Making regulatory compliance the primary driver for corporate information security projects isn’t a good idea.
Using it as a strategy for increasing security investments – common among U.S. companies – could actually weaken enterprise defenses in the long run, according to Ray Wagner, vice-president for information security and privacy research at analyst firm Gartner Inc., based in Stamford, Conn.
But Canadian companies don’t seem to be getting caught in the compliance web, according to one enterprise security expert.
One reason for this is regulatory requirements in Canada are not quite as intense as U.S. compliance regulations, such as Sarbanes-Oxley, said Marcus Shields, enterprise product manager for Toronto-based security vendor Soltrus Inc., a Canadian affiliate of VeriSign Inc.
The consequences of non-compliance are not as severe in Canada, he said.
It is true, however, that local firms that have a business presence in the U.S – directly or indirectly – tend to put more focus on compliance, he said.
But while Canadians generally understand the benefits of bringing compliance into the organization’s information security architecture, Shields does not believe it is the biggest driver for information security spending.
“Suppose there were no compliance regulations, at all. Would that mean that, instantly, enterprises would cut their security budget? I don’t think so,” he said.
According to Gartner’s Wager, compliance has led to increased security spending, but it should be a by-product of a much broader strategy.
Organizations are cloaking their pet projects in compliance to get funding. “We have reached a point where the information security budget is peaking and downward pressure will begin to emerge,” he said, adding that the current spend is about 6 percent of the IT budget.
Jack Jones, chief information security officer (CISO) at Nationwide Mutual Insurance Company, said that when companies try to manage risks by using a checklist of compliance items, there is “a very real danger” of overlooking other critical security issues. “Checklists cast the world in black-and-white terms,” Jones said.
Neal Wise, partner with IT security consultancy firm Assurance.com.au, warned many companies approach compliance and security as an opportunity to kill two birds with the one stone.
“Legislation is getting some companies to invest in security, but in some cases they are just doing the bare minimum and this could give those companies a false sense of security,” he said.
“In some cases, because companies have to look externally for security recommendations, they may use regulations to start building their own security frameworks.”
Shields, however, admitted the advent of regulatory compliance has brought on new challenges to the information security infrastructure. New requirements, such as segregation of duties and the capability to track and audit information access, are being built into information security systems as part of the organization’s compliance objectives.
“If somebody was (previously) both the CFO and the sales manager, now he is not allowed to be (both). So, we (have to) design an information security infrastructure to accommodate that, and all of those are imposing challenges in the enterprise,” said Shields.
Ben Rothke, a senior security consultant at ThruPoint, said the problem with compliance is that people tend to take a myopic view of what needs to be done whenever new regulations come out.
“The point needs to be made that those organizations with a solid security framework in place could easily handle any regulations thrown at them,” he added.
James Turner, Frost & Sullivan security analyst, said compliance is about transparency.
“Obfuscating funds by using the compliance hot button is going to get stomped on … of course this doesn’t mean shonky people won’t try it, and ironically these are the very people that regulations are beefed up to address,” Turner said.
(Jaikumar Vijayan of Computerworld (US) contributed to this report.)
– With files from Mari-Len De Guzman