Does Malicious Compliance Define Your Organization's Security Program?

Even with the best intentions, no law or regulation can address every possible security threat. Every organization has unique challenges, and new threats arise daily. Organizations who base security programs around only compliance are missing many security best practices and are at risk of a breach. We call this malicious compliance, and it is a constantly growing threat.

What exactly is malicious compliance? Malicious compliance comes as a result of an organization building a security program, or adhering to a set of security practices, solely around being compliant to a specific law or regulation as opposed to security best practices.

Is malicious compliance happening in my organization? Simply put, your organization may concede to this mindset if there is a belief that compliance equals security, which any good security professional knows is not the case.

How does my organization avoid the problem? While the answer is simple, the solution is complex; begin building an enterprise security program with effective management, operational and technical controls. The absence of any one of these components results in an ineffective security program. The absence of an effective security program most likely will result in a lack of compliance with industry regulations or, at the very least, a security program built around malicious compliance.

A  simple example follows, regarding a much more complex problem as to how these controls can come together to help maintain an effective compliance program.

Let’s start with management controls. When we discuss management controls, we have to begin with organizational structure. A good security program uses a top-down approach. That means an effective security program is supported by upper management and filters down through mid-level managers all the way down to hourly associates.

This is, in a sense, the only way to properly execute an effective security program. This approach is not industry specific, as Fortune 100 banks to mom-and-pop dry cleaning chains all should use the same approach.

At the end of the day, if upper management isn’t concerned with security, then why would an hourly associate care? In an organization where this approach is not executed, the only ones who care about security is the person who will lose their job in the event of a breach. Most times these people aren’t the ones with decision making power. In this type of organization, an individual or department unfairly holds most of the risk for the organization.

There is no right way to properly structure an organization, as all organizations are different. Typically in a banking environment, there will be dedicated security, risk management, and internal audit departments. In an organization such as this, all of these departments have to work together effectively and act as a check and balance system. In a smaller organization it probably isn’t necessary to split departments in this manner. The only things that remain consistent are that security should be supported from the top down, and that there is an effective way to identify and manage risk.

Second is operations. These employees perform the day to day activities including anything from monitoring to access control maintenance. The ways in which these actions are performed are dictated by operational policies and procedures.

Both policies and procedures set the tone for how the organization is to operate. They comprise the law of the land, if you will. Without these, there is no good way to communicate marching orders from upper management.

Policies and procedures cannot just be stagnant documents sitting on the company intranet of which no one knows the location. These important documents need to be constantly updated to reflect technological changes, as well as communicated to associates. Any unapproved action by the end user to circumvent these policies and procedures needs to be met by management with disciplinary action against the end user. All approved exceptions to standard policies and procedures need to go through formal change management and be documented as such.

One last note: policies and procedures shouldn’t be based solely on compliance requirements, but should also include industry best practices. Typically compliance requirements are a step behind industry best practices, and most times compliance requirements are updated to reflect industry best practices. This approach ensures that your organization remains ahead of the curve from a compliance standpoint.

Finally, there are technical controls. These are implemented to enforce information security best practices as well as corporate policies and procedures. These controls encompass everything from a corporate firewall to ensuring that USB ports are disabled on end user systems.

The level of technical controls implemented on systems in an organization typically depends on the risk associated with that specific system. For many regulations such as GLBA, HIPAA, and FISMA, a formal risk assessment must be performed before technical control requirements are implemented. The results of this assessment determine the level of controls needed to protect the specific system/network infrastructure. Although one of the most effective ways to enforce policy, typically, this area is where most organizations want to do the minimum amount required by compliance regulations. Not only do technical controls have a high association with increased cost, but many also impact the way business is done and therefore are not typically supported by upper management or line of business owners.

Let’s consider an example of how all of these components come together and how doing so can help to maintain an effective compliance program. Once again, let’s start with people. Whether or not security is supported from the top down or not, senior executives do have a vested interest in ensuring that their organization is compliant with whatever regulation to which the organization may have to adhere.

