In Support of Security Standards Randy Robertson

Data Security Many companies use data for critical functions Many companies use data for critical functions Data often private or confidential Data often private or confidential Highest organizational priority is to keep data from corruption or unauthorized access Highest organizational priority is to keep data from corruption or unauthorized access Most use Database Management Systems to manage and secure data Most use Database Management Systems to manage and secure data

Problems Treatment of Data Treatment of Data Types of Data Types of Data Different Organizations Different Organizations Difficult to work with other companies Difficult to work with other companies HIPAA legislation – just the beginning? HIPAA legislation – just the beginning?

Problems Many organizations have several options when designing or updating their database system. Many organizations have several options when designing or updating their database system. Each has different options and configurations Each has different options and configurations Difficult to select the right system Difficult to select the right system

Research Iachello (2003) Iachello (2003) Argues for adding data protection standards Argues for adding data protection standards EU more strict regarding data then U.S. EU more strict regarding data then U.S. Points raised Points raised Regulations changing among different nations Regulations changing among different nations Confusion regarding 3 areas of data Confusion regarding 3 areas of data Legislation Legislation Technology Technology Process Design Process Design

Research Vieira (2005) Vieira (2005) Not all data is considered critical Not all data is considered critical DBMS classification DBMS classification Security Class Level Security Class Level Class 0 to Class 5 Class 0 to Class 5 Security Requirements Fulfillment Security Requirements Fulfillment Percentage rating from 0 to 100 Percentage rating from 0 to 100 Compares DBMS within the same class level Compares DBMS within the same class level

Solution Agree with both papers Agree with both papers Change in Vieira’s proposal Change in Vieira’s proposal Add measure for past history Add measure for past history Flaws and Vulnerabilities Flaws and Vulnerabilities

Solution Standards Body Standards Body Create a Security standard Create a Security standard Based on data levels Based on data levels Create a DBMS rating system Create a DBMS rating system Ability to merge with Security Standard Ability to merge with Security Standard Organization Organization Review Standards to classify data used Review Standards to classify data used Select DBMS to meet the needs Select DBMS to meet the needs

Solution Security Standards Benefits Security Standards Benefits Liability insurance could be easier and cheaper to purchase if standards are followed Liability insurance could be easier and cheaper to purchase if standards are followed Following standards may show due diligence of the organization if they have litigation due to a security breach Following standards may show due diligence of the organization if they have litigation due to a security breach

Solution DBMS Standards Benefits DBMS Standards Benefits Allow organizations the ability to identify and adapt security needs quickly. Allow organizations the ability to identify and adapt security needs quickly. Can help companies do business in other countries Can help companies do business in other countries Can also satisfy requirements when working with vendors or alliance partners. Can also satisfy requirements when working with vendors or alliance partners.

Solution Possible drawbacks Possible drawbacks Companies could be forced to update system and change DBMS Companies could be forced to update system and change DBMS Costs incurred from upgrade Costs incurred from upgrade Possible attacks if not secure Possible attacks if not secure DBMS would probably not support solution DBMS would probably not support solution Highlight flaws and vulnerabilities Highlight flaws and vulnerabilities

Questions?