A panel of witnesses told a Senate subcommittee on March 12 that Fisma compliance isn't translating into bolstered security, given the lack of consistent assessments of the effectiveness of the work being done, mounting data breaches and continuous system penetrations.

Dave Chronister is cofounder of Parameter Security, a firm of certified ethical hackers that hack companies to identify the pitfalls a penetration test can't weed out. He says that the problem with the banking industry in particular is with the federally employed or state-employed regulators who come in to perform audits. At a bank worth $2 billion or less, those will typically be loan officers or security officers, Chronister says.

One of the problems banks run into, he says, is that such regulators look at the protection of the safe and the database upstairs as being "exactly the same."

"The state will attempt to apply IT regulations onto the bank, and they'll have an accountant come in and try to explain these," Chronister says.

His war story: One banking client under the pressure of GLB (Gramm-Leach-Bliley) compliance had to log every single thing its data administrator did. Chronister told the client that it could simply audit its servers.

The examiner said no. Instead, the examiner said, the bank had to hire somebody to watch what the administrator did. Then an internal auditor had to verify that everything the administrator did every day was safe. A non-IT staffer, that is, looking over the shoulder of an IT professional and being responsible for ascertaining which of his actions were "safe"—constantly.

These are only a few horror stories. What are the workarounds?

Chronister says his firm has started educating the examiners themselves. They've even begun to educate IT departments and federal examiners and are trying to initiate training with governing bodies to explain how GLB works and how they should do their jobs.

Some are receptive; some just aren't. "Some figure that after an 8-hour class on how all security works, they're experts on it, so it sometimes gets tough," Chronister says.

Kevin McDonald, executive vice president for managed services provider Alvaka Networks, a member of the national board of directors of the AeA (American Electronics Association) and author of several books on cybersecurity, says that the problem with auditors is that they come at it with "the purest defense of regulation."

If an IT pro doesn't actually understand the given regulation, he or she is "at the mercy of that auditor," McDonald says.