Oct 20, 2009 2
Outline
• What is the Gramm-Leach-Bliley Act?
• Involving the Board
• Assessing Risk
• Managing Risk
• Adjusting the Program, Reporting to the Board, and Implementing the Standards
• What’s Different About the FTC Safeguards Act?
• Identity Theft and Regulatory Compliance
Oct 20, 2009 3
What is the Gramm-Leach-Bliley Act?
• Financial Modernization Act of 1999 - Security Regulations For Financial Sector
• Signed Nov 11, 1999 – allowed banks to engage in wide array of financial services
• Ended regulations prohibiting merger of banks, stock brokers, insurance companies
• Title 5 specifically addresses privacy and security of customer financial information
• Section 501(b) requires all financial institutions to implement and maintain safeguards to protect customer information (Nonpublic Personal Information – NPI)
Oct 20, 2009 4
GLBA
• Automobile Dealers• Check-Cashing• Consumer Reporting• Courier Services• Credit Card• Credit Counselors• Data Processors• Debt Collectors• Educational Institutions
• Financial Planners• Insurance Companies• Mortgage Brokers• Property Appraisers• Real Estate • Retail Stores That Use
CC• Securities Firms
Oct 20, 2009 5
GLBA
• February 1, 2001 - 12 CFR, Part 30, et al. Interagency Guidelines Establishing Standards for Safeguarding Customer Information Final Rule (effective July 1, 2001)– Comprehensive written information security
program including administrative, technical, and physical safeguards
• May 23, 2003 – FTC 16 CFR Part 314 Standards for Safeguarding Customer Information; Final Rule (effective May 23, 2003)
Oct 20, 2009 6
GLBA Information Security Program
• Ensuring Confidentiality of Customer Information
• Protecting Integrity of Information Against Threats
• Making information Available to customers and management in an accurate and timely manner
• Protecting Against Unauthorized Access• Protecting against loss• Establishing procedures for safeguarding of
assets
Oct 20, 2009 7
Involving the Board
• Interagency Guidelines require that Board of Directors must oversee development, implementation, maintenance and approve the written information security program
• Financial institutions that fail to comply face civil penalties of $100K per violation and Officers/Directors can be personally liable with penalties of $10K per violation
Oct 20, 2009 8
Assessing Risk• Risk Management program is critical component• Interagency Guidelines:
– Identify foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information
– Assess likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information
– Assess sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks
• Information and Information Systems Inventory• Identifying and Assessing Threats• Mitigating Controls
– Classify System Criticality– Classify Threats– Sort by Criticality/Threat– Identify Mitigating Control (Safeguard)
Oct 20, 2009 9
Managing Risk
• Control Identified Risks According to Sensitivity of Information and Activity Complexity– Access Controls on Customer Information Systems– Access Restrictions at Physical Locations Containing
Customer Information– Encryption of Electronic Customer Information– System Modification Procedures– Dual Control, Segregation of Duties, Employee
Background Checks– Monitoring Systems and Attack Detection Procedures– Response Systems including Reports to Regulatory and
Law Enforcement– Measures to Protect Against Destruction, Loss, or Damage
Due to Environmental Hazards or Technological Failures
Oct 20, 2009 10
Adjusting the Program, Reporting to the Board, and Implementing the Standards
• Must Monitor, Evaluate and Adjust Effectiveness of Security Program
• Report to Board of Directors At Least Annually– Risk Assessment, Risk Management and Control,
Service Provider Arrangements, Test Results, Security Breaches or Violations and Management Responses, Recommendations for Change
Oct 20, 2009 11
What’s Different About the FTC Safeguards Act?
