Regulation is harming computer security, say experts

The increasing level of regulation, both from government and within companies, is harming computer security, according to experts.

Speaking at the Black Hat USA 2009 conference, chief security officers (CSO) complained that too much of their time was spent doing jobs relating to regulation.

“The security industry is beholden to is to do things that aren’t effective due to audits and regulation,” said John Stuart, CSO for Cisco.

“I stopped paying attention to intrusion detection system logs - I don’t care how many times we get attacked. Now I spend time looking at traffic leaving the company to find what’s infected.”

“It took nine months to convince the auditors about this.”

He continued that each task had to be measured on efficacy and if he was asked to do something that reduced his efficiency then he finds another “sucker group” within the company to do.

“I’d agree,” said Bob West, founder of security intelligence firm Echelon One.

“I could be spending a whole lot of time on compliance but I wouldn’t be spending it doing my security job.”

Companies need to analyse what compliance issues need to be addressed and remove them as far as possible from the CSO’s job where possible. This frees up the CSO to get on with the job of protecting the company.