IDERA Live | Maintaining Regulatory Compliance and Security in Challenging Conditions

© 2016 IDERA, Inc. All rights reserved. Proprietary and confidential.© 2020 IDERA, Inc. All rights reserved.
Maintaining Regulatory Compliance and
Security in Challenging Conditions

© 2016 IDERA, Inc. All rights reserved. Proprietary and confidential.© 2020 IDERA, Inc. All rights reserved. 2
Hello and Welcome!

Agenda
▪ The connection between security and compliance
▪ What is Personal Data?
▪ Why is personal data collected?
▪ Concerns over data privacy
▪ Protecting sensitive data in SQL Servers
▪ Database security vulnerabilities
▪ Internal and external threats
▪ Challenges posed by the COVID-19 pandemic
▪ Demonstrating regulatory compliance for SQL Servers
▪ Complications of regulatory diversity
▪ Detailed look at GDPR
▪ Internal Audits
▪ External Audits
▪ Challenges posed by the COVID-19 pandemic

Agenda Continued
▪ Dangers of lax security
▪ Dangers of noncompliance
▪ IDERA’s software solutions for SQL
Server
▪ SQL Secure
▪ SQL Compliance Manager

Security and Compliance are Connected
Security and compliance are two complimentary components that are
required to provide and verify data privacy. We are going to look at
how these elements impact IT in general and specifically SQL Server
environments.

“
© 2020 IDERA, Inc. All rights reserved. 6
“Historically, privacy was almost implicit, because it
was hard to find and gather information. But in the
digital world, whether it's digital cameras or satellites
or just what you click on, we need to have more
explicit rules - not just for governments but for
private companies.” Bill Gates

“
© 2020 IDERA, Inc. All rights reserved. 7
“Proof is the bottom line for everyone.” Paul
Simon

Two Sides to Protecting Personal Data
Security comprises activities that protect the privacy of personal data.
Compliance involves demonstrating that the proper security measures are being
taken to protect personal data.

Personal Data Defined
‘Personal data’ means any information relating to an identified or identifiable
natural person (‘data subject’); an identifiable natural person is one who can
be identified, directly or indirectly, in particular by reference to an identifier
such as a name, an identification number, location data, an online identifier
or to one or more factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that natural person.

Examples of Personal Data
• Full name
• Home address
• Bank account or credit card number
• ID number such as Social Security or driver’s
license
• Racial or ethnic origin
• Location data
• Health or medical records
• Email address
• Political or religious beliefs

Why Personal Data is Collected
▪ Creating user profiles for
personalized marketing
▪ Verifying online financial
transactions
▪ Customizing the user experience
on websites and in applications

Concerns Regarding Data Privacy
Citizens have multiple concerns
regarding the privacy of their personal
data
• Digital surveillance by corporations or
governments
• Identity theft
• Unsolicited marketing materials
• Lack of control over use and sharing of
personal data

Why Data Privacy is Essential
▪ Digital commerce
▪ Validly collected information
misused
▪ Identity theft with long-term
repercussions to the affected
individuals

The Effects of Covid-19 on Database Security
▪ Remote work means more places
need to be secured
▪ Healthcare and medical facilities are
being targeted with ransomware
▪ When setting up remote access,
elevated privileges may have been
granted
▪ Lack of oversight for file copies
▪ General anxiety leads to a greater
probability of success with phishing
emails.

Covid-19 Related Ransomware Incidents
▪ Netwalker
▪ Boyce Technologies and the
DoppelPaymer ransomware
group
▪ Interpol - The problem is not only
in the U.S.
▪ Evolution of ransomware to
include triggering data breaches

Database Security Vulnerabilities
• Weak passwords
• Shared passwords
• Default system passwords and settings
• Excessive and elevated privileges
• Lack of pre-deployment security testing
• Poor data encryption
• Insecure database backups
• Unnecessary database features

Protecting Sensitive Data
• External threats
• Direct attacks
• Malware infection
• Internal threats
• Accidental misuse of data
• Intentional data misuse

External Threats to Sensitive Data
• External threats
• Direct attacks using
compromised credentials and
network vulnerability
• Malware infection delivered
through phishing emails or
other methods

Internal Threats to Sensitive Data
• Internal threats
• Accidental misuse of data
due to lack of training or
human error
• Intentional misuse using
unauthorized access or
elevated privileges

•Geographic location or
jurisdiction of data owners
•Type of data under
consideration
•Industry or market sector in
which the data is used
Factors Affecting Data Privacy Regulations

Geographic Location or Jurisdiction of Data Owners
• General Data Protection Regulation - GDPR
• Brazilian General Data Protection - LGPD
• New Zealand Privacy Bill
• California Consumer Privacy Act - CCPA

