Don't let compliance hinder your growth

...which systems are affected by compliance regulations. For example:

• Assess perimeter controls to ensure that regulated data is protected from intrusion or attack that could result in disclosure.
• Assess storage systems at the server level (access controls/permissions, strong authentication) to ensure that if an intruder does penetrate the network, he can't access the systems on which the protected data is stored.
• Assess disk and file level security (encryption) to ensure that if an intruder is able to access the server, he won't be able to read the information in the files.
• Assess communications applications (email, instant messaging) to ensure that protected data can't be leaked in that way. This may require active monitoring, keyword filtering of outgoing traffic and the like. You must also assess archiving policies to ensure the safety of stored messages.

Ensuring scalability
If scalability is a priority a modular solution may be the answer. This means security can be upgraded or capacity can be expanded at different levels independently. It may mean using different vendors' products to provide different levels of protection (such as firewall/perimeter, storage, server, communications).

Many companies offer "turnkey" compliance solutions that integrate with the company's existing network infrastructure. These are targeted toward specific industries. For example, last June Qumas announced a pre-configured compliance solution for pharmaceutical firms called PharmaQCompliance that uses a subscription licensing model based on number of users. SenSage offers separate out-of-the-box solutions designed to help companies comply with SOX or HIPAA.

Another option is to find a service provider that provides security by diverting your network traffic through their own networks. These managed security services can take a load off your network administrators' backs or offer protection against attack; managed firewall and VPN services; email security, encryption; and suchlike. Compliance Solutions can provide a full outsourced compliance department.

Either way, a big question is whether the product or service is actually a compliance solution developed by software professionals or a software solution developed by compliance professionals. The ideal, of course, comes from a collaboration of the two.