NDSS 2020 Compliance Cautions: Security Issues Associated with U.S. Digital-Security Standards
SESSION 10A-5 Compliance Cautions: Investigating Security Issues Associated with U.S. Digital-Security Standards
Digital security compliance programs and policies serve as powerful tools for protecting organizations' intellectual property, sensitive resources, customers, and employees through mandated security controls. Organizations place a significant emphasis on compliance and often conflate high compliance audit scores with strong security; however, no compliance standard has been systemically evaluated for security concerns that may exist even within fully-compliant organizations. In this study, we describe our approach for auditing three exemplar compliance standards that affect nearly every person within the United States: standards for federal tax information, credit card transactions, and the electric grid. We partner with organizations that use these standards to validate our findings within enterprise environments and provide first-hand narratives describing impact.
We find that when compliance standards are used literally as checklists -- a common occurrence, as confirmed by compliance experts -- their technical controls and processes are not always sufficient. Security concerns can exist even with perfect compliance. We identified 148 issues of varying severity across three standards; our expert partners assessed 49 of these issues and validated that 36 were present in their own environments and 10 could plausibly occur elsewhere. We also discovered that no clearly-defined process exists for reporting security concerns associated with compliance standards; we report on our varying levels of success in responsibly disclosing our findings and influencing revisions to the affected standards. Overall, our results suggest that auditing compliance standards can provide valuable benefits to the security posture of compliant organizations.
PAPER
https://www.ndss-symposium.org/wp-con...
SLIDES
AUTHORS
Rock Stevens (University of Maryland)
Josiah Dykstra (Independent Security Researcher)
Wendy Knox Everette (Leviathan Security Group)
James Chapman (Independent Security Researcher)
Garrett Bladow (Dragos)
Alexander Farmer (Independent Security Researcher)
Kevin Halliday (University of Maryland)
Michelle L. Mazurek (University of Maryland)
Network and Distributed System Security (NDSS) Symposium 2020, 23-26 February 2019, Catamaran Resort Hotel & Spa in San Diego, California.
https://www.ndss-symposium.org/ndss-p...
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
https://www.ndss-symposium.org/
#NDSS #NDSS20 #NDSS2020 #InternetSecurity