Gramm-Leach-Bliley Act and Its Impact on Sysadmims?

NetworkCop asks: "Hi, I was recently reading a white paper on a company that helped banks to comply with the Gramm-Leach-Bliley Security Act. However, it sounded like it was a simple Nessus/NMAP scan. Does anyone here have experience implementing the requirement of this Act in a *nix platform?"

In case you are like me....

[sweetooth]

and have never heard of this. here [ftc.gov] is a link to some info on it.

Re:In case you are like me....

[Ivan the Terrible]

How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act A Guide for Small Business from the Federal Trade Commission [ftc.gov]

Re:In case you are like me....

[unitron]

Is this that thing they were forcing on the banks a few years ago when they were calling it the "know your customer" act or program?

(It was basically a way to get the banks to spy on everybody with an account and send the results to the government, only the banks had to shoulder the entire expense of doing so.)

Lawyer

[falsification]

Talk to an attorney. You should be able to consult with your corporate legal counsel. If you don't know who that is, ask an upper management type.

If you work at a university, or other organization, talk to your entity's legal counsel.

There is no substitute for professional legal advice which applies to your particular situation.

Woah

[Stigmata669]

Was that question even in English?

I guess they just don't teach em like they used to.

GLB requirements

[Thu Anon Coward]

I examine financial institutions (credit unions) in the area of IT controls and policies and procedures. I can tell you that the GLB Act basically specifies 3 things. [senate.gov]
They are:
-all data is private, you must keep it secure
-vendors handling your data must keep it at least as secure as you are required to
-I can't remember the 3rd at this time of night

Anyway, if I found out during the exam that the party who performed an "audit" only did a simple port scan, I certainly wouldn't hesitate in letting the credit union know that they were taken advantage of and their "security audit" was most likely unacceptable and could not be relied upon as showing due diligence in execution of their duties. I've had some extremely small credit unions tell me that their DSL Internet connection has a firewall....a Linksys cable/modem router and ZoneAlarm Pro! and they were serious!

Due to varying circumstances, I give a lot of leeway in what is required of these financial institutions. I don't necessarily require them to have an IDS or a firewall. It all depends on their particular circumstances. However, if there is even a possibility of remote access, I scrutinize their setups and make recommendations on what they can do to improve the situation and cover their asses.

SysadMIMs?? what are those?

[mnmn]

I'm beginning to think slash should include a spell checker, and warn before committing a story.

Re:SysadMIMs?? what are those?

[cybermace5]

It's a contraction of "System Admimistrator."

Re:SysadMIMs?? what are those?

[SiMac]

Maybe it's referring to people who mimic system administrators...

Re:Just like HIPPA

[Anonymous Coward]

I even know how to spell it...HIPAA

stands for Health Insurance Portability and Accountability Act

GLBA Compliance Requirements

[bongk]

If you are a sysadmin trying to understand what you need to do to comply with GLBA, some of the best resources are:
Interagency Guidelines Establishing Standards For Safeguarding Customer Information [ffiec.gov]

Interagency Guidelines .. Federal Reserve System Examiner Guidance [federalreserve.gov]

In our GLBA audits, some of the things examiners were looking for the most were:

• A written security program that coordinates all aspects of the physical and electronic data security
• A risk assessment that details systems and the data they contain, vulnerabilties and threats, controls in place to mitigate threats, and the overall effectiveness of controls
• Vendor management policies and practices
• Involement, approval, and annual reporting to the board of directors of the security program

While a penetration test is definetely one part of what is necessary to obtain GLBA complaince, there is a great deal more than that.

One last excellent resource is the FFIEC Information Technology Examination Handbook [ffiec.gov].

Kevin

Re:GLBA Compliance Requirements

[Thu Anon Coward]

Kevin-
contact me offlist would you?

[e-mail]

thx
TAC

New Handbook Explains All

[wingspan]

The FFIEC recently posted a new information security examination handbook [ffiec.gov]. Because the booklet "serves as a supplement to agency GLBA 501(b) expectations", it may answer your questions.