Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

4/16/2012
11:26 AM
50%
50%

Your Compliance Is Decaying Every Day

As soon as you train your colleagues about compliance, noncompliance is back in charge

As soon as you train staff, implement new technology, and make business process changes to become (or remain) compliant, the next day you are already less compliant. People's habits are hard to break, and what we are taught begins to fade within hours.

At the same time, risks to technology and security never rest or stop changing, whether from smarter malicious technology or simply the pace an organization’s technology continues to be updated and modified. It can be hard to monitor and verify for compliance without slowing down the necessary pace of business.

In a discussion I had with one CEO who was concerned about the expense of training, he said, “What if I spend all this money training my staff, and they leave? Then I’ve wasted all that time and money.” As politely as I could, I leaned over and quietly said, “What if you don’t train them, and they stay?”

He paused a moment, processing my question. I was relieved when he smiled and gave that nod we all give when we’ve had an “a-ha” moment. Training is not an extra, and its related costs are not optional. Training is something we pay for when we choose to do it, but it’s also something we pay for when we choose not to.

Untrained staff, like everyone else, will develop habits in their work. Without training, these will more often than not be bad habits that cost organizations money. This cost might not have its own line item -- it might be hidden in payroll and hard to identify immediately -- but it will be there. On the other hand, ongoing training helps your staff know the expectations and requirements of a job well done.

Organizations that do not include regular training and coaching for all aspects of their business operations typically see such education as an extra expense they can defer (or ignore). Oh, they claim they know training is important, but if they don’t show any commitment in either time or budget, they are deceiving themselves. This mindset applies to compliance, as well, because true compliance requires specific processes to be part of your daily operations, not add-on tasks at the end of projects.

Proper compliance training is really about much more than compliance. It is about how to perform work that includes compliant processes and procedures. The actions that lead to better compliance cannot be bolted on at the end of training or in separate compliance classes.

While annual training is better than no training at all, few of us recall the details of classes we took months ago. Effective training is intentionally designed to regularly reinforce processes that are compliant, secure, and healthy for the organization. Like fighting decay, being compliant requires regular updates, repairs, and attention. Compliance is your best effort toward maintaining the health of your company.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11931
PUBLISHED: 2019-11-14
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prio...
CVE-2019-18980
PUBLISHED: 2019-11-14
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The o...
CVE-2019-17391
PUBLISHED: 2019-11-14
An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and sec...
CVE-2019-18651
PUBLISHED: 2019-11-14
A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document to a user that the website trusts. The user needs to have ...
CVE-2019-18978
PUBLISHED: 2019-11-14
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.