It's always gratifying when a blog post gets noticed, and I should be flattered since the author above (listed as Anonymous; his name is Danny Lieberman) has commented on my blog post at different sites at least five times! Each time, however, he's misrepresented the content of the blog post. Normally I don't respond to comments to my blog, but in this case I need to set the record straight.

First, he gets the title wrong. The blog article is entitled "Is Compliance the New Security Standard?" (a question), not "Compliance is the New Security Standard" (an assertion). If someone can't cut and paste a title correctly, what are we to think of how they relate the content of the article?

As the opening paragraph of my article makes clear it's a continuation of a discussion from the "Cornerstones of Trust 2009" conference which I had attended a day earlier. Here's the blog summary (taken from the content of the article):

"Given the compelling case for securing the enterprise, why do CEOs fail to invest more in security solutions? Does this simply represent a failure of IT and security staff to make a compelling business case? Or are the CEOs in fact being short-sighted?"

Nowhere in my article do I imply, as stated above, that since companies have to spend money on compliance, they might as well spend the money once and rename the effort “security” -- as stated above. You be the judge: read the blog post yourself at http://www.cloud-compliance.com/blog/bid/27935/Is-Compliance-the-New-Security-Standard.

Lieberman says in another comment that I'm "selling snake oil". Of course bloggers like to be controversial to get read, but I would suggest that getting ones facts right is far more important.

If we want to have an honest discussion of an important topic, let's make it fact-based. You may disagree with my hypothetical CEO perspective; you may disagree that compliance provides a liability shield; you may disagree with the Ponemon study regarding the cost of a data breach; and you may disagree that compliance spending is a factor in making security spending decisions. But please don't intentionally misrepresent the points made and smear the author with "snake oil" insults. That doesn't get us any closer to understanding issues around an important topic -- a topic with no easy answers as evidenced by the thoughtful discussion among security professionals at the "Cornerstones of Trust 2009" conference.

- Robbie Forkish