Pironti, a respected veteran of the IT security industry and president of IP Architects, told ISACA's international conference in Los Angeles that security by compliance is no longer working.
"The number and impact of security breaches have dramatically increased in the last couple of years, even though companies are in compliance with standards like PCI, GLBA, FFIEC, FISMA and others," he said in a speech titled 'InforInfomation Security 2.0.'
Speaking at the ISACA conference yesterday, Pironti, who is also a frequent presenter for Infosecurity's webinar program, warned that, if enterprises continue to focus on security by compliance, then their adversaries will continue to win as their attacks become more effective and damaging.
Compliance, he explained, can be a good starting point for securing information infrastructure and data if an organization has not put anything in place previously, but it cannot be the end point of the conversation.
"We need to change the fundamental approach to the way enterprises deal with information protection," he argued, adding that the industry needs to stop thinking about information security and start thinking about information risk management.
Information risk management, he went on to say, requires more input from - and decisions made by - the business, instead of solely by security professionals and regulators.
Explaining the difference between the two, Pironti told his audience that information security sets the tone for organizations that forces them to put measures in place that may actually end up preventing the business from being successful.
"Risk management gives the organization the power to make the security decisions that align with its business requirements and then implement appropriate controls."
Another critical change, he said, is to focus on protecting data and information instead of just technology.
The technology, he added, is just a vessel for the data and has little value by itself. And by focusing on the data, enterprises will be better prepared for the challenges that they may face from any adversary.
In parallel with Pironti's presentation, ISACA's international conference also featured the unveiling of Risk IT, a new IT enterprise risk management framework developed by the association.
A spokesperson for ISACA told Infosecurity that the Risk IT framework will be made available via the association's web site in September.