Chapter 15 Flashcards
U.S. Compliance Laws
Organizations entrusted with sensitive data should take steps to protect data
U.S. doesn’t have one comprehensive data protection law
Many federal data protection laws focus on specific types of data
Require organizations to use security controls to protect the different kinds of data that they collect
Laws are not optional
Organizations collect sensitive data called personally identifiable information (PII), which includes:
First, middle, and last name Home mailing address Social Security number Driver’s license number Financial account data Health data and biometric data Authentication credentials
Privacy
A person’s right to control the use and disclosure of his or her own personal information
Control
A person can decide how his or her data can be collected, used, and shared with third parties
Information security
The process used to keep data private
____ is the process; ____ is the result
Security is the process; privacy is a result
Federal Information Security
Federal government is the largest creator and user of information in the United States
Government IT systems hold:
Data that are critical for government operations
Data that are important for running the business of the federal government
Sensitive military data
Federal Information SecurityManagement Act (FISMA) of 2002
Applies to federal agencies and their IT systems
Federal agencies fall under the executive branch of the U.S. government
The Office of Management and Budget (OMB) is responsible for FISMA compliance
FISMA: Purpose and Main Requirements (9)
Risk assessments Annual inventory Policies and procedures Subordinate plans Security awareness training Testing and evaluation Remedial actions Incident response Continuity of operations
FISMA: Purpose and Main Requirements (cont.)
An agency must:
Protect the IT systems that support its operations
Test its IT systems at least yearly
Review the information security controls on IT systems
Apply some types of controls and make sure they work
Monitor its security risk
Federal Information Security Modernization Act (FISMA) of 2014
Clearly defines the roles, responsibilities, accountabilities, requirements, and practices needed to fully implement FISMA security controls and requirements
Role of the National Institute of Standards and Technology (NIST)
Creates guidance that all federal agencies use for their information security programs
Creates standards that agencies use to classify their data and IT systems
Creates guidelines and minimum information security controls for IT systems
Creates Federal Information Processing Standards (FIPSs) and Special Publications (SPs)
National Security Systems (NSSs)
Secure using a risk-based approach
Include systems used for:
Intelligence activities
National defense
Foreign policy
Military activities
Committee on National Security Systems (CNSS) oversees FISMA activities
Use the same six-step process as the NIST RMF
Health Insurance Portability and Accountability Act (HIPAA): Purpose and Scope
Contains data protection rules that address security and privacy of personally identifiable health information
Department of Health and Human Services (HHS) responsible for rules and compliance
Protected health information (PHI) is any individually identifiable information about a person’s health
Covers health care providers and business associates
Main Requirements of the HIPAA Privacy Rule
Determines how covered entities must protect the privacy of PHI
Covered entities may not use or disclose a person’s PHI without his or her written consent
Exceptions allow a covered entity to share a person’s PHI without a person’s written consent
A covered entity must inform people about how it uses and discloses PHI
