Nation's toughest personal info law about to take effect
Connecting state and local government leaders
A Massachusetts law set to go into effect March 1 requires strong encryption, firewalls and antivirus protection in addition to a written security plan for all organizations that hold personal information on state residents.
Businesses that hold personally identifiable information on Massachusetts residents have one month to comply with what security experts are calling the toughest data security requirements in the nation.
The Massachusetts Data Breach Law, passed in 2007, goes into effect March 1 and requires personal information in networked systems to be protected with strong encryption, firewalls, antivirus and access controls.
“I think it’s a good thing to have,” said Bradley Dinerman, president of the Boston chapter of the National Information Security Group. “If nothing else, it will make many businesses more secure.”
But it will not necessarily make them more secure right away. “I would say very few businesses actually are in compliance,” said Dinerman, who also is president of Fieldbrook Solutions, a company based in Ashland, Mass., that provides information technology support.
The challenges are twofold. The first is awareness. “When I talk to one of my clients, they say, ‘Law? What law?’” he said. The second is the requirement for a written information security plan (WISP). “Ninety percent of the clients I deal with on this law do not have a WISP.”
The law was written in response to the theft of information on more than 45 million credit card accounts from TJX Companies in 2007. Hacker Albert Gonzalez pleaded guilty to the theft in August 2009.
The law is designed to ensure “the security and confidentiality of customer information,” based on current industry standards, focusing on threats that can or should be anticipated. The regulations take into account the size of a business, the amount of resources available to it, the amount of personal data held and the sensitivity of the data. It covers paper and electronic records and requires physical and IT security.
It originally was scheduled to go into effect Jan. 1, 2009, but was delayed at first until May 2009 and eventually until March 1 of this year.
“My clients now are in panic mode,” Dinerman said.
State agencies have created their own regulations for compliance with the law. Regulations for nongovernmental organizations were written by the state’s Department of Consumer Affairs and Business Regulation. Although the IT security regulations are largely technology-neutral, they do require “reasonably up-to-date firewall protection and operating system security patches,” and “reasonably up-to-date” antivirus tools and signatures. There must be user authentication with passwords or other factors of appropriate strength and least privilege access policies, along with monitoring of systems for unauthorized access.
Regulations also require encryption of personal data transmitted via public or wireless networks and stored on laptops or other portable devices. The law defines encryption as using at least 128-bit keys. Written security plans must cover physical and IT security, include a designated security manager, and cover everything from system monitoring to employee training.
The policy requirements are basic, but putting them into writing can be difficult, Dinerman said. “Is it common sense? One would hope so. But many businesses don’t sit down and think this out.”
Enforcement of the law will be difficult inside Massachusetts and practically impossible outside the state, but the requirements hammered out over several years of compromise are reasonable, Dinerman said.
“I think the law is in a good place now,” he said. “It forces people to lock down their systems and know what they are doing.”
The challenges of compliance with and enforcement of the state law underscore the need for a single nationwide standard in data security and breach notification, Dinerman said. “It is probably a matter of time before all states have something in place,” making compliance for multistate businesses even more complex. Is the Massachusetts law the model for a national standard? “We’ll have to wait and see.”
NEXT STORY: New threats compel DOD to rethink cyber strategy