Disk Encryption & Advanced Password Protection: A Necessity for Financial Services Enterprises

 
 
 
 
Disk Encryption and
Advanced Password Protection:
A Necessity for Financial Services Enterprises
 An AlertBoot Whitepaper
 
 
 
 
 
 
 
 
 
 
 
 
 
Disk Encryption and Advanced Password Protection: A Necessity for Financial Services Enterprises   Overview  The data security challenges for financial enterprises have never been as challenging as they are in today's turbulent times. Not only must financial enterprises comply with regulations such as SOX, GBLA and PCI along with a multitude of state regulations concerning customer privacy and electronic data security, they must also guard against the staggering costs-both tangible and intangible-that a security breach can incur. In addition, the latest information technology, from easily portable laptops, CDs, and USB "flash" drives (also called memory sticks) to email, the internet, shared networks, and backup tapes, while streamlining routine financial transactions and simplifying the work of financial professionals, is also opening new avenues of risk for security breaches. Fortunately there are solid and proven technologies that a financial enterprise can implement to secure their data, helping them comply with existing regulations and deal with the other security issues they face. Paramount among these are Password Protection and Disk Encryption. Securing every computer and ? Password Protection: Securing every computer and laptop with password protection ensures that only users laptop with with the appropriate password can use the computer at all. password protection Password Protection, while not a complete solution, is a critical first line of defense in any financial environment ensures that only because it restricts access to the computer itself. users with the ? Disk Encryption: Very simply put, encryption is a way of appropriate "scrambling" the information on a disk so that only password can use authorized users can "unscramble" it. Even if an encrypted computer or drive were stolen, the information on it would the computer at all. not be accessible, appearing merely as "gibberish". You can encrypt the data on a file, a particular drive (for example, a portable memory stick), or the full disk (called Full Disk Encryption). Most importantly, Disk Encryption is generally considered adequate for regulatory compliance- and in some cases can even exempt an enterprise from notification requirements in case of a breach. Simple to implement, yet robust enough to meet the demands of the largest enterprise, Password Protection and Disk Encryption, taken together, form the basis of a solid security framework that addresses many of the most pressing concerns in the financial industry today.
© 2008 Data Guard Systems, Inc. All rights reserved. Reproduction in any manner whatsoever without written permission is strictly forbidden. Visit www.alertboot.com for more information. 2 Disk Encryption and Advanced Password Protection: A Necessity for Financial Services Enterprises  
The Regulatory Compliance Landscape Financial enterprises face a particularly demanding regulatory environment that not only mandates how private information must be handled but in some cases requires notification should a security breach occur. Compliance and notification are mandatory with steep fines and even prison terms for non-compliance. In fact, ensuring regulatory compliance is a major initiative for most large enterprises, and especially those in the financial sector, and one in which Information Technology plays a significant role. Various federal regulations impact financial enterprises. Sarbanes-Oxley, commonly referred to as SOX, requires controls in the financial reporting process for any large corporation and also mandates controls on the integrity of information. More specific to the financial services industry is the Gramm-Leach- Bliley Act (GLBA) and its Privacy Rule. GLBA defines financial institutions very broadly, including any business that is significantly engaged in activities that are financial in nature as well as those that receive data that is incidental or complimentary Compliance and to financial activity. This broad definition encompasses not only notificati... [download for more]