Category: Regulations

Among the provisions of the Police and Justice Bill 2006, which gained Royal Assent on Wednesday, is a clause that makes it an offense to impair the operation of any computer system.

http://sympatico-msn-ca.com.com/UK+outlaws+denial-of-service+attacks/2100-7348_3-6134472.html?part=sympatico-msn-ca&tag=feed_2570&subj=ns_6134472

Rob Gretton, Business Development Director for DISUK commented: “This legislation is a step in the right direction as anything that empowers the individual and gives them more information is a good thing.

Identity theft is not just a problem on the Internet; it can happen in much less visible ways. Thefts and losses of backup tapes mean that large volumes of personal information such as, mother’s maiden name, date of birth or national insurance number are exposed to potential misuse at any time in the future.

http://www.it-observer.com/news/6910/europe_prepares_data_breach_notification_legislation/

The maximum punishment under the new legislation is a prison sentence of ten years and a fine of US$1.3million, which can be imposed on anyone found guilty of hacking into government networks to steal information related to national security or using the internet in support of terrorism.

Any person who gains unauthorised access to a public network or who installs viruses on that network will be subject to a fine of around US$800,000 and/or up to four years in prison.

http://www.itp.net/news/details.php?id=22318&srh=&tbl=itp_news

“Enterprises are doing all of their compliance work in silos, and they aren’t seeing the commonality between [the projects], particularly in the area of security,” says Stephen Barlock, North America security lead at Accenture. “The net result is that their compliance efforts are much too complex.”

Enterprises are also finding that the costs of their compliance efforts are rising, not falling, because of the growing number of independent, and sometimes redundant, regulatory efforts, says Mark Perry, vice president of global consulting services at Symantec, who will head the joint venture.

SOX and the Gramm-Leach-Bliley Act (GLBA) mandate data protection, but don’t give any IT specifics. The Health Insurance Portability and Accountability Act (HIPAA) and the Payment Card Industry (PCI) standards outline more specific requirements.

“What we encourage companies to do is build a matrix of the requirements,” says Chris Apgar, president of Apgar and Associates LLC, a compliance consulting firm. If they meet the most stringent security requirements on the matrix in each category, the result should be a security platform that meets the compliance mandates of all of them. For example, if you look at SOX and GLBA, they don’t say much about encryption,” Apgar says.

Accenture and Symantec are working on a way to automate the process of correlating the security requirements of each regulatory mandate and identifying the most stringent elements, says Accenture’s Barlock. “With this joint venture with Symantec in place, though, we think the days of doing this manually are numbered.” “If you want to encrypt email, a $250,000 package from Tumbleweed is a pretty sure thing to pass an audit,” he says.

http://www.darkreading.com/document.asp?doc_id=106910&WT.svl=news2_5

ISO 17799 provides best practice recommendations for initiating, implementing, or maintaining information security management systems. The standard contains 12 sections: risk assessment and treatment; security policy; organization of information security; asset management; access control; information security incident management; human resources security; physical and environmental security; communications and operations management; information systems acquisition, development and maintenance; business continuity management; and compliance. Within each section, information security control objectives are specified and a range of controls. For each control, implementation guidance is provided.

The second standard, ISO 27001, specifies requirements for establishing, implementing, maintaining, and improving an information security management system consistent with the best practices outlined in ISO 17799. ISO 27001 is the first standard in a proposed series of information security standards which will be assigned numbers within the ISO 27000 series. ISO 17799 is expected to be renamed ISO 27002 in 2007. ISO 27001 is the formal standard against which organizations may seek independent certification of their information security management systems. It contains a total of 133 controls in eleven sections.

Certification is entirely voluntary but is increasingly being demanded from suppliers and business partners who are concerned about information security.

The management processes implemented for ISO 27001 are based on the Deming cycle of continuous improvement: Plan-Do-Check-Act. Measuring effectiveness is a critical element of improving information security management, and hence realizing business benefit and flexibility in a changing environment.

http://www.bankinfosecurity.com/articles.php?art_id=165

PCI, which includes specifications for both physical and logical security of credit card data, is required for all merchants who accept credit cards or store credit information. Merchants that don’t comply could face fines as high as $500,000, or, in extreme cases, could have their ability to accept credit cards revoked.

PCI 1.0 was issued two years ago, and merchants were supposed to have achieved compliance by the deadline of June 30 of this year.

Experts say the new guidelines are more clear about “compensating controls,” which give merchants a bit more flexibility in their deployment of encryption and other PCI requirements. David Taylor, vice president of data security strategies at Protegrity and a former industry analyst, isn’t so sure. “The new specs are definitely clearer, and that’s great, but I think a lot of merchants were hoping that the new rules would make it easier to comply, and that didn’t happen,” he says.

PCI auditors previously had hoped that PCI 1.1 would somehow divide the specifications between critical requirements — such as the need for encryption and firewalls — and best practices, such as thorough documentation and training.

http://www.darkreading.com/document.asp?doc_id=103292&WT.svl=news2_1