Suggestions for Getting Ready
What can you do? Since the law is in its infancy, there are no existing industry best practices. There are however, recommendations on what can be done. IDN supports the following:
- Identify key systems containing personal information and activate/enhance logging capabilities on such systems
- Consider encrypting all stored customer data. Determine whether the cost to the company is worth the time and effort of IT to employ total database encryption practices. If needed during a lawsuit, IT will have to prove the data was encrypted at the time of the security breach.
- Deploy new technology designed to provide forensic detail about network conduct (see: guidancesoftware.com) and data-flow pattern anomalies (see: www.lancope.com) Timely and accurate answers to data acquisition will be critical.
- If you don't already have one in place, create a comprehensive Incident Response Plan that details how IT will handle security breaches and other catastrophic incidents on the corporate network. Make sure that this plan includes a detailed notification procedure on how the company will address affected customers should IT detect a security breach. The law provides for more flexibility if an existing IT policy is in place for responding to incidents and notifying customers.
- Include a provision in your IT response plan that addresses a period of investigation, and response to the security incident prior to notifying the customers. This will allow reasonable time to address the security breach and restore the integrity of the system before any mandatory notification begins.
- Review all existing third-party contracts involving the transfer of sensitive personal data to ensure that they contain provisions for notification, investigation, and the right to participate in or control reporting of incidents involving customer data. This is especially important if IT has outsourced data storage and has no visibility into the storage network's compliance policies.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.