Story image

Welcome to the cyber-regulatory market of 2018 and beyond

12 Jun 18

Article written by Carbon Black senior director of compliance strategy Chris Strand

In recent years we’ve seen an increase in the number of companies facing legal consequences for ineffectively meeting deadlines requiring them to measure the effectiveness of their security solutions. Combined with these deadlines, companies also have to prove they have awareness and control over the security regulations that govern their respective industries.

Throughout the rest of 2018, this cyber-regulatory environment will grow exponentially, just as the number of data breaches and stolen data records have grown off the charts.  I believe we are seeing the maturity of a brand new market, one where both security and regulatory professionals will have to band together like never before.  Welcome to the cyber-regulatory/cyber-compliance market.

The cyber-regulatory market is not new; it has been with us for quite some time.  However, in recent years, it has evolved into a well-defined, addressable market with metrics showing its impact in relation to other associated sectors, such as cybersecurity and data security.  

In my past experience, I have been responsible for unifying corporate security policy and teams by coupling together major pillars of cybersecurity technology, risk, assessment and audit. In undertaking this, I have never seen a time where the application of any one of those pillars has not been enough to solve or offset the problem. I’ve also never believed the individual application of any one of those pillars ever really solved the problem in the first place. Until recently, companies could get away with applying only one pillar and temporarily avoid attention. That’s no longer the case.

The cyber-regulatory market is evolving rapidly – much faster than in the past.  New and updated laws and regulations are being introduced. These regulations and laws are being driven directly by security requirements (mostly data and PII security) and the associated liability and consequences these requirements bring. 

We have seen far too many examples recently regarding the failure of cybersecurity controls and regulatory requirements. No enterprise is spared (in any region of the globe) and security vendors and agencies need to be prepared to address these market demands or risk getting left behind. 

Some of the substantial cyber-regulatory law deadlines (both past and future) from the first half of 2018 include;

  • The GDPR clock stopped on May 25, presenting cyber-regulatory challenges to organizations all over the world.  
  • The PCI SSC has several impending deadlines around data security that take effect this year, and many institutional and global agencies have put a deadline in place, forcing organizations to mandate PCI DSS as a standard data-security policy measure. 
  • Other notable cyber-regulatory developments on the table include the recent Australian Mandatory Data Breach Notification legislation, which is driven as part of the Australian Privacy Act. 

The effects on businesses subjected to any of these laws are going to be felt in a big way, and many global organisations will have to deal with multiple cyber-regulatory mandates at once.

Cybersecurity firms can help organisations around the globe gain insight on a combined view of their cybersecurity and cyber-regulatory postures. Data security technology includes functions and solutions that help to answer the questions encountered throughout the cyber attack chain while ensuring the collection of ALL of the relevant data that is used to find, analyse and contain a compelling security event.  

This further helps satisfy the common response requirements called for as part of many regulations and laws (i.e. the 72-hour identification law found in so many impending regulations like GDPR and the AUS Data Breach Notification Act, as well as others).

The most effective technology is capable of providing a real-time glimpse into the status of cyber posture and regulatory alignment.

Gartner names newcomer Exabeam a leader in SIEM
The vendor landscape for SIEM is evolving, with recent entrants bringing technologies optimised for analytics use cases.
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
Genesys PureCloud generates triple-digit revenue growth year on year
In Australia and New Zealand, the company boosted PureCloud revenue by nearly 100%.
Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
IDC: Standalone VR headset shipments grow 428.6% in 3Q18
The VR headset market returned to growth in 3Q18 after four consecutive quarters of decline and now makes up 97% of the combined market.
Open source will be the next big thing for the channel
Channel firms should be on the lookout for opportunities across open source and more diverse software offerings like software-defined containers and storage.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
NBN Co rolls out 'optimised' wholesale business bundles for ISPs
“We recognise some businesses are on nbn powered plans that have not been optimised for their needs," says Paul Tyler.