[Autogenerated] now, Jacob,
This is an area that causes everyone's head to explode.
Compensating control?
Yes.
Talk me through how to write a good compensation control.
What are you looking for?
When you're an assessor?
When you see a compensating control, does your heart go?
Oh, no.
Because you wish that ask you to write it for them or you thinking great?
No, it was so so.
I think they're a couple of pieces to that, right?
One.
I do want clients to at least draft the compensating control.
Right?
I'm not going to write the first draft for them.
You write it up.
Here's the worksheet you fill in because I want the client
to have some skin in the game right now,
I absolutely reserve the right to edit that.
Because what I often get a sort of full of __________ that
that very much needs to be sort of pruned out of what goes
in the report on compliance.
Right?
But but no.
Take the first stab at it because I want you to think
about what you're compensating.
Controls are right.
What your what your extra steps are.
And before you even get there, what?
Your constraints are right.
I mean, if you actually read the text about compensating controls in the DSS,
it says, Do some risk assessment about this before you get to proceed on.
That's the part that everybody sort of, you know,
kind of blinds themselves to on.
Doesn't really consider just Oh, I need to control.
I'm going to throw some garbage against the wall and see what sticks, right?
So compensating controls have a bad rap,
and it's not undeserved because there are a lot of
really terrible ones out there.
Uh, but the first question, right, What is the constraint?
Yeah, right.
It is it really that you have some technical or business challenge, right?
If I do this, it break something.
If I do this, it costs too much money.
If I do this, it adversely impacts performance.
Or it creates too much effort for my people to fulfill those.
Those are valid constraints, right?
I don't wanna isn't right.
And so you have to sort of parts that carefully and make sure that
you're getting a really legitimate constraint.
Because then that's also the circumstance where maybe that
compensating control needs to come to an end,
then understanding kind of what happens if you
don't meet the requirements stated?
There's there's a line in the compensating control worksheet that says,
What are the additional risks that come from not
meeting the requirements stated?
And very often, the first draft I get from clients are none right?
Ah, let's try that part again.
Okay.
Uh, no.
There really are going to be additional risks almost all of the time.
Yeah, right.
Then I want you to explain to me what it is you're doing to compensate for this,
right?
And there are a couple of criteria, right?
It needs to meet the intent and the rigour.
That's right off the original requirement.
And it needs to go above and beyond other PC ideas s requirements.
Uh, and so those air, those air sort of tough, right?
I have clients that look at sort of one and maybe not the other.
Okay, um, you know, they say, Oh, well, you know,
I'm going to go above and beyond, right?
It doesn't say I have to have purple stripes on the wall of my data center,
so I'm gonna paint purple stripes on the wall in my data center.
That's above and beyond, right?
Like you miss the intent in the rigor part right on.
And the purple stripes is is sort of an obvious sort of,
uh, yeah, but but I get a lot of really weak nonsense that is just like,
what's the thing I confined?
That's above and beyond.
That doesn't actually cost me any.
Okay, Right on.
So then you have to sort of redirect clients back to intense and rigor, right?
What are we trying to accomplish with this?
You know, there's a lot of sort of.
There are a lot of kind things that we reach for
normally our clients reach for normally.
How can they do some extra logging?
Well, what's that really going to accomplish?
Right looking requirement.
Anyway,
logging is not have a requirement in the competent
authorities already requirement.
You can't have a requirement in a compensating troll.
That's already a requirement.
But if you if you apply that requirement differently or with maybe greater
frequency or or in some above and beyond kind of way,
then maybe that could be a part of it, right?
And so if you say middle, maybe I'm going to doom or frequent,
you know,
some sort of security monitoring that's more frequent
down what's required in p cdss.
You know, maybe that's above and beyond.
Right?
But sorry, Jacob.
So So if I were to run my vulnerability scam on a weekly basis now,
on a three monthly basis, that is that above and beyond.
Well, it may be above and beyond,
but then the questions doesn't meet the intent and doesn't meet the rigor.
Right?
I have a lot of clients that try to float the idea of running vulnerability
scans more frequently as part of a compensating control for,
you know, an inability to apply security patches and timely fashion.
Right, So we're gonna run scans more frequently.
So you're going to mawr regularly discover that you are vulnerable, right?
But is there any part of this compensating control that's going toe fix?
That that's going to prevent the attacker from doing something about that?
Running scans more frequently is just information.
Yeah, right.
And it's information that in many cases you already know.
Look, we didn't patch were vulnerable, right?
So run it every 10 minutes.
It doesn't.
You know, still, you're still vulnerable.
The frequency isn't helping you there.
Now Maybe running scans Mawr frequently to try to
uncover potential vulnerabilities.
Sooner might be part of another compensating control,
but by itself I don't think it buys you a whole lot.
Okay?
And this is the reality of compensating controls is that it's
very likely a combination of a couple of factors that are
going to put something together.
So don't look for just the one thing.
Oh, let's do extra file integrity wandering.