Legal, Regulations, Investigations, and Compliance Chapter 9 Part 2 Pages 1006 to 1022

Privacy Privacy is threatened by technology Data collection, storage, and mining Globalization

Personal Identifiable Information (PII) Uniquely identify, contact, or locate a single person Used in identity theft and financial crimes U.S. Office of Budget and Management – List on page 1007 May require protection from improper disclosure – List on page 1007

Federal Privacy Act of 1974 Data collected by government agencies must be done in a fair and lawful manner, used for the purpose it was collected, and held only for a reasonable amount of time.

Chief Privacy Officer Created by many organizations to deal with privacy issues Lawyer

SOX Sarbanes-Oxley The Public Company Accounting Reform and Investor Protection Act of 2002 U.S. Publicly traded company How companies must track, manage and report on financial information.

Privacy Laws In 30 states “As a security professional, you should understand the types of privacy laws your organization deals with and help to ensure that it is meeting all of its legal and regulation requirements pertaining to this type of data.”

Laws and Regulations You are not a lawyer – Get help from legal department Non-compliance – Fines, going out of business, executive in jail

HIPAA Health Insurance Portability and Accountability Act National standards and procedures for the storage, use, and transmission of personal medical and heath care data. Steep federal penalties for non-compliance.

GLBA Gramm-Leach-Bliley of 1999 Financial institutions Financial Privacy Rule – Privacy notice, allow customers to opt out of sharing information with 3 rd parties Board of Directors is responsible for security issues

GLBA Safeguard Rule – Written security plan – Protect clients non-public personal information

Computer Fraud and Abuse Act Federal antihacking statue Protect federal computers Protect illegal access – Fraud and theft – Modification of medical information

PCI DSS Payment Card Industry Data Security Standard Applies to any entity that processes, transmits, stores, or accepts credit card information Industry standard, not a law

FISMA Federal Information Security Management Act Federal agencies must have security programs

Employee Privacy If the state allows it, a company can monitor employees keyboards, s, conversations with customers Must inform employees Employees should sign a document describing the monitoring and reasonable expectation of behavior (REP = Reasonable Expectation of Privacy document)