The InfoSec Blog
24Mar/12

Surely compliance is binary?

Call me a dinosaur (that's OK, since its the weekend and dressed down to work in the garden) but ...

Surely COMPLIANCE is a binary measure, not a "level of" issue.
You are either in compliance or you are not.
As in you are either deal or alive.

Now it may be that some "standard" (such as ISO27001) has a number of clauses and its possible to be in compliance with some and not with others, and so fall into the delusion that you are "82% compliant" with the standard. This gets back to the silliness of exams where you are not expected to be able to answer all the questions and so the pass mark was 65%. In actuality its a recipe for disaster; if you're only required to have 65% of the items complaint to "pass" then the standard is a joke.

It brings to mind the advert for the disinfectant that "kills 99% of all known germs". OK, but that remaining 1% is highly deadly and highly infectious.. And then what about the Rumsfeld Class III germs?

No, really, would you let a military expedition or a group of mountaineers attempting to scale Mt Everest with only the "passing grade" - 65% - of the equipment (be if food, ammunition, ropes, insulated clothing, whatever) that they needed?

So there's this marriage ceremony and the groom only manages to get 65% of the way to the church; is that a passing grade? Ask the bride what she thinks.

No, compliance is binary.

 

Compliance Bridge - Broad requirements so that...

Compliance Bridge - Broad requirements so that clients are Ready, Willing and Able to comply. (Photo credit: Wikipedia)

Enhanced by Zemanta

Posted by Anton Aylward

Comments (4) Trackbacks (0)
  1. Hi Anton.

    Many real-world assessments involve pass-marks or hurdles or qualifying levels, which are arbitrary, very seldom at 100%. Furthermore, regarding the pass-marks themselves, there’s ambiguity and leeway in almost all real-world situations, for very good reasons (e.g. variations in factors, inaccuracies in measurement, and to give the assessors some latitude to “take things into account”). The alternative – hard and fast, absolute, strictly applied rules – may suit your binary preference but can create anomalies and inappropriate outcomes under some real-world situations.

    Get real! Embrace ambiguity (to some extent)!

    Gary.

  2. Yes Gary, but its still binary.

    Suppose the pass-mark is 80%. Well you’ve either passed or you haven’t. Yes that 80% may be the sum of individual questions; but each of those questions was answered either correctly or incorrectly. Such is the nature of tests.

    I’ve just had this debate in another form. A younger engineer seemed to think that things like FFT filters and auto-correlators could only be digital (though he did admit that our ears did that as analogue in some way he didn’t understand). I had to explain to him that all my first exposure to signal processing was analogue and I only learnt digital methods later.

    Yes, out there in the real world, things are ‘continuous’, but I was talking about compliance and tests. You either pass a test or you don’t.

  3. OK, let’s try another tack.

    Would you accept that there’s a difference between “barely scraping a pass” and “passing with flying colours”? Both are a 1 on the binary compliance scale, but rather different on the analogue real-life scale.

    Gary

  4. Ah, good, Gary, you are finally seeing my point.
    This is about TESTS. You either pass the test or you don’t. Binary. You are either in compliance or you are not.

    There an old saw that goes “What do you call the guy that came in last in class in medical school?” The answer: “Doctor”.

    Yes, there are situations where the analogue value counts, but that’s not the point I was making.

    Consider a annual race such as the Iditarod Race (See http://iditarod.com/race/) It may happen that one year, because of conditions, the “winner” has a time significantly poorer than last year’s winner. Does that mean that he hasn’t won the race? In the Olympics and track events its common for a winner *not* to break the world, record, that is to have a time worse by an analogue measure, than the record. That doesn’t stop them taking the medal.

    Winning is binary, not analogue.
    The timing may be analogue but that’s another matter.


Leave a comment

No trackbacks yet.