How Thales solutions help with GLBA Compliance
The Gramm-Leach-Bliley Act (GLBA)--also known as the Financial Services Modernization Act of 1999--requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The core aim is to prevent and mitigate cyber threats. The Federal Trade Commission (FTC) Safeguards Rule requires covered companies to develop, implement, and maintain an information security programme with administrative, technical, and physical safeguards designed to protect customer information.
The GLBA is composed of three main rules regarding the privacy and protection of sensitive consumer data held by financial institutions:
The GLBA applies to a broad range of companies classified as financial institutions. The FTC explains that the GLBA applies to “all businesses, regardless of size, that are ‘significantly engaged’ in providing financial products or services.” That includes not only companies providing financial products or services like loans, financial advice, or insurance, but also companies providing appraisals, brokerage, and loan servicing, check-cashing, payday loans, courier services, nonbank lending, and tax preparation services, among others.
The Gramm-Leach-Bliley Act was enacted by congress in 1999 and is in full effect. Primarily, the FTC enforces the regulation, although other federal agencies, such as the Federal Reserve Board and the FDIC, and State governments are responsible for regulating insurance providers.
A financial institution found in violation of GLBA may face fines of $100,000 for each violation. Its officers and directors can be fined up to $10,000 for each violation and be imprisoned for five years or both.
Thales helps organisations comply with GLBA by addressing essential requirements for safeguarding customer information.
The Safeguards Rule of the GLBA requires the development, implementation, and maintenance of an information security programme with administrative, technical, and physical safeguards designed to protect customer information.
Part 314. b:
“risk assessment that identifies… risks to security of customer information”
CipherTrust Data Discovery and Classification identifies structured and unstructured sensitive data on-premises and in the cloud. Built-in templates enable rapid identification of regulated data, highlight security risks, and help uncover compliance gaps.
Part 314. c.1:
“Implement and periodically review access controls. Determine who has access to customer information and reconsider on a regular basis whether they still have a legitimate business need for it.”
Thales OneWelcome identity & access management solutions limit the access of internal and external users based on their roles and context. Backed by strong authentication (MFA), granular access policies and fine-grained authorisation policies help ensuring that the right user is granted access to the right resource at the right time; whereby minimising the risk of unauthorised access.
Thales OneWelcome Consent & Preference Management module enables organisations to gather consent of end consumers such that financial institutions may have clear visibility of consented data, thereby allowing them to manage access to data that they are allowed to utilise.
CipherTrust Transparent Encryption encrypts sensitive data and enforces granular privileged-user-access management policies that can be applied by user, process, file type, time of day, and other parameters. It provides complete separation of roles where only authorised users and processes can view unencrypted data.
Part 314. c. 3:
“Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest"
Protect Data at Rest:
CipherTrust Data Security Platform provides multiple capabilities for protecting data at rest in files, volumes, and databases. Among them:
Protect keys and certificates:
Luna Hardware Security Modules (HSMs) protect cryptographic keys and provide a FIPS 140-2 Level 3 hardened, tamper-resistant environment for secure cryptographic processing, key generation and protection, encryption, and more. Luna HSMs are available on-premises, in the cloud as-a-service, and across hybrid environments.
Protect data in motion:
Thales High Speed Encryptors (HSE) provide network-independent, data in-motion encryption (layers 2, 3, and 4) ensuring data is secure as it moves from site-to-site or from on-premises to the cloud and back. Our network encryption solutions allow customers to better protect data, video, voice, and metadata from eavesdropping, surveillance, and overt and covert interception— without performance compromise.
Part 314. c, 4:
“Adopt secure development practices for in-house developed applications”
CipherTrust Platform Community Edition makes it easy for DevSecOps to deploy data protection controls in hybrid and multi-cloud applications. The solution includes licenses for CipherTrust Manager Community Edition, Data Protection Gateway, and CipherTrust Transparent Encryption for Kubernetes.
CipherTrust Secrets Management is a state-of-the-art secrets management solution, which protects and automates access to secrets across DevOps tools and cloud workloads including secrets, credentials, certificates, API keys, and tokens.
Part 314. c, 5:
“Implement multi-factor authentication...”
