Security != Compliance... But It Should

Transcript

1. Security != Compliance... But It Should SAINTCON 2025 Chris Honda Thursday, October 23
2. • insert_standard_disclaimer() => my thoughts and opinions, none of this is advice, consult a lawyer... Ground Rules • This isn’t *another* AI talk - you’re welcome (or sorry, if you were hoping I was going to bring it up), though I used it to get this slide deck template • I want to hear your thoughts more than my voice, if you have an opinion and are willing to share, please wave your hand, shout your question, interrupt me, and share
3. A Bit About Me • Did some school • Studied some things • Worked at some places • Now I do something else
4. A Bit About Me • Korean @ BYU, InfoSec @ Maryville • Education, Sales, Finance, SWE • Built Security + GRC @ Whistic, doing it again @ Plotly
5. • Security + Compliance were meant to be partners, not opponents tl;dr • Each team fulfills different functions to support the same mission • If {other_team} isn’t working well, they could probably use your help • We’re all on the same team
6. • Never had separate teams for GRC and Security: always just ‘the team’ doing Security + GRC together Disclaimer s • Done both roles, but never just one or the other at a time - always been a hideous mix-and-match • 25 minutes isn’t a long time to get into depth, please excuse general statements
7. • Words Matter Main Points • Being Compliant Doesn’t Make You Secure • The Point of ALL Business Is... • Everything Comes Down to Risk Management
8. Words Matter
9. • Security absolutely isn’t (!=) compliance Words Matter • Also, they weren’t meant to be the same • To be fair, the core argument is that...
10. Being Compliant Doesn’t Make You Secure (or, your SOC 2 report doesn’t mean you’re unbreachable)
11. • Compliance shows us the security floor Being Compliant Doesn’t Make You Secure • Occasionally, compliance highlights points that need more focus, but it doesn’t make you secure • “Policies never prevented a breach”
12. • “It’s our policy” is just “Security != Policies Never Prevented a Breach Compliance” in action • Beautiful documents dusted off annually to appease the auditors • Even if the doc is true and accurate, who uses it?
13. What’s the point of it all?
14. What’s the point of compliance? • Same as every other team: • MAKE AND KEEP AS MUCH MONEY AS POSSIBLE!!!!!
15. What’s the point of security? • Same as every other team: • MAKE AND KEEP AS MUCH MONEY AS POSSIBLE!!!!!
16. What’s the point of security? • Same as every other viable team: • MAKE AND KEEP AS MUCH MONEY AS POSSIBLE!!!!!
17. • Are we really just a cost center? Really though, what’s the point? • How do we provide tangible value? • Can’t we just secure all the things?
18. • Security keeps the bad guys out and recover quickly when they get in Value of Security & Compliance • Compliance translates customer and legal requirements, and tells the story of how Security meets them • When Security and Compliance work together, Customer Trust is created • Re: “Can’t we just secure all the things?”
19. “Can’t we just secure all the things?”
20. “Can’t we just secure all the things?”
21. • Security secures things (the whole confidentiality/integrity/availability thing) Where our paychecks come from • Compliance makes sure requirements are known and fulfilled • Security + Compliance = Risk Management • Good risk management helps the business make and keep money (thru trust)
22. • Security secures things (the whole confidentiality/integrity/availability thing) Where our paychecks come from • Compliance makes sure requirements are known and fulfilled • Security + Compliance = Risk Management • Good risk management helps the business make and keep money (thru trust)
23. Everything comes down to risk management
24. What do we do about it?
25. • Can you make an accurate and complete collection of customer and regulatory requirements? • Can you convince others WHY controls should be implemented or maintained? For compliance people: • How well can you work with others to design, implement, and maintain effective controls? • Can you hold a conversation with Engineering/Product about what needs to be done in their language? • Can you demonstrate value in the standards, frameworks, and processes you oversee? • How do you explain your recommendations when you’re likely not the one implementing them?
26. Ayoub Fandi AJ Yawn Justin Pagano Trailblazers for more effective GRC
27. • Can you get your CFO to want to invest in that new tool without using terms like “exploit”, “authentication”, or “best practices”? • How do you show customers how you protect their data without a For security people: 2-hour guided tour of your AWS infrastructure? • How do you prove reasonable security without an audit? (“We’ve not been breached [yet]” doesn’t count) • If you want to “secure all the things”, where do you start and how will you know when you’re done?
28. Where Security & GRC Overlap
29. We’re on the same team
30. a d e y h .W s ie ? c i m l o ea p t e ’s c y n n a a i l p p m m o co yc Ih m e dl n a ld u wo e n I W hy wo in ul to Questions? d co m m pl ian ak ce in g m th e c atte om r i pa f we ny co m or uld es pu tt ec ha ur tt e? im e How do you make good teriyaki chicken?
31. THANK YOU!!! linkedin.com/in/ichirohonda chris.honda@plotly.com