Managing large-volume data while also ensuring its confidentiality is challenging and when companies have to handle data that is subject to laws of different jurisdictions, data protection compliance becomes quite difficult. Confidentiality breaches can occur at any stage of data transmission, which makes even a basic process such as data entry outsourcing highly sensitive. Many business partners may impose data compliance rules via contracts and industry standards. When the stakeholders are diverse, and they compete to establish that their rules surpass that of others, compliance becomes even more complicated.
Diverse Data Types That Are Subject to Regulations
What types of data are subject to laws?
- In the United States, health data and patient data are subject to laws such as HIPAA (Health Insurance Portability and Accountability Act), and the HITECH (Health Information Technology for Economic and Clinical Health Act). Regulations such as the CLIA (Clinical Laboratory Improvements Amendments) also apply.
- Financial data must comply with the EFTA (Electronic Fund Transfer Act) as well as the regulations under the SEC, CFTC, FISMA and other financial regulatory bodies.
- If data collected online involves minors, it may have to comply with certain requirements under the COPPA (Children’s Online Privacy Protection Act).
The European Union’s GDPR (General Data Protection Regulation) will come into effect on May 25, 2018. This regulation has made the stakes of a data breach higher than ever. While strengthening and unifying data protection for individuals, and providing them control over their personal data, the GDPR also regulates the export of personal data outside the EU. This affects all businesses including non-European businesses, operating in the EU. Many businesses are not fully aware of the consequences of non-compliance with GDPR. This regulation along with France’s Digital Republic Bill could expose multinational organizations to heavy financial penalties. The GDPR puts the maximum penalty for a breach or violation at 4% of worldwide revenues of the offending organization.
In the United States, 46 states have their own data breach notification laws and their own definition of basic terms such as “data” and “breach.” Among these, Massachusetts and California’s respective breach notification schemes are considered the strictest. U.S states also differ on other data privacy and IT security compliance regulations. Nevada, Minnesota and Washington are distinctive for having their own laws creating liability in certain situations for businesses that handle credit card transactions and are not in compliance with PCI-DSS (Payment Card Industry Data Security Standard).
Federal regulators may apply the NIST Cybersecurity Framework to financial services and government contractors. Data collectors transacting business in the U.S must be compliant with applicable federal laws and regulations apart from any state laws and regulations. The FTC (Federal Trade Commission) has a very broad regulatory reach, sometimes overlapping jurisdiction with other agencies, and it enforces many other laws affecting data practices.
This brings forth the huge challenge even small businesses face to stay compliant with information security and data privacy laws and regulations. The challenge is more for large enterprises.
Ways to Improve Security Compliance with Data Privacy Regulations
Regulations and directives cannot be ignored and by failing to comply, companies will have to face fines and audits. However, with some effective security measures such as the following, all critical data can be kept safe and secure.
- A good software portfolio helps to minimize security risks by reducing the attack surface for software vulnerabilities. It helps to identify and remove freeware and unauthorized software that can be a security risk. Run a full audit to collect comprehensive hardware and software inventory data and identify which applications are using personal data and people who are using those applications. This will ensure that the company’s data that doesn’t comply with Data Protection standards in use is reviewed.
- Stay alert about tracking and respond to alerts on software assets. Keep a list of installed software that needs to be monitored for vulnerabilities. Also, understand OSS components so that alerts to vulnerability can be acted on.
- Use vulnerability management policies and workflow. Report on remediation process from end-to-end to ensure that Service Level Agreements are met. With the right patches, companies can close the main external intrusion methods for cyber attacks. Minimizing the attack surface for cyber criminals reduces the risk and costly consequences of personal data breaches.
- Removing local administrator rights will minimize the organization’s exposure to risk. Use of administrative rights is a major means for hackers to spread malware inside the enterprise. By using local administrator’s rights on an employee’s device, they can be easily tricked to open malicious email attachments or download apps from malicious websites.
- Organizations typically know only less than 10 percent of the software that’s actually used. Software engineers use open source components to expedite their work but don’t understand the software vulnerability risks involved. Manage the use of OSS and use automation to create a formal OSS inventory and policy that balances benefit and risk management.
- Prevent users from downloading apps from unknown sources. Install authorized software and enforce company using an enterprise app store. Enterprise app store ensures that governance is in place to install only authorized applications. It can be also used to remove unlicensed and black-listed applications.
- As the complexity and frequency of applications increase, the risks also increase. Desktop engineering, software procurement and IT security have a role to play in reviewing these risks. As a part of the change control process, study risks involved when deploying new and updated apps into an enterprise and make sure that they don’t have vulnerabilities.
- Detect software that is EOL (end-of-life) and upgrade to supported version or remove it entirely from the device. SinceEOL programmes are no longer maintained by the vendor, they will not have any security updates and therefore are insecure.
- Make sure that the IT Security and IT operations have consistent data to effectively collaborate on the latest research, assessed vulnerabilities and remediation activities. To track and confirm remediation create service desk tickets.
Modern Technologies Ensuring Data Security and Privacy
- Cloud data protection: One of the best ways to protect data is by encrypting critical data before it is stored in the cloud. The keys should be maintained by the enterprise and not the cloud provider. Encryption is a great way to ensure protection against unwelcome government surveillance. It also helps to remove security, compliance and privacy concerns that impede cloud adoption.
- Big Data encryption: With data encryption, companies can ensure safety of data stored in relational databases, graph databases and diverse big data platforms. The key is to install encryption at all levels. Businesses must have encrypted card readers for all customers to use, and other companies should encrypt all sensitive emails. Encryption helps to protect personal data, achieve compliance and reduce the impact of data breach and accidental data leak.
- Data privacy management solutions: These are platforms that help to operationalize privacy processes and practices. It supports privacy by design, and by meeting compliance requirements and initiating workflows.
- Data access governance solutions: These are very important if you are dealing with huge volumes of data. Proper visibility into sensitive data and where it exists, and permission for data access and related activities are essential, and it allows organizations to manage data access permission and identify sensitive stale data. These tools help to automate the challenge of addressing data protection, sensitive data discovery and cleaning up data access permissions to implement least privilege.
- Data rights/consent management: Technologies in this regard help to manage consent of customers and employees, and enforce their rights over the personal data they share, allowing organizations to search, identify, categorize and modify personal data as required.
- Data classification: Analyzing structured and unstructured data that match predefined patterns and customer policies is necessary. There are many tools that support user-driven and automated classification possibilities. Classification of data is crucial to ensure data security, to better understand and prioritize what data you want to protect. It also helps companies define how employees should manage data so that all security and privacy requirements are met. You may also hire a data cleansing service provider to convert unstructured data into structured data for easier classification and analysis.
- Data encryption at application (app) level: Data should be encrypted within the application itself when it is generated and processed before it is committed and stored at the database level. This will ensure effective encryption policies. Sensitive data will be protected at every stage in the computing and storage processes, and wherever it is copied or transmitted. The data can be accessed only by authenticated and authorized app users. Even database administrators cannot access encrypted data.
Securing sensitive business information is vital and companies must ensure that they choose reliable vendors who can guarantee a high level of data security. The above mentioned best practices can help businesses ensure data security and compliance with diverse data privacy regulations. Studies done by Forrester Research and Gartner regarding data security compliance issues show that the main intrusion method hackers use to gain access to data is via software vulnerabilities. Security and privacy professionals have to proactively manage such vulnerabilities to ensure data security and compliance.
