Perimeter
11/27/2011
09:33 AM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Partner Management: Assessing Compliance Capability And Willingness

The first step is to determine the partner's understanding of its responsibility and ability to comply

Regulations like HIPAA and state privacy regulations and contracts like PCI DSS require organizations to ensure that any partner or service provider with access to data covered under the regulation or contract complies with the data protection requirements. In my previous post, I discussed the need to assess and control the risk associated with these relationships. However, it is can be a challenge to assess an organization’s ability to protect the data.

In fact, there is an important aspect of compliance that many organizations miss: Does the vendor even understand its compliance requirements?

Before embarking on a detailed assessment of an organization’s compliance and security programs, all organizations considering consuming a service that would be involved in protecting regulated information should ask the vendor whether it recognizes its responsibilities.

It is often surprising to find that service providers that manage protected health information, personal identifying information, and payment card information have no idea what controls what they should have in place. Equally surprising is the fact that consumers of the service have the false impression that the vendor is completely aware of its protection “responsibilities” and has accepted them.

Organizations entrusted with protected information are responsible for the practices of their vendors. Normally, vendors are contractually responsible for protecting the information. In poorly managed relationships, however, the consuming organization doesn’t make the requirement clear and allows the vendor to either be ignorant of the presence of protected information or believe that detailed understanding of regulatory requirements isn’t important.

Service consumers should be aware of an important point: You cannot force a vendor to comply with a regulation it doesn’t understand or hasn’t acknowledged by contract. It is for this reason that data protection regulations require contracts between data owners and service providers. All entities need to understand their requirements.

Once this understanding is established, the service consumer can assess whether the compliance program and security controls will meet its requirements.

In my next post, I’ll describe different methods for assessing partner practices, and the pros and cons of each.

Richard Mackey is vice president of consulting at SystemExperts Corp.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio