Understanding Data Handling Regulations
Several regulations out there tell you how you should be handling your data. Some organizations are held accountable to multiple different regulations at the same time. Some of these regulations may conflict with others.
However, at the base of all of the regulations, they look towards many of the same things to ensure that your data remains protected and processed correctly.
Key Data Standards in Regulations
In the regulations, the data standards define “what” you should be doing with your data. They outline what information needs to be protected/audited. They talk about what you should do in the case of a data breach.
Many of the regulations also define security standards or “how” to process your data. They might cover how you should configure your network or your systems.
Regulatory Guidelines on Data Handling
In this blog post, we’ll take a look at what these regulations state about handling your data:
- CIS (Center for Internet Security) – Global Internet Security Standards
- DISA/STIG (Defense Information Systems Agency) – Anyone with Government Contracts
- FISMA/NIST (Federal Information Security Management Act) – All Federal Agencies
- FERPA (Family Education Rights and Privacy Act) – Educational Institutions
- GDPR (General Data Protection Regulation) – Anyone collecting data on EU Members
- HIPAA (Health Insurance Portability and Accountability Act) – Healthcare Institutions
- NERC-CIP (North American Electricity Reliability Corporation) – Electricity Providers
- PCI DSS (Payment Card Industry Data Security Standard) – Anyone capturing credit card data
- SOX (Sarbanes Oxley) – Publicly Traded Companies and management and accounting firms
5 Key Elements for Data Handling According to Regulatory Guidelines
In a nutshell, the regulatory guidelines look for 5 key elements in how you should handle your data:
- Reporting (and maintaining) audit data
- Tracking user access
- Protecting the data from the bad guys (and watching for data breaches)
- Planning and having good processes and response plans
- Assessing your risks
Clear Expectations from Regulations
In many cases, the regulations will identify very clearly what they expect in regard to these elements. With ER/Studio, organizations can manage and track compliance, ensuring that these regulations are met efficiently and securely.
CIS Compliance Standards
Tracking
- Capture your logins and failed logins.
DISA STIG Compliance Guidelines
Reporting
- Generate audit records for DoD-defined auditable events.
- Generate audit records when privileges and permissions are retrieved.
- Initiate session auditing upon startup.
- Audit records for events identified by type, location, and subject.
- Capture the audit information in a centralized place.
Tracking
- Capture record and log all content related to a user session.
- Protect audit information from unauthorized read access, modification, or deletion.
Planning
- Alert support staff in real-time for any failure events.
FISMA/NIST Compliance Essentials
Tracking
Protecting
- Monitor, report, and respond to incidents.
Planning
- Create an audit process and certification.
- Plan for contingency.
- Manage your configurations.
Assessing
- Assess your risks.
- Confirm system and information integrity.
FERPA Compliance for Educational Institutions
Tracking
- Document who has access to student information.
- Confirm that the instructors or officials only access records for legitimate purposes.
- Authorized representatives may have access to education records in connection with an audit.
Planning
- Student transfers must be handled appropriately.
GDPR Compliance for EU Data Protection
Reporting
- Provide audit details about how that data is processed and who interacted with it.
Tracking
- Know who has access to PII data.
Protecting
- Notify the supervising authority of a breach within 72 hours.
Planning
- Identify PII Data.
- Process data lawfully, fairly, and in a way that users understand.
- Limit the collection of data to only what is necessary.
Assessing
- Conduct impact assessments for higher-risk areas.
HIPAA Compliance for Healthcare Organizations
Tracking
Protecting
- Protect, detect, contain, and correct security violations.
- Detect breaches and notify impacted individuals.
Planning
- Implement security measures to reduce risks and vulnerabilities.
- Implement procedures to regularly review audit logs, access reports, and security incidents.
- Implement procedures to terminate access.
NERC – CIP Compliance for Electricity Providers
Reporting
- Log events for identification of and after-the-fact investigations of Cyber Security Incidents.
Tracking
- Log failed and successful logins.
PCI DSS Compliance for Payment Data Security
Reporting
- Implement automated audit trails for all database events.
- Retain audit trail history for at least a year.
Tracking
- Assign a unique identifier for each person who has access.
- Actions taken on critical data must be traced to known authorized users.
- Track and monitor all access to the network.
- Immediately revoke access for terminated users.
Protecting
- Change vendor-supplied defaults and disable unnecessary default accounts.
- Encrypt the data.
- Secure audit trails so they cannot be altered.
Planning
- Develop configuration standards.
SOX Compliance for Financial Transparency
Reporting
- Report on the effectiveness of the company’s internal controls and procedures.
- Report on who changed permissions.
- Report on who changed the financial data.
Tracking
To help you out, SQL Server does have some native capabilities that can address some compliance needs.
SQL Server Compliance Features
Reporting
- SQL Server Audit.
- Temporal Tables.
Tracking
- Object Level Permissions.
- Role-Based Security.
Protecting
- Authentication Protocols.
- Firewalls.
- Dynamic Data Masking.
- Transport Level Security (TLS).
- Encryption Protocols (TDE, Always Encrypted, Always On).
Of course, the real gem, is using Compliance Manager to track all of your data related activity on your database server
SQL Compliance Manager Capabilities
Reporting
- Capture activity on the database (DDL and DML).
- Track the behavior of privileged users.
- Track who is accessing your sensitive data.
- Track who has changed your data and what it was changed to.
- Track security and administrative changes.
- Track user-defined events.
- Audit systems tables, stored procedures, views, indexes, etc.
Tracking
- Capture logins, logouts, and failed logins.
Protecting
- Determine how much data was accessed in a breach.
Additional IDERA Tools for Regulatory Compliance
Reporting and Maintaining Audit Data
Tracking User Access
Protecting the Data from Breaches
- SQL Compliance Manager.
- SQL Secure.
Planning and Response Processes
- SQL Compliance Manager.
- SQL Secure.
- ER/Studio Business Architect.
Assessing Risks
- SQL Compliance Manager.
- SQL Secure.
For more information about SQL Security Suite, SQL Compliance Manager or SQL Secure, contact your Sales Representative.
