STE WILLIAMS

Unless you spent your childhood with actuarial tables as a best friend, you probably don’t like the word “audit.” It conjures notions of paperwork and checklists and deadlines, and just a general swirl of annoying action items. What’s even worse, is that it suggests the idea that someone suspects you did something wrong, and they’re going to watch over you until you can prove you can do it right. It’s like an adult version of after-school detention.

For companies that operate in the cloud, audits are used to ensure that companies adhere to rules and commonly accepted best practices. We use cloud security compliance standards to define what these practices are, how enterprises can function with them, and how they can provide a roadmap for better business operations. Standards like NIST 800-53 and NIST 800-171 are required for organizations to do business with the federal government. HIPAA sets the framework for working with privileged and personal health data, and PCI compliance is demanded for organizations doing digital payments. Comply and you can operate at the pleasure of standards organizations. Be out of compliance and your “license” to operate is revoked.

Ideally, an enterprise complies with the requirements of the standards they need/want to adhere to, and then their business functions more securely, more efficiently, and the governing bodies give their everlasting blessing. It would be nice if it were that simple, but that’s never how compliance works. New servers are inserted into the IT environment, application updates are deployed, unrelated specs are mandated on top of other specs. With each change to your cloud and its component pieces, your enterprise risks missing something that will likely take it out of compliance. There are hundreds of lines of controls in the NIST 800-53 compliance spreadsheet, and each of those controls has a set of corresponding instructions. If just one of those conditions is not met properly, you’re unfortunately out of compliance.

This is clearly a lot to manage, especially when your business needs to remain compliant in the midst of constant business and technology change. To add to your burden, you have to deal with audits that check to see if you’re compliant now, if your processes are optimized to meet compliance standards, and if you’ve been out of compliance and what, if any, repercussions might have come from that. I’ve met many auditors, and while generally a pleasant group, they can strike fear into an organization that doesn’t fully know what’s going on in their cloud infrastructure.

When audited, you will be required to furnish comprehensive reports that detail your compliance and security adherence. Ultimately, the auditor is acting in the interests of the data and the owners of that data. They want to see if that data, or the assets that touch it, have been compromised. There are a lot of records you’ll have to compile and analyze in order to deliver what the auditors request. A Plan of Action and Milestone Template (POAM) will be created which will guide you, under the direction of the auditors, back to a state of compliance.

The idea of manually maintaining a compliant state for your cloud, and being able to keep detailed reports of it over time is a massive undertaking. Beyond just the sheer amount of work it would take to constantly check all the layers of your cloud stack and compare them with compliance controls, there’s also the opportunity cost. Managing compliance distracts a highly skilled part of your IT team from performing more business-critical functions.

Two things need to happen if you truly want to be in control of compliance management and be prepared for audits:

1. You need a tool that can continuously monitor the entirety of your cloud environment;
2. You need to automate compliance assessment to determine where there might be failures and risks.

Some solutions will deploy agents within your infrastructure – avoid that because it will just give you more to manage. An agent-less, cloud-native solution will work continuously on your behalf and according to the requirements of compliance standards when your data is in AWS, Azure, or any public cloud. You can then use your time more effectively in creating remediation processes that can also be triggered with a cloud-based monitoring and risk assessment solution.

Audits are necessary and actually help you improve your brand value. When validated to operate under specific standards, they open new business potential for your enterprise and increases your potential audience. The actual work of being audited, however, is a pain in the neck unless you’ve used a cloud monitoring solution that helps you avoid compliance issues and track all your compliance and security activity. When you’ve done that, your audits still won’t be fun, but they’ll be a lot less painless and your organization will avoid unnecessary interruption.

Tim Prendergast co-founded Evident.io to help others avoid the pain he endured when helping Adobe adopt the cloud at a massive level.  After years of building, operating, and securing services in Amazon Web Services, he set out to make security approachable and … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/evidentio/continuous-compliance-and-effective-audit-preparation-for-the-cloud/a/d-id/1329714?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Unless you spent your childhood with actuarial tables as a best friend, you probably don’t like the word “audit.” It conjures notions of paperwork and checklists and deadlines, and just a general swirl of annoying action items. What’s even worse, is that it suggests the idea that someone suspects you did something wrong, and they’re going to watch over you until you can prove you can do it right. It’s like an adult version of after-school detention.

For companies that operate in the cloud, audits are used to ensure that companies adhere to rules and commonly accepted best practices. We use cloud security compliance standards to define what these practices are, how enterprises can function with them, and how they can provide a roadmap for better business operations. Standards like NIST 800-53 and NIST 800-171 are required for organizations to do business with the federal government. HIPAA sets the framework for working with privileged and personal health data, and PCI compliance is demanded for organizations doing digital payments. Comply and you can operate at the pleasure of standards organizations. Be out of compliance and your “license” to operate is revoked.

