Compliance is Security?
If, like me, you have been in cyber for longer than 3 days, you have probably heard someone lament that, “Compliance is not security!”
I’ve said it myself, and it’s typically in the context of wanting to go beyond “good enough” security controls as defined by compliance frameworks, or by wanting to extend those controls to more systems.
I believe it happens because at that stage your influence is going to be needed to take your controls or program further.
No longer can you fall back to using compliance as a lever to move things along, you need to change hearts and minds. You need to unlock budgets through conversation, understanding, communication, and motivation.
It’s the stage you go from saying we are not compliant with easily translatable risks around financial penalties, to the more challenging conversations on risk appetite and the returns on investment for any incremental spend beyond that point.
Question
Here I want to explore the statement, “Compliance is Security”.
We’re going to do that by using your knowledge of cyber news, personal breaches, and possibly the general news cycle. We have to do this, because when I tried to get concrete numbers for PII and PCI data breaches it just wasn’t possible, likely due to differences in disclosure requirements.
Would you say that there have been more PII data breaches, or more PCI data breaches recently? In terms of number of breaches, and size of breaches. This question has a pretty obvious answer from my perspective.
So we start with two statements, that there are more PII data breaches than PCI data breaches, and that PII data breaches are larger than PCI data breaches.
There is absolutely a difference in terms of mandatory disclosures around PII breaches and PCI breaches based on your location. This likely makes the difference feel even more exaggerated than it actually is.
The question then should be why have there been more PII data breaches than PCI data breaches recently?
Possible answers
Think of how companies handle PII, how your employer handles it, how your bank handles it, your telco, your energy provider, your favourite loyalty program, or how about your rental agent. Each of these companies has at least 1 copy of your PII.
Get Jerome B’s stories in your inbox
Join Medium for free to get updates from this writer.
More than likely though, your PII is in a customer database, in a marketing system, extracted into a spreadsheet, in a billing system, and in an analytics system. The list of systems, and therefore the number of copies of your PII that any one company may have is probably between 5 and 10.
Each of these systems may have different controls implemented, have different parts of the business accessing them, and have different levels of public reachability.
With PCI if you transfer, process, or store clear text PCI data you have a few hundred controls you need to implement. If you only have a pin pad in your store, or hosted payment page then you have a few frozen controls you need to implement. As most companies want money for their goods and don’t want an increased compliance burden they typically forgo the clear text PCI data and focus on their core competencies.
The result here is that fewer companies hold PCI data, and the companies that do hold PCI data hold as few copies of that data as possible. All of this in the pursuit of reducing the scope of their PCI audit. This PCI data has a standardised set of controls applied to it, with very well governed access, and is typically stored well away from public networks.
This change in behaviour effectively reduces the average number of PCI data stores per company to below 1.
The human impact
Leaked credit card information usually leads to fraudulent transactions, refunds, cancelled cards, and a brand new uncompromised credit card.
Leaked personal information is much longer lived, your name, date of birth, email address, physical address, first pet’s name, and mothers maiden name can pay dividends for years as you are quite unlikely to change these due to a breach.
So compliance is security then?
There have been more PII data records breached than PCI data records breached in the last 5 years. So compliance is security! Whip out those checklists and clipboards, right?
That’s probably not entirely true, I think the compliance burden of PCI data has led to a change in behaviour for most companies, which has directly reduced the number of copies of your PCI data out there. I believe this is the number one reason why we are seeing less PCI data breaches.
The number two reason in my view is the strong mandated controls around PCI data. This isn’t a budget decision, or one that comes down to your Security Lead’s ability to put a business case together, it is a simple fact that if you want the data you need to put the controls in place.
There is probably a whole conversation to have on what PCI is doing for credit card data that GDPR, the APP, or the CCPA aren’t doing for your PII.
So in this instance compliance has led to a change in behaviour, and with that new behaviour we have new outcomes. Fewer data breaches, and smaller data breaches.
What if PII data had the same mandated controls as PCI data?
You would see a shift in behaviour, companies would streamline the number of copies of PII in their environments probably down to a single Customer PII database with just in time calls for the data as needed by processes. Or, maybe outsource it as far as practical depending on the size and business value of the information.
The truth is that this would take effort, software, and services. These all cost money, money that is currently being spent elsewhere in the business. Yet I believe that a change in architecture, and the availability of these services would lead to decreasing instances of PII data breaches.
