A new year and a new theme. This year I want to spend some time on compliance, because it is one of the most misunderstood parts of security.<\/p>\n
Let me start with a statement that usually upsets someone: Compliance is never good security. At best it is a baseline.<\/p>\n
Every standard and regulation is written to work for a large number of organisations. That means it describes the minimum that everyone should be able to do. It can\u00b4t know your environment, your threats or what an attacker would go for in your network. And it is always a few years behind, because it takes time to agree on a standard.<\/p>\n
The problem starts when the minimum becomes the goal. I see it all the time. The audit requires password complexity, so passwords are complex but the admins still logon everywhere with the same account. The standard requires logging, so the logs are collected but nobody reads them. The control is in place, the box is ticked and the attacker walks right past it.<\/p>\n
Technically, the gap is almost always the same: how admin accounts are protected, how lateral movement is stopped and how fast you detect someone who is already inside. Very few standards go deep on those.<\/p>\n
Use compliance as the floor, not the ceiling. Then build the security on top of it.<\/p>\n","protected":false},"excerpt":{"rendered":"
A new year and a new theme. This year I want to spend some time on compliance, because it is one of the most misunderstood parts of security. Let me start with a statement that usually upsets someone: Compliance is never good security. At best it is a baseline. Every standard and regulation is written […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[79,40,26],"class_list":["post-1257","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-compliance","tag-risk-management","tag-security-architecture"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1257"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1257\/revisions"}],"predecessor-version":[{"id":1295,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1257\/revisions\/1295"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}