DATA STORAGE MANAGEMENT
The compliance payoffs for securing vulnerable information at rest
Kevin Beaver, CISSP
10.27.2005
Rating: --- (out of 5)
What you will learn from this tip: Trying to find good reasons to secure information at rest can be difficult -- even in the name of regulatory compliance. In this tip, information security expert Kevin Beaver highlights several business needs associated with securing data at rest that can help justify your efforts and storage-related security expenditures.
Most organizations, large and small, are affected by some type of law or regulation dealing with information privacy and security. As I've highlighted in a previous tip, some of the greatest security risks revolve around information at rest. When it's all said and done, virtually every information privacy and security law and regulation in the U.S., Canada, Europe and elsewhere requires in some way that sensitive information at rest (health information, financial information, financial reporting information, etc.) be protected in reasonable ways. It's really the most fundamental of all protection requirements.
Whether the threat comes in the form of malicious insiders, malware or hackers, businesses can't afford to not protect this information. There's simply too much too lose -- especially when it comes to some of the severe fines and jail time associated with noncompliance with recent regulations.
Various proven safeguards and countermeasures exist for the protection of information at rest, but you can't really implement and manage them effectively without some business justification. Ideally, business needs and risk management should drive the need for information security -- not solely regulatory compliance requirements. In fact, recent surveys show that regulatory compliance
To continue reading for free, register below or login
To read more you must become a member of SearchStorage.com
is less of a driver for security spending than many anticipated.
Regardless, it's got to be done sooner or later. Here are some business-focused benefits of compliance you can use to sell security within your organization and show that value can be attained by ensuring the proper controls are in place for sensitive information at rest:
I'm a big advocate of keeping things simple and practical. Perfecting the security of your data at rest is not necessary at first and will likely prove elusive moving forward. I challenge you to spend your efforts and budget wisely on the latest 'compliant-ready' products and spend more on the security controls you already have at your disposal.
Focus on the areas that need the most attention (likely the corralling of stray information and improper file permissions) and then create a good plan, show that progress is being made and drill down over time. This will show that your organization is doing the right thing, keep employees on the up and up and help executives stay out of trouble. These are payoffs you can't refuse.
For more information:
Storage vulnerabilities you can't afford to miss
About the author: Kevin Beaver is an independent information security consultant, author, and speaker with Atlanta-based Principle Logic, LLC. He has more than 17 years of experience in IT and specializes in performing information security assessments. Kevin has written five books including "Hacking For Dummies" (Wiley), the brand new "Hacking Wireless Networks For Dummies," and "The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach)." He can be reached at kbeaver @ principlelogic.com.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchStorage.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
