In Support of Security Standards

1
In Support of Security Standards

• Randy Robertson

2
Data Security

• Many companies use data for critical functions
• Data often private or confidential
• Highest organizational priority is to keep data
  from corruption or unauthorized access
• Most use Database Management Systems to manage
  and secure data

3
Problems

• Treatment of Data
• Types of Data
• Different Organizations
• Difficult to work with other companies
• HIPAA legislation just the beginning?

4
Problems

• Many organizations have several options when
  designing or updating their database system.
• Each has different options and configurations
• Difficult to select the right system

5
Research

• Iachello (2003)
• Argues for adding data protection standards
• EU more strict regarding data then U.S.
• Points raised
• Regulations changing among different nations
• Confusion regarding 3 areas of data
• Legislation
• Technology
• Process Design

6
Research

• Vieira (2005)
• Not all data is considered critical
• DBMS classification
• Security Class Level
• Class 0 to Class 5
• Security Requirements Fulfillment
• Percentage rating from 0 to 100
• Compares DBMS within the same class level

7
Solution

• Agree with both papers
• Change in Vieiras proposal
• Add measure for past history
• Flaws and Vulnerabilities

8
Solution

• Standards Body
• Create a Security standard
• Based on data levels
• Create a DBMS rating system
• Ability to merge with Security Standard
• Organization
• Review Standards to classify data used
• Select DBMS to meet the needs

9
Solution

• Security Standards Benefits
• Liability insurance could be easier and cheaper
  to purchase if standards are followed
• Following standards may show due diligence of the
  organization if they have litigation due to a
  security breach

10
Solution

• DBMS Standards Benefits
• Allow organizations the ability to identify and
  adapt security needs quickly.
• Can help companies do business in other countries
• Can also satisfy requirements when working with
  vendors or alliance partners.

11
Solution

• Possible drawbacks
• Companies could be forced to update system and
  change DBMS
• Costs incurred from upgrade
• Possible attacks if not secure
• DBMS would probably not support solution
• Highlight flaws and vulnerabilities

12
Questions?