Mark Curphey - SecurityBuddha.com

Decade after decade politics moves from regulated economies to de-regulated economies. Changes are usually are triggered by “unpredictable events” (in political speak). We are almost certainly about to go onto a period of heavy government regulation of the financial services industry where “unpredictable events” or “failure” in plain English is blamed on inadequate of regulation.

Internet cycles are of course generally shorter than political cycles yet at the same time closely tied. Over the last decade or so I have watched corporate security teams (and the information security industry as a whole) cycle through waves where governance, regulation and compliance was the short order of the day and waves where technical security was served up as the predominant answer. It’s hard to argue with risk management, it makes sense in the context of business conversations. It’s hard to argue with technical security, it makes equal sense in the context of technology discussions.

It seems to me the failures occur because there is a lack of connection between the two approaches. My issues with PCI are not about the intent, but about the implementation. We can all see how easy it is to have a PCI compliant application (some might say appropriately managed risk, and complying with regulations) that is wholly insecure.

I speculate that what’s actually at play in the big picture is a giant human Fourier series where convergence will only occur when technical security and business security connect.

(Graphic when I have time)