Elements of Optimized Security: Automated Compliance

As a CIO or CISO, you’re constantly reminded that your job is to reduce costs, improve security and achieve compliance. And, if you’re like the many IT leaders I’ve worked with, I wouldn’t be surprised if you said you felt you were subject to an almost overwhelming number of regulations. Regulations that are constantly being revised and updated (we’re talking SOX, PCI, HIPAA, FISMA, the list goes on). Managing these regulations is a constant, sometimes daunting, task, and leads me to the final element of an optimized security posture: automated, centralized compliance.

We recently polled CIOs on the biggest challenges to their compliance efforts and the top three issues they noted were:

?      Lack of standard configurations & requirements

?      Manual internal/external audit processes

?      Configuration drift that leads to a rework before each audit

Organizations today have highly distributed, complex systems with disparate tools that generate a lot of data. If you don’t have a consistent approach across these tools you’re going to have gaps in your compliance posture, lose thousands of man-hours on multiple, repetitive audits and see a significant decrease in your overall ROI.

So, how do you get your security organization to a place where your compliance initiatives are streamlined, you’re regularly collecting data and feel confident in your compliance posture? At McAfee we see five steps toward ‘compliance nirvana’:

?      Set policy and prioritize assets. You can’t protect what you don’t know you have. Get an understanding of what’s managed and what’s not, as well as the value of the stored and processed data. What will cause a financial loss or downtime? What’s subject to regulatory audit?

?      Vulnerability management and configuration audit: Focus on process – where are the gaps? Where’s the potential configuration drift? What devices in your system are unmanaged? What’s the overall security state of your various devices?

?      Risk-based remediation: Identifying and prioritizing risk is key. Do you have an understanding of what threats are targeting you? Do you have countermeasure technologies in place and are they automated?

?      Enforce policy & monitor change: This is critical.  Do you know what can be changed in your system and by whom? Can you ensure the integrity of your systems? Configuration drift is one of the top causes of security breaches.

?      Real-time reporting: Collect data consistently, so that at any point in time you can assess our compliance posture. A great question to ask yourself – if you ran your financial reporting the way you run your security reporting, would you still be in business?

Most companies work through these steps as they navigate the various stages of enterprise security maturity. As you work towards an optimized security posture that includes automated, centralized compliance, you’ll start to see drift prevention as well as achieve greater visibility, efficiency and agility out of your environment.

Check out our recent webinar with Tyco International on how they automated their compliance processes.

Tags: Risk and Compliance, vulnerability