Is Legally Requiring Good Security Practices a Good Thing? 

Recently, the State of New York has taken steps towards passing the nation’s first cybersecurity regulation which explicitly tells financial organizations in New York what they must do in their security program.  You can read an overview of this in the article, “Full Employment for CISOs in New York.”

The main question I have is, does it make sense to legislate the details of a security program versus allowing organizations to build programs that meet the business needs and risk tolerance of their organizations? 

Before I answer that question, let me first state that overall, I believe the directives in the regulation generally make sense.  In fact, they are practices that most security professionals would have as part of their standard operating procedures.  It is a little odd though that they explicitly call out two technology areas – multi-factor authentication and encryption – for inclusion, while staying very high-level on the other security control areas.  Again, not that multi-factor authentication and encryption are bad areas to focus on, but why are those included and while other important security controls, such as email security, Web security, anti-virus, identity management, and many other security categories?

Now back to the main question of this blog, is legally requiring specific security practices a good thing?  My take is no.  However, should regulators consider cybersecurity as part of their supervisory responsibilities?  Yes, as part of their view of the organization’s risk management program.  Ultimately, organizations are responsible for their own risk management programs and how much risk they can tolerate and how best to mitigate that risk. 

Just as regulators don’t direct in detail other aspects of the organization’s business practices, nor should they do it for their cyber risk management practices.  There are just too many opportunities for unintended consequences to arise.  For example in my experience the more detailed the regulation, it not only becomes overwhelming for the CISO looking to implement, but there’s also a greater chance that the security program turns into a checklist program and not a risk management focused one.