• Applies to Individuals or Organizations in Providing Financial Products or Services
• Not As Comprehensive as Interagency Guidelines
• Organizations Subject to Safeguards are not audited for compliance unless complaint filed
• Objectives:– Ensure security and confidentiality of customer
records– Protect Against Threats or Hazards– Protect Against Unauthorized Access or Use
Oct 20, 2009 12
FTC Safeguards Act Elements
• Designate Employee(s) to Coordinate Information Security Program
• Identify Risks to CIA of Customer Information– Employee Training and Management– Information Systems– Detecting, Preventing and Responding to Attacks,
Intrusions or Other System Failures
• Design and Implement Information Safeguards, Test and Monitor Effectiveness
• Oversee Service Providers• Evaluate and Adjust as a Result of Testing and
Monitoring or Changes to Business
Oct 20, 2009 13
Identity Theft and Regulatory Compliance
• 2005 Supplement A – Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice
• Additional Security Controls:– Access Controls, Background Checks, Response
Programs
• Response Program:– Assess Incident and What Has Been Compromised,
Notify Federal Regulator, Notify Law Enforcement, Contain and Control Incident, Notify Customers
• Notification
Oct 20, 2009 15
Outline
• HIPAA
• Understanding the Security Rule
• Administrative Safeguards
• Physical Safeguards
• Technical Safeguards
• Organization Safeguards
• Policies and Procedures
Oct 20, 2009 16
HIPAA
• Health Insurance Portability and Accountability Act of 1996
• Simplify and Standardize Healthcare Administration– Enable Better Access to Health Insurance, Reduce Fraud
and Abuse, Lower Overall Cost of Healthcare
• Title II Addresses How Healthcare Transactions Are Processed and Stored
• HHS Published 5 Rules:– Code Set, Transaction Identifiers, Electronic Data
Interchange, Privacy, Security
• August 20, 2003 Security Rule Published
Oct 20, 2009 17
Understanding the Security Rule
• Focus on Safeguarding Electronic Protected Health Information (ePHI)– Individually Identifiable Health Information (IIHI)– Stored, Processed, or Transmitted Digitally or
Electronically
• Main Goal is to Protect CIA• Entities not Complying Subject to Civil Penalties
($100 per Violation) and Criminal Penalties ($50K in fines plus 1 Year to $250K plus 10 Years)
• Five Categories:– Administrative Safeguards, Physical Safeguards,
Technical Safeguards, Organizational Requirements, Documentation Requirements
Oct 20, 2009 18
Administrative Safeguards• Formal Management Process
– Risk Analysis, Risk Management Program, Development and Implementation of Sanction Policy, Development of Information System Activity Review
• Designation of Security Officer• Workforce Security
– Supervision, Clearance, Termination Procedures• Information Access Management• Security Awareness and Training• Security Incident Procedures• Contingency Plans• Evaluation• Business Associate Contracts and Other
Arrangements
Oct 20, 2009 19
Physical Safeguards
• Facility Access Controls– Facility Security Plan, Access Control and
Validation Procedures, Maintenance Records, Contingency Operation
• Workstation Use
• Workstation Security
• Device and Media Controls– Disposal Policies and Procedures, Reuse
Policies and Procedures, Hardware and Media Accountability, Data Backup and Storage Procedures
Oct 20, 2009 20
Technical Safeguards• Access Control
– Unique User Ids, Emergency Access Procedures, Auto Logoff Procedures, Encryption of Information at Rest
• Audit Control– Failed Logons, Account Lockouts, Initial Logon Times, Which
System Users Normally Logon, Possible Security Log Tampering, Failed Object Access Events, User Account Mods, Software Mods, Attempted Privilege Escalation
• Integrity Control– Patch Management, AV Software, Antispyware, Internal Port
Scanning, File Integrity Checkers, Database Integrity Utilities, Email Filtering, Firewalls and IDS
• Person or Entity Authentication– Single or Multi-factor
• Transmission Security– Integrity Controls, Encryption
Oct 20, 2009 21
Organization Safeguards
• Business Associates Contracts– Must Adequately Protect ePHI, Must Report
Incidents, Must Comply or Risk Termination, Provide for Government Entity Exceptions, Cover Other Arrangements for Covered Entities and Business Associates
• Standard Requirements for Group Health Plans
Oct 20, 2009 22
Policies and Procedures
• Policies and Procedures
• Documentation– Retention, Making Available, Updating
Oct 20, 2009 24
Outline
• Introduction
• E-Government is Becoming a Reality
• FISMA
• NIST
• Protecting the Privacy of Student Records
• It all Started with a Corporate Scandal
Oct 20, 2009 25
Introduction
• GLBA – Banking and Finance
• HIPAA – Health Care
• Federal Information Security Management Act (FISMA)
• Federal Educational Rights and Privacy Act (FERPA)
• Sarbanes-Oxley (SOX)
Oct 20, 2009 26
E-Government is Becoming a Reality
• 2002 E-Government Act (Public Law 107-347) provides better efficiency, effectiveness and responsiveness
• Established Federal Chief Information Officer within OMB
• Title III (Federal Information Security Management Act – FISMA) requires every agency to develop, document, and implement an agency-wide risk-based information security program
Oct 20, 2009 27
FISMA
• Focuses on CIA of information and information systems as well as assurance and accountability
• 3 Federal Agencies have related roles:– National Institute of Standards and Technology (NIST) to
develop technical security standards and guidelines for unclassified federal systems
– Office of Management and Budget (OMB) to develop and oversee implementation of government-wide policies, principles, guidance, and standards
– US House Committee on Government Reform to oversee variety of subject areas, including issuing the Federal Computer Security Report Card
Oct 20, 2009 28
NIST
• Standards used to categorize all information and information systems for objective of providing appropriate levels of information security according to risk level
• Guidelines recommending types of information and information systems to be included
