Hi everyone. My name's Albert Whale. Many of you know me already and for those of you that don't, I'm a cybersecurity leader and I work in cyber exclusively for businesses. I. Eventually, I'm gonna branch out for consumers as well, but let's take care of the businesses that support our economy, and then help filter out and protect the data that they're working with, which is ideally your data.
So today's conversation is compliance is a cybersecurity matter now. A while ago, I didn't really consider compliance as being a great tool for cybersecurity. And I say that because everybody can do compliance. And even the attackers know what compliance means so that they have the rules of the road on how do they attack a surface that they're not already involved in.
Did you know. They use the compliance rules 'cause a lot of compliance rules come up with standards on how do I do security and keep the bad guys out. So let's talk about that. The compliance is a starting point. So essentially, if you're told that you must record failed logins and your business decides that.
Five failed walk-in attempts in a minute is abuse or excessive or incapable by most humans, which apparently it is. If I stepped it up to 10, I think everybody would agree, but maybe some at the five level wouldn't understand that. But let's take it down to a level that's fairly reasonable and has very little false positives.
So I like five. Four would even be better. But compliance is the beginning of a cybersecurity program because organizations contain and control data that they use in everyday business. The requirements for their handling, their safe handling, help to mitigate problems with the attackers, getting access to the information.
Compliance is a starting point. It's not the end point. Being compliant with regulations and requirements does not make you secure. That's a false sense of security that you get with being compliant. Oh, we've achieved compliance and now we're FSMA compliant, or we're N compliant, or we're HIPAA compliant, or, Hey, we're high trust plus compliant compliance.
It's a misdirection on security. It's a good place to start. The right compliance program can significantly improve your organization's overall cybersecurity program. What does that mean? When you start out in a compliance program, you're told about the requirements and also given information about how do I achieve those goals?
Because not every organization has security controls in place that will protect them. Protection that's security. Compliance means you have the protection tools in place. Looking at logs is a reactive way to look at what's going on inside your environment. Why do I say that? The data that you get out of a log file are events that have happened already.
You're not blocking them. You're just reviewing what Johnny did on the internet or what Betty did when she sent data accounts, payable information to another vendor. But what happens when the unknown occurs, and what do I mean by unknown? Connections that you never intended to be there, but they're there now anyway.
Most of them will appear harmless to your firewall and virus scanner and let's step back a second. When was the last time your firewall and virus scanner told you that you were in an active exploit situation? Go ahead and check your data. Call it. If you have one call, the cybersecurity department, although it or your security operations or network operations center, should be able to tell you, and most definitely, it's nothing like in the nineties when viruses blew up your screen, gave you the BSOD blue screen of death, or posted to words you've been hacked.
We're getting some of that with ransomware. And the problem is the attackers have figured out what your compliance rules are. That's why I said compliance is not security. If you're using compliance rules to try to facilitate a secure operation, you're gonna lose. I'd say you've already lost.
Compliance is not security. Better. Cybersecurity works with continuous monitoring and proactive defense. It's what I talk about in my books. Hashtag Hack and the number one international bestselling book in less than 12 hours. Hashtag hack two, written with 12 additional cybersecurity professionals. My favorite methodology, zero trust.
Thanks for your time, and I'll be talking to you again soon about another topic. Take care.
Email YouTube@albertwhale.com …...more
...more
Show less