Security pros call for data breach regulations

A recent report calling for stringent data security and breach notification laws has been welcomed by information security professionals.

Delegates of the independent Information Security Solutions Europe (ISSE) conference being held this week in Madrid broadly welcomed the recommendation to introduce a breach notification law presented in the report compiled by respected IT security academics.

Commissioned by European Union (EU) agency, The European Network and Information Security Agency (ENISA), the report made a series of recommendations, focused on shifting the liability of IT security gaps onto IT users and vendors alike. The requirement to notify EU authorities and affected customers of any potentially damaging data breach came out top.

Presenting the research findings on behalf of his fellow report authors, Rainer Bohme from the Dresden University of Technology said such regulation was necessary to keep pace with the economic challenges created by today‘s security threat landscape.

“The threats to regional and national security are clear, as are the potential financial and privacy harm,” Bohme said. “That’s why the number one recommendation of our research was for a comprehensive breach notification law.”

He said such a law would not only create an atmosphere of greater responsibility around security among organisations and consumers alike, but it would also provide a central repository of data on security breaches that could be used to quantify their economic impact.

Overall the report included 15 recommendations and Bohme also highlighted those that sought to shift liability for IT system vulnerabilities back to the software industry and for passing on malware to internet service providers (ISPs).

An ENISA spokeswoman said it was in the process of preparing a report on the recommendations for the EU, but that the initial reaction of business and the IT industry alike was that the recommendations, particularly around shifting liability, were “highly controversial”. But she added: “The main ones around breach notification were received positively and we’ll be reflecting that in our report.”

Email to a friend

Print this page

Social Bookmark this article: What is this?

Digg

Delicious

Reddit

StumbleUpon

Slashdot

Google

Facebook