See your link here
Compliance legislation: lack of enforcement or lack of solutions?
6 comments- IT TOPICS:Security
I'd like to reference Eric Ogren's blog on the topic "Are all these compliance regulations productive?" I quote, "Even though these regulations are reasonably precise about security requirements, the lack of enforcement has led to the lack of investment."
I don't think that's why there's a lack of investment. It's not the lack of enforcement. It's the lack in vendor solutions that fully understands the business needs.
For instance, take HIPAA data. When I think about data management, I think about data in transit and data at rest, and whether or not to encrypt it; the sensitivity of that data and what type of access controls to apply. I think about network security and what network security zone sensitive data should reside within. I think about security issues through all the layers of the OSI model.
When a vendor comes to me and tells me that their,document management system, for instance, is HIPAA compliant, I ignore the claim. There is no one solution or technology that enables an organization to become compliant. I consider their boast to be false and I don't even bother to have a discussion about it.
When I evaluate a "solution", I am thinking circles around the vendor because information security is a complicated, multi-layered beast. If a vendor came in, who was very well versed in the legislation, and in the security arena, and understood what their solution actually did as a part of the total solution, I would listen. So far, I've just not been that impressed and maybe that is why compliance vendors are wondering "how little market demand there is for HIPAA and PCI compliance solutions".
I suggest they rethink their marketing strategy.
Print
Email this
Digg this
