IPLocks GLBA / FFIEC Compliance Solutions

Guidelines Guide; IPLocks Protects

Known for its three authors, Senators Gramm, Leach, and Bliley, the US Federal Government passed the Financial Services Modernization Act of 1999 (aka GLBA), which includes provisions to protect consumers' personal financial information held by financial institutions.

As part of its implementation of the GLBA, the Federal Trade Commission (FTC) issued the Safeguards Rule under section 501(b), requiring financial institutions under FTC jurisdiction to secure customer records and information. The three main objectives of GLBA 501(b) are to:

Ensure the security and confidentiality of customer records and information
Protect against any anticipated threats or hazards to the security or integrity of such records
Protect against unauthorized access or use of such records or information which could result in substantial harm or inconvenience to any customer.

The Federal Financial Institutions Examination Council (FFIEC), comprised of examiners from many different regulatory bodies tasked with GLBA enforcement, has created an Information Security Handbook and an exhaustive set of tests to assess compliance with the Safeguards Rule. The security process recommended by the FFIEC comprises five key areas:

Information security risk assessment
Information security strategy
Implement security controls
Security testing
Monitoring and updating

Addressing GLBA and Related Acts with IPLocks

GLBA and related acts promise stiff penalties to organizations that fail to keep customer data safe, making software such as IPLocks an organization’s best friend. The following section enumerates some FFIEC Guidelines for GLBA, then identifies how IPLocks addresses each guideline:

Information Security Assessment: Gather data on assets and threats to those assets

IPLocks can auto-discover all databases on your network
IPLocks can probe for weaknesses in database security and recommend how to fix those weaknesses

Security Strategy that includes - prevention, detection, and response

IPL hardens databases;
Monitor access for policy violations and anomalous activity
Respond in near real-time to security policy violations
Audit configuration changes and vulnerability exposures

IDS/IPS monitoring of incoming and outgoing traffic

Monitor user and application access for anomalous activity
Automatically disconnect ‘bad’ sessions
Integrate with existing ticketing systems for security control

Hardening: minimum system requirements - disallowing non-compliant activity

IPL test for custom configurations; automates monitoring and enforcement of configuration policy.
Security Monitoring: policy violations, anomalous activity, security events
IPL continuous monitoring for security events, anomalous behavior, configuration changes & policy violations, and vulnerability exposure