New Laws Complicate Security Efforts in 2010
Regulatory compliance will continue to influence security projects in 2010 as a slew of new security and privacy regulations go into effect, such as the federal HITECH Act.
Tue, December 15, 2009
Network World — Regulatory compliance will continue to influence data security projects in 2010, as a slew of security and privacy regulations are due to go into effect. New rules at both the federal and state level will require IT managers to deploy protective technologies such as encryption to achieve compliance.
Health privacy undermined: Worst breaches of 2009
The federal Health Information Technology for Economic and Clinical Health Act, or HITECH Act, will be enforced by the Department of Health and Human Services beginning in February, for instance. It's a game-changer for the healthcare industry because it calls for hefty fines for a data breach involving unencrypted data. The HITECH Act is prompting hospitals and others that handle patient health information to consider deploying encryption, identity management and data-loss prevention (DLP) technologies in their organizations. (See what you need to know about the HITECH Act here.)
"We have two major systems being implemented right now because of the HITECH," says Ben Nathan, associate director for security and identity management at Weill Cornell Medical College in New York City. The medical college is deploying Symantec's Vontu DLP and PGP encryption software on laptops.
There are also state regulations going into effect in 2010 that will have wide impact, such as the Massachusetts data privacy law that requires laptops holding sensitive data to be encrypted.
"We're starting to use whole-disk encryption," says Ray Pata, manager for systems and programming at Burlington, Mass.-based A.I.M. Mutual Insurance, which has licensed BitArmor's encryption software for about 40 laptops. BitArmor's cloud-based management technology will monitor to make sure the host machines are properly encrypted, he says. "The new regulation in Massachusetts takes effect March 1," Pata says, "but we should probably be doing this anyway."
In the insurance industry, there are several new data-protection regulations at the state level that need addressing, says Mark Pfefferman, assistant vice president and director of identity and access management at Cincinnati-based Western & Southern Financial Group, whose 13 companies include insurance businesses.
Specifically, there's a regulation known as the Model Audit Rule established by the National Association of Insurance Commissioners (NAIC) that takes effect in 2010 in some states where it has won legislative approval, including Ohio, New York and Indiana. The Model Audit Rule, like the well-known Sarbanes-Oxley Act of 2002, requires demonstrated controls to be in place related to databases and data access.
"Like Sarbanes-Oxley, and typical of many laws, it's not prescriptive, but you need to have controls related to access," Pfefferman says. Regulators want to see a compliance framework, such as COBIT or COSO in place as a starting point, Pfefferman says. "We've chosen the COSO framework for information technology general controls, such as segregation of duties."
