Security Compliance is to ensure that an Organization is compliance to a certain standard, policy or requirement. This will give confidence to customers and business partners.

Yes, I agree with you that some of the Big 4 auditor are not technical in nature. This is because they are more trained in the Security Management and documentation side of Security (What I call Soft technique).

An Organization can only be able to protect themselves properly is have all security controls checked. Such as checking if they are compliance to ISO27001, SOX, HIPAA, PCI, and so on.

Penetration Testing (Hard techniques) will not verify whether an Organization’s security framework. Can withstand Disaster Recovery, BCP, System Fall Back control. Incident response, Computer forensic, Operation security, Physical Security, Employment Dismissal and other procedure, policy, guidelines, standards in place.

I’m certainly not saying that the PCI standards or auditors doing anything to actually provide REAL security (vs. a false sense of security), I’m simply saying that it’s given financially crippled security departments a reason to request additional support and funds. It still takes actual security professionals who know how to evaluate technology and implementations and can realistically determine what the risk, impact, and probability of an attack would be and then propose various ways of mitigating the issues.

You had a great comment/question in your response: “I do not understand why money is an issue when someone is willing to throw ridiculous amount of them on compliances”. Why? well, because they HAVE to. Now granted, more companies are getting it, they have good security teams in place, provide a good deal of resources and pay for talent…so when it comes time for the auditors to do their thing, they don’t find issues. Unfortunately, there are still lots of companies that don’t get it.

I guess what I’m trying to say is that I agree that 3 letter compliances don’t do anything to help a business that doesn’t believe in investing in security…but it does give existing security teams a financial impact bullet to fire at executives who are trying to say that our efforts and needs are meaningless.

I’m not sure I’m grasping what you’re trying to say in the last 2 paragraphs or your response…are you saying that here at “Wade W Inc” we proudly have our security assessed by GNUCITIZEN…that I would have no problem posting…however (going back to the big 4 from your opening paragraph) “Wade W Inc” we proudly have our security assessed by Symantec Professional Services makes me want to vomit then start hacking away.

I do not understand why money is an issue when someone is willing to throw ridiculous amount of them on compliances, which does not work, which give you nothing more but a 3 letter word you can put next to your name, which have no value whatsoever since majority of your customers probably do not know what the compliance is really all because serious people do not have the time and interest to go ahead and read it.

Security solutions should be delivered by people with experience not CLAS consultants who have got their qualifications after 3 weeks of trainings. No offense!

Personally, I do not care if compliance is the preferred way for companies doing business today. If it works for you and especially for your PR (only if), then why not do it. But I still think that compliance is nothing more but a business tool which puts ROI next to security so someone can sleep better at night.

However, soon or latter, shit hits the fan. You cannot escape it. Then how compliance helps you in anyway? It doesn’t help! So why take it then? You take it not because of your security! It is certainly not because of your PR because I hardly doubt that the huge majority of customers know what your ISO accreditations are for.

Compliances, accreditations and certifications are only ways for aware companies ripping huge fees off your back just to tell you that you are doing well, when in fact, you are not doing well at all! It is a complete waste of time and resources. :)

Instead of putting meaningless ISOs next to your name, put the company that did the security work for you. Say: Our company’s security was proudly assessed by X. Hey, you are not only going to give some good PR to your security team but you will also make them work harder and provide even better value for your money. People understand people. They do not understand 3 letter words.

–windexh8er