.svg){kind=icon}
.svg){kind=icon}
Strata Consulting was founded in 2011 with a mission to help companies build scalable, secure, and efficient security programs and infrastructure. In that span of time, we have seen a lot of security programs and have worked with companies of all sizes and types. From the small two-person startup that has grown to thousands of employees and subsequently IPO-ed, to large biotech companies that have embarked and since then completed infrastructure transformation from on-premise data centers to hybrid cloud–we have seen a lot of security programs at different stages of maturity and have helped many companies complete their objectives.
The truth is–companies today face a much more challenging security and compliance environment than in the past. When I first started my career in the nineties, building secure infrastructure and security programs was something done only by the largest companies. For smaller companies, security and compliance requirements were relevant insofar as it made business sense to apply best practices. It was not so much that they thought security was not important, rather most were focused on developing products and making them available.
A Brief History of Compliance
Prior to the year 2000, compliance was largely the domain of companies working with governments and companies dealing with regulatory and legal requirements. Security and compliance standards existed with NIST and SAS 70. Companies leveraged these as best practices, and compliance was applicable to those that worked with large organizations requiring these practices. There was no forcing function for the majority to be compliant.
The 2000s was a period where we saw the seeds of mainstream compliance being planted. In 2004, PCI stepped onto the scene with PCI v1.0 to mandate requirements for companies that process, transmit, store or accept cardholder data. SAS 70 from the AICPA was used to demonstrate control objectives and validate control activities. First published in October 2005, ISO 27001 was later revised in October 2013 to better accommodate the changing information security challenges. Back then, the requirement to be ISO 27001 compliant mostly applied to companies in Europe or those working with them.
The 2010s was a Renaissance period for compliance. Alongside the rise of cloud services and globalization, we saw rapid maturity and adoption of compliance standards. In 2010, the AICPA introduced SOC 2 and Service Organization Controls to replace SAS 70. ISO 27001 became more relevant as companies continued to market their services all over the world, especially in Europe. We also saw the rise of privacy compliance due to the invalidation of the US-EU Safe Harbor and eventually the requirements for the GDPR in 2018.
Fast forward to the 2020s and we see that security and compliance have gone fully mainstream. Today, due in part to the proliferation of cloud services and rising maturity in risk management, companies regularly come under the scrutiny of customers for security requirements and are held accountable to a swath of different frameworks, including, but not limited to these:
- SOC 2
- ISO 27001
- ISO 27017
- ISO 27018
- PCI
- HIPAA
- HITRUST
- FedRAMP
- CMMC
- NIST 800-53
- NIST 800-171
- GDPR
- CCPA
- APEC
As more companies pursued the compliance requirements above, their third-parties and vendors were also required to maintain similar processes. This cycle had a positive effect in requiring security compliance to become more mainstream, but also made it a challenge for companies of all sizes to implement and maintain.
Key Compliance Challenges Today
Among the many security and compliance challenges companies face today, these are the ones we see over and over again.
- More security and compliance requirements. Keeping up with more security and compliance requirements as the company grows.
- Privacy requirements. Keeping up with privacy regulations and their intersection with security and compliance.
- Decentralizing security. Making security a part of every individual and department instead of being owned and enforced centrally.
- Customer security requests and audits. As companies acquire more and larger customers, they are subject to more and more difficult security questions and are often required to support customer audits.
- Changing and increasing compliance scope. Managing compliance evidence and requirements in the face of changes or increases in scope and environment(s).
- Complexity in managing cloud risks. Complexity in managing risks on a technology stack that uses multiple cloud service providers and where there is shared responsibility to protect data.
- Effective incident response. Challenge of implementing and managing effective incident response processes.
- Security monitoring in the cloud. Adequate and reliable security monitoring of data and infrastructure in the cloud.
- Effective vulnerability management. Managing vulnerabilities across cloud providers and the technology stack.
- Security staff turnover. Employee turnover in security and compliance resulting in the loss of valuable domain knowledge.
- Shortage of security and compliance staff. Shortage of resources to keep up with the increase in demand.
No Silver Bullet for Compliance
How do companies address these challenges?
While there is no silver bullet, companies can opt to leverage baseline approaches that have worked in the past, as well as take advantage of improved tools, technology, automation, and experienced resources that are available today to address these challenges. One downside to many approaches that have worked in the past is that they tend to be manual and require constant maintenance to keep up to date.
The following are key areas to systemize well in order to adequately address challenges:
- Controls, policies, and procedures management
- Audit management
- Change management
- Vulnerability management
- Risk management
- Vendor risk management
- Customer response management
- Incident management
- Privacy management
Although we wish we could answer with a single product or service, compliance still requires companies to continually assess how to manage their people, processes, and technology to mitigate their risks. Companies must focus limited resources against the ever-growing landscape of threats and regulatory requirements.
Better Ways to Systemizing Compliance
Here is a summary of these key areas and the baseline ways we have seen companies attempt to systemize addressing them. We also provide some recommendations on a better approach.
|
Key Areas to Systemize |
Baseline |
Better |
|
Control, Policies, and Procedures Management |
|
|
|
Audit Management |
|
|
|
Vulnerability Management |
|
|
|
Risk Management |
|
|
|
Vendor Risk Management |
|
|
|
Customer Response Management |
|
|
|
Privacy Management |
|
|
What’s Next?
Strata have found that teaming up with Cobalt helps companies maintain a security vulnerability management practice. Continuous monitoring and testing of one’s environment helps build a more real-time and accurate risk profile. Further, continuous penetration tests supply data that can identify whether the compliance program and information management systems are operating effectively. If a penetration tester is able to exploit vulnerabilities and bypass company controls, this is feedback on where to improve.
As technology and organizations continue to evolve with risks and threats, we expect compliance to also evolve and change. To keep up with these changes, companies need to rely on fundamentals that work while leveraging tools, experienced resources, and automation to scale alongside growing scope and complexity.
As a company that has been working in the forefront helping others build and evolve security and compliance programs with a collective 150+ years of experience, Strata looks forward to the future and helping customers adapt to meet these challenges.
