Infosec Journey

Organizations have numerous regulatory control requirements and frameworks. These can be used to identify and address risks in their infrastructure and applications. These standards often serve as references during audits and certification processes. When core security principles are implemented alongside technical controls, safeguards often align with specific regulatory frameworks. Many safeguards can be linked to specific security frameworks.

Security awareness, while procedural, is a control that appears in multiple standards and is integral to compliance.

This blog describes common enterprise security awareness lapses. Each lapse can be mapped to key standards or regulatory frameworks. These can be considered potential non-compliance items.

Common Security Awareness Lapses and Framework Mandates

Developers Unaware of Secure API Credential Management

Regulatory Controls: NIST SP 800-53 (AC-6, IA-2), ISO/IEC 27001 Annex A.9, PCI DSS Requirement 7.
Impact: Insecure API credential management may result in access control violations and can be cited during compliance assessments, potentially leading to regulatory scrutiny and breach notifications.

Administrators Assigning Unnecessary Elevated Privileges

Regulatory Controls: NIST SP 800-53 (AC-6), ISO/IEC 27001 Annex A.9, HIPAA 164.308(a)(4).
Impact: Assigning privileges beyond what is necessary may lead to findings during audits, data compromise, and increased risk of non-compliance with access control requirements.

Cloud Administrators Leaving Public Endpoints Unmonitored

Regulatory Controls: CIS Controls v8 (Control 14), NIST SP 800-53 (AC-4, SC-7), ISO/IEC 27017.
Impact: Public endpoints without monitoring are a common audit finding and may expose organizations to unauthorized access, potentially requiring incident reporting.

End Users Downloading Malicious Software

Regulatory Controls: NIST SP 800-53 (SI-3, AT-2), ISO/IEC 27001 Annex A.12, PCI DSS Requirement 5.
Impact: Malware incidents attributed to user actions can result in non-compliance with detection and prevention requirements, possibly triggering notification obligations.

Network Administrators Creating Unrestricted Connections

Regulatory Controls: PCI DSS Requirement 1, NIST SP 800-53 (SC-7), ISO/IEC 27001 Annex A.13.
Impact: Lack of network segmentation may be identified during audits and can increase the risk of exposure for regulated data.

SOC Analysts Missing Alerts from Restricted Regions

Regulatory Controls: NIST SP 800-137, ISO/IEC 27001 Annex A.16, CIS Controls (Control 6).
Impact: Failure to respond to alerts based on geographic policy may be noted as a monitoring gap in compliance reviews.

Security Architects Neglecting API Security in Microservices

Regulatory Controls: NIST SP 800-53 (SA-11, SC-23), OWASP ASVS, ISO/IEC 27034.
Impact: Inadequate API security can be identified during application assessments and may result in findings related to data protection.

Operations Treating Non-Production Environments as Unimportant

Regulatory Controls: NIST SP 800-53 (CM-2, CM-6), ISO/IEC 27001 Annex A.12, PCI DSS Requirement 6.
Impact: Test and staging environments without appropriate controls may be cited in audits, as standards typically require controls across all environments.

Risk Managers Approving Risks Without Full Knowledge

Regulatory Controls: NIST SP 800-30, ISO/IEC 27005, SOC 2 Common Criteria.
Impact: Approving risks without thorough analysis may be viewed as non-conformant with risk management standards and could affect audit outcomes.

Security Analysts Configuring Insufficient Blocking on IPS/WAF/Cloud Tools

Regulatory Controls: NIST SP 800-53 (SI-4), PCI DSS Requirement 1, ISO/IEC 27001 Annex A.13.
Impact: Inadequate detection and prevention configurations may be noted as control deficiencies during compliance assessments.

Pen Testers Skipping End-to-End Tests

Regulatory Controls: PCI DSS Requirement 11.3, NIST SP 800-53 (CA-2), ISO/IEC 27001 Annex A.12.
Impact: Limited testing scope may lead to undetected vulnerabilities and can be identified as non-compliance with validation requirements.

Privacy Teams Ignoring Consent or Retention Requirements

Regulatory Controls: GDPR (Articles 5, 6, 7, 17), CCPA, ISO/IEC 27701.
Impact: Failure to adhere to consent or data retention rules can result in regulatory findings, fines, or mandatory breach notifications.

CISOs Who Don’t Foster a Security Competency Center

Regulatory Controls: NIST CSF (Identify, Protect), ISO/IEC 27001 Clauses 5 & 7, CIS Controls (Control 17).
Impact: A lack of centralized security governance may be observed in audits and could be associated with fragmented control implementation.

Process, Training, and Separation of Duties

Given the complexity of modern technology environments, some of these awareness gaps persist across organizations. Internal audits and third-party assessments are methods commonly used to identify security process weaknesses. Addressing gaps often involves reviewing processes. Providing training tailored to specific roles is also important. Uniform training may not address all risk profiles.

Organizational independence between the security function and other business units is referenced in standards such as ISO/IEC 27001 (Annex A.6), which highlights the importance of separation for oversight.

Conclusion

Security awareness controls are referenced in multiple regulatory and industry frameworks, including NIST, ISO/IEC 27001, PCI DSS, GDPR, and CIS Controls. Mapping common lapses to these standards can assist organizations in aligning with compliance expectations and audit requirements. Ongoing process review and training are practices observed in organizations with mature security postures.

In a world where compliance is table stakes, security awareness is the silent backbone of every resilient enterprise—fueling both audit success and sustainable risk management