Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:13 PM
Connect Directly

Tougher Data Protection Laws Could Force Businesses To Rethink Compliance

New RSA, SBIC report provides guidelines for businesses in 'new era' of compliance

Say goodbye to the compliance-checkbox mentality: Data protection laws are expanding worldwide and cracking down on the way businesses protect electronic information, a new report published this week says.

"A New Era of Compliance: Raising the Bar for Organizations Worldwide," written by RSA and the Security for Business Innovation Council (SBIC), analyzes how new legislation and more legal muscle behind regulations are forcing businesses to change how they approach compliance. The report highlights how tougher enforcement, more data breach notification laws emerging around the globe, more prescriptive regulations, and increasing requirements for making enterprises responsible for the security of their data even when a business partner handles it are requiring businesses to look at compliance as a strategy, not just a necessary evil.

"Regulators are moving away from light-touch to more interventionist regulation," said Stewart Room, partner with the privacy and information law group at Field Fisher Waterhouse LLP and a data protection expert and guest contributor to the report. "That's clear in all senses of society and economy, so it's not surprising regulation is tightening up in the data protection field. As I see it, the trajectory of the law here is one way only, which is toward more frequent regulatory intervention, more disputes, more arguments, and more litigation."

In the report, the SBIC, which is made up of Global 1000 security executives from JP Morgan Chase, T-Mobile USA, eBay, BP, FedEx, Time Warner, EMC, Cigna, and other firms, offered several recommendations for enterprise security teams in what it calls a new era of compliance.

"As more regulations are introduced, the rules are becoming increasingly prescriptive," said Art Coviello, executive vice president at EMC president of RSA, the security division of EMC, in a statement. "Regulators are making it clear that you're on the hook for ensuring the protection of your data at all times, even when it's being processed by a service provider. Going forward, it will be impossible to hide information security failings as legislators force transparency and data breach disclosure becomes a global principle."

Among the recommendations by the SBIC:

1. Embrace risk-based compliance. Set up a program where everyone, from business-process owners and the board of directors, get the information needed to make risk decisions;

2. Establish an enterprise controls framework. Create a consistent set of controls across the organization that maps to regulatory requirements and business needs;

3. Set/adjust threshold for controls. Decide the proper level of security controls and ensure that you meet the legal requirement for "reasonable and appropriate" security;

4. Streamline and automate compliance processes. Formulate an enterprise governance, risk, and compliance strategy that manages risk and compliance and includes appropriate visibility into controls;

5. Fortify third-party risk management. Ditch "boilerplate" security agreements and adopt a strategy that covers "diversification, due diligence, rigorous contractual requirements, consequence management and governance";

6. Unify the compliance and business agendas. Incorporate compliance into the business and align it with the organization's main goals; and

7. Educate and influence regulators and standards bodies. That prevents overly prescriptive rules that can hurt businesses. "You need a broad perspective of all of the various legislation in the U.S. and elsewhere. Legislators and people in Congress don't often understand the nuances of things like identity theft. They might pass all sorts of legislation that's actually not going to reduce identity theft but just create a whole bunch of requirements," said Dave Cullinane, chief information security officer and vice president of eBay, in a statement in the report. "It's important for security officers to be participating in that conversation and provide insight into draft legislation."

The report is available for download here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-09-21
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
PUBLISHED: 2019-09-21
The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to file disclosure and XSS.
PUBLISHED: 2019-09-21
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
PUBLISHED: 2019-09-21
admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.
PUBLISHED: 2019-09-21
Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.