The difference between a top down approach and a “we just need to be compliant” approach is the “effectiveness” part. The latter of the two approaches pushes the organization into a program of malicious compliance. Other than the obvious issues around malicious compliance, it’s very hard to maintain compliance as such. For example, PCI requires only 7-character passwords. Let’s assume the organization simply wants to meet this minimum, but industry best practices suggest a minimum of 12.

If the standard were to change, then that organization would have to meet that requirement. Although this may seem like a relatively arbitrary task, I can ensure you that it isn’t that easy. In addition to the sometimes difficult logical changes that will need to be made, policies and procedures will need to be updated and communicated to end users as well.

However, if executive management would have actually been concerned about security and not just compliance to begin with (in a top down approach), policies and procedures would already have been created based on industry best practices to meet this new compliance requirement. In addition, the technical controls would already have been implemented to ensure that policies and procedures around this requirement were properly being enforced.

Compliance with various regulatory standards becomes much easier to manage if an organization is already aligning with industry best practices. In order to become compliant with industry best practices, all of the safeguards discussed need to be addressed.

This not only makes sense from a compliance perspective but just from an overall “doing good business” perspective. Organizations can use security frameworks such as NIST or ISO:27001-2 as good references for security best practices. Organizations can even become certified to such frameworks. Organizations that have certification and accreditation to such frameworks have no difficulty meeting the demands of either somewhat subjective compliance requirements such as GLBA and HIPAA or more black-and-white standards such as PCI.

In conclusion, much of the information provided above is fairly easy to understand -- Security 101 type stuff. The issue is not with understanding, but with articulating to organizations, that the long term reduction in the cost of compliance quickly will outweigh the short term investment needed to ensure their environment is implemented in accordance with security best practices. Unless security is made a top priority in your organization and is implemented using a top-down approach, the preceding advice will fall on deaf ears and malicious compliance will continue to plague your organization.



  • Live From ISC West 2023 Preview

    ISC West 2023 is right around the corner! This year’s trade show is scheduled from March 28–31 at the Venetian Expo in Las Vegas, Nevada. The Campus Security & Life Safety and Security Today staff will be on hand to provide live updates about the security industry’s latest innovations, trends, and products. Read Now

    • Industry Events
    • ISC West
  • A Break from Routine

    It was three years ago right about now that COVID was bringing the world to its knees. In mid-March of 2020, the president put travel restrictions on all flights in and out of Europe, the NBA suspended its season, and Tom Hanks announced that he’d tested positive for the disease—all in the same night. It was officially a national emergency two days later. Read Now

    • Industry Events
    • ISC West
  • Until We Meet Again

    A short three years ago we were all pondering whether to attend any tradeshows all thanks to COVID-19. Sorry to bring that nightmare up again, but it seems that little pandemic is in the rear-view mirror, and it’s time to meet again. Read Now

    • ISC West
  • Cyber Hygiene: What it Looks Like for IoT Devices

    Cyber Hygiene: What it Looks Like for IoT Devices

    For our second pillar about the Industrial Internet of Things (IIoT) Pillars of Security, we are going to discuss what cyber hygiene looks like for IoT devices. Read Now

Featured Cybersecurity

New Products

  • ComNet NW1 Gen 4

    ComNet NW1 Gen 4

    ComNet, Communication Networks, is announcing the introduction of its Generation 4 line of NetWave® wireless products that offer greater performance and increased stability in applications where throughput and increased bandwidth is increasingly important. 3

  • D-Tools System Integrator (SI) Software

    D-Tools System Integrator (SI) Software

    D-Tools Inc. has announced the availability of System Integrator version 16, which adds powerful new project and service management capabilities to its award-winning, end-to-end business management solution. 3

  • Tyco Kantech EntraPass security management software

    Tyco Kantech EntraPass security management software

    Johnson Controls, the global leader in smart, healthy and sustainable buildings, and architect of the Open Blue digital connected platforms, has released the newest version of the Tyco Kantech EntraPass security management software. 3