Threat Stack Blog and Cloud Security News

Continuous security monitoring for your cloud.

Three Good Reasons to Get Compliant Now

by Tim Armstrong , posted in Compliance, Regulatory Compliance, Compliance in the Cloud, Compliance Playbook

Three Reasons Compliance Blog Banner.jpg

When things are hectic at your organization, compliance may not feel like the highest priority. If you aren’t in an industry that absolutely requires compliance, it can feel like a box to check — more of a nice-to-have than a must-do. In other cases, it may seem like a good idea . . . but one that can be kicked down the road indefinitely. However, we believe it’s a good idea to approach compliance early — often earlier than you may think.

Indeed, there are some situations in which compliance can actually move the needle in a big way for your business, either positively or negatively. Here are three specific, value-driven reasons why you should consider being proactive about compliance and get out ahead of it before it’s too late.

Read More [fa icon=long-arrow-right"]

Feb 1, 2017 11:21:24 AM

[fa icon="comment"] 0 Comments

Allocating Resources for a Compliance Audit: A Practical Framework

by Anthony Alves , posted in HIPAA, Regulatory Compliance, Compliance in the Cloud, PCI DSS, Compliance Audit, Resources

Compliance_Series_Part_11_Blog_Banner.jpg

When companies prepare to meet compliance, whether it’s PCI DSS, HIPAA, or SOC 2, one thing that can be estimated inaccurately is the stakeholders who need to be involved — who they are, what departments they come from within your organization, what their roles are, what knowledge and skill sets they require, how long they’ll be needed, etc. This post is intended as a practical guide to help you develop a thorough and realistic resource plan for your next compliance audit.

Read More [fa icon=long-arrow-right"]

Oct 6, 2016 1:28:29 PM

[fa icon="comment"] 0 Comments

File Integrity Monitoring and Its Role in Meeting Compliance

by Anthony Alves , posted in HIPAA, Cloud Security, File Integrity Monitoring, Regulatory Compliance, PCI DSS, FIM

Compliance_Series_Part_9_Blog_Banner-1.jpg

When’s the last time someone made an unauthorized change to your system files?

To answer this and other important security questions, as well as to meet many compliance requirements, you first need to have file integrity monitoring. In case you aren’t familiar with the term, file integrity monitoring (sometimes abbreviated to FIM) is the method for knowing exactly when and how your files are being changed at any moment in time. This includes critical system files, configuration files, and content files.

Read More [fa icon=long-arrow-right"]

Sep 27, 2016 11:14:32 AM

[fa icon="comment"] 0 Comments

Budgeting for a Compliance Audit: A Practical Framework

by Anthony Alves , posted in HIPAA, Regulatory Compliance, Compliance in the Cloud, PCI DSS, Compliance Audit

Compliance_Series_Part_8_Blog_Banner.jpg

Companies can easily underestimate the investment required to meet compliance. Thinking compliance is a one-and-done activity that you can skate by with minimal spend only sets you up for unpleasant surprises later on. Compliance can be a long, drawn-out process, involving everyone including HR, finance, security, and leadership. So it’s important to look at all the costs up front in order to set aside a realistic budget.

A good way to approach compliance is to treat it like a new product launch. You’ll need a dedicated project team, new technology, a reasonable budget, and more to get it off the ground.

Read More [fa icon=long-arrow-right"]

Sep 21, 2016 3:30:42 PM

[fa icon="comment"] 0 Comments

The Compliance Playbook: How to Build PCI & HIPAA Compliant Businesses in the Cloud

by Anthony Alves , posted in HIPAA, Cloud Security, Regulatory Compliance, Compliance in the Cloud, PCI DSS

Compliance_092016-09.jpg

 

The Threat Stack Compliance Playbook for Cloud Infrastructure is now available!

The Compliance Playbook is intended for readers who want to understand what’s involved in becoming compliant in a cloud environment — without getting caught up in the details and complexity that the compliance process is well known for.

Read More [fa icon=long-arrow-right"]

Sep 14, 2016 1:04:41 PM

[fa icon="comment"] 0 Comments

The Importance of Security Monitoring to Achieving Compliance in the Cloud

by Anthony Alves , posted in Security Monitoring, HIPAA, Cloud Security, Compliance, Regulatory Compliance, PCI DSS

Compliance_Series_Part_7_Blog_Banner.jpg

Monitoring is the most reliable method of identifying and tracking users who are accessing data on company systems. Whether you’re on the lookout for an unauthorized employee viewing confidential patient data, or a malicious outsider trying to steal cardholder data, monitoring is indispensable to a strong security posture.

As well, monitoring is a requirement for just about every major compliance framework and regulation, from PCI DSS to HIPAA and beyond. For the sake of this post, we’ll be focusing on security monitoring requirements for PCI DSS and HIPAA, two of the most widely applicable regulations today.

Read More [fa icon=long-arrow-right"]

Sep 8, 2016 10:19:01 AM

[fa icon="comment"] 0 Comments

Aug 25, 2016 10:39:03 AM

[fa icon="comment"] 0 Comments

Can You Afford NOT To Be HIPAA Compliant?

by Anthony Alves , posted in HIPAA, Regulatory Compliance, Compliance in the Cloud, Compliance Audit

TS16031_ThreatStack_ComplianceSeries_Part4_BlogImg.jpg

The Office of Civil Rights (OCR) has been alluding to a large-scale HIPAA audit for quite some time now — and it looks like that threat will soon come to pass.

Read More [fa icon=long-arrow-right"]

Aug 18, 2016 2:30:33 PM

[fa icon="comment"] 0 Comments

How to Reconcile Different Definitions of PCI DSS and HIPAA Compliance

by Anthony Alves , posted in HIPAA, Cloud Security, Regulatory Compliance, Compliance in the Cloud, PCI DSS

TS16031_ThreatStack_ComplianceSeries_Part3_BlogImg-1.jpg

Compliance would be challenging even if it were a black and white issue. The reality is that compliance regulations, such as PCI DSS and HIPAA, are really just a string of requirements open to interpretation. The definitions of each requirement can vary, sometimes quite a bit, from auditor to auditor or from company to company. Today, even the auditors are getting audited in an effort to ensure that the application of compliance regulations is as uniform as possible.

Read More [fa icon=long-arrow-right"]

Aug 12, 2016 12:59:25 PM

[fa icon="comment"] 0 Comments

How Does Compliance Differ In The Cloud Versus On-Premise?

by Anthony Alves , posted in HIPAA, Cloud Security, Regulatory Compliance, Compliance in the Cloud, PCI DSS

TS16031_ThreatStack_ComplianceSeries_Part2_BlogImg_1.jpg

With 253 healthcare breaches in 2015 for a total of 112 million lost records, HIPAA compliance has never been more relevant. Meanwhile, 80 percent of businesses fail their PCI compliance assessments.

As a business, whether you’re storing patient records or processing customer credit card data, chances are the government or your customers (or, many times, both) require you to meet some sort of compliance standards. And it ain’t easy.

Read More [fa icon=long-arrow-right"]

Aug 4, 2016 12:12:31 PM

[fa icon="comment"] 0 Comments

Subscribe via email:

Posts by Topic

see all