|By Jim Hare||
|January 26, 2011 07:00 PM EST||
You may think IT compliance is nothing more than big government sticking its nose into everyone’s business. Compliance equals Big Brother. OK, so there is some truth in that government compliance regulations are a little over the top, and perhaps there are just too many of them that functionally do the same thing. It’s not just about government regulations — it’s also about non-government standards, such as PCI, that need to be addressed.
Look at SOX, FISMA, FERPA, HIPAA and the brothers FERC and NERC. Aren’t they basically the same rules? Can’t we have just one large compliance regulation with small amendments for each specific industry? That would be easier, but since various politicians have stakes in their own versions, I don’t think we will see unification in the short term. That is one reason why regulators have to levy heavy fines and other punitive measures to force organizations to follow their rules.
However, if we look at compliance in a slightly different light, perhaps complying with these regulations will be just a little less painful.
Today, security is more complex than simply deploying firewalls and virus protection. For a company to be secure, it also has to look at security from an overall company risk perspective. This includes cybercrime and physical security as well as regulatory risks and profit risks around the costs versus the gains of implementing security measures.
In order to achieve complete security, your strategy needs to include multiple layers across three functional areas:
1) The protection of assets and data. This is the traditional implementation of firewalls, IDS systems, vulnerability protection, virus protection, penetration testing and many other standard security practices. Of course this is a very expensive proposition, so organizations must make technology strategy decisions based on budget and their type of business.
2) Process and procedures to adequately maintain security technology. You need to have methods and rules on how and when you update security components such as firewall policies, IOS, virus protection, log-in polices, and active directory policies. All of these need to be reviewed and updated frequently.
3) Defining and enforcing policies. It is one thing to have a policy on updating your virus definitions, but if these policies are not followed, then the first two areas cited above are worthless.
Many companies spend hundreds of thousands or even millions of dollars on firewalls, biometric devices, IDS/IPS, and anomaly detection but fail to deploy basic compliance-management systems. This places businesses at risk because it is very easy for someone to go into a device on the computer network, make changes that do not follow corporate security guidelines, and then open a hole in your defenses. An effective, automated compliance system continually validates that the rules of all devices follow correct security procedures.
Another aspect to consider is that compliance is often mandated by regulatory decrees, such as SOX, HIPAA, FISMA, GLBA and many others—or by industry requirements such as PCI and ISO. Non-compliance can result in significant fines and, in some cases, criminal prosecution. But even if compliance is not mandated, it is common sense to create policies and procedures and to verify they are being followed.
While risk management and mitigation serve as key drivers, incorporating business objectives and policies is an important part of the desired objective and is ultimately the end game. This is where compliance comes into the picture. Compliance proves the organization has the correct policies in place, and that the policies are being followed.
Security, compliance and risk assessment are the processes, but in the past, they have been 100 percent manual processes, time consuming, and prone to error. As a result, there is now an emerging trend to outsource the mechanics of monitoring the validation process to a local service provider, also called a Managed Compliance Provider or MCP.
MCPs perform the grunt work in tracking compliance processes through a managed service. Effective MCP solutions provide clients with near real-time dashboards and reports on their compliance status while also eliminating or significantly reducing error-prone, manual processes. Some MCPs even have the ability to certify if clients are within compliance.
Security does not imply compliance, and compliance does not beget security. There must be a unification of both programs, which is what compliance is all about. Compliance also should not be viewed as some government oversight, but instead a common-sense approach to protecting the assets and value of your business.
The 4th International Internet of @ThingsExpo, co-located with the 17th International Cloud Expo - to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA - announces that its Call for Papers is open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than
Jul. 5, 2015 08:00 PM EDT Reads: 630
The 17th International Cloud Expo has announced that its Call for Papers is open. 17th International Cloud Expo, to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, APM, APIs, Microservices, Security, Big Data, Internet of Things, DevOps and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal today!
Jul. 5, 2015 06:30 PM EDT Reads: 449
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at @ThingsExpo, James Kirkland, Red Hat's Chief Architect for the Internet of Things and Intelligent Systems, described how to revolutionize your archit...
Jul. 5, 2015 06:00 PM EDT Reads: 457
The 5th International DevOps Summit, co-located with 17th International Cloud Expo – being held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real results. Among the proven benefits, DevOps is corr...
Jul. 5, 2015 05:15 PM EDT Reads: 535
SYS-CON Events announced today that Secure Infrastructure & Services will exhibit at SYS-CON's 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Secure Infrastructure & Services (SIAS) is a managed services provider of cloud computing solutions for the IBM Power Systems market. The company helps mid-market firms built on IBM hardware platforms to deploy new levels of reliable and cost-effective computing and high availability solutions, leveraging the cloud and the benefits of Infrastructure-as-a-Service (IaaS...
Jul. 5, 2015 05:00 PM EDT Reads: 638
To many people, IoT is a buzzword whose value is not understood. Many people think IoT is all about wearables and home automation. In his session at @ThingsExpo, Mike Kavis, Vice President & Principal Cloud Architect at Cloud Technology Partners, discussed some incredible game-changing use cases and how they are transforming industries like agriculture, manufacturing, health care, and smart cities. He will discuss cool technologies like smart dust, robotics, smart labels, and much more. Prepare to be blown away with a glimpse of the future.
Jul. 5, 2015 04:45 PM EDT Reads: 508
SYS-CON Events announced today that ProfitBricks, the provider of painless cloud infrastructure, will exhibit at SYS-CON's 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. ProfitBricks is the IaaS provider that offers a painless cloud experience for all IT users, with no learning curve. ProfitBricks boasts flexible cloud servers and networking, an integrated Data Center Designer tool for visual control over the cloud and the best price/performance value available. ProfitBricks was named one of the coolest Clo...
