Nation's toughest personal info law about to take effect

Massachusetts regulations will require strong encryption, a written security plan and more

Businesses that hold personally identifiable information on Massachusetts residents have one month to comply with what security experts are calling the toughest data security requirements in the nation.

The Massachusetts Data Breach Law, passed in 2007, goes into effect March 1 and requires personal information in networked systems to be protected with strong encryption, firewalls, antivirus and access controls.

“I think it’s a good thing to have,” said Bradley Dinerman, president of the Boston chapter of the National Information Security Group. “If nothing else, it will make many businesses more secure.”

But it will not necessarily make them more secure right away. “I would say very few businesses actually are in compliance,” said Dinerman, who also is president of Fieldbrook Solutions, a company based in Ashland, Mass., that provides information technology support.

The challenges are twofold. The first is awareness. “When I talk to one of my clients, they say, ‘Law? What law?’” he said. The second is the requirement for a written information security plan (WISP). “Ninety percent of the clients I deal with on this law do not have a WISP.”

The law was written in response to the theft of information on more than 45 million credit card accounts from TJX Companies in 2007. Hacker Albert Gonzalez pleaded guilty to the theft in August 2009.

The law is designed to ensure “the security and confidentiality of customer information,” based on current industry standards, focusing on threats that can or should be anticipated. The regulations take into account the size of a business, the amount of resources available to it, the amount of personal data held and the sensitivity of the data. It covers paper and electronic records and requires physical and IT security.

It originally was scheduled to go into effect Jan. 1, 2009, but was delayed at first until May 2009 and eventually until March 1 of this year.

“My clients now are in panic mode,” Dinerman said.

State agencies have created their own regulations for compliance with the law. Regulations for nongovernmental organizations were written by the state’s Department of Consumer Affairs and Business Regulation. Although the IT security regulations are largely technology-neutral, they do require “reasonably up-to-date firewall protection and operating system security patches,” and “reasonably up-to-date” antivirus tools and signatures. There must be user authentication with passwords or other factors of appropriate strength and least privilege access policies, along with monitoring of systems for unauthorized access.

Regulations also require encryption of personal data transmitted via public or wireless networks and stored on laptops or other portable devices. The law defines encryption as using at least 128-bit keys. Written security plans must cover physical and IT security, include a designated security manager, and cover everything from system monitoring to employee training.

The policy requirements are basic, but putting them into writing can be difficult, Dinerman said. “Is it common sense? One would hope so. But many businesses don’t sit down and think this out.”

Enforcement of the law will be difficult inside Massachusetts and practically impossible outside the state, but the requirements hammered out over several years of compromise are reasonable, Dinerman said.

“I think the law is in a good place now,” he said. “It forces people to lock down their systems and know what they are doing.”

The challenges of compliance with and enforcement of the state law underscore the need for a single nationwide standard in data security and breach notification, Dinerman said. “It is probably a matter of time before all states have something in place,” making compliance for multistate businesses even more complex. Is the Massachusetts law the model for a national standard? “We’ll have to wait and see.”

About the Author

William Jackson is freelance writer and the author of the CyberEye blog.

Reader Comments

Tue, Oct 12, 2010 Fortune Articles http://www.fortunearticles.com

It can actually save the whole country from this awful health care.

Thu, Feb 11, 2010

This law has been around for a year, and postponed at least twice. The threatened laws in the House and Senate are supposed to supercede this and a big portion of the nearly 700 laws for infosec. How much money would you spend to comply when the law could change tomorrow?

Tue, Feb 9, 2010

I follow security stuff fairly closely as it's an interest of mine, but this is news to me. Not sure how I missed this. Perhaps it's not meant to help people but is actually one of those laws that's purposefully not advertised so that the state can use it to abuse people. I love how ignorance is no excuse, yet they make it impossible to know what the laws actually are.

Mon, Feb 1, 2010

I love how industry keeps touting "industry best practices" to the government, and yet security basics like security plans and encryption to protect sensitive data are nearly devoid in industry. It's a shame that government leadership feels that going to the industry is going to be better and cheaper for the government, sure it will (if industry doesn't know Security 101).

Sun, Jan 31, 2010 Brad Dinerman

I should emphasize that all of my legacy clients are very informed of this law. Rather, I was referring to "clients that are new to me" when being interviewed for this piece. I immediately make certain that all of my clients are not only informed, but also start down the road to full compliance.

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above