• 1:31
  SPEAKER_00: Some of the parts, even though HIPAA is not all about security, the parts in there that are about security, it's enforceable regulation, HIPAA high trust, that kind of stuff.
• 1:39
  SPEAKER_00: PCI DSS, not a state regulation, not a federal regulation, but a standard that you have to meet if you have credit cards.
• 1:49
  SPEAKER_00: Any of the security regulations that are out there and privacy regulations, those things that you have to comply with if your company and your organization is not going to get in trouble by some governmental body or by a body that has control essential of your finances, those are not fundamentals of a security program.
• 2:11
  SPEAKER_00: Those are necessities of a security program, not fundamentals of a security program.
• 2:19
  SPEAKER_00: What they are built on are standards that you can use that are a fundamental of a security program.
• 2:26
  SPEAKER_00: Because if you don't have a standard that you're working by, even if it's one you make up, but if you don't have a standard that you're working by, then you're just gonna get all out of sorts and you're really not gonna have a very organized security program, and it's just gonna kind of fall apart, or can if you don't just hold it together with sheer force of will.
• 2:46
  SPEAKER_00: So I I make that distinction because it's important that when you have these discussions, that you're not approaching your security program from a compliance perspective with a regulation or a standard that is enforceable.
• 3:02
  SPEAKER_00: What you should be doing is approaching your security program with a standard that helps you organize and adjust and figure out where your priorities are for your security program, what gaps you need to fill.
• 3:18
  SPEAKER_00: Use a standard, but then use that and choose it wisely as the basis of what you do with the other compliance stuff that you have to deal with.
• 3:27
  SPEAKER_00: You've you've heard it, I'm sure, a million times.
• 3:30
  SPEAKER_00: You shouldn't have checkbox security, you shouldn't be doing things to meet a regulation, you should be doing things to have a secure environment and then adjust to meet the regulation, not the other way around.
• 3:45
  SPEAKER_00: People have arguments about this all the time, and I'm absolutely somebody who says, I will put, I've said this before, I will put a widget in my environment if it gets an auditor off my back.
• 3:56
  SPEAKER_00: 100% I'll do it.
• 3:58
  SPEAKER_00: It may not have all of the best uh utility and do all the things that it should, but if an auditor wants to see that tool in there and it doesn't cost me an arm and a leg and make sense to get them off my back so I can do my day job, then absolutely I'll put it in there.
• 4:13
  SPEAKER_00: However, that should not be how you approach your security program.
• 4:19
  SPEAKER_00: So essentially, what I'm saying is regulations that are enforceable, standards that are enforceable by some kind of fine or otherwise, those should not be considered fundamentals to a security program.
• 4:33
  SPEAKER_00: They should be considered a necessity, and you should not be building your security program off of a regulation.
• 4:40
  SPEAKER_00: You should build your security program off of a standard and then meet and then fill the rest of it in to meet that regulation.
• 4:47
  SPEAKER_00: Hope that makes sense.
• 4:48
  SPEAKER_00: Let me know what you think.
• 4:50
  SPEAKER_00: Hope you see this because it's Labor Day.
• 4:51
  SPEAKER_00: Maybe you're just cooking or something.
• 4:53
  SPEAKER_00: I don't know.
• 4:54
  SPEAKER_00: But anyway, thanks everybody.
• 4:55
  SPEAKER_00: Thanks for listening.
• 4:56
  SPEAKER_00: Talk to you next time.