Securosis Guide: P.Compliance.90X

Posted on by Securosis Team

This post is part of a multi-part series about the Securosis Guide to the RSA Conference (download the RSAC-G PDF). Please scroll to the bottom for links to other posts in the series.

Compliance. It's a principle driver for security spending, and vendors know this. That's why each year compliance plays a major role in vendor messaging on the RSAC show floor. A plethora of companies claiming to be "the leader in enterprise compliance products" all market the same basic message: "We protect you at all levels with a single, easy-to-use platform." and "Our enterprise-class capabilities ensure complete data security and compliance." Right.

The single topic that best exemplifies our fitness meme is compliance. Most companies treat compliance as the end goal: you hold meetings, buy software, and generate reports, so you're over the finish line, right? Not so much. The problem is that compliance is supposed to be like a motivational poster on the wall in the break room, encouraging you to do better—not the point itself. Buying compliance software is a little like that time you bought a Chuck Norris Total Gym for Christmas. You were psyched for fitness and harbored subconscious dreams it would turn you into a Chuck Norris badass. I mean, c'mon, it's endorsed by Chuck Friggin' Norris! But it sat in your bedroom unused, right next to the NordicTrack you bought a few years earlier. By March you hadn't lost any weight, and come October the only thing it was good for was hanging your laundry on, so your significant other posted it on Craigslist.

The other side of the compliance game is the substitution of certifications and policy development for the real work of reducing risk. PCI-DSS certification suggests you care about security but does not mean you are secure—the same way chugging down 1,000-calorie fruit smoothies makes you *look* like you care about fitness but won't get you healthy. Fitness requires a balance of diet and exercise over a long period; compliance requires hard work and consistent management towards the end goal over years. Your compliance requirements may hinge on security, privacy, fraud reduction or something else entirely, but success demands a huge amount of hard work.

So we chide vendors on their yearly claims about compliance-made-easy, and that the fastest way to get compliant is buy this vendors class-leading product. But this year we think it will be a little more difficult for vendors, because there is a new sheriff in town. No, it's not Chuck Norris, but a new set of buyers. As with every period of disruptive innovation, developers start to play a key role in making decisions on what facilities will be appropriate with newer technology stacks. Big Data, Cloud, Mobile, and Analytics are owned by the fitness freaks who build these systems. Think of them as the leaner, meaner P90X fitness crowd, working their asses off and seeing the results of new technologies. They don't invest in fancy stuff that cannot immediately show its worth: anything that cannot both help productivity and improve reliability isn't worth their time. Most of the value statements generated by the vendor hype machine look like Olivia Newton-John's workout gear to this crowdsorely out-of-date and totally inappropriate. Still, we look forward to watching these two worlds collide on the show floor.
—Adrian Lane, Analyst & CTO, Securosis

Check out other posts in the series: Introduction
Theme posts: Change; Internet of Things; Professionalism; Compliance; Big Data; Bonk; DevOps
Coverage Area Deep Dives: Overview; Endpoint Security; Network Security; IAM; Cloud Security; Data Security; Security Management;
Download your copy of RSAC-G

Securosis Team

, Securosis

risk management

Blogs posted to the website are intended for educational purposes only and do not replace independent professional judgment. Statements of fact and opinions expressed are those of the blog author individually and, unless expressly stated to the contrary, are not the opinion or position of RSA Conference™, or any other co-sponsors. RSA Conference does not endorse or approve, and assumes no responsibility for, the content, accuracy or completeness of the information presented in this blog.

Share With Your Community

Related Blogs