Jul. 5, 2015 04:30 PM EDT Reads: 1,387
17th Cloud Expo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterprises are using some form of XaaS – software, platform, and infrastructure as a service.
Jul. 5, 2015 03:00 PM EDT Reads: 448
Internet of Things is moving from being a hype to a reality. Experts estimate that internet connected cars will grow to 152 million, while over 100 million internet connected wireless light bulbs and lamps will be operational by 2020. These and many other intriguing statistics highlight the importance of Internet powered devices and how market penetration is going to multiply many times over in the next few years.
Jul. 5, 2015 03:00 PM EDT Reads: 1,140
The basic integration architecture, as defined by ESBs, hasn’t changed for more than a decade. Most cloud integration providers still rely on an ESB architecture and their proprietary connectors. As a result, enterprise integration projects suffer from constraints of availability and reliability of these connectors that are not re-usable across other integration vendors. However, the rapid adoption of APIs and almost ubiquitous availability of APIs amongst most SaaS and Cloud applications are rapidly redefining traditional integration approaches and their reliance on proprietary connectors. ...
Jul. 5, 2015 02:30 PM EDT Reads: 407
SYS-CON Events announced today that Dyn, the worldwide leader in Internet Performance, will exhibit at SYS-CON's 17th International Cloud Expo®, which will take place on November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Dyn is a cloud-based Internet Performance company. Dyn helps companies monitor, control, and optimize online infrastructure for an exceptional end-user experience. Through a world-class network and unrivaled, objective intelligence into Internet conditions, Dyn ensures traffic gets delivered faster, safer, and more reliably than ever.
Jul. 5, 2015 02:30 PM EDT Reads: 1,497
"We have a tagline - "Power in the API Economy." What that means is everything that is built in applications and connected applications is done through APIs," explained Roberto Medrano, Executive Vice President at Akana, in this SYS-CON.tv interview at 16th Cloud Expo, held June 9-11, 2015, at the Javits Center in New York City.
Jul. 5, 2015 01:30 PM EDT Reads: 434
WebRTC converts the entire network into a ubiquitous communications cloud thereby connecting anytime, anywhere through any point. In his session at WebRTC Summit,, Mark Castleman, EIR at Bell Labs and Head of Future X Labs, will discuss how the transformational nature of communications is achieved through the democratizing force of WebRTC. WebRTC is doing for voice what HTML did for web content.
Jul. 5, 2015 01:00 PM EDT Reads: 407
Today air travel is a minefield of delays, hassles and customer disappointment. Airlines struggle to revitalize the experience. GE and M2Mi will demonstrate practical examples of how IoT solutions are helping airlines bring back personalization, reduce trip time and improve reliability. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Dr. Sarah Cooper, M2Mi’s VP Business Development and Engineering, will explore the IoT cloud-based platform technologies driving this change including privacy controls, data transparency and integration of real time context wi...
Jul. 5, 2015 12:00 PM EDT Reads: 378
Buzzword alert: Microservices and IoT at a DevOps conference? What could possibly go wrong? In this Power Panel at DevOps Summit, moderated by Jason Bloomberg, the leading expert on architecting agility for the enterprise and president of Intellyx, panelists peeled away the buzz and discuss the important architectural principles behind implementing IoT solutions for the enterprise. As remote IoT devices and sensors become increasingly intelligent, they become part of our distributed cloud environment, and we must architect and code accordingly. At the very least, you'll have no problem fillin...
Jul. 5, 2015 11:45 AM EDT Reads: 1,772
The Internet of Things is not only adding billions of sensors and billions of terabytes to the Internet. It is also forcing a fundamental change in the way we envision Information Technology. For the first time, more data is being created by devices at the edge of the Internet rather than from centralized systems. What does this mean for today's IT professional? In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists addressed this very serious issue of profound change in the industry.
Jul. 5, 2015 09:30 AM EDT Reads: 536
Internet of Things (IoT) will be a hybrid ecosystem of diverse devices and sensors collaborating with operational and enterprise systems to create the next big application. In their session at @ThingsExpo, Bramh Gupta, founder and CEO of robomq.io, and Fred Yatzeck, principal architect leading product development at robomq.io, discussed how choosing the right middleware and integration strategy from the get-go will enable IoT solution developers to adapt and grow with the industry, while at the same time reduce Time to Market (TTM) by using plug and play capabilities offered by a robust IoT ...
Jul. 5, 2015 09:00 AM EDT Reads: 1,162
It is one thing to build single industrial IoT applications, but what will it take to build the Smart Cities and truly society-changing applications of the future? The technology won’t be the problem, it will be the number of parties that need to work together and be aligned in their motivation to succeed. In his session at @ThingsExpo, Jason Mondanaro, Director, Product Management at Metanga, discussed how you can plan to cooperate, partner, and form lasting all-star teams to change the world and it starts with business models and monetization strategies.
Jul. 3, 2015 12:00 PM EDT Reads: 1,319
SYS-CON Events announced today that BMC will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. BMC delivers software solutions that help IT transform digital enterprises for the ultimate competitive business advantage. BMC has worked with thousands of leading companies to create and deliver powerful IT management services. From mainframe to cloud to mobile, BMC pairs high-speed digital innovation with robust IT industrialization – allowing customers to provide amazing user experiences with optimized IT per...
Jun. 29, 2015 12:15 PM EDT Reads: 2,249
There will be 150 billion connected devices by 2020. New digital businesses have already disrupted value chains across every industry. APIs are at the center of the digital business. You need to understand what assets you have that can be exposed digitally, what their digital value chain is, and how to create an effective business model around that value chain to compete in this economy. No enterprise can be complacent and not engage in the digital economy. Learn how to be the disruptor and not the disruptee.
Jun. 29, 2015 11:00 AM EDT Reads: 1,586