Are all of these compliance regulations productive?

One common theme I am hearing from many of the leading database security vendors and their customers is how little market demand there is for HIPAA and PCI compliance solutions. Even though these regulations are reasonably precise about security requirements, the lack of enforcement has led to the lack of investment. This is a good thing, as these specifications are malformed attempts to require available technologies that frequently are poorly aligned with business or consumer protection needs. For instance, PCI barely touches on loss of personally identifiable information, which a naïve analyst would think is its reason for existence in the first place.

It is very hard to write effective regulations. Our state and federal legislatures can learn from provisions of the only two effective regulations.

1. Executive accountability is the key provision of SOX. Having the chief executive of a publicly held company personally sign off on the controls and security of the company’s financial results is a powerful force. Executive commitment, not lip service, to security has had positive returns in keeping security aligned with IT and business needs.
2. Market accountability is the key provision of 1386. Requiring companies to disclose loss of personally identifiable information is a huge influence on corporate behavior. Accountability to the market, that is customers and prospects, goes right to the bottom line of businesses and drives investments to keep from appearing on the front page of the local newspaper.

When I see PCI or HIPAA programs, the motivating factor seems to be CYA tied to executive or market accountability. That is, if there is a breach, affected parties want to know that the organization took every reasonable precaution. That’s when compliance with specific sections of PCI or HIPAA comes in handy.

We are now on the threshold of more regulations. It is very clear that governments cannot mandate how organizations secure confidential information. The attacks and defense technologies just change too rapidly for any such regulations to be effective for long (like PCI requiring an IDS). New statutes for such things as data encryption or identity theft should use executive and market accountability as the enforcement hammers. Let the businesses adapt and innovate over time as threats and risks evolve. Anything else is doomed to be unproductive without improving security one iota.