Welcome!

Cloud Expo Authors: Anne Buff, John Grady, Elizabeth White, Carmen Gonzalez, Bob Gourley

Related Topics: Security

Security: Article

The Rise of the Managed Compliance Provider

Today, security is more complex than simply deploying firewalls and virus protection

You may think IT compliance is nothing more than big government sticking its nose into everyone’s business. Compliance equals Big Brother. OK, so there is some truth in that government compliance regulations are a little over the top, and perhaps there are just too many of them that functionally do the same thing. It’s not just about government regulations — it’s also about non-government standards, such as PCI, that need to be addressed.

Look at SOX, FISMA, FERPA, HIPAA and the brothers FERC and NERC. Aren’t they basically the same rules? Can’t we have just one large compliance regulation with small amendments for each specific industry? That would be easier, but since various politicians have stakes in their own versions, I don’t think we will see unification in the short term. That is one reason why regulators have to levy heavy fines and other punitive measures to force organizations to follow their rules.
However, if we look at compliance in a slightly different light, perhaps complying with these regulations will be just a little less painful.
 
Today, security is more complex than simply deploying firewalls and virus protection. For a company to be secure, it also has to look at security from an overall company risk perspective. This includes cybercrime and physical security as well as regulatory risks and profit risks around the costs versus the gains of implementing security measures.
In order to achieve complete security, your strategy needs to include multiple layers across three functional areas:
 
1) The protection of assets and data. This is the traditional implementation of firewalls, IDS systems, vulnerability protection, virus protection, penetration testing and many other standard security practices. Of course this is a very expensive proposition, so organizations must make technology strategy decisions based on budget and their type of business.
 
2) Process and procedures to adequately maintain security technology. You need to have methods and rules on how and when you update security components such as firewall policies, IOS, virus protection, log-in polices, and active directory policies. All of these need to be reviewed and updated frequently.
 
3) Defining and enforcing policies. It is one thing to have a policy on updating your virus definitions, but if these policies are not followed, then the first two areas cited above are worthless.
 
Many companies spend hundreds of thousands or even millions of dollars on firewalls, biometric devices, IDS/IPS, and anomaly detection but fail to deploy basic compliance-management systems. This places businesses at risk because it is very easy for someone to go into a device on the computer network, make changes that do not follow corporate security guidelines, and then open a hole in your defenses. An effective, automated compliance system continually validates that the rules of all devices follow correct security procedures.
 
Another aspect to consider is that compliance is often mandated by regulatory decrees, such as SOX, HIPAA, FISMA, GLBA and many others—or by industry requirements such as PCI and ISO. Non-compliance can result in significant fines and, in some cases, criminal prosecution. But even if compliance is not mandated, it is common sense to create policies and procedures and to verify they are being followed.
 
While risk management and mitigation serve as key drivers, incorporating business objectives and policies is an important part of the desired objective and is ultimately the end game. This is where compliance comes into the picture. Compliance proves the organization has the correct policies in place, and that the policies are being followed.
Security, compliance and risk assessment are the processes, but in the past, they have been 100 percent manual processes, time consuming, and prone to error. As a result, there is now an emerging trend to outsource the mechanics of monitoring the validation process to a local service provider, also called a Managed Compliance Provider or MCP.
 
MCPs perform the grunt work in tracking compliance processes through a managed service. Effective MCP solutions provide clients with near real-time dashboards and reports on their compliance status while also eliminating or significantly reducing error-prone, manual processes. Some MCPs even have the ability to certify if clients are within compliance.  
 
Security does not imply compliance, and compliance does not beget security. There must be a unification of both programs, which is what compliance is all about. Compliance also should not be viewed as some government oversight, but instead a common-sense approach to protecting the assets and value of your business.

