Cyberguard sent out an interesting press release today that provides “Ten Tips for Corporations to Protect Customer Information from Identity Theft”.
The list is pretty self explainatory:
- Unless there is a specific reason that personal information
is being stored, get rid of it. If information needs to be there, set a
timetable for its length of stay and when it can be disposed of.
- Make sure that the server holding personal information is
isolated to its own network with limited access. The network should be
secured/protected by a strong firewall that protects from attacks at
the network, protocol and most importantly the application layer.
- The server that contains the personal information should NOT allow direct connectivity to any user on the public Internet.
- The isolation of the database server should provide protection
not only from the Internet but from other Internet facing servers as
well as the internal network.
- Under no circumstance should the database server be permitted to initiate connections to the Internet.
- The controls afforded by the application layer defenses must
include the ability to control not only what the database can query,
but the explicit commands that can be run, as well as the number of
responses per query.
- Both the security mechanisms and the database server should be
operated on kernel hardened operating systems to mitigate the risk of
operating system bugs or vulnerabilities.
- Strict controls of who can access the server should be in
place, be enforced, and reviewed to validate the need for access rights.
- A multi-defense is your best defense; take full advantage of
both security mechanisms available within the database application and
strong encryption as well as security mechanisms of the application
- All communication of personal data sent to/from the database
across public and private networks should be permitted over encrypted
channels (HTTPS / SSL SSH).