Protecting Consumer Data on the Cheap

A mandate to protect individuals' personal data in the agency's databases isn't accompanied by any extra funds.

By C.J. Kelly

May 23, 2005 12:00 PM ET

Computerworld - In my last column , I discussed how I was called upon to do a fiscal-impact analysis of a privacy bill that was going before our state legislature. The bill is expected to pass soon and become law. And when that happens, state agencies like the one I work in, as well as private businesses, will be held accountable for any disclosures of individuals' personal information.
Despite my conclusion that complying with this law would require several hundred thousand dollars for just my agency, we and other state agencies might not receive any additional funds to comply with the mandate. So how do I go about protecting all the personal information that resides in our databases and servers and traverses our network?
No single hardware device or software application will be adequate. My best option is to use open-source tools and existing hardware to configure and install an intrusion-detection system. The IDS will let us monitor network intrusions and attacks and investigate the possibility of data such as Social Security numbers leaving or traversing our network in plain text. At least it's a start.
Do-It-Herself
In all my previous, private-sector jobs, I managed the people who configured and installed such systems. Although I have analyzed the data from these systems, correlated the information with output from other sources, given direction to staff and approved plans related to the placement of network taps, network monitoring appliances, firewalls, VPN concentrators and other security devices, I have never built such a device with my bare hands and put it into production. I am unaware of anyone within the state system who has walked down this path before. But that could be a case of the right hand not knowing what the left hand is doing; state agencies are fairly autonomous, and while efforts are under way to improve collaboration and the pooling of talent in the security arena, there doesn't appear to be a strategic plan. So people like me just muddle along, trying to do the right thing.
I'm a bit hesitant. Can I do this? To master the software I have selected -- Red Hat Inc.'s Fedora Core 3, Snort, MySQL and BASE, as well as Apache, SSL and PHP -- I will have to rely on my little-used *nix (Unix and Linux) skills, as well as white papers and how-to articles written by those much more experienced than me in the nuts and bolts of all this. I can also consult newsgroups and call on many friends and colleagues. And

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

POLL RESULTS

Leading IT Pros Weigh In on Top IT Issues

Accelerate your knowledge of the IT world you inhabit by viewing the results of a series of polls taken by your IT peers. These polls of 100+ IT professionals each are available for full viewing. They cover key topics such as virtualization, processor performance, green IT, cloud computing and many others. Be a part of the buzz.

WHITE PAPER

For Best Results, Think Beyond the Box

Technology is complex. Keeping it running productively shouldn't be. To that end, you want to minimize the number of solutions needed in-house to simplify operations, maintenance, and support. Kodak offers a best-practices model. One company provides support for both scanner and software, for fast problem resolution without vendor finger-pointing. Download now!

WHITE PAPER

Accelerating the Path to Demand Intelligence with a Demand Signal Repository

Utilizing demand intelligence improves the precision of pricing, product assortments, channel/store placement, and promotion, which are all essential for sustainable revenue management performance. Learn more, download this free whitepaper today.

White Papers & Webcasts

Centralized Data Backup and Your WAN
Is your organization prepared to tackle the massive challenge of protecting your data in a cost effective and timely manner? With a growing...

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

An All-in-One Approach to Web Security
Granting web access to employees poses challenges to IT administrators and introduces unique security risks. Even as companies have perfected their security techniques...

Best Practices for Managing Business Risks from the Use of IT
(Source: Symantec) Based on exhaustive benchmarks conducted by the IT Policy Compliance, this session highlights the relationship between business risks and use of...

The Hidden Dangers of Spam
Beyond the well-understood productivity drain that spam inflicts on businesses, threats posed by illicit email circulating through a network are causing many security...

Managing And Protecting Your Ever Increasing Mobile Assets
(Source: Absolute Software) Your users are becoming more mobile each day. This is great for productivity - yet challenging for IT control. Natalie...

Open Source Security Myths Dispelled
(Source: Astaro) Open Source Software is computer software whose source code is available to the general public. This openly viewable nature...

Sun OpenSSO Enterprise Webinar
(Source: Sun) This webinar replay discusses Sun OpenSSO Enterprise innovation--the single, open-source solution that helps your business solve the challenges around internal access...

Best Practices for Backing Up VMware® with Veritas NetBackup™
VMware® is used by enterprises large and small to increase the efficiency and cost-effectiveness of their IT operations. With this in mind, Symantec...

Agile Enterprise Content Management (ECM) for Rapid ROI
(Source: IBM) Content rich business processes are a core feature of daily operations at just about any organization today. Very often these essential...

All White Papers | All Webcasts