Regulatory compliance will continue to influence security projects in 2010 as a slew of new security and privacy regulations go into effect, such as the federal HITECH Act.
Regulatory compliance will continue to influence data security projects in 2010, as a slew of security and privacy regulations are due to go into effect. New rules at both the federal and state level will require IT managers to deploy protective technologies such as encryption to achieve compliance.
The federal Health Information Technology for Economic and Clinical Health Act, or HITECH Act, will be enforced by the Department of Health and Human Services beginning in February, for instance. It's a game-changer for the healthcare industry because it calls for hefty fines for a data breach involving unencrypted data. The HITECH Act is prompting hospitals and others that handle patient health information to consider deploying encryption, identity management and data-loss prevention (DLP) technologies in their organizations. (See what you need to know about the HITECH Act here.)
"We have two major systems being implemented right now because of the HITECH," says Ben Nathan, associate director for security and identity management at Weill Cornell Medical College in New York City. The medical college is deploying Symantec's Vontu DLP and PGP encryption software on laptops.
There are also state regulations going into effect in 2010 that will have wide impact, such as the Massachusetts data privacy law that requires laptops holding sensitive data to be encrypted.
"We're starting to use whole-disk encryption," says Ray Pata, manager for systems and programming at Burlington, Mass.-based A.I.M. Mutual Insurance, which has licensed BitArmor's encryption software for about 40 laptops. BitArmor's cloud-based management technology will monitor to make sure the host machines are properly encrypted, he says. "The new regulation in Massachusetts takes effect March 1," Pata says, "but we should probably be doing this anyway."
In the insurance industry, there are several new data-protection regulations at the state level that need addressing, says Mark Pfefferman, assistant vice president and director of identity and access management at Cincinnati-based Western & Southern Financial Group, whose 13 companies include insurance businesses.
Specifically, there's a regulation known as the Model Audit Rule established by the National Association of Insurance Commissioners (NAIC) that takes effect in 2010 in some states where it has won legislative approval, including Ohio, New York and Indiana. The Model Audit Rule, like the well-known Sarbanes-Oxley Act of 2002, requires demonstrated controls to be in place related to databases and data access.
"Like Sarbanes-Oxley, and typical of many laws, it's not prescriptive, but you need to have controls related to access," Pfefferman says. Regulators want to see a compliance framework, such as COBIT or COSO in place as a starting point, Pfefferman says. "We've chosen the COSO framework for information technology general controls, such as segregation of duties."
Spurred by the NAIC regulations, Western & Southern Financial Group is also deploying identity management and access control software to broadly enforce policies for access rights and provisioning, even though only about 10% of the approximately 500 applications used at the company would appear to fall under the Model Audit Rule.
Western & Southern is using Novell's identity-management and access governance suite to enable role-based access control for the entire company. The deployment covers about 150 employees and is expected to extend to 4,500 employees during 2010.
Another big compliance development shaping up for 2010 is not the result of a federal or state law but rather an anticipated iteration of the Payment Card Industry (PCI) standard set by the PCI Security Standards Council, which is based in Wakefield, Mass.
PCI is an industry requirement that originated under the aegis of the card associations such as Visa and MasterCard, along with the banks, to improve security practices associated with payment-card processing and handling. Demonstration of PCI compliance has attained huge importance over the past few years within organizations accepting payment cards.
Though it's not yet known what will happen with the PCI standard in 2010, the council and its hundreds of members have spent time in community meetings this year debating security issues related to virtual environments, and the possible benefits of tokenization and end-to-end encryption, with the idea they could influence a new version of the PCI standard in 2010.
In general, appreciation for regulatory compliance among IT and security managers seems fairly strong -- in part because regulations give management a good reason to allocate resources to technology projects to avoid non-compliance problems. According to a recent Ponemon research poll of about 3,000 IT and security managers, 52% of the survey's respondents said compliance improves security and "is essential to obtaining resources."