The Coalfire Blog

Welcome to the Coalfire Blog, a resource covering the most important issues in IT security and compliance. You'll also find information on Coalfire's insights into the unique cybersecurity issues that impact the industries we serve, including Cloud Service Providers, RetailFinancial Services, Healthcare, Higher Education, Payments, Government.

The Coalfire blog is written by the company's leadership team and our highly-credentialed security assessment experts.

The Coalfire Blog

IT Compliance Matures into Risk Management

March 07, 2011, Rick Dakin, CEO, Co-founder and Chief Security Strategist

Rick Dakin

Over the past ten years rapid change and an evolving threat landscape has better prepared Coalfire to defend our clients against known risks. Not surprisingly, much of the progress is due to compliance-related investments. As we look towards the next ten years, we see a proactive risk management framework being set in place.

Banks have seen well-orchestrated attacks that have caused millions to be lost to cyber thieves engaged in wire transfer fraud. In one recent example,  a weak five-year-old password left the door open. A simple review of the risks threatening wire transfer accounts – and appropriate corrective actions — could have prevented this loss.

Merchants have also suffered staggering losses to credit card thieves. The PCI Data Security Standard is now quite well-known, and many merchants consider PCI compliance with basic PCI tests to be adequate. This often leads to a false sense of security, since some high-value, low-cost controls are neither considered nor implemented.   In another investigation, we learned that  simple system maintenance procedures and secure data deletion tools would have prevented the incident.

We are now encouraging our clients to take  proactive steps that go beyond compliance.  These comprehensive  enterprise-level risk assessment efforts, which often include penetrations tests and mock social engineering attacks,  create awareness of the vulnerabilities before issues occur.

At Coalfire, we share your optimism that we can fight back and win. To all of our clients and countless IT security thought leaders, thank you for the past ten years, may the next ten be even better.

<< Go Back

IT support London
Appreciation for the great blog post. I am glad I have taken the time to learn this.
11/28/2011 5:53:54 AM

Post Topics



Accounting Agency AICPA Assessment assessments ASV audit AWS AWS Certified Cloud Practitioner AWS Certs AWS Summit bitcoin Black Hat Black Hat 2017 blockchain Blueborne Breach BSides BSidesLV Burp BYOD California Consumer Privacy Act careers CCPA Chertoff CISO cloud CMMC CoalfireOne Compliance Covid-19 credit cards C-Store Culture Cyber cyber attacks Cyber Engineering cyber incident Cyber Risk cyber threats cyberchrime cyberinsurance cybersecurity danger Dangers Data DDoS DevOps DevSecOps DFARS DFARS 7012 diacap diarmf Digital Forensics DoD DRG DSS e-banking Education encryption engineering ePHI Equifax Europe EU-US Privacy Shield federal FedRAMP financial services FISMA Foglight forensics Gartner Report GDPR Google Cloud NEXT '18 government GRC hack hacker hacking Halloween Health Healthcare heartbleed Higher Education HIMSS HIPAA HITECH HITRUST HITRUST CSF Horror Incident Response interview IoT ISO IT JAB JSON keylogging Kubernetes Vulnerability labs LAN law firms leadership legal legislation merchant mobile NESA News NH-ISAC NIST NIST 800-171 NIST SP 800-171 NotPetya NRF NYCCR O365 OCR of P2PE PA DSS PA-DSS password passwords Payments PCI PCI DSS penetration Penetration Testing pentesting Petya/NotPetya PHI Phishing Phising policy POODLE PowerShell Presidential Executive Order Privacy program Ransomware Retail Risk RSA RSA 2019 Safe Harbor Scanning Scans scary security security. SOC SOC 2 social social engineering Spectre Splunk Spooky Spraying Attack SSAE State Stories Story test Testing theft Virtualization Visa vulnerability Vulnerability management web Wifi women XSS