kris lahiri

Re-Defining Security – It’s More Than Just Compliance

Re-Defining Security

Risk management is messy. The internet has known vulnerabilities, and regulatory issues seem to change faster than you can say “Privacy Shield.”

So why can’t security and compliance teams see eye to eye?

Sixty-four percent of IT executives feel confident that compliance will protect their company against breaches, according to Vormetric’s 2016 Data Threat Report. Couple this assumption with Trustwave’s finding that 77 percent of IT professionals are pressured to take IT projects public without “sufficient security protections,” and you see the beginnings of a broken system.

Security and compliance are permanently entangled. Teams that don’t collaborate effectively risk losing both. Learning how compliance and security operate now, and why teams disagree, is the first step towards bringing groups together.

Reducing Overlap and Uniting Teams

Until recently, security and compliance teams have remained siloed. Compliance is traditionally a function of paperwork: sign here, initial there, make sure critical information is laid out and legally bound. Professionals in this field succeed by understanding and adhering to extensive legal frameworks.

security-community

Contrast that with security, a highly technical function that operates deep in the bowels of IT. Security teams continuously evolve their understanding of online environments, tuning and innovating protections against an unceasing torrent of malware.

Now that forms are being validated online through software like DocuSign and ShareFile, and confidential data travels across innumerable consumerized cloud services, compliance and security overlap in many ways and the two will soon merge.

Key Tips to Ensure Security and Compliance in 2016

Online documents have brought compliance online and put paperwork into the realm of IT. To work with this new reality, teams must be clear on a few key things, otherwise the finger pointing will continue:

  1. Compliance is not security. This is an assumption that IT shops make when they’re still purely on-premise (those using XaaS have their own set of issues, which I’ll explain later). Consumers continue to demand new features and levels of service from every company in every sector, whether it sells apples or augmented reality apps. Stubborn companies will require customers to use dated—but compliant—tools like FTP, while competitor businesses will already have bounded into the mobile cloud. Becoming compliant in new ways will cost a company time, but not moving ahead will cost it the whole business.
  2. Complicated security systems are not secure.Business users are more freely finding new apps and services they want to use to improve workflows. At the same time, IT is challenged with managing oversight and outdated solutions like FTP to ensure compliance.

Business users would rather send an email with company intellectual property than try to remember yet another login and password. IT faces a different kind of feature sprawl: teams lose management and oversight – security intelligent monitoring, network breach detection, firewalls, event correlation and other security tools. When IT focuses on the handful of essentials that everyone will use—such as enterprise key management and end-to-end data encryption—and prioritizes apps that end users will actually engage with, the entire company is safer.

Becoming compliant in new ways will cost a company time, but resisting an evolution will have a negative impact on the business.

  1. The cloud is only as secure and compliant as you make it. Major cloud providers attract the best minds in security, and that’s how it should be. Every cloud service has its weaknesses. What they are depends on the product or services a company provides. Custom integrations, while convenient, open up new backdoors that wouldn’t otherwise be there. From a security standpoint, companies must ensure that their providers maintain a centralized API as the only way for one service to digitally communicate with another, and aren’t littered with custom integrations.

A New Framework to Align Security and Compliance

There will always be new malware, and new regulations show no signs of stopping their forward march either.

ID-Theft-Comic

Privacy is seen as a consumer rights issue in the US, but to Europeans, it is a fundamental right—and transnational agreements are getting ever more complicated because of it.

Last year, the European Court of Justice decided that Safe Harbor rules were not specific enough to protect citizen data from NSA mass surveillance and backdoors. Reborn as Privacy Shield, the new transatlantic agreement promises to add more stringent reviews and give US agencies like the FTC broader enforcement powers.

Does adding layers of legal directives and pulling in more agencies really guarantee data privacy across the pond? The verdict is out, but the unfolding drama of Privacy Shield should serve as a lesson to every organization wishing to keep its data both secure and compliant: align the security and compliance organizations and concentrate on forward innovation. 

