Elements of Optimized Security: Automated Compliance

As a CIO or CISO, you’re constantly reminded that your job is to reduce costs, improve security and achieve compliance. And, if you’re like the many IT leaders I’ve worked with, I wouldn’t be surprised if you said you felt you were subject to an almost overwhelming number of regulations. Regulations that are constantly being revised and updated (we’re talking SOX, PCI, HIPAA, FISMA, the list goes on). Managing these regulations is a constant, sometimes daunting, task, and leads me to the final element of an optimized security posture: automated, centralized compliance.
We recently polled CIOs on the biggest challenges to their compliance efforts and the top three issues they noted were:
●      Lack of standard configurations & requirements
●      Manual internal/external audit processes
●      Configuration drift that leads to a rework before each audit
Organizations today have highly distributed, complex systems with disparate tools that generate a lot of data. If you don’t have a consistent approach across these tools you’re going to have gaps in your compliance posture, lose thousands of man-hours on multiple, repetitive audits and see a significant decrease in your overall ROI.
So, how do you get your security organization to a place where your compliance initiatives are streamlined, you’re regularly collecting data and feel confident in your compliance posture? At McAfee we see five steps toward ‘compliance nirvana’:
●      Set policy and prioritize assets. You can’t (continue reading...)