One thing I should say is we're going to talk about
data breaches in a different course,
but one of the requirements when a forensic investigator comes and looks at
you is one of the questions I answer to the card brands is,
did this requirement, did this not having this requirement in place,
did that contribute to the breach, right?
So no one ever cares when you're breached that your 288 controls are all
running and everything and compliant and working fine.
but was any of the controls failed that made the breach happen, right?
And one I always use to see was the fact the policies were not right.
So the forensic investigator says show me your policies.
We don't have one.
That's a fail.
You didn't have a policy for a firewall.
They broke in through a firewall.
Everything else about your firewalls was fine,
but your policy failed,
and now you're maybe assessed as liable for that breach
for not having a policy in place.
Right.
So although it might not be the cause of a compromise,
it might be the cause of some really serious
questions if you do suffer a breach.
Right.
Great.
Anything else we should talk about?
Firewall, personal firewalls, and policies?
I'd say the one thing that I do see more and more of now where in my current
employment we do a variety of different kinds of audits,
so we do PCI, and we do SSAE 18, SOC, and we do ISO 27001,
very often I have organizations come to me and say here are the policies,
and they were adequate for ISO 27001.
They should be fine for you.
And that, I think,
really gets into the sort of differentiation between policies and procedures,
which PCI DSS maybe it doesn't care so much about,
but those policies that are sort of ISO adequate are very,
very high level, right,
and do not have a lot of the sort of necessary detail that we require.
And maybe that should go in your procedure documents if you also have
ISO requirements for policies that are very top level.
That's fine, but then, fine,
show me the attendant procedures that also have the detail,
who does what, how do you accomplish this,
what are the steps.
And if you don't have that, then maybe your ISO auditor will say,
eh, you're fine, but I'm going to say, hmm,
we need more substance here.
Okay.