Doing as little as possible
Jan 22nd, 2021 by Jesper Kråkhede
Following my previous post, a word to management about compliance.
In many companies compliance has become a game of doing as little as possible. The auditor comes once a year, the team prepares the evidence, the findings are negotiated down to something manageable and everybody is happy until next year. I understand it. Compliance costs money and nobody gets a bonus for exceeding a requirement.
But think about what that means. You are spending money to reach a level that you know is the minimum, and then you stop. Every gap between that minimum and what your threats actually require is a vulnerability you have paid to keep.
The attackers don´t read your audit report. They look for the easiest way in, and the easiest way is very often exactly where the requirement ended.
So for management: Don´t ask only ‘Are we compliant?’ Ask ‘What would an attacker do to us, and would our compliance stop it?’ If the answer is no, compliance isn´t the goal. Security is.
And the good news is that if you build real security, compliance usually comes almost for free. The other way around never works.
Compliance tells you that you did your homework. It doesn´t tell you that you passed the exam.