"Making Gramm-Leach-Bliley Security Compliance Fast & Easy"

If you receive errors when attempting to view this white paper, please install the latest version of Adobe Reader.

"Qualys® is headquartered in Redwood Shores, California, with offices in France, Germany, the U.K., Japan and Hong Kong, and has partners worldwide."
Source : Qualys

Resources Related to Security Compliance:

• Regulatory Compliance (Wikipedia)

Making Gramm-Leach-Bliley Security Compliance Fast & Easy

Security Compliance is also known as : Security Compliance, Security Compliance Management Toolkit Series, Security Standard Compliance, Generate Compliance Audit Reports, Compliance White Papers, Compliance Mgmt Software, Security Compliance Software, Information Security, Security Compliance Loan, PCI Data Security Standard Compliance, Impact Growing Compliance Mandates, Security Compliance Suite Addresses, Identity Compliance Tool, Ensure Security Compliance , Ensure Regulatory Compliance, Simplify Security Processes Required, Discover Information Security Compliance , DISC.

EXECUTIVE SUMMARY

Gramm-Leach-Bliley Act Defined

Gramm-Leach-Bliley is U.S. Public Law 106-102, the Financial Services Modernization Act (GLBA or "the Act") signed into law on Nov. 12, 1999. Congress created the Act to improve consumer financial services. The complex, seven-Title law applies to about 9,500 financial institutions that offer financial products and services such as securities, banking, loans, and insurance. A series of rules and guidelines were established by several federal agencies for implementation of the Act, including deadlines for compliance.

Security Technology Focus

This paper focuses on the Act's digital security requirements, especially security audits and vulnerability management. Security rules and guidelines are to assure people that the confidentiality and privacy of financial information electronically collected, maintained, used, or transmitted is secure ' especially when financial information can be directly linked to an individual. Security is not a product as much as it is an on-going, dynamic process. Accordingly, many security rules and guidelines published by federal agencies are processintensive. Automation of these on-going processes with a web service like QualysGuard can speed and simplify frequent compliance audits ' especially when institutions monitor GLBA security compliance of subsidiaries and affiliates.

QualysGuard Security Audit and Vulnerability Management Web Service Meets Key Compliance Rules

QualysGuard is a network security audit and vulnerability management web service from Qualys, Inc. It meets key security technology requirements detailed in the Final Rules published by:

• Board of Governors of the Federal Reserve System
• Federal Deposit Insurance Corporation
• National Credit Union Association
• Office of the Comptroller of the Currency
• Office of Thrift Supervision
• Secretary of the Treasury
• Securities and Exchange Commission
• Federal Trade Commission

Organizations can comply with Gramm-Leach-Bliley security rules faster, easier and for less cost with the automated QualysGuard web service. This paper maps QualysGuard capabilities to specific requirements of the law, helping security managers to quickly understand a fast, easy and cost-effective compliance path. It concludes with instructions for obtaining a free trial of the QualysGuard service.

AUTOMATION MAKES CONTINUOUS GLBA SECURITY COMPLIANCE EASIER ' FOR HALF THE COST

Financial services Security Professionals have their work cut out to comply with GLBA. Details of security provisions for Gramm-Leach-Bliley are complex and process-intensive. To comply with the process intensive GLBA guidelines, organizations can take one of two paths. One is a do-it-yourself productsoriented approach requiring expensive staff for installation and maintenance. Alternatively, Qualys offers an easier, faster and more cost-effective approach by using the QualysGuard web service.

QualysGuard Provides Instant, Automated Security Audits

Good security requires frequent audits for vulnerabilities in all network security processes, anywhere non-public data can be found. As a turnkey web service, QualysGuard enables immediate, on-going compliance with key Gramm-Leach- Bliley security rules and guidelines. Subscribers can scan their perimeter-facing hosts with Qualys Remote Scanners, internal hosts with QualysGuard Scanner Appliance, and manage both with an easy-to-use web interface. The combination of internal and external audits provides the most comprehensive, GLBA-compliant assessment of risks to unauthorized access of non-public financial data. QualysGuard customers may also use the service to monitor GLBA compliance by service providers, subsidiaries and other affiliates.

QualysGuard Web Service Dramatically Cuts Total Cost of Ownership

Total Cost of Ownership (TCO) analysis for five years shows tremendous savings using an automated web service for auditing network security and vulnerability management versus a do-it-yourself products-oriented solution. For a mid-sized enterprise, the expense of using even "free" security software on self maintained servers is more than $1.2M for five years, mainly due to administrative and maintenance efforts. The five-year TCO for the automated QualysGuard web service is just under $600K, or half the expense.

TCO increases when factoring administrative duties like signature and engine updates, consolidated reporting, vulnerability life cycle management, and historical trend analysis for various time frames. Five-year TCO for the do-it-yourself approach is more than $1.6M while the automated QualysGuard web service is well under $700K.

GRAMM-LEACH-BLILEY"IMPROVING SECURITY FOR THE FINANCIAL INDUSTRY

Congress enacted the Gramm-Leach-Bliley Act as a broad effort to improve financial services to consumers. The Act details seven major legislative areas: Our focus in this paper is security technology, covered by Title V (Privacy). Security safeguard provisions are in Sections 501 and 505(b) of the Act.