SafeNet Trusted Access is a cloud-based access management solution that provides commercial, off-the-shelf multi-factor authentication with the broadest range of hardware and software authentication methods and form factors.
Part 314. c, 8:
“Maintain a log of authorised users’ activity and keep an eye out for unauthorised access.”
The Thales Data Security Solutions all maintain extensive access logs and prevent unauthorised access. In particular, CipherTrust Transparent Encryption security intelligence logs and reports streamline compliance reporting and speed up threat detection using leading security information and external SIEM systems.
SafeNet Trusted Access allows organisations to respond and mitigate the risk of data breach by providing an immediate, up to date audit trail of all access events to all systems.
Part 314. f, 2:
“Oversee service providers, by: Requiring your service providers by contract to implement and maintain such safeguards...”
CipherTrust Cloud Key Manager can reduce third party risks by maintaining on-premises under the full control of the financial institution the keys that protect sensitive data hosted by third party cloud providers under “bring your own keys” (BYOK) systems.
CipherTrust Transparent Encryption provides complete separation of administrative roles where only authorised users and processes can view unencrypted data. Unless a valid reason to access the data is provided, sensitive data stored in a third-party cloud will not be accessible in cleartext to unauthorised users.
Thales Data Security solutions offer the most comprehensive range of data protection, such as Thales Data Protection on Demand (DPoD) that provides built in high availability and backup to its cloud-based Luna Cloud HSM and CipherTrust Key Management services, to the HSE network encryption appliances that provides options to zeroise.
Product review of SafeNet Trusted Access. Explore the options of authentication security that STA offers, to bridge the MFA, SSO and access management worlds in a single, well-integrated package. Discover how your business can bring security to access management.
In today’s ever increasing digital world, protecting critical data and ensuring the identity of those accessing data is essential. The standard measures once thought to be strong enough are simply insufficient when compared to the sophistication and persistence of today’s...
This ebook shows how Thales data security solutions enable you to meet global compliance and data privacy requirements including - GDPR, Schrems II, PCI-DSS and data breach notification laws.
The crucial first step in privacy and data protection regulatory compliance is to understand what constitutes sensitive data, where it is stored, and how it is used. If you don't know what sensitive data you have, where it is, and why you have it, you cannot apply effective...
Enterprise digital transformation and increasingly sophisticated IT security threats have resulted in a progressively more dangerous environment for enterprises with sensitive data, even as compliance and regulatory requirements for sensitive data protection rise. With attacks...
Safeguarding sensitive data requires much more than just securing a data center’s on-premises databases and files. The typical enterprise today uses three or more IaaS or PaaS providers, along with fifty or more SaaS applications, big data environments, container technologies,...
Traditionally organizations have focused IT security primarily on perimeter defense, building walls to block external threats from entering the network. However, with today’s proliferation of data, evolving global and regional privacy regulations, growth of cloud adoption, and...
You’ve been tasked with setting and implementing an enterprise wide encryption strategy, one that will be used to guide and align each Line of Business, Application Owner, Database Administrator and Developer toward achieving the goals and security requirements that you define...
Secure your sensitive data and critical applications by storing, protecting and managing your cryptographic keys in Thales Luna Network Hardware Security Modules (HSMs) - high-assurance, tamper-resistant, network-attached appliances offering market-leading performance and...
Business critical data is flowing everywhere. The boundaries are long gone. As an enterprise-wide data security expert, you are being asked to protect your organization’s valuable assets by setting and implementing an enterprise-wide encryption strategy. IT security teams are...
Networks are under constant attack and sensitive assets continue to be exposed. More than ever, leveraging encryption is a vital mandate for addressing threats to data as it crosses networks. Thales High Speed Encryption solutions provide customers with a single platform to ...
Perhaps the most comprehensive data privacy standard to date, GDPR affects any organisation that processes the personal data of EU citizens - regardless of where the organisation is headquartered.
Any organisation that plays a role in processing credit and debit card payments must comply with the strict PCI DSS compliance requirements for the processing, storage and transmission of account data.
Data breach notification requirements following loss of personal information have been enacted by nations around the globe. They vary by jurisdiction but almost universally include a “safe harbour” clause.
