Compliance – The Invisible Hand Guiding Cybersecurity

Have you ever worked with a company that operates as “close to broken” as reasonably possible? Companies that follow that mindset usually do not have the most robust security practice, and they certainly will walk very close to the edge of compliance.

Even if you don’t work in such a dysfunctional enterprise as described above, many companies still do not appreciate the interconnection of security and compliance. Both are often considered cost centers, and that paints a scowl on the face of many Chief Financial Officers. However, there is a different way of looking at compliance (or its negative counterpart, non-compliance).

We can divide compliance into the categories of obvious and not-so-obvious costs.

The obvious costs are easy to understand:

• Track – Keeping a close watch on the requirements to maintain compliance
• Mitigate – Correcting any deficiencies
• Fines – Monetary penalties for compliance failure

Some of the hidden costs include:

• Additional internal audits – To verify that everything is in order as well as the costs of reworking
• Business disruption – Due to a regulator lockdown of a business unit or the entire organization,
• Productivity loss – The time employees need to focus on remediation
• Brand loss – Due to bad media coverage, and this leads to customer erosion

These costs ensure that your organization is equipped with the correct resources that are required to maintain and confirm there are no compliance slips. The biggest hidden cost, though, is the loss that is not accounted for due to non-standardized operating procedures and a lack of standardized control.

In information technology, this is known as secure configuration management.  An organization may be operating at lower efficiency without being noticed until regulatory compliance audits unravel the cracks in the IT ecosystem. This is the “close to broken” setting mentioned earlier.

Easing the burden

Fortunately, the journey to compliance need not be a burdensome task. For example, in the banking industry, digital checking mechanisms enable institutions to track all the risks and ensure compliance by applying the appropriate controls. Comprehensive dashboards are used to ensure that banks can effectively monitor and mitigate compliance issues before they cross into non-compliant territory.

To reduce business risk by ensuring systems are properly configured or hardened to meet with your internal regulatory and legislative compliance standards, Secure Configuration Management is a must.

A secure configuration management tool combines network monitoring and Endpoint Protection methodology to compare monitored systems against an approved configuration baseline or a golden image. Deviation from this baseline, known as test failures, can usually be corrected with little or no human intervention. Secure configuration management is truly a need-to-have based solution.

Secure configuration management offers benefits to organizations, not only from the cost-avoidance standpoint of non-compliance but also from increased organizational efficiency and agility. 

Secure Standard = Enhanced Security

There are added security benefits of having a secure standard.

All security professionals are familiar with the Common Vulnerabilities and Exposures (CVE) system, which provides a reference-method for publicly known information-security vulnerabilities and exposures. Along with that, The National Cybersecurity Federally Funded Research and Development Centers (FFRDC), operated by The MITRE Corporation, maintains a system dedicated to complex cybersecurity problems.

The vulnerabilities that are tracked by CVE and FFRDC aren’t targeted at your individual organization; they are just common susceptibilities that are easily exploited. This is why it is important to maintain baselines against these known weaknesses. Rapid response mechanisms can prevent your organization from exposure to any exploits that are tracked through CVE and MITRE. Setting and maintaining a configuration standard results in enhanced security.

Not All Attacks Are Random

It is important to note that while many vulnerabilities are “common,” there is a more critical aspect of maintaining compliance to protect your organization. The largest segments of attack types are targeted. This type of attack means your organization is singled out, and the attacker has a specific interest in your business or your intellectual property.

A targeted attack takes time and planning, sometimes months, to lay the groundwork and prepare. Attackers still use commodity techniques to probe the systems in your organization, looking for the best path to exploit, but their methods are specifically tailored to your infrastructure, your processes and your personnel. The main reason that targeted attacks are effective is because organizations struggle to follow basic security practices and properly institute measurable security policies.

Could you imagine how much less risk your organization would have if you could eliminate 99.99% of attacks?

How Tripwire Can Help

Tripwire makes compliance to security standard easier with the broadest set of compliance and security policies that accelerate securing your infrastructure and knowing where the weak points are. We update these policies as standards change and allow you to customize the test and assessment results to better meet your individual needs, as you get a giant head-start on your security policy and framework as well as the flexibility to make it your own.

Tripwire covers your infrastructure. Companies have an individual, unique infrastructure, consisting of legacy applications, older operating systems and hardware that may be antiquated. This doesn’t mean it isn’t valuable, and you should be able to get the same amount of protection and monitoring for these older systems as the rest of your systems.

Tripwire monitors almost any asset that you have, detecting changes in real time. Imagine if you could immediately catch configuration drift in your security configurations, giving you a chance to remediate and respond to those changes and to then re-assess the overall impact to your security posture within seconds.

This immediacy eliminates the old days of doing scheduled scans and then spending weeks manually fixing all configuration changes to return you back in alignment with your security policy. The best practice would be to do continuous assessment in real time and then fix the drift, keeping systems in a secure state. We help you categorize and fix deviations from your baseline, as remediation can be very expensive, and it isn’t always known if a change results in an increase or a decrease in risk.

Let us be a key part of your enterprise ecosystem to keep you compliant and secure. To find out more, or to request a demonstration, visit our full product line here.