Ideally, an enterprise complies with the requirements of the standards they need/want to adhere to, and then their business functions more securely, more efficiently, and the governing bodies give their everlasting blessing. It would be nice if it were that simple, but that’s never how compliance works. New servers are inserted into the IT environment, application updates are deployed, unrelated specs are mandated on top of other specs. With each change to your cloud and its component pieces, your enterprise risks missing something that will likely take it out of compliance. There are hundreds of lines of controls in the NIST 800-53 compliance spreadsheet, and each of those controls has a set of corresponding instructions. If just one of those conditions is not met properly, you’re unfortunately out of compliance.

This is clearly a lot to manage, especially when your business needs to remain compliant in the midst of constant business and technology change. To add to your burden, you have to deal with audits that check to see if you’re compliant now, if your processes are optimized to meet compliance standards, and if you’ve been out of compliance and what, if any, repercussions might have come from that. I’ve met many auditors, and while generally a pleasant group, they can strike fear into an organization that doesn’t fully know what’s going on in their cloud infrastructure.

When audited, you will be required to furnish comprehensive reports that detail your compliance and security adherence. Ultimately, the auditor is acting in the interests of the data and the owners of that data. They want to see if that data, or the assets that touch it, have been compromised. There are a lot of records you’ll have to compile and analyze in order to deliver what the auditors request. A Plan of Action and Milestone Template (POAM) will be created which will guide you, under the direction of the auditors, back to a state of compliance.

The idea of manually maintaining a compliant state for your cloud, and being able to keep detailed reports of it over time is a massive undertaking. Beyond just the sheer amount of work it would take to constantly check all the layers of your cloud stack and compare them with compliance controls, there’s also the opportunity cost. Managing compliance distracts a highly skilled part of your IT team from performing more business-critical functions.

Two things need to happen if you truly want to be in control of compliance management and be prepared for audits:

1. You need a tool that can continuously monitor the entirety of your cloud environment;
2. You need to automate compliance assessment to determine where there might be failures and risks.

Some solutions will deploy agents within your infrastructure – avoid that because it will just give you more to manage. An agent-less, cloud-native solution will work continuously on your behalf and according to the requirements of compliance standards when your data is in AWS, Azure, or any public cloud. You can then use your time more effectively in creating remediation processes that can also be triggered with a cloud-based monitoring and risk assessment solution.

Audits are necessary and actually help you improve your brand value. When validated to operate under specific standards, they open new business potential for your enterprise and increases your potential audience. The actual work of being audited, however, is a pain in the neck unless you’ve used a cloud monitoring solution that helps you avoid compliance issues and track all your compliance and security activity. When you’ve done that, your audits still won’t be fun, but they’ll be a lot less painless and your organization will avoid unnecessary interruption.

Tim Prendergast co-founded Evident.io to help others avoid the pain he endured when helping Adobe adopt the cloud at a massive level.  After years of building, operating, and securing services in Amazon Web Services, he set out to make security approachable and … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/evidentio/continuous-compliance-and-effective-audit-preparation-for-the-cloud/a/d-id/1329714?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

There are certain things we can expect during the course of the annual conference season. Every year at about this time, the breathless headlines start rolling in, describing the impending doom due to some vulnerability or other. The stories we may hear less about, which could even be the most innovative, are those inaugural speeches by people who are new to the security conference circuit.

Many of us may feel like we shouldn’t be on the stage if we can’t bring headline-generating topics or a TED Talk level of showmanship. But it’s those new voices that keep conferences interesting in the long run, and which may offer the perspectives that bring big changes in the effectiveness of security. As you attend conferences this year, it is my hope that you give some thought about how you could add your voice to the conversation.

My own inaugural security conference presentation was one born of necessity. I had been to enough events to get completely hooked on repeating the experience, and when travel budget cuts dictated the need for stronger justification to send people to future conferences, I submitted my first abstract for consideration. No one could have been more shocked than I was when it was accepted; I was a relative newcomer with zero experience in computers before I started in this industry. I could not have been further from the definition of a security expert at that point.

I prepared for this speech harder than I’ve ever prepared for anything in my life. I did all those things everyone tells you to do to ensure that you are comfortable and at ease, so that your talk will go smoothly. I had so many friends in the audience that it was not simply a mental game to pretend that I was talking to a group of my favorite people. The elements were all there for things to go well.

Of course everything went perfectly, right? As you might guess, the answer is a resounding No. It was a total disaster that was precipitated by my overwhelming anxiety, which led to a cascade of technical glitches, and me speaking so rapidly that I ran out of material way before the end of my allotted time. It took everything in my power not to vanish into an awkward puff of smoke when the talk was over.

And yet, it was not the end of the world, nor was it even the end of my speaking career. I learned two important things about public speaking that day: living your worst-case scenario is never as bad as you think it will be, and not all of us need to fit in a certain mold to be a good speaker.

