oracle security GLB, SOX HIPAA

Home
E-mail Us
Oracle Articles
New Oracle Articles

Oracle Training
Oracle Tips
Oracle Forum
Class Catalog

Remote DBA
Oracle Tuning
Emergency 911
RAC Support
Apps Support
Analysis
Design
Implementation
Oracle Support

SQL Tuning
Security
Oracle UNIX
Oracle Linux
Monitoring
Remote support
Remote plans
Remote services
Application Server
Applications
Oracle Forms
Oracle Portal
App Upgrades
SQL Server
Oracle Concepts
Software Support
Remote Support
Development
Implementation

Consulting Staff
Consulting Prices
Help Wanted!

Oracle Posters
Oracle Books
Oracle Scripts
Ion
Excel-DB

Don Burleson Blog

Sheila Jenkins

Oracle News Headlines

New Oracle Data Security Laws Have Teeth
September 3, 2004

In a whitepaper title "How to Safeguard sensitive Oracle data", the author notes that the new US and European laws require the Oracle DBA to have a complete security plan:

http://www.nyoug.org/200306mattsson.pdf

For complete information on these new Oracle security laws, see the bestselling book "Oracle Privacy Security Auditing" book,

http://www.rampant-books.com/book_2003_2_audit.htm

The specific Oracle security laws include:

- U.S. Gramm-Leach-Bliley Act requires financial institutions and their partners to protect non-public personal information by implementing a variety of access and security controls. There are specific requirements relating to administrative, technical, and physical safeguards for customer records and information. Security measures should include management controls that provide effective segregation of duties and restrictions on accessing data. Database auditing is an essential requirement.

- The VISA U.S.A. Cardholder Information Security Program (CISP) requires that personally identifiable information customer data related to credit card transactions be encrypted in the database. CISP offers a very well structured security and encryption standard.

- The U.S. Health Information Portability and Accountability Act (HIPAA) guidelines place legal standards and requirements for protecting non-public personal data in databases that are used by healthcare organizations.

Sanctions for non-compliance can be quite forceful and some companies are offering Oracle security insurance:

Coverage includes protection against losses resulting from computer hacking, illegitimate use of computer systems and other Information Technology security risks. Below are a few issues executives need to consider:

• Class and individual action suits

• Loss of network/database integrity and availability

• Loss of intellectual capital

• Loss of employee productivity

• Defamation of brand name and reputation