The California Consumer Privacy Act
CCPA
The California Consumer Privacy Act gives
consumers more control over the personal
information that businesses collect about them.
• The right to know about the personal information a
business collects about them and how it is used
and shared
• The right to delete personal information collected
from them (with some exceptions)
• The right to opt-out of the sale of their personal
information
• The right to non-discrimination for exercising their
CCPA rights

Which Businesses Does CCPA
Affect?
Businesses need to follow CCPA
guidelines if they meet one of
these criteria:
▪ Have $25 million or more in
annual revenue;
▪ Possess the personal data of
more than 50,000 consumers,
households, or devices;
▪ Earn more than half of its
annual revenue selling
consumers’ personal data.
Businesses are exempt from CCPA
regulations if they are in the
following market sectors:
▪ Health providers and insurers
already under HIPAA
guidelines;
▪ Banks and financial companies
covered by Gramm-Leach-
Bliley;
▪ Credit reporting agencies
operating under the Fair Credit
Reporting Act.

Type of Data or Industry
• Personally Identifiable Information (PII)
• Health-related information - HIPAA
• Financial disclosure information - SOX
• Credit card payment information - PCI

The Effects of Covid-19 on Regulatory Compliance
▪ Remote work locations
▪ Local copies of sensitive data
▪ Additional security
vulnerabilities that need to be
tested
▪ New protocols put in place to
address compliance gaps

Inside GDPR

GDPR Data Protection Principles
1. Lawfulness, fairness, transparency
2. Purpose limitation
3. Data minimization
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
7. Accountability

GDPR - When You Can Process Data
1. With unambiguous consent from the data owner
2. When entering into a contract with the data owner
3. To comply with legal obligations
4. To save someone’s life
5. To perform a task in the pubic interest
6. With a legitimate interest

GDPR - Checklist for U.S. Companies
• Audit your environment for EU personal data
• Inform customers why you are processing their data
• Assess and improve data processing activities
• Maintain data processing agreements with vendors
• Appoint a data protection officer if necessary
• Designate a representative in the EU
• Understand the responsibilities in the event of a data breach
• Comply with cross-border data transfer laws

Compliance Audits
A compliance audit tests the
state of your systems against a
set of regulatory standards.
Audits can be carried out by:
• Internal teams
• External agencies

Demonstrating Compliance
• Proof!
• Reports
• Run books
• Documentation
• Configuration settings
• Security settings

Why Compliance is Important
• Attract business by demonstrating compliance with industry
specific regulations like PCI or SOX.
• Assure customers that their data is protected in your
company’s databases.
• Avoid financial penalties levied by regulatory agencies
• Maintain a high level of customer confidence

Keys to Regulatory Compliance
•Understanding the specific regulations that apply to your systems
•Buy-in and full support from senior management
•Implementing risk assessment measures for internal controls
•Written procedures and policies to deal with business practices
•Extensive training for management, employees and contractors
•An oversight team to enforce, monitor, audit and respond to allegations and
misconduct

Dangers of Lax Security
• Data breaches
• System outages
• Loss of customer trust
• Inability to comply with
privacy regulations

Dangers of Noncompliance
• Loss of customer trust
• Loss of business opportunities
• Financial penalties

IDERA Solutions for SQL Server
SQL Secure
SQL Compliance Manger

SQL Secure
Take full control of SQL Server permissions
• Identify existing vulnerabilities in your SQL Server, Azure, and Amazon environments.
• Harden security policies across SQL Server, Azure, and Amazon SQL databases.
• Rank security levels with the security report card.
• Analyze and report on user permissions across database objects.
• Comply with audits using customizable templates for PCI, HIPAA and more.

SQL Compliance Manager
Monitor, audit and alert on SQL Server user activity and data changes
• Track and manage SQL Server database compliance quickly and easily.
• Audit servers, databases, and sensitive data to see who did what. when, where, and how.
• Monitor and alert on suspicious activity to detect and track potential problems.
• Satisfy audits with configurations and reports for multiple regulatory guidelines requirements.
• Reduce impact on audited servers via a lightweight data collection mechanism.

A Powerful Combination of Software Tools for SQL Server
SQL Secure enables you
to identify where
sensitive data resides
and helps you tighten up
the security of your SQL
Servers. It provides the
functionality needed to
meet data privacy
regulations and keep
personal data safe.
SQL Compliance
Manager performs the
complimentary task of
demonstrating
compliance with the
regulatory security
standards that affect the
data in your SQL
Servers.

THANKS!
Any questions?
You can find me at:
@robert.agar@idera.com

There icons are editable shapes.
This means that you can:
● Resize them without losing quality.
● Change fill color and opacity.
● Change line color, width and style.
Examples:

IDERA Live | Maintaining Regulatory Compliance and Security in Challenging Conditions

Recomendados

Recomendados

Mais conteúdo relacionado

Mais de IDERA Software

Mais de IDERA Software (20)

Último

Último (20)

IDERA Live | Maintaining Regulatory Compliance and Security in Challenging Conditions