More Stories By Jim Hare

Jim Hare is channel chief and VP of worldwide sales for eGestalt Technologies, a cloud-computing provider of IT-GRC applications for enterprises, including small to mid-size enterprises. Based in Santa Clara, CA, eGestalt has created “The Managed Compliance Provider Cookbook,” which is available to all Managed Compliance Provider (MCP) partners. The cookbook is a guide for service providers and MSPs looking to enter the lucrative field of compliance services.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@CloudExpo Stories
European data center operator DEAC is the largest in the Baltics. The activities are orientated to provide data center services and IT outsourcing on Eurasia and America scale in order to create the primary or backup or additional data center for customer in the EU, to protect its business and, most importantly, reduce costs up to 40% within 3-5 years. DEAC is an IT outsourcing services and solutions company whose highly experienced and qualified employees offer various groups of services and...
Things are being built upon cloud foundations to transform organizations. This CEO Power Panel at 15th Cloud Expo, moderated by Roger Strukhoff, Cloud Expo and @ThingsExpo conference chair, will address the big issues involving these technologies and, more important, the results they will achieve. How important are public, private, and hybrid cloud to the enterprise? How does one define Big Data? And how is the IoT tying all this together?
Dyn solutions are at the core of Internet Performance. Through traffic management, message management and performance assurance, Dyn is connecting people through the Internet and ensuring information gets where it needs to go, faster and more reliably than ever before. Founded in 2001 at WPI, Dyn’s global presence services more than four million enterprise, small business and personal customers.
Until recently, many organizations required specialized departments to perform mapping and geospatial analysis, and they used Esri on-premise solutions for that work. In his session at 15th Cloud Expo, Dave Peters, author of the Esri Press book Building a GIS, System Architecture Design Strategies for Managers, will discuss how Esri has successfully included the cloud as a fully integrated SaaS expansion of the ArcGIS mapping platform. Organizations that have incorporated Esri cloud-based appl...
When an enterprise builds a hybrid IaaS cloud connecting its data center to one or more public clouds, security is often a major topic along with the other challenges involved. Security is closely intertwined with the networking choices made for the hybrid cloud. Traditional networking approaches for building a hybrid cloud try to kludge together the enterprise infrastructure with the public cloud. Consequently this approach requires risky, deep "surgery" including changes to firewalls, subnets...
Ixia develops amazing products so its customers can connect the world. Ixia helps its customers provide an always-on user experience through fast, secure delivery of dynamic connected technologies and services. Through actionable insights that accelerate and secure application and service delivery, Ixia's customers benefit from faster time to market, optimized application performance and higher-quality deployments.
SYS-CON Events announced today that Stratogent will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Stratogent is a custom managed services organization based in San Mateo, California. We design, implement, and support mission critical infrastructure 24x7 on premises, in datacenters and in the Cloud. Since 2005, we have acted as an extension of internal IT teams, achieving a customer reten...
SYS-CON Events announces a new pavilion on the Cloud Expo floor where WebRTC converges with the Internet of Things. Pavilion will showcase WebRTC and the Internet of Things. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devices--computers, smartphones, tablets, and sensors – connected to the Internet by 2020. This number will con...
The only place to be June 9-11 is Cloud Expo & @ThingsExpo 2015 East at the Javits Center in New York City. Join us there as delegates from all over the world come to listen to and engage with speakers & sponsors from the leading Cloud Computing, IoT & Big Data companies. Cloud Expo & @ThingsExpo are the leading events covering the booming market of Cloud Computing, IoT & Big Data for the enterprise. Speakers from all over the world will be hand-picked for their ability to explore the economic...
SYS-CON Events announced today that Cloudian, Inc., the leading provider of hybrid cloud storage solutions, has been named “Bronze Sponsor” of SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Cloudian is a Foster City, Calif.-based software company specializing in cloud storage. Cloudian HyperStore® is an S3-compatible cloud object storage platform that enables service providers and enterprises to bui...
SYS-CON Events announced today that Gridstore™, the leader in software-defined storage (SDS) purpose-built for Windows Servers and Hyper-V, will exhibit at SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Gridstore™ is the leader in software-defined storage purpose built for virtualization that is designed to accelerate applications in virtualized environments. Using its patented Server-Side Virtual C...
As the Internet of Things unfolds, mobile and wearable devices are blurring the line between physical and digital, integrating ever more closely with our interests, our routines, our daily lives. Contextual computing and smart, sensor-equipped spaces bring the potential to walk through a world that recognizes us and responds accordingly. We become continuous transmitters and receivers of data. In his session at Internet of @ThingsExpo, Andrew Bolwell, Director of Innovation for HP’s Printing a...
SAP is delivering break-through innovation combined with fantastic user experience powered by the market-leading in-memory technology, SAP HANA. In his General Session at 15th Cloud Expo, Thorsten Leiduck, VP ISVs & Digital Commerce, SAP, will discuss how SAP and partners provide cloud and hybrid cloud solutions as well as real-time Big Data offerings that help companies of all sizes and industries run better. SAP launched an application challenge to award the most innovative SAP HANA and SAP ...
The Internet of Things (IoT) promises to evolve the way the world does business; however, understanding how to apply it to your company can be a mystery. Most people struggle with understanding the potential business uses or tend to get caught up in the technology, resulting in solutions that fail to meet even minimum business goals. In his session at Internet of @ThingsExpo, Jesse Shiah, CEO / President / Co-Founder of AgilePoint Inc., will show what is needed to leverage the IoT to transform...
SYS-CON Events announced today that AIC, a leading provider of OEM/ODM server and storage solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. AIC is a leading provider of both standard OTS, off-the-shelf, and OEM/ODM server and storage solutions. With expert in-house design capabilities, validation, manufacturing and production, AIC's broad selection of products are highly flexible and are conf...
We are all here because we are sold on the transformative promise of The Cloud. But what good is all of this ephemeral, on-demand infrastructure if your usage doesn't actually improve the agility and speed of your business? How must Operations adapt in order to avoid stifling your Cloud initiative? In his session at DevOps Summit, Damon Edwards, co-founder and managing partner of the DTO Solutions, will highlight the successful organizational, process, and tooling patterns of high-performing c...
SYS-CON Events announced today that O'Reilly Media has been named “Media Sponsor” of SYS-CON's 15th International Cloud Expo®, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. O'Reilly Media spreads the knowledge of innovators through its books, online services, magazines, and conferences. Since 1978, O'Reilly Media has been a chronicler and catalyst of cutting-edge development, homing in on the technology trends that really matter and spurri...
SYS-CON Events announced today that Aria Systems, the recurring revenue expert, has been named "Bronze Sponsor" of SYS-CON's 15th International Cloud Expo®, which will take place on November 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Aria Systems helps leading businesses connect their customers with the products and services they love. Industry leaders like Pitney Bowes, Experian, AAA NCNU, VMware, HootSuite and many others choose Aria to power their recurring revenue bu...
The Transparent Cloud-computing Consortium (abbreviation: T-Cloud Consortium) will conduct research activities into changes in the computing model as a result of collaboration between "device" and "cloud" and the creation of new value and markets through organic data processing High speed and high quality networks, and dramatic improvements in computer processing capabilities, have greatly changed the nature of applications and made the storing and processing of data on the network commonplace. ...
Seagate has a strong track record of collaborating with others to develop better cloud solutions. The Seagate Cloud Builder Alliance program, for example, leverages the company’s knowledge of storage and cloud-optimized solutions to give cloud service providers the customized, flexible and scalable server and storage solutions to meet the high levels of service their customers demand. Seagate also is a member of the OpenStack Foundation and Open Compute Project to help define and promote open-so...