Swimming Upstream - Regulation vs Security

Explore strategies for navigating the complex interplay between regulation and security in heavily regulated industries through this conference talk from BSidesSF 2017. Learn how security teams can overcome bureaucratic, compliance, and political challenges to achieve their security goals. Gain insights from real-world examples spanning major US industries, covering topics such as HIPAA, compliance automation, risk management, and dealing with conflicting directives. Discover practical approaches for driving change, implementing test-driven development, and managing multiple platforms while balancing regulatory requirements and security objectives.

Intro
What is the problem
HIPAA
Security vs Compliance
How to drive change
Global Framework
Customer Requirements
Risk Narrative
Strategic Objectives
Implementation
Testdriven development
Metrics
How to fight upstream
Compliance automation
Managing multiple platforms
Risk
Dealing with issues that go down