Information security forecast: Security management in 2009

By David Mortman, Contributor | Jan 26, 2009

1 comments

Facebook

LinkedIn

Digg

This year was an interesting year in privacy and information security, and by looking back, we can clearly discern trends that will likely be a major part of the security management landscape in 2009.

More and more states passed breach-notification laws and several enhanced or extended existing legislation. Software-as-a-Service (SaaS) and virtualization really took off, and compliance's looming presence grew with PCI DSS version 1.2 and some actual enforcement of HIPAA.

Of particular note was Massachusetts' data breach law 201 CMR 17.00: Standards for The Protection of Personal Information of Residents of the Commonwealth. This is to date the most comprehensive law of its kind, setting a new standard for what breach-notification laws should look like; it covers both paper and electronic records, it mandates appropriate security awareness training as well as security and risk assessments and, most importantly, requires companies to make changes to their security programs in accordance with the findings of those risk assessments.

Similarly, California enhanced the well-known CA-1386 to include not just traditional financial information, but also health care and health insurance data as well.

With new mandates popping up all the time, it's no wonder compliance was one of the biggest focus areas for enterprise information security teams in the past year, and this trend will clearly continue in 2009; there will be more regulation on both the state and federal levels, and stronger enforcement of existing regulations. Fines and other penalties for violations of PCI DSS and HIPAA will continue to rise, along with the inevitable rise in discoveries of malfeasance. As a result, there will be an even larger focus on compliance by upper management, which also means decreased time and budget for necessary security controls that don't clearly fall under a compliance umbrella.

Two other major trends that will continue into 2009 are increased use of virtualization, particularly on the outsourcing side, and an increased focus on the security of Web-based applications. IT shops are always looking for ways to reduce costs and leverage the full value of their existing hardware investments. In 2008, many enterprises finally reached a comfort level with server virtualization in production environments. This trend will continue in 2009 until managers find creative ways of handling this technology dynamic, since there will be a corresponding drop in security as the traditional controls -- such as VLANs and firewalls -- prove less effective. For this reason, during the transition to a virtualized environment, security managers should pay particular attention to systems that contain critical data like corporate financials or source code.

1 comments

Facebook

LinkedIn

Digg