|
|
|
Features
< Back
Sarbanes Oxley : Technology : Security
The Role of Regulation, Extrusion Prevention
Regulation ? drives business into taking action
By
Danny Lieberman
|
|
Danny Lieberman
Managing Director
Fidelis Security
|
..."Truth be told, everything we?ve done in the area of extrusion prevention is because of industry regulations. The police were useless in our last extrusion event and we?re developing self-audit and control capability in order to protect our customer records and actuarial data." - General Counsel of an insurance company with $8BN in assets.
"...We don?t invest in extrusion prevention technology because it?s a criminal offense when one of our employee extrudes critical filings. We feel the legal deterrent is sufficient."
IT Manager - Securities and Exchange Commission in a Middle East country.
Is regulation more than just a trigger to management action?
Extrusion prevention requires both management and technology controls. The trigger to implementation often lies in government regulation. This article examines the relevance of regulation in the US and in Europe.
Regulation cannot protect us from extrusion. Uncompromising ethics and good management are prerequisites for protecting a company?s digital assets and individuals? private information.
Let?s look at the relationships between individuals, companies and regulation:
Privacy regulation trends in the US and Europe
Government-regulated privacy-protection of information is a natural response rooted in the field of telecommunications, since countries either own the telecom business outright or tightly regulate their industry. This has largely led to a view of electronic privacy as an issue of citizen rights versus state legislation and monopoly.
In the information age, privacy has two dimensions ? intrusion and extrusion:
- Protection against intrusion by unwanted information or criminals; similar to the constitutional protection to be secure in one's home.
- Protection against extrusion by controlling information flows about an individual?s or a business?s activies; for example preventing identify theft or protecting a company?s trade secrets.
Regulation has moved in two major directions--centralized general protection and decentralized ad-hoc protection. The EEC (European Economic Community ) has pursued the former, and passed comprehensive data protection laws with coordination on information collection and data flows. The United States, in contrast, has dealt with issues on a case-by-case basis (health-care, credit cards, corporate governance etc?) resulting in a variety of ad hoc federal and state legislation.
A synthesis of the European and the American approaches is to formulate a set of broad rules for vertical industry. This was the direction taken by the New York Public Service Commission on the issue of telecommunications privacy.
However, U.S. privacy legislation remains considerably less strict than European law in the regulation of private databases. Two Representatives in the House Select Committee on Homeland Security are calling for a Privacy Czar. The Privacy Czar would be responsible for privacy policies throughout the federal government as well as ensuring private technology does not erode public privacy.
"Right now, there's no one at home at the White House when it comes to privacy. There's no political official in the White House who has privacy in their title or as part of their job description. Congress should take the lead here because this administration has not," says Peter Swire, an Ohio State University law professor and former chief privacy officer in the Clinton administration.
Horizontal Applications
Sarbanes Oxley: enforcing corporate governance
The Sarbanes-Oxley Act (SOX) has had a major impact on US corporate governance SOX was a response to the accounting scandals and senior management excesses at some public companies in recent years. It requires compliance with a comprehensive reform of accounting procedures for public corporations to promote and improve the quality and transparency of financial reporting by both internal and external independent auditors. SOX regulation is enforced by the Public Company Accounting Oversight Board ("the Board").
SOX Section 404 - ?Management Assessment Of Internal Controls ? is indirectly relevant to extrusion. It requires an ?internal control? report in the annual report which states management responsibility and assesses effectiveness of internal controls. Companies are also required to disclose whether they have adopted a code of ethics for senior financial officers and the contents of that code.
SOX Section 409 ? ?Real Time Disclosure? implies that a significant extrusion event be disclosed on ?a rapid and current basis?. SOX also increases the penalties for mail and wire fraud increased from 5 to 10 years and creates a crime for tampering with a record or otherwise impeding any official proceeding.
HSS/HIPPA: enforcing patient privacy
Each time a patient sees a doctor, is admitted to a hospital, goes to a pharmacist or sends a claim to a health plan, a record is made of their confidential health information. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) gave Congress 3 years to pass health privacy legislation. In May 2003 ? the HHS (Dept of Health and Human services implemented federal protections for the privacy of individual health information under the Privacy Rule, pursuant to HIPAA. Because of limitations of HIPPA, the rule is far from seamless and will require a lot more work in the US Congress by both parties to ensure privacy of personal health information.
My conclusion on all of this is:
- SOX is a great opportunity for IT vendors of products and services (185,000 hits in Google), although external auditors arent supposed to charge more for SOX compliant work.
- SOX has general management relevance to extrusion prevention requiring internal controls, ethics and disclosing bad news on time.
- Extrusion of patient information continues to be an issue.
Vertical Industries
Securities: Did we leave the cat guarding the cream?
Annette L. Nazareth, market regulation director at the U.S. Securities and Exchange Commission, outlined proposals at a securities industry conference in New York last year calling for stock exchanges, as the Associated Press put it, "to abide by most of the requirements they set for companies they list."
Insurance Industry: Federal versus free market
October 2003, witnesses before the Senate Commerce committee testified regarding insurance industry regulations. The committee analyzed the current US system, which relies on state law, and examined proposals for improving industry regulation. One of the central issues was whether or not the federal government should play a larger role in insurance industry regulation. Also discussed was the need to provide protection for consumers without forcing unnecessary regulations on insurance companies. Some senators expressed concerns about high insurance rates.
Conclusion
If you?re an IT vendor of products and services, there may be gold in them thar hills but when you?re running your business don?t leave your ethics at home and don?t wait for governments to tell you what you learned from your parents at age 5 ? put your toys away and don?t steal from the other kids.
Danny Lieberman
Managing Director
Fidelis Security
Danny Lieberman is Managing Director of Fidelis Security Systems in EMEA. Fidelis specializes in digital asset protection with extrusion prevention technologies.
Danny has over 25 years experience in IT and data communications and has held senior positions at Intel Corp. in Israel, the Rad-Bynet group and Tadiran Information Systems. His areas of expertise include secure transactions, IP content interception, -tech sales and business development and playing saxophone and clarinet.
Danny's personal web site is www.software.co.il.
|
|
|
|
|
