Many interdependencies exist between the security and privacy-related tasks demanded by compliance frameworks such as HIPAA, CCPA, and GDPR. The business implication is that enterprise security and privacy teams need to work together. Commercial platforms must also support this coordination – and the ControlCase solution is offered as a case study.
Introduction
Modern enterprise security teams must address many different types of requirements as they create their cyber defenses. These requirements can be internally generated, customer requested, legally defined, mandated by a court, or driven by an incident. They typically involve adding new protections such as cyber security platforms or increasing assurance such as through penetration testing. Security teams must also address the best practices included in the various frameworks that have emerged during the past decade. In addition to security frameworks such as NIST Cyber Security Framework (SF), they must also deal with privacy frameworks such as the Health Insurance Portability and Accountability Act (HIPAA), California Consumer Protection Act (CCPA), and the General Data Protection Regulation (GDPR). In this report, we review the differences between security and privacy frameworks, and how they are used by security and privacy teams. Data loss is shown to be vulnerable to several attack cases, and that both security and privacy teams are required to work together to prevent all bad outcomes. Specifically, without attention to both security and privacy concerns, it is unlikely that any complex organization will be able to ensure proper control of data. [downloadbox text="WhitePaper: HIPAA, CCPA, and GDPR: Privacy or Information Security?" button_name="Download Now" button_link="https://dev.controlcase.com/infosec-whitepaper-lp/"]Security Frameworks
To begin – let’s recognize that sensitive data can be leaked in three different ways: It can be leaked accidentally, such as an email sent unintentionally to the wrong recipient; it can be leaked intentionally, such as by a compromised insider; or it can be leaked as a result of bad policy, where the data is shared inappropriately as part of some business practice. Security frameworks address the first of these two cases.
Figure 1. Security Coverage of Data Leakage
Privacy Frameworks, Policies, and Platforms
Privacy frameworks have thus been developed to help define an organization’s intentional business practices regarding data handling. They complement security systems by helping an organization make good decisions about how to empower customers to take control of their data, and to support the rights and privileges of data owners. These decisions must take into account customer preferences, local laws, and technological feasibility. In the best case, the implementation of security and privacy controls – driven by their respective frameworks – will be set up to coordinate and cooperate functionally. Both security and privacy control systems should, for example, generate audit log evidence of effectiveness so that auditors or assessors can gain confidence that things are working properly. Figure 2 shows how these controls might complete the data protection picture.
Figure 2. Privacy Coverage of Data Leakage
Figure 3. Comparing GDPR, HIPAA, and CCPA