The Coalfire Blog
IT Compliance Matures into Risk Management
March 07, 2011, Rick Dakin, CEO, Co-founder and Chief Security Strategist
Over the past ten years rapid change and an evolving threat landscape has better prepared Coalfire to defend our clients against known risks. Not surprisingly, much of the progress is due to compliance-related investments. As we look towards the next ten years, we see a proactive risk management framework being set in place.
Banks have seen well-orchestrated attacks that have caused millions to be lost to cyber thieves engaged in wire transfer fraud. In one recent example, a weak five-year-old password left the door open. A simple review of the risks threatening wire transfer accounts – and appropriate corrective actions — could have prevented this loss.
Merchants have also suffered staggering losses to credit card thieves. The PCI Data Security Standard is now quite well-known, and many merchants consider PCI compliance with basic PCI tests to be adequate. This often leads to a false sense of security, since some high-value, low-cost controls are neither considered nor implemented. In another investigation, we learned that simple system maintenance procedures and secure data deletion tools would have prevented the incident.
We are now encouraging our clients to take proactive steps that go beyond compliance. These comprehensive enterprise-level risk assessment efforts, which often include penetrations tests and mock social engineering attacks, create awareness of the vulnerabilities before issues occur.
At Coalfire, we share your optimism that we can fight back and win. To all of our clients and countless IT security thought leaders, thank you for the past ten years, may the next ten be even better.
<< Go Back