Compliance or Security, What Cost? (Poster)

  • Craig Wright
Conference paper

DOI: 10.1007/978-3-642-22497-3_27

Part of the Lecture Notes in Computer Science book series (LNCS, volume 6812)
Cite this paper as:
Wright C. (2011) Compliance or Security, What Cost? (Poster). In: Parampalli U., Hawkes P. (eds) Information Security and Privacy. ACISP 2011. Lecture Notes in Computer Science, vol 6812. Springer, Berlin, Heidelberg


This paper presents ongoing work toward measuring the effectiveness of audit and assessment as an information security control. The trend towards the application of security control measures which are employed to demonstrate compliance with legislation or regulations, rather than to actually detect or prevent breaches occurring is demonstrated to result in a misallocation of funds. Information security is a risk function. Paying for too much security can be more damaging in economic terms than not buying enough. This research reveals several major misconceptions among businesses about what security really means and that compliance is pursued to the detriment of security. In this paper, we look at some of the causes of compliance based audit failures and why these occur. It is easier to measure compliance than it is to measure security and spending money to demonstrate compliance does not in itself provide security. When the money spent on achieving compliance reduces the funding available for control measures that may actually improve security problems may arise.


Audit Economics Incentives Risk Security Compliance 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Craig Wright
    • 1
  1. 1.Computer Science EditorialSpringer-VerlagHeidelbergGermany

Personalised recommendations