by Jesper Kråkhede, Sweden
Posted in Security Architecture, Technology on Mar 7th, 2021
I have spent some time lately looking at how Azure can help with the technical part of compliance, and I´m impressed by where this is heading. Most of the technical controls in standards like ISO 27001 and NIST are about configuration. Is the disk encrypted? Is the firewall on? Are the right security settings applied? […]
Posted in Business, Security Architecture on Feb 14th, 2021
After two months of writing about compliance I have had a few questions from managers along the lines of: Fine, but what should it cost? There is no single answer, but here is how I suggest you think about it. Split the cost in three: the work to implement the controls, the work to prove […]
Posted in Security Architecture, Technology on Feb 5th, 2021
There is one moment every security architect fears. You arrive at a new customer, you ask about their requirements and someone proudly opens a spreadsheet. It has every regulation and standard the company needs to follow mapped against each other. ISO 27001, NIST, GDPR, the industry regulator, a couple of customer contracts. Hundreds of rows, […]
Posted in Business, Security Architecture on Jan 22nd, 2021
Following my previous post, a word to management about compliance. In many companies compliance has become a game of doing as little as possible. The auditor comes once a year, the team prepares the evidence, the findings are negotiated down to something manageable and everybody is happy until next year. I understand it. Compliance costs […]
Posted in Business, Security Architecture on Jan 22nd, 2021
In my previous post I described the spreadsheet where all compliance requirements are mapped into one big set of rules. This post is about what it costs. The first cost is time. Every new system needs to be checked against hundreds of rules. Projects that should take months take a year. The business waits, or […]
Posted in Security Architecture, Technology on Jan 3rd, 2021
A new year and a new theme. This year I want to spend some time on compliance, because it is one of the most misunderstood parts of security. Let me start with a statement that usually upsets someone: Compliance is never good security. At best it is a baseline. Every standard and regulation is written […]