While it may take time to establish, once alignment is achieved it will enable the teams to move forward with confidence and shift their focus back to the business. And that is a value proposition that everyone can appreciate.

kris lahiriBy Kris Lahiri

Kris is co-founder and Chief Strategy Officer at Egnyte, responsible for Egnyte's security and compliance, as well as the core infrastructure, including storage and data center operations. Prior to Egnyte, Kris spent many years in the design and deployment of large-scale infrastructures for Fortune 100 customers of Valdero and KPMG Consulting. Kris has a B.Tech in Engineering from the Indian Institute of Technology, Banaras, and an MS from the University of Cincinnati.

 

CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in cloud connected technology information and consultancy services.

Are you a cloud services expert in a world of digital transformation? If so, contact us for information on how to become part of our growing cloud consultancy ecosystem.

CONTRIBUTORS

Why ‘Data Hoarding’ Increases Cybersecurity Risk

Why ‘Data Hoarding’ Increases Cybersecurity Risk

Data Hoarding The proliferation of data and constant growth of content saved on premise, in cloud storage, or a non-integrated ...
Cloud-Based or On-Premise ERP Deployment? Find Out

Cloud-Based or On-Premise ERP Deployment? Find Out

ERP Deployment You know how ERP deployment can improve processes within your supply chain, and the things to keep in ...
AWS S3 Outage & Lessons in Tech Responsibility From Smokey the Bear

AWS S3 Outage & Lessons in Tech Responsibility From Smokey the Bear

AWS S3 Outage & Lessons in Tech Responsibility Earlier this week, AWS S3 had to fight its way back to ...
Two 2017 Trends From A Galaxy Far, Far Away

Two 2017 Trends From A Galaxy Far, Far Away

Reaching For The Stars People who know me know that I’m a huge Star Wars fan. I recently had the ...
3 Ways to Protect Users From Ransomware With the Cloud

3 Ways to Protect Users From Ransomware With the Cloud

Protect Users From Ransomware The threat of ransomware came into sharp focus over the course of 2016. Cybersecurity trackers have ...
How Big Data Can Empower Native Ads

How Big Data Can Empower Native Ads

Empower Native Ads The realm of big data is expanding an astonishing rate, and its presence can be felt across ...
Battle of the Clouds: Multi-Instance vs. Multi-Tenant Architecture

Battle of the Clouds: Multi-Instance vs. Multi-Tenant Architecture

Multi-Instance vs. Multi-Tenant Architecture  The cloud is part of everything we do. It’s always there backing up our data, pictures, ...
Financial Management Finds a Welcome Home in the Cloud

Financial Management Finds a Welcome Home in the Cloud

Cloud Based Financial Management The most cautious person in any organization is likely to be the CFO. After all, they’re ...
Imminent IoT Eye-Tracking Technologies To Transform The Connected World

Imminent IoT Eye-Tracking Technologies To Transform The Connected World

IoT Eye Tracking Smelling may be the first of the perceptible senses, but the eye is the fastest moving organ ...
Safeguarding Data Before Disaster Strikes

Safeguarding Data Before Disaster Strikes

Safeguarding Data  Online data backup is one of the best methods for businesses of all sizes to replicate their data ...

NEWS

email as a service

Google Data Analysis, Artificial Intelligence and Predicting Vaccine Scares

Social media trends can predict tipping points in vaccine scares Analyzing trends on Twitter and Google can help predict vaccine ...
U.S. IT Sector Employment Expands by 8,100 Jobs in November, CompTIA Analysis Reveals

U.S. IT Sector Employment Expands by 8,100 Jobs in November, CompTIA Analysis Reveals

DOWNERS GROVE, Ill., Dec. 8, 2017 /PRNewswire-USNewswire/ -- New hiring in computer and electronics manufacturing and technology services and custom ...
Deloitte TMT Predictions: Machine Learning Deployments, On-Demand Content and Live Events Will Continue to Drive Growth

Deloitte TMT Predictions: Machine Learning Deployments, On-Demand Content and Live Events Will Continue to Drive Growth

NEW YORK, Dec. 12, 2017 /PRNewswire/ -- Deloitte forecasts double digital growth in machine learning deployments for the enterprise, an increasing worldwide ...