Lab#5
Define a process for Gathering Information pertaining to a GLBA Compliance
1. GLBA repealed parts of an act. Name the act and explain why it was significant for financial institutions and insurance companies. Parts of the glass Steagall act of 1933 GLBA allows financial institutions such as banks to act as insurance companies. GLBA covers both financial institutions and insurance companies since both can perform financial services for its customers. This reform requires banks and insurance companies to comply with both the privacy and safeguard rules of GLBA.
2. What is another name for obtaining information under false pretenses and what does it have to do with GLBA? What is an example of the safeguard pertinent to this requirement? Pre-texting or social engineering. GLBA specifically mentions this in title 15 US code chapter 94 sub chapter 2, section 6821. GLBA encourages companies to implement safeguards around pre-texting and social engineering. Security awareness training and periodic reminders of awareness to pre-texting and social engineering is a best practice performed within the user domain.
3. How does GLBA impact information system security and the need for information systems security practitioners and professionals? The safeguards rule within GLBA requires financial institutions and insurance companies to develop security plan detailing how they will protect their customers nonpublic personal information. The safeguards rule impacts the security plan throughout the 7 domains of a typical IT infrastructure in regards to protecting nonpublic personal information.
4. If your organization is a financial institution or insurance company that is also publicly traded, what other compliance law must you comply with? The Sarbanes-Oxley act. Proper security controls and safeguards must be designed and implemented to protect the nonpublic