When it comes to enterprise security is it better to focus on compliance or risk?

摘要

A CIO once quipped, "Security isn't hard; compliance is." And in fact, many companies focus their security efforts on meeting compliance requirements. But if you are audit-compliant, have you really addressed all of your risks, or are you just kidding yourself? Is it better to focus on the risks, presuming that doing so will cover you off on the compliance side? Network World Editor in Chief John Dix asked Christian Anschuetz, CIO of Underwriters Laboratories, to share his opinion.