Throughout 2018, I believe this cyber-regulatory environment will grow exponentially, just as the number of data breaches and stolen data records have grown off the charts. I believe we are seeing the maturity of a brand-new market, one where both security and regulatory professionals will have to band together like never before. Welcome to the cyber-regulatory/cyber-compliance market.
The cyber-regulatory market is not new; it has been with us for quite some time. However, in recent years, it has evolved into a well-defined, addressable market, with metrics showing its impact in relation to other associated sectors, such as cybersecurity and data security.
In my past experience (unifying corporate security policy and teams by coupling together some major pillars: cybersecurity technology, risk, assessment, and audit) I have never seen a time where the application of any one of those pillars has not been enough to solve or offset the problem. I’ve also never believed the individual application of any one of those pillars ever really solved the problem in the first place. Until recently, companies could get away with applying only one pillar and temporarily avoid attention. That’s no longer the case.
The cyber-regulatory market is evolving at a rapid pace – much faster than in the past. New and updated laws and regulations are being introduced. These regulations and laws are being driven directly by security requirements (mostly data and Personally Identifiable Information a.k.a PII security) and the associated liability and consequences these requirements bring. We have seen far too many examples recently regarding the failure of cybersecurity controls and regulatory requirements. No enterprise is spared (in any region of the globe) and security vendors and agencies need to be prepared to address these market demands or risk getting left behind.
We have some substantial cyber-regulatory law deadlines looming in the first part of 2018:
• The GDPR clock is stopping on May 25 (today) and presents cyber-regulatory challenges to organizations all over the world.
• The PCI SSC has several impending deadlines around data security that take effect this year, and many institutional and global agencies have put a deadline in place, forcing organizations to mandate PCI DSS as a standard data-security policy measure.
• Other notable cyber-regulatory developments on the table include the recent Australian Mandatory Data Breach Notification legislation, which is driven as part of the Australian Privacy Act.
The effects on businesses subjected to any of these laws are going to be felt in a big way, and many global organizations will have to deal with multiple cyber-regulatory mandates at once.
Organizations need to start investing in security solutions that go beyond just protection, these solutions should contain the necessary components to build actionable intelligence to solve both security problems and gain insight on the risk to cyber-regulatory requirements. In a world where cyberattacks are inevitable, businesses must also strengthen their ability to answer the questions encountered throughout the cyberattack chain by harnessing relevant data to find, analyse, and contain a compelling security event. This further helps satisfy the common response requirements called for as part of many regulations and laws (i.e. the 72-hour identification law found in so many impending regulations like GDPR and the AUS Data Breach Notification Act, as well as others).
[su_box title=”CONTRIBUTOR PROFILE” style=”soft” box_color=”#717171" radius=”0"]
Senior Director, Compliance and Governance Programs
Christopher Strand leads Carbon Black’s IT governance, audit, and compliance programs. With more than 20 years of information technology and compliance experience, he oversees the development of enterprise network and application security solutions that help organizations deploy positive security to maintain and improve their compliance posture.
Previously, Strand held security/compliance positions at Trustwave, Tripwire, EMC/RSA, and Compuware. A PCI Professional (PCIP) and trained Quality Security Assessor (QSA), he also has been certified on and is proficient with other regulatory disciplines including HIPAA, North American Electrical Reliability Corporation (NERC), and Gramm-Leach-Bliley Act (GLBA).
Strand regularly speaks about security and compliance issues and best practices on webinars and at industry conferences. He has authored several whitepapers, published articles in security industry journals, and is frequently quoted by leading media outlets.
Carbon Black is the leader in next-generation endpoint security. IDC, in its latest specialized threat analysis and protection (STAP) report, named Carbon Black the leader in the endpoint security segment with 37% market share. By the end of 2015 the company expects to achieve 70 percent growth, 7 million+ software licenses sold, almost 2,000 customers worldwide, partnerships with 60+ leading managed security service providers and incident response companies, and integrations with 30+ leading security technology providers. For more information, visit https://www.carbonblack.com/.