The reality of a world of always-connected customers and cloud platforms is that hackers are overwhelmingly targeting managed service providers. The main question posed in that article was how managed service providers could protect their clients with proper security measures. Here, we want to take this a step further to suggest that these managed service providers should look to a security partner who can not only support their own security but the security of their clients.

Awareness Continuum GRC

How Are IT Compliance and Cyber Security Different?

Jul 2, 2019 Continuum GRC 0 Comment

IT Compliance and Cyber Security: Understanding the Differences

IT compliance and cyber security are often used interchangeably, even within the cyber security and compliance fields. This is the basis for the completely incorrect and dangerous notion that achieving compliance automatically equals being secure.

IT Compliance and Cyber Security: Understanding the Differences

While there is some overlap, and the two fields complement each other, IT compliance and cyber security are not the same, and being compliant – with HIPAA, FedRAMP, PCI DSS, or any other framework – is not the same thing as being secure.

What is cyber security?

Cyber security is the protection of computer hardware, software, systems, networks, and data from cyberattacks. It is a very broad field that encompasses an enterprise’s policies, processes, end user education, and technical controls to address the following areas:

Application security – securing software and apps
Information security – securing data, including customer data, employee data, and confidential business information
Network security – securing the ports and databases within a network
Operational security – classifying information assets and determining the controls needed to secure them
Cyber incident management and response

What is IT compliance?

There is much overlap between the goals of IT compliance and cyber security, which is the root of the confusion. They both address securing hardware and digital assets. However, unlike cyber security requirements, which are developed internally, IT compliance requirements are mandated by a third party, such as the government, an industry regulatory body, or a client.

Organizations operating in the healthcare industry in the U.S. must comply with HIPAA, a federal law
Organizations around the world that wish to accept major payment cards must comply with PCI DSS, a set of standards mandated by the major credit card brands
The U.S. federal government requires organizations that wish to sell cloud services to federal agencies to comply with FedRAMP
Many private-sector businesses require their cloud services vendors to release an SOC 2 attestation

The takeaway is that enterprises implement cyber security controls for their own protection; they undergo IT compliance audits to satisfy a third party.

What are some additional differences between cyber security and IT compliance?

While many IT compliance standards, such as FedRAMP and SOC 2, are quite rigorous, they are not meant to provide full cyber security protection on their own. There’s no way they could.

The cyber security threat landscape is dynamic; it changes on a daily basis. IT compliance frameworks change very slowly, typically annually or less often.
Every organization’s data environment and risk profile are different. No IT compliance framework could comprehensively address every possible eventuality at every organization.

Additionally, some IT compliance regulations, such as the GDPR and the California Consumer Privacy Act, focus more on data privacy (giving individual consumers control over the data enterprises collect from them) than cyber security (protecting enterprise assets).

IT compliance complements cyber security

With the costs of IT compliance skyrocketing, some enterprises view compliance quite negatively, as a list of line items that must be checked off to conduct business in a certain industry or with certain clients. However, IT compliance complements enterprise cyber security and provides numerous benefits.

Compliance with certain standards, such as FedRAMP and SOC 2, is seen as a “gold standard” of data security by companies seeking to purchase cloud services, and compliance with the GDPR is seen by some consumers as a testament to a company’s commitment to data privacy. The process of undergoing a compliance audit also helps companies identify issues with their cyber security and data governance that may have otherwise gone undetected. Finally, IT compliance frameworks provide a good starting point for enterprise cyber security.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Awareness Continuum GRC

5 Practical Applications of Blockchain to Cyber Security and Compliance

Nov 7, 2018 Continuum GRC 0 Comment

While digital currencies, particularly bitcoin, are the most common and well-known application of blockchain technology, they are far from being the sole or even the most important use. Blockchain is one of the most important technological advancements of the digital age, and its full potential has barely been tapped. Among the most exciting potential uses for this technology are cyber security and compliance applications.

5 Practical Applications of Blockchain to Cyber Security and Compliance

What Is Blockchain?

