Perimeter
11/27/2011
09:33 AM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Partner Management: Assessing Compliance Capability And Willingness

The first step is to determine the partner's understanding of its responsibility and ability to comply

Regulations like HIPAA and state privacy regulations and contracts like PCI DSS require organizations to ensure that any partner or service provider with access to data covered under the regulation or contract complies with the data protection requirements. In my previous post, I discussed the need to assess and control the risk associated with these relationships. However, it is can be a challenge to assess an organization’s ability to protect the data.

In fact, there is an important aspect of compliance that many organizations miss: Does the vendor even understand its compliance requirements?

Before embarking on a detailed assessment of an organization’s compliance and security programs, all organizations considering consuming a service that would be involved in protecting regulated information should ask the vendor whether it recognizes its responsibilities.

It is often surprising to find that service providers that manage protected health information, personal identifying information, and payment card information have no idea what controls what they should have in place. Equally surprising is the fact that consumers of the service have the false impression that the vendor is completely aware of its protection “responsibilities” and has accepted them.

Organizations entrusted with protected information are responsible for the practices of their vendors. Normally, vendors are contractually responsible for protecting the information. In poorly managed relationships, however, the consuming organization doesn’t make the requirement clear and allows the vendor to either be ignorant of the presence of protected information or believe that detailed understanding of regulatory requirements isn’t important.

Service consumers should be aware of an important point: You cannot force a vendor to comply with a regulation it doesn’t understand or hasn’t acknowledged by contract. It is for this reason that data protection regulations require contracts between data owners and service providers. All entities need to understand their requirements.

Once this understanding is established, the service consumer can assess whether the compliance program and security controls will meet its requirements.

In my next post, I’ll describe different methods for assessing partner practices, and the pros and cons of each.

Richard Mackey is vice president of consulting at SystemExperts Corp.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-0889
Published: 2014-07-29
Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDiscovery Process Management through 6.0.3, Disposal and Governance Management for IT through 6.0.3, and Global Retention Policy and Schedule Management through 6.0.3, allow remote atta...

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3020
Published: 2014-07-29
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

Best of the Web
Dark Reading Radio