• Minimal information security requirements for information and information systems in each category
Oct 20, 2009 29
NIST
• Developed resources for FISMA– Security standards and guidelines– Program to accredit public and private sector
organizations to conduct security certification– Program to validate commercial off-the-shelf
(COTS) and Government off-the-shelf (GOTS) security tools
Oct 20, 2009 30
Protecting the Privacy of Student Records
• Financial Aid/Counseling – GLBA• Healthcare Services – HIPAA• Schools receiving Federal Aid subject to
FERPA– Primarily Privacy (“C” of CIA)– Right to access record kept by school– Right to demand records be disclosed only with
student consent– Right to amend records– Right to file complaints against school for
disclosure
Oct 20, 2009 31
Protecting the Privacy of Student Records
• 2 Types of Educational Records– Directory Information may be disclosed without
consent (name, address, phone, date/place of birth, honors and awards, dates of attendance)
– Nondirectory Information may not be disclosed (even to parents) without consent (SSN, race, ethnicity, gender, transcripts, grade reports)
Oct 20, 2009 32
It all Started with a Corporate Scandal
• Late 1990s Scandals with WorldCom, Enron, etc.• Sarbanes-Oxley (SOX) improves transparency and
accountability– Section 404: identify control framework used by
management to evaluate effectiveness of internal controls and requires management to attest to effectiveness
– Section 302: requires management to attest to accuracy of quarterly and annual reports, certify that they reflect financial position, note weaknesses in controls exposed by audit and describe how controls are integrated into operations
Oct 20, 2009 33
SOX
• Establish infrastructure to protect and preserve records and data from destruction, loss, unauthorized alteration, or other misuse
• Steps:– Map information systems that process, store, and
transmit financial data– Identify risks – Design and implement controls – Document and test applications and controls– Ensure that controls apply to all systems, services and
personnel– Ensure that controls are updated and changed– Monitor controls for effective operation
Oct 20, 2009 34
SOX
• Section 404:– Identify control framework – Collection of
controls that covers all internal controls – COSO and CobiT
Oct 20, 2009 36
Outline• What is a Small Business?• Why Have a Confidentiality Policy?• What is Acceptable Behavior?• Internet Use—Where to Draw the Line• Keeping Corporate Email Secure• Reporting and Responding to Incidents• Managing Passwords• Protecting Information• Protecting From Malware• Securing Remote Access• Controlling Change• Data Backup and Recovery
Oct 20, 2009 37
What is a Small Business?
• Independently owned and operated• Employs < 500 people• Has < $6.5M in annual revenue• Depend upon information systems for:
– Financial, Management, Marketing, Production– Email, Internet, E-commerce
• Cannot afford IT Departments or Information Security Officers– Should have a Security Policy and follow
applicable regulations (HIPAA, GLBA, etc.)
Oct 20, 2009 38
Why Have a Confidentiality Policy?• Company information belongs to the company• Obtain injunctive relief in case of a violation• Confidentiality Agreements:
– Specify types of information that can and cannot be disclosed
– Provide legal remedy in case of disclosure– Define how information is to be handled and for what
length of time– Explain what happens to information when there is no
longer a “need to know”• Policy Structure:
– Recognition of company’s right to nondisclosure of information
– Acknowledgement of the obligations of confidentiality– Understanding that all company information must be
returned at the termination of employment
Oct 20, 2009 39
What is Acceptable Behavior?
• Generally, policy statements outline unacceptable behavior
• Should contain:– Ownership, hardware and software, resource
misuse, etc.
Oct 20, 2009 40
Internet Use—Where to Draw the Line
• Trade-offs: Company is tyrannical!! Vs. Time Waster
• Should contain:– Monitoring and logging, data transmission (FTP,
IM, P2P)
Oct 20, 2009 41
Keeping Corporate Email Secure
• Should contain:– Business Use only, Clear text (unprotected),
misuse of resources (spam, hoaxes, chain letters)
Oct 20, 2009 42
Reporting and Responding to Incidents
• Policy to deal with incidents• Define framework to clearly identify:
– What needs to be done, By Whom, Who is in charge of the situation
• All users responsible for recognizing unusual or suspicious activity– Network slowdown, Bouncing emails, Unexpected repair person,
Papers on desk rearranged, new program on computer
• Key Questions:– Who should be notified, How will severity be determined, What
should happen when incident occurs
• Plan Requirements:– List of Potential Incidents, Checklist of Who is in charge, Their
Backups, Who should be notified, Prioritized Steps to Deal with Situation
Oct 20, 2009 43
Managing Passwords
• Trade-off between Security and Convenience
• Policy should address:– Length, Complexity, Age, Reuse, Monitoring and
Audits, Consequences
Oct 20, 2009 44
Protecting Information
• Use Information Classification Policy
• Instructions on who can access an asset, how the asset may be used, what security measures need to be in place, and way asset should ultimately be disposed of or destroyed
• May be uncomplicated:– Confidential, Restricted, Public
• Cover Access, Storage, Transmission, Disposal
Oct 20, 2009 45
Protecting From Malware
• Malware Policy
• AV Software on all Workstations, Email Servers
• Anti-spyware also on Workstations
• Education and training on avoiding websites, downloading music or programs, etc.
• Patch Management
Oct 20, 2009 46
Securing Remote Access
• Who will be allowed, under what conditions, with whose authorization
• How will connection be made
• Don’t forget wireless
Oct 20, 2009 47
Controlling Change
• Policy for Change Control to software, hardware, network, business processes
• Change Management Process:– Assessment, Logging, Communication
• Disciplinary Actions if Not Followed
Top Related