WASHINGTON — Congress is not going to ignore the spate of data breaches
plaguing private enterprise and will pass new data protection laws, a Gartner analyst predicted.
Speaking at a Gartner IT security conference less than 24 hours after
CitiFinancial admitted it
had lost almost 4 million records with personally identifiable information,
John Pescatore told a packed room that Congress is bound to respond with new
laws.
“What will be the next Sarbanes-Oxley? It’s going to be some type of
identity theft or data security legislation,” said John Pescatore, a vice
president and analyst at Gartner. “That’s such a politician-friendly issue,
it’s the next big one coming.”
CitiFinancial’s revelation Monday only ups the pressure on lawmakers.
Pescatore urged the crowd to take advantage of the situation and not to let
it become a “regulatory distraction.”
“Any regulation brought to security is a two-way sword. It’s really nice to
have a regulatory stick to whap [executives] over the head with, because it forces
them to recognize that we need to change some things and spend some money on
security,” he said. “The dangerous side is that it often distracts that
spending towards reporting on compliance versus increasing security.”
According to Pescatore, compliance does not equal security.
That line of thinking, he said, leads to “this hangover that says, ‘Cool, we
had a big party, and we spent all this money, and now we’re compliant.’ But,
we didn’t change anything. We didn’t use [that money] to change anything to
get more secure.”
The result?
“We really focus on reporting and passing tests, and we have the same problem
we have now,” Pescatore said. “The real risk is that we are building these
cultures where we look at these pages that say, ‘We’re compliant, we’re
compliant.'”
If any one of several bills pending before Congress becomes law, security
officials will certainly be facing more regulatory compliance.
Sen. Dianne Feinstein (D-Calif.) is pushing legislation based on California’s
landmark disclosure law requiring any company or government agency to notify
an individual in writing or by e-mail when it is believed that unencrypted
personal information has been compromised.
Feinstein wants to take the California law one step further to also include
encrypted data. The legislation proposes a $1,000 per individual civil fine
for failure to notify or not more than $50,000 per day while the failure to
notify continues.
