Story image

Living in today’s new cyber regulatory reality

21 Sep 2018

Article by Carbon Black compliance strategy senior director Chris Strand

In recent years, we’ve seen an increase in the number of companies facing legal consequences for failing to meet deadlines requiring them to measure the effectiveness of their security solutions.

Combined with these deadlines, companies also have to prove they have awareness and control over the security regulations that govern their respective industries.

Throughout 2018, this cyber-regulatory environment will grow exponentially, just as the number of data breaches and stolen data records have grown off the charts. 

I believe we are seeing the maturity of a brand new market, one where both security and regulatory professionals will have to band together like never before. 

Welcome to the cyber regulatory/ cyber compliance market.

The cyber regulatory market is not new; it has been with us for quite some time. 

However, in recent years, it has evolved into a well-defined, addressable market with metrics showing its impact in relation to other associated sectors, such as cybersecurity and data security.  

In my past experience unifying corporate security policy and teams by coupling together cybersecurity technology, risk, assessment and audit, I have never seen a time where the application of any one of those pillars has not been enough to solve or offset the problem. I’ve also never believed the individual application of any one of those pillars ever really solved the problem in the first place.

Until recently, companies could get away with applying only one pillar and temporarily avoid attention.

That’s no longer the case.

The cyber regulatory market is evolving rapidly – much faster than in the past. 

New and updated laws and regulations are being introduced.

These regulations are being driven directly by security requirements (mostly data and personally identifiable information (PII) security) and the associated liability and consequences these requirements bring. 

We have seen far too many examples recently regarding the failure of cybersecurity controls and regulatory requirements.

No enterprise is spared (in any region of the globe) and security vendors and agencies need to be prepared to address these market demands or risk getting left behind. 

We have some substantial cyber regulatory law deadlines looming in the first part of 2018:

The GDPR clock stopped on May 25, presenting cyber regulatory challenges to organisations all over the world.  

The PCI SSC has several impending deadlines around data security that take effect this year, and many institutional and global agencies have put a deadline in place, forcing organisations to mandate PCI DSS as a standard data-security policy measure. 

Other notable cyber regulatory developments on the table include the recent Australian Mandatory Data Breach Notification legislation, which is driven as part of the Australian Privacy Act. 

The effects on businesses subjected to any of these laws are going to be felt in a big way, and many global organisations will have to deal with multiple cyber regulatory mandates at once.

Certain cybersecurity firms help organisations around the globe to gain insight on a combined view of their cybersecurity and cyber regulatory postures. 

Our security solutions contain the necessary components to build actionable intelligence to solve both security problems and gain insight on the risk to cyber regulatory requirements. 

Data security technology includes functions and solutions that help to answer the questions encountered throughout the cyberattack chain, while ensuring the collection of all of the relevant data that is used to find, analyse and contain a compelling security event. 

This further helps satisfy the common response requirements called for as part of many regulations and laws (i.e. the 72-hour identification law found in so many impending regulations like GDPR and the AUS Data Breach Notification Act, as well as others). 

The most effective technology is capable of providing a real-time glimpse into the status of cyber posture and regulatory alignment. 

GitHub launches fund to sponsor open source developers
In addition to GitHub Sponsors, GitHub is launching the GitHub Sponsors, GitHub will match all contributions up to $5,000 during a developer’s first year in GitHub Sponsors.
Check Point announces integration with Microsoft Azure
The integration of Check Point’s advanced policy enforcement capabilities with Microsoft AIP’s file classification and protection features enables enterprises to keep their business data and IP secure, irrespective of how it is shared. 
ESET researchers break down latest arsenal of the infamous Sednit group
At the end of August 2018, the Sednit group launched a spear-phishing email campaign, in which it distributed shortened URLs that delivered first-stage Zebrocy components.
Container survey shows adoption accelerating while security concerns remain top of mind
The report features insights from over 500 IT professionals.
Google 'will do better' after G Suite passwords exposed since 2005
Fourteen years is a long time for sensitive information like usernames and passwords to be sitting ducks, unencrypted and at risk of theft and corruption.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.
Forrester names Trend Micro Leader in email security
TrendMicro earned the highest score for technology leadership, deployment options and cloud integration.