If you’ve never read the Bloggess blog or any of Jenny Lawson’s books, you should probably remedy that right now. If you have, you probably know that she is screamingly hilarious and that she has struggled with anxiety issues of her own. There was one particular talk she did (in a bathroom stall, and with her taxidermied service animal) that I found especially helpful to envision other ways I could speak effectively. And it served as an entertaining reminder of how much I personally enjoy talks that offer something truly unique.

There are only so many times one can watch a variation on the “Hacking (X) for fun and profit” theme. For the last few years, I have found myself seeking out conferences and presentations that offer an angle that’s new to me: for example, speakers from outside the mainstream security industry discussing issues that are unique to certain business verticals, or who offer a different perspective on existing technologies or techniques. No joke — I’ve even gone to a herpetology conference for security inspiration.

If we keep doing things the way we’ve always done them, we will continue to get the same suboptimal results. We need new voices from people with different perspectives to help us make a substantive change in the way things are going. You could be one of those voices; even if you don’t think you’re the type of person whose talk would be accepted, even if the mere idea of talking in public makes you want to hide in a bathroom stall with a stuffed bobcat. There are ways to make your voice heard that make your differences creative advantages.

Related Content:

• From Reporter to Private Investigator to Security Engineer
• A Day in the Life of a Security Avenger
• All Generations, All Risks, All Contained: A How-To Guide

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/a-call-for-new-voices-on-the-security-conference-circuit/a/d-id/1329718?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

There are certain things we can expect during the course of the annual conference season. Every year at about this time, the breathless headlines start rolling in, describing the impending doom due to some vulnerability or other. The stories we may hear less about, which could even be the most innovative, are those inaugural speeches by people who are new to the security conference circuit.

Many of us may feel like we shouldn’t be on the stage if we can’t bring headline-generating topics or a TED Talk level of showmanship. But it’s those new voices that keep conferences interesting in the long run, and which may offer the perspectives that bring big changes in the effectiveness of security. As you attend conferences this year, it is my hope that you give some thought about how you could add your voice to the conversation.

My own inaugural security conference presentation was one born of necessity. I had been to enough events to get completely hooked on repeating the experience, and when travel budget cuts dictated the need for stronger justification to send people to future conferences, I submitted my first abstract for consideration. No one could have been more shocked than I was when it was accepted; I was a relative newcomer with zero experience in computers before I started in this industry. I could not have been further from the definition of a security expert at that point.

I prepared for this speech harder than I’ve ever prepared for anything in my life. I did all those things everyone tells you to do to ensure that you are comfortable and at ease, so that your talk will go smoothly. I had so many friends in the audience that it was not simply a mental game to pretend that I was talking to a group of my favorite people. The elements were all there for things to go well.

Of course everything went perfectly, right? As you might guess, the answer is a resounding No. It was a total disaster that was precipitated by my overwhelming anxiety, which led to a cascade of technical glitches, and me speaking so rapidly that I ran out of material way before the end of my allotted time. It took everything in my power not to vanish into an awkward puff of smoke when the talk was over.

And yet, it was not the end of the world, nor was it even the end of my speaking career. I learned two important things about public speaking that day: living your worst-case scenario is never as bad as you think it will be, and not all of us need to fit in a certain mold to be a good speaker.

If you’ve never read the Bloggess blog or any of Jenny Lawson’s books, you should probably remedy that right now. If you have, you probably know that she is screamingly hilarious and that she has struggled with anxiety issues of her own. There was one particular talk she did (in a bathroom stall, and with her taxidermied service animal) that I found especially helpful to envision other ways I could speak effectively. And it served as an entertaining reminder of how much I personally enjoy talks that offer something truly unique.

There are only so many times one can watch a variation on the “Hacking (X) for fun and profit” theme. For the last few years, I have found myself seeking out conferences and presentations that offer an angle that’s new to me: for example, speakers from outside the mainstream security industry discussing issues that are unique to certain business verticals, or who offer a different perspective on existing technologies or techniques. No joke — I’ve even gone to a herpetology conference for security inspiration.

If we keep doing things the way we’ve always done them, we will continue to get the same suboptimal results. We need new voices from people with different perspectives to help us make a substantive change in the way things are going. You could be one of those voices; even if you don’t think you’re the type of person whose talk would be accepted, even if the mere idea of talking in public makes you want to hide in a bathroom stall with a stuffed bobcat. There are ways to make your voice heard that make your differences creative advantages.

Related Content:

• From Reporter to Private Investigator to Security Engineer
• A Day in the Life of a Security Avenger
• All Generations, All Risks, All Contained: A How-To Guide

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/a-call-for-new-voices-on-the-security-conference-circuit/a/d-id/1329718?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple