If I were to ask you why you scanned for compliance at your company, I’d bet you’d tell me it was to help you pass requirements easier, to ensure that your audits are good on the first pass and so that you could troubleshoot technical issues with another process.
You didn’t know about that last one? Wait, are you telling me you don’t know about the hidden benefits of compliance that you’re getting? Let’s talk.
The truth is, if you're setting up your compliance policy and tools correctly, you’re getting benefits you may not be aware of.
For starters, it can make your company run more efficiently through transparency. If you are reviewing the compliance reports, you’ll get a clear picture of not only your compliance status but also your operational decisions. Let’s say you set up a server used for tracking code errors, and you buy licenses for 1,000 people to use it. Through your compliance, you realize that there are really only 50 people who connect to enter data on the server. With that information, you can cut down considerably on the licenses you purchase, possibly saving your company tens of thousands of dollars.
Speaking of data, it seems like every time we turn around, we hear about another breach where data is compromised. It’s why we use compliance tools in the first place. And yes, protecting your customers’ data is crucial. Being compromised costs a company untold amounts of money and a potential loss of customers, but it’s much worse than that. We’re not just protecting data. More importantly, we’re protecting our reputations in the business world. As a business, you can pay the fines and give customers access to free identity theft services, but you can’t make people regain your trust in you. You hope they will. But you can’t bet on it. It’s better to not lose that confidence in the first place.
Now, let’s talk about fines. If you don’t have your compliance standards documented in your reporting, you will fail certain audit-types such as HIPAA, PCI and others. Failure creates fines and takes resources to quickly resolve those failures. In other words, IT COSTS YOU MONEY. As we said previously, you can pay those fines, but why not avoid those costs and spend your budget on that new ergonomic desk you’ve had your eye on?
While writing this post, I spoke with a friend of mine who performs compliance for her department. She mentioned that something her compliance audits helped her with was discovering a technical issue in another process. During an audit scan, there were certain compliance practices missing from a group of servers. It made no sense since they had a script that would apply their compliance policy to new servers. When her team investigated closer, they discovered an issue with the script that caused it to not run correctly on some servers’ configuration. The script hadn’t kicked out any errors, so it had gone unnoticed. If not for reviewing her scan results, she would have continued using her broken script. Instead, they found the problem, fixed the script, and continued happily scanning.
Here’s another thing you probably didn’t think of. So, you didn’t take the time to set up your compliance correctly? You know who did? Your competitors. And you’re better than them, aren’t you? Maybe not. A company’s only as good as the protection they apply to their data. Leave a few holes in your protection, next thing you know, your competitors’ security is heading towards the top of the ladder. And yours? Not so much.
Let’s switch gears a moment and talk about an important bit of compliance that is often over-looked-- compliance training. Remember when I said there are hidden benefits to compliance if you’ve set up your processes correctly? That means you need to ensure your team is trained, not only on the latest industry standards, but also your company’s standards. This will ensure that your team, your supervisor, and their manager will all be aligned on the policies your company needs to protect itself and your customers. Here’s the important bit. It’s not enough to train your team, but to make sure your processes are all documented. This gives the team something to refer to when there are questions and makes those processes easily accessible to new team members. A good rule of thumb is if you haven’t documented a process, then it doesn’t actually exist.
Having a well trained team and documented processes will lead to another hidden benefit as well. It will minimize the time spent enforcing your security policies. That sounds like an oxymoron, doesn’t it? Spending time on deploying security in order to save time on deploying security? But it’s not. Spending the time beforehand, mapping your network out, figuring what sort of policy needs to be deployed to each system and making sure to document the “Hows” and “Whys” sounds obvious, but I hear from customers time and time again who inherited a compliance system and have no idea why it was set up that way by their predecessor. This leads to them not able to build on the existing system and having to recreate it from the ground up. And when they do, guess what they often leave out? Documentation again. These customers will wind up continually having to recreate the wheel over and over again.
Look, we all have to use compliance security. There’s no way around it. But if you initially deploy it with a plan in mind, if you document it, if you review your results carefully, not only will you use your compliance tools to their fullest, you’ll also reap those hidden benefits as well.
Mastering Security Configuration Management
Master Security Configuration Management with Tripwire's guide on best practices. This resource explores SCM's role in modern cybersecurity, reducing the attack surface, and achieving compliance with regulations. Gain practical insights for using SCM effectively in various environments.