At its simplest, a blockchain is a digitized, distributed public ledger. While it was originally developed to keep track of bitcoin transactions, it can be used for any sort of record-keeping, from health records to the requirements of a business contract. Each record (called a block) contains a cryptographic hash of the previous block, a timestamp, and transaction data, and the blocks are linked using cryptography.

Typically, a blockchain is managed by a peer-to-peer network that collectively adheres to a protocol for inter-node communication and the validation of new blocks. Once recorded, blockchain data is immutable. Blocks cannot be deleted, and if data is altered on a single block, those alterations must be verified with the rest of the chain. Hacking one entry in a blockchain ledger requires hacking every single transaction that precedes or follows it – and every change made to a block is appended with a digital signature or timestamp showing who did it and when. Finally, because the blockchain is distributed, it is not and cannot be controlled by a single entity, and there is no central point of access or failure.

It’s not difficult to envision the potential benefits of these features for cyber security and compliance. It would be extremely difficult to breach the data on a blockchain ledger or launch a DDoS attack against a blockchain DNS system. Because the records are immutable, data integrity is assured.

Practical applications of blockchain technology to cyber security and compliance include:

Identity Theft Prevention

Even in our digital age, reliable identity verification remains a problem. We establish we are who we say we are using one or multiple hard-copy documents or electronic records, from driver licenses to Social Security Numbers. All these records are highly prone to theft and forgery; even children are being victimized by identity theft. Using blockchain, we will be able to combine our current forms of identification into a “blockchain ID.” Instead of brandishing documents to verify their identities, people will produce a secure, immutable public key generated by a blockchain ledger. This will allow consumers to verify their identities without having to share their personal data, simplify identity authentication and make it more secure, and prevent identity theft.

Securing Healthcare Records

Just as it can secure our identities, blockchain can be used to secure our personal healthcare records and make sharing them easier and safer. Electronic health records (EHR) systems are major targets for cyber criminals, and there is still no secure, efficient way for healthcare providers to share patient data; patient records are scattered in different systems run by different facilities and providers.

EHR systems built on blockchain technology will benefit both providers and patients. Patients will have a comprehensive and secure record of their healthcare that is continually updated and can be easily and securely shared with providers. Providers will be able to access patient data more quickly, reduce medical errors caused by inaccurate or missing data, and have an easier time complying with HIPAA and other data privacy regulations.

Smart Contracts

Organizations worldwide are losing millions to business email compromise (BEC) scams. The U.S. Securities & Exchange Commission recently investigated a series of BEC attacks where hackers impersonated either a company executive or an outside vendor and convinced unwitting employees to wire money or pay invoices to accounts that the hackers controlled. In some cases, the victims had no idea they’d been tricked until the real vendor contacted them about the invoices being past due. Each organization lost at least $1 million, and two lost more than $30 million.

Smart contracts, also known as self-executing contracts, blockchain contracts, or digital contracts, will help prevent these types of BEC scams. Smart contracts are embedded with an if-this-then-that (IFTTT) code that automatically executes the contract’s terms once its conditions are met; for example, once a vendor completes work or delivers goods to a buyer, the vendor is automatically paid, and changing the payment account data would require validation from the entire chain.

Secure International Payments

Many organizations work with vendors located overseas. Currently, transferring money overseas is slow, cumbersome, expensive, and prone to error and criminal activity. A blockchain-powered payments system produces a secure, immutable ledger showing where the funds are and whose hands they are passing through, every step of the way.

Compliance Audit Trails

The immutability of blockchain records equates to a verified chain-of-trust and proof-of-process for compliance. Organizations can prove that they have secured their customers’ data and that they have followed specific business processes. Auditors and regulators can be assured of the integrity of an audit trail produced by a blockchain-powered system.

For all its promise, blockchain is not a panacea, and many of its potential applications are still theoretical or have kinks that need to be ironed out. However, it’s safe to say that the future of cyber security and compliance will be built on blockchain.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.