GNUCITIZEN

Amen! The one thing I disagree is that you stated “…you will get a good idea how the majority of security professionals on LinkedIn think”. You are highly generous in your credit here PDP… These, in your book and mine, are not “security professionals”. They’re the guys who only think of the three and four letter acronyms, but generally couldn’t provide a lucid solution if their career depended on it. I think a lot of the security bloggers that are bathing in the limelight tend to drift towards this side as well… It’s those who actually present technical solutions / findings that gain my respect. The “analysts” are generally, to me, a waste of time / humorous reading. They make a pretty Keynote preso and travel the country regurgitating something they really don’t understand… If only I could be that self-unaware!

–windexh8er

Wade, generally speaking compliance is a waste of money. Not that long ago I had the chance to experience an audit performed by one of the big 4s. Basically their work was down to going over a checklist. On the top of that the employees from the company that was audited had to spend time in writing useless and very irrelevant policies nobody really follows. It was the biggest waste of money and resources I have ever seen. But compliance is a compliance. It gives you undeserved sense of credibility and authority.

I do not understand why money is an issue when someone is willing to throw ridiculous amount of them on compliances, which does not work, which give you nothing more but a 3 letter word you can put next to your name, which have no value whatsoever since majority of your customers probably do not know what the compliance is really all because serious people do not have the time and interest to go ahead and read it.

Security solutions should be delivered by people with experience not CLAS consultants who have got their qualifications after 3 weeks of trainings. No offense!

Personally, I do not care if compliance is the preferred way for companies doing business today. If it works for you and especially for your PR (only if), then why not do it. But I still think that compliance is nothing more but a business tool which puts ROI next to security so someone can sleep better at night.

However, soon or latter, shit hits the fan. You cannot escape it. Then how compliance helps you in anyway? It doesn’t help! So why take it then? You take it not because of your security! It is certainly not because of your PR because I hardly doubt that the huge majority of customers know what your ISO accreditations are for.

Compliances, accreditations and certifications are only ways for aware companies ripping huge fees off your back just to tell you that you are doing well, when in fact, you are not doing well at all! It is a complete waste of time and resources. :)

Instead of putting meaningless ISOs next to your name, put the company that did the security work for you. Say: Our company’s security was proudly assessed by X. Hey, you are not only going to give some good PR to your security team but you will also make them work harder and provide even better value for your money. People understand people. They do not understand 3 letter words.

Sorry PDP, I have to disagree with you this time. There are many security techniques and control in order to test, verify, certify, protect an organization. Each of these disciplines (Layers) has it own purposes.

Security Compliance is to ensure that an Organization is compliance to a certain standard, policy or requirement. This will give confidence to customers and business partners.

Yes, I agree with you that some of the Big 4 auditor are not technical in nature. This is because they are more trained in the Security Management and documentation side of Security (What I call Soft technique).

An Organization can only be able to protect themselves properly is have all security controls checked. Such as checking if they are compliance to ISO27001, SOX, HIPAA, PCI, and so on.

Penetration Testing (Hard techniques) will not verify whether an Organization’s security framework. Can withstand Disaster Recovery, BCP, System Fall Back control. Incident response, Computer forensic, Operation security, Physical Security, Employment Dismissal and other procedure, policy, guidelines, standards in place.