Compliance training will help you pass an audit, but to secure your customer data, your teams need virtual security training beyond compliance requirements.

As many businesses have begun to work almost entirely remotely until an as-yet-to-be-determined date, they have had to plan for activities that took place largely in person in the past. For example, many compliance audits have gone virtual in these times of uncertainty. This shift has forced organisations to adjust how they prepare and plan.

But even in these times of uncertainty, it is your organisation’s responsibility to stay sharp and on track with security knowledge, planning, and response. Your security team must learn to prepare for these audits in a new way. Now that many of them will be administered remotely, teams must be aware of the potential shortcomings. A virtual audit may not catch everything that its physical counterpart could have.

Oversights in audits may result in passing marks on a compliance report but do not always translate to passing marks regarding your organisation’s security. Just because your auditor missed something doesn’t mean that a hacker won’t try to capitalise on that same oversight a day later. For this reason, it is more important than ever to arm your teams – from developers to management – with the security knowledge and training necessary not only to pass their compliance audits but also to exceed them. Striving for the gold standard in security regulation and compliance is one of the best ways to protect your organisation, employees, and customers.

How training improves compliance rates

Compliance rates on security audits for industry standards and regulations such as the Payment Card Industry Data Security Standard (PCI DSS) have been falling, according to a survey of industry professionals. For example, compliance with PCI DSS declined for the first time since 2012, slipping from 42% in 2018 to only 26% in 2019. There are many reasons for the drop-off in compliance, but for 10% of respondents, a key factor in compliance failure resulted from a decrease or elimination of compliance education.

Meanwhile, other regulations, such as the Health Insurance Portability and Accountability Act (HIPAA), don’t have a pass/fail compliance regimen per se. But for compliance, they do require training in security topics and best practices, including social engineering, passwords, and encryption, when employees are hired or when there is a material change in policies or procedures.

However, a one-shot training designed to tick off a box on a checklist will not satisfy HIPAA requirements for compliance training. And while HIPAA does not specify how frequently training should occur to maintain compliance, the organisation that oversees HIPAA said in a recent newsletter that monthly security updates and biannual training work well for many healthcare organisations in meeting the requirement.

Increasing costs of data breaches

Whatever regulations your organisation needs to comply with, failure to do so can carry heavy penalties. These can include fines and revocation of licences and certifications.

But in addition to any direct penalties for being out of compliance, an even greater business impact for not being up to date on security audit training is increased data breaches. So training not only keeps your organisation current with applicable regulations but also reduces the potential for information loss.

Studies have quantified these effects. For example, over the last 14 years, there has not been a single confirmed data breach of an organisation that was fully PCI DSS compliant. And organisations that have experienced a data breach see an average cost of US$270,000 less per occurrence when their employees have completed PCI DSS compliance security training.

eLearning meets your specific organisational needs

With large portions of employees working remotely without the ability to train in classroom settings or have security messaging reinforced on-site, organisations should turn to or double down on virtual options to help with security knowledge transfer. eLearning classes and virtual Instructor-Led Training (vILT) are some great options to help you meet your compliance training needs.

eLearning offers advantages that are now more important than ever, including on-demand access, role-specific training (e.g., developers, architects, DevOps managers, security practitioners, executives), and training appropriate across particular compliance standards (e.g., PCI DSS). Plus, eLearning training can help with regulation coverage for specific verticals, such as financial services and automotive.

On the other hand, vILT is a great option for maintaining classroom control, similar to in-person ILT, but with a virtual interaction and training component among small groups. With different organisations needing different types of courses, eLearning and vILT provide the flexibility to meet those needs.

eLearning courses can cover the depth of content necessary to meet the training requirements for the regulations or standards that apply to your organisation with specific compliance courses related to PCI DSS, GDPR, CCPA, and so on. If your organisation wants additional depth or breadth of compliance or security training, you can select the full eLearning course catalogue or just pick courses a la carte. The full security catalogue covers categories ranging from fundamentals and defensive strategies to specific programming frameworks/languages and cloud platforms.

And while the on-demand eLearning compliance courses are great for developers, eLearning also accommodates other roles. For example, General Data Protection Regulation (GDPR) compliance training is available for development and project managers as well as for CISOs and other upper management.

eLearning integrates into the IDE

As development teams shift left to take on more security responsibility earlier in the software development cycle, they have to squeeze in compliance training in between their code commits. To accommodate this need, on-demand eLearning integrates directly into the developers’ integrated development environment (IDE) through the Synopsys Code Sight plugin.

eLearning also integrates with Coverity Connect and Seeker. These integrations enable the presentation of eLearning courses in context to teams. Thus, integration directly supports development teams shifting left while ensuring they obtain relevant training to meet their security and compliance needs.

Don’t leave security training for a rainy day: It’s already pouring

With many organisations focused on making the virtual workplace a working reality, the dynamic of compliance audit training has changed. The remote workplace has altered your processes and introduced new challenges. But the need for security compliance has not diminished.

eLearning can help you stay hyper-focused on your compliance and regulation training needs in these times of uncertainty. With online training available to emphasise specific regulations and standards like PCI DSS, GDPR, and the new California Consumer Privacy Act (CCPA), industry verticals such as financial services or automotive, or general training fundamentals (e.g., principles of software security), on-demand eLearning delivers the flexibility your employees need when they need it the most.

-- BERNAMA

Rachel Zahr is Product Marketing Manager at Synopsys Software Integrity Group.