Understanding Compliance

This blog was originally published by CyberCrypt here.

Tip: Don’t treat compliance merely as a checklist. Use the process as an audit of your security controls. Put security first: Build security around your threat model and then confirm that you are compliant.

As regulators demand stricter security and privacy controls and increase penalties for noncompliance, entities are desperately seeking new ways to secure data.

The challenges to compliance will only grow as nationalities around the world enact their own data-protection laws and industries impose more stringent standards. Following is a summary of expectations from the most common regulatory and industry frameworks.

General Data Protection Regulation (GDPR)

The GDPR imposes strict requirements for the privacy protections of EU citizen data, including pseudonymizing, or removing identifiers, and encrypting that data. It does not require a specific encryption algorithm, architecture, or type (at rest, in transit, or end-to-end) -- only that the encryption be secure, and that the mode of operation doesn’t allow the CSP to decrypt the information.

The European Data Protection Board (EDPB), an advisory board to the European Commission regarding the GDPR, has recently recommended the following measures for entities storing personal data in a non-EU country, which a French court expanded to include cloud providers subject to U.S. law:

• Use strong encryption to protect the data before transmission.
• Make sure that the encryption algorithm has no misconfigurations and adheres to state-of-the-art parameters that defy cryptanalysis.
• Provide encryption keys only to a “trusted” third party.

Payment Card Industry Data Security Standard (PCI-DSS)

The PCI-DSS is a must for every organization that accepts debit or credit card payments. Non-compliance can cost an entity its payment-card privileges. And yet, according to the Verizon Business 2020 Payment Security Report, only 27.9% of organizations around the world comply with PCI-DSS and the number is dwindling. Compliance with PCI-DSS means meeting its 12 requirements for system configuration, data encryption, and other security measures.

This list is not exhaustive, or meant to be. Many other frameworks also specify security and privacy controls that apply to the cloud, including

• The Health Insurance Portability and Accountability Act (HIPAA)
• International Organization for Standardization (ISO) 27001
• The California Consumer Privacy Act (CCPA)
• System and Organization Controls for Service Organizations (SOC)2
• The National Institute of Standards and Technology (NIST)