Through the Act, Congress directed several federal agencies to establish standards for safeguarding customer information. The Act permitted most of the Banking agencies to develop their safeguards standards by issuing "guidelines." The Act required the Securities and Exchanges Commission and the Federal Trade Commission to issue standards as "rules" (formal regulations).

The Banking industry was first to publish security guidelines. Subsequent guidelines and rules from other agencies are similar, if not identical. This paper uses Banking guidelines as the baseline for fulfilling security provisions of Gramm-Leach-Bliley ' "Interagency Guidelines Establishing Standards for Safeguarding Customer Information and Rescission of Year 2000 Standards for Safety and Soundness; Final Rule" (12 CFR Part 30, et al., Federal Register, February 1, 2001, pages 8616-8641). Authors were the Federal Reserve System, FDIC, NCUA, and U.S. Treasury's Comptroller of the Currency, and Office of Thrift Supervision.

Securities Standards Short List

Every governed organization must create a comprehensive, written Information Security Program fulfilling Objectives described in the sidebar. Guidelines specify seven steps for development and implementation. Virtually all require Vulnerability Assessment, and most key elements can be automated with QualysGuard. The steps include:

• Involve the Board of Directors
• Assess Risk ' Identify reasonably foreseeable internal and external risks, assess likelihood and potential damage of these threats, and assess sufficiency of existing security. All risks to non-public data must be assessed, even innocuous entry points such as a small wireless LAN operated by a bank branch office.
• Manage and Control Risk ' Regularly test security policy and infrastructure. A third party should conduct or review tests.
• Oversee Service Provider Arrangements ' Insure that service providers, subsidiaries and affiliates are following Security Guidelines.
• Adjust the Program ' Constantly evaluate security provisions, especially for new technology, new threats, and changes to infrastructure. Regular, documented audits are a must because enforcement agencies do many spot checks each year with little or no advance notice.
• Report to the Board ' Issue written track record of security audits, risks found, responses, and recommended changes.
• Implement the Standards ' Deadline was July 1, 2001, with service provider contracts grandfathered until July 1, 2003.

Who Must Comply?
The law applies to "financial institutions" ' companies that offer financial products and services to individuals, including banks, insurance companies, mortgage companies, securities brokers, loan brokers, some financial or investment advisors, tax preparers, providers of real estate settlement services, and debt collectors.

INSTANT COMPLIANCE WITH KEY SECURITY RULES

QualysGuard meets key Gramm-Leach-Bliley security safeguard rules and guidelines detailed below.

FREE, EASY TRIAL

Experience the benefits of automated network security audits and vulnerability management with a free, seven-day trial of QualysGuard. Here are the easy steps:

1. Complete a short form at https://www.qualys.com/GLBA or call a Qualys sales representative at 800.745.4355.
2. Qualys will email you a link. Click the link to scan your system. Qualys will assign an account name and password for the free trial.
3. Enter range of IP addresses for an audit scan. Click on "start" to begin the scan.
4. View the scan's audit results online, read suggested solutions, download patches and fix security problems ' just as if you were a regular QualysGuard subscriber.
5. Repeat scans as often as you like for seven days.

Searches related to Making Gramm-Leach-Bliley Security Compliance Fast & Easy:
Security Compliance | Security Compliance Management Toolkit Series | Security Standard Compliance | Generate Compliance Audit Reports | Compliance White Papers | Compliance MGMT Software | Security Compliance Software | Information Security | Security Compliance Loan | PCI Data Security Standard Compliance | Impact Growing Compliance Mandates | Security Compliance Suite Addresses | Identity Compliance Tool | Ensure Security Compliance | Ensure Regulatory Compliance | Simplify Security Processes Required | Discover Information Security Compliance | DISC | Security Compliance TCO | Security Compliance Management Toolkit Series TCO | DISC TCO | Security Standard Compliance TCO | Generate Compliance Audit Reports TCO | Compliance White Papers TCO | Compliance MGMT Software TCO | Security Compliance Software TCO | Information Security TCO | Security Compliance Loan TCO | PCI Data Security Standard Compliance TCO | Impact Growing Compliance Mandates TCO | Security Compliance Suite Addresses TCO | Identity Compliance Tool TCO | Ensure Security Compliance TCO | Ensure Regulatory Compliance TCO | Simplify Security Processes Required TCO | Discover Information Security Compliance TCO | Security Compliance Qualysguard | Security Compliance Management Toolkit Series Qualysguard | Security Standard Compliance Qualysguard | Generate Compliance Audit Reports Qualysguard | Compliance White Papers Qualysguard | Compliance MGMT Software Qualysguard | Security Compliance Software Qualysguard | Information Security Qualysguard | Security Compliance Loan Qualysguard | PCI Data Security Standard Compliance Qualysguard | Impact Growing Compliance Mandates Qualysguard | Security Compliance Suite Addresses Qualysguard | Identity Compliance Tool Qualysguard | Ensure Security Compliance Qualysguard | Ensure Regulatory Compliance Qualysguard