Security Compliance Is Not the Same as Protection | Opinion
Summary
Mitch Lawrence argues that security compliance rules have not kept pace with changing technologies and threats, and that meeting a checklist does not necessarily protect an organization. He calls for regular reviews of security standards that use threat information and technical expertise and weigh protection against cost.Key Facts
- The article is an opinion piece by Mitch Lawrence.
- The EPA reported in May 2024 that more than 70 percent of the community water systems it had inspected since September 2023 did not fully meet federal risk-assessment and emergency-planning requirements.
- The EPA also identified cybersecurity weaknesses at some inspected water systems, including default passwords that had not been changed and shared staff logins.
- Lawrence says emerging and changing technologies include artificial intelligence, drones, 5G, encryption, and quantum computing.
- Lawrence argues that security programs can focus too much on meeting formal standards rather than reducing actual risks.
- He says rigid requirements may impose costs on small contractors that are not suited to their specific risks.
- Lawrence recommends reviewing standards more often, using threat intelligence and technical and operational security experts, and assessing both effectiveness and cost.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
