Compliance and security are not always the same. A report by the American National Standards Institute (ANSI; Washington DC, USA) and the Internet Security Alliance (ISA; Arlington, VA, USA) aims to help individual companies analyze, calculate, and budget for their unique risks. Another report by Verizon Business (Basking Ridge, NJ, USA) shows how cyber and data loss risks differ across industries.
"The trouble [with compliance] is that it is sometimes written by bureaucrats in a vacuum," said Tom Wills, a senior analyst at Javelin Strategy & Research Inc. (Pleasanton, CA, USA) business research and consulting services. Since some major regulations apply to many different kinds of organizations, and, therefore, do not address all the relevant risks, he suggests carrying out threat assessments at least two or three times annually.
The ANSI-ISA report, The Financial Impact of Cyber Risk: 50 Questions Every CFO Should Ask, shows how the question-and-answer format, can identify individual risks. Broad company participation, involving "CFO's and other executives responsible for legal, business, technology, privacy, and other issues," is recommended.
The Verizon Business report, based on the 2008 Data Breach Investigations Supplemental Report, analyzes differences in data breaches across four different industries: finance, high-tech, retail, and food. Among the conclusions: In the financial sector, some of the biggest threats came from inside; The highest rate of data loss from employee errors was in the high-tech sector, because of the complexity of their technological environments and; Most data losses in both the retail and food-and-beverage sectors came from outside attacks on the communications systems.
"The study reveals the extent of the differences in sector risk," said Dr. Peter Tippet, vice president of research and intelligence at Verizon. "It is important to avoid a 'one-size-fits-all' approach to security," he concluded.
Related links:
American National Standards Institute
Internet Security Alliance
Verizon Business
Javelin Strategy & Research Inc.
