New Massachusetts Data Privacy Regulation

201 CMR 17.00 • slideshare.net/becarreno • When: 3/1/10 • Who: “entity” that stores PI of residents of the Commonwealth • Similar to PCI DSS • Motivation: avoid another TJ Maxx

Personal Information PI • First name (or initial) + last name + • SSN or • Driver’s license number or • Account number: credit card, bank account, policy number?, ... • Any format: paper, electronic, audio, video ...

Administrative Requirements • WISP • Identify security risks • Ways to detect & prevent security failures • Designate Information Security Ofﬁcer

Technical Requirements • User authentication, passwords for: software, computer, laptop, ﬂash drive, ... • Access control • Firewalls, antivirus, keep software updated • Wireless networks must be encrypted • VPN for remote access

Technical Requirements • Email must be encrypted • Portable devices must be encrypted: • Laptop hard drive (password not enough) • iPhone, Blackberry, PDA’s • Portable (backup) hard drives • Flash drives

Technical Requirements • Fax, telephone, ﬁrst class mail are complaint • If not “technically feasible” don’t do it, example: use FedEx instead of email • No need to encrypt if no PI

Recommendations • Easiest ➫ no PI • Example of WISP • Compliance checklist • VPN, WPA, ﬁrewalls, updates, antivirus, ...

Recommendations • TrueCrypt • PGP • S/MIME

References • Full Text of Massachusetts 201 CMR 17.00 http://www.mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf • Frequently Asked Questions http://www.mass.gov/Eoca/docs/idtheft/201CMR17faqs.pdf • Regulation explained and practical steps http://www.informit.com/articles/article.aspx?p=1433062

References • Sample WISP http://nengroup.com/the-basics/products-andnengroup.com-services/ma-201-cmr-17/mass-201-cmr-17- comprehensive-information-security-program-example • Compliance checklist http://www.mass.gov/Eoca/docs/idtheft/compliance_checklist.pdf • Encryption http://www.truecrypt.org http://www.gnupg.org

Disclaimer I am not a lawyer and this is not legal advice

slideshare.net/becarreno Braulio Carreno @bcarreno bcarreno@gmail.com http://carreno.me

New Massachusetts Data Privacy Regulation

by becarreno on Aug 09, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

Statistics

New Massachusetts Data Privacy Regulation — Presentation Transcript