GLBA and Compliance with the FTC’s Safeguards Rule
5:04 pm in post by Mike Vaughan
Dealers are becoming more dependent on the internet. Security threats are of critical importance for dealerships nation wide. Every Internet connection, whether it is a bank, an apartment complex, a house, or a dealership, is identified only by an IP address. Attacks are indiscriminate and usually “automated”; in actuality, targeted assaults are actually very rare.
All dealerships collect personal information from their customers; such as names, addresses, credit card numbers, credit histories, and Social Security numbers. GLBA requires dealerships as a financial institution to ensure the security and confidentiality of this type of information. The Safeguards Rule applies, regardless of size, to those businesses who are “significantly engaged” in providing financial services to their customers.
The FTC has tried to make the standards as flexible as possible when referring to the dealer’s size and complexity of their information systems. As a reference to information systems the FTC uses the National Institute of Standards and Technology (NIST) when enforcing compliance among government and financial institutions. The current NIST standards for protection of electronic data include not only a firewall, but a firewall that can detect, and respond to, intrusions into the network.
“Continually monitoring threats through intrusion detection system (IDS) and other mechanisms is essential” (Executive Summary NIST 800-61 Computer Security Handling Guide Pages ES-1)
Visit http://niada.com/PDFs/Publications/Safeguards%20Rule.